[viztor]

Phase P-R2 of docs/improvement-plan.md, stacked on #113.

P-R2 is a measurement phase. The default endpoint family stays modern, so the plugin's behaviour does not change and no S0_TODAY or characterization row flips. The title carries no ! and the commit has no breaking footer.

What changed

#	Item	Where
1	The default has a name. AUTO_ENDPOINT_FAMILY = "modern" is what auto resolves to. Before this, the choice sat inside a ternary. A later flip is a one-word edit, and the constant is pinned.	src/utils/plane-model.ts, test/endpoint-family.test.ts
2	Wider keyless matrix. It now covers 3 URL shapes: legacy /zen(/go)/v1, a new root /inference(/go)/v1, and modern /inference(/go)/{openai,anthropic,google}/…. That is 24 cells over 4 protocols and 2 planes. It adds LEGACY_DISPATCH (the cells endpoint: legacy really sends to) and one keyless free-model probe with its own pure classifier. classifyKeylessProbe is unchanged.	test/support/keyless-matrix.ts, test/e2e/keyless-matrix.e2e.ts
3	Minimal keyed probes. There is one probe per plane × protocol × shape. Each uses the plane's own key in the header its protocol reads, with tiny bodies (8/16/1/8 tokens) and a pure keyed classifier. The identity comes from one shared constant, PROBE_IDENTITY, and an offline test pins it against the identity a real turn sends. Only the cells the default sends to (TODAY_DISPATCH) are asserted. Every other cell is recorded.	test/support/keyed-probes.ts, test/e2e/keyed-probes.e2e.ts, test/keyed-probes.test.ts
4	The live job is gated by tier. OPENCODE_E2E_KEYED takes none, probes or full. Unset means full, so local runs behave as before. CI picks the tier per event: probes for a pull request touching src/host/**, protocols.ts, plane-model.ts, identity.ts, request-shape.ts or the probes' own inputs; full nightly and on dispatch; none otherwise. Secrets are passed only when the tier is not none. The full keyed suites read their keys through armedKey(tier, "full", …).	.github/workflows/ci.yml, test/e2e/*.e2e.ts
5	A dated record. Both live suites write a markdown table to $OPENCODE_E2E_RECORD_DIR. The job publishes it to the run summary and to an endpoint-families artifact.	test/support/endpoint-record.ts, test/endpoint-record.test.ts
6	Docs. docs/redirect-planes.md §13 uses the same columns, and every cell reads "pending the first CI run". A unit test holds the doc's tables to the formatter's columns and row order. The tier scope, the skip reasons and the plan's status row are updated.	docs/redirect-planes.md, docs/improvement-plan.md, CONTRIBUTING.md, AGENTS.md

Decision recorded in the plan: endpoint: legacy is recorded, not guarded, in the live job. Unit tests pin its mapping of every protocol on both planes. If a keyed modern cell fails in CI, that is the evidence for a later fix: that flips the default.

Behaviour changes

Plugin: none. The changes below are to the test suite and CI only:

• The keyed probes take their identity from one shared constant, PROBE_IDENTITY in test/support/keyed-probes.ts. What they send live is unchanged: user-agent OPENCODE_UA, x-opencode-client, x-opencode-project, and the probe session id under both session headers. They deliberately leave out x-opencode-request, the per-request metric id.
• CI arms the probes keyed tier on a pull request that touches src/utils/request-shape.ts, because every Messages probe sends its anthropic-version. This is in addition to src/host/**, protocols.ts, plane-model.ts, identity.ts and the probes' own inputs.
• An earlier review round switched protocol-routing's PLUGIN_HEADERS to OPENCODE_UA. That user agent reaches the suite's keyless free-tier and unmetered cases on every tier, so on every pull request and every push to main. This PR's own e2e run is therefore the first live observation of the new user agent on keyless traffic, before the nightly run. docs/credentials.md records that this user agent did not change the free-tier verdict.

Review

Each round ran three reviewers (correctness, tests, rules) with none missing. Every upheld finding was fixed in the next round.

Round	Found	Upheld	Fixed	Headline findings
1	22	22	22 (round 2)	(high) keyed probes sent no session header, so the Go half passed without measuring anything; (medium) a keyed probe passed green with no default-family cell measured; (medium) a rate-limit hang turned the probes red where protocol-routing skips
2	8	8	8 (round 3)	(medium) probes sent the plugin's own-request user agent, not the one its turns carry, and the unit test checked against that same constant; 404 model-gone matched Anthropic's generic not_found_error; a pipefail hazard in the tier step
3	8	8	8 (round 4: 7 in the tree, 1 in wording)	(medium) the live suite's identity was a second copy no offline test checked; upstream-busy clauses never decisive alone; the tier scope left out request-shape.ts

Round-4 mutation checks were each run, watched fail, then restored:

• The e2e passing its own patch-UA identity: 1 test failed.
• PROBE_IDENTITY bound to the patch UA: 4 failed.
• Dropping the 529 clause: 1 failed.
• Dropping the UNAVAILABLE and "model is overloaded" alternatives: 2 failed.
• A case-insensitive UNAVAILABLE match: 1 failed.

Verification

Node	Step	Result
26	pnpm run check	0 errors, 11 warnings in 203 files (limit 21)
26	vp test run	94/94 files, 1454/1454 tests
26	vp test run --config vitest.mock.config.ts	4/4 files, 61/61 tests
26	pnpm run build	exit 0
26	scripts/check.ts	check passed, including "lib/ carries the current build, including the served client bundle"
26	shuffle, seeds 1, 42 and 1234	94/94 files, 1454/1454 tests each
26	vp test run --coverage	statements 97.64 (ratchet 97.5), branches 94.31 (94), functions 97.51 (97.4), lines 97.63 (97.5); per-file thresholds pass
24	shuffle, seed 7	94/94 files, 1454/1454 tests
24	mock suite	4/4 files, 61/61 tests
—	local-path grep over git diff, the 6 new files and lib/	0 hits; a positive control matched 1
—	credential-shape grep over the diff and new files	only a pinned action SHA and the test fixture key sk-probe-0123456789abcdef

The first five Node 26 rows were re-run on the final tree right before the commit. The live keyed and keyless results are not in this PR: they come from this branch's CI run, and §13 stays "pending" until then.

Known red check: catalog freshness fails on every branch until the vendor-catalog refresh lands on main. It does not come from this change.

Restacked onto main 1.8.0

The branch now carries main 1.8.0 through its parent, #113 (P-R1), which merged main. P-R2 merged P-R1; it did not merge main itself.

Scope after the restack

test: measure the endpoint families against the live gateway, on both harness channels.

• AUTO_ENDPOINT_FAMILY (modern) is the one value auto resolves to. test/endpoint-family.test.ts pins the bases of the default and of legacy for every plane × protocol, and the cells each setting reaches (TODAY_DISPATCH, LEGACY_DISPATCH). Since P-R1 these are the same on every host cell. No behaviour change, and no characterization row flips.
• Keyless matrix: 3 shapes (legacy, root, modern) × 4 protocols × 2 planes, plus a keyless free-model probe and System One's three shapes (L13).
• Keyed probes, tiered by OPENCODE_E2E_KEYED (none/probes/full). They add the keyed variants of the default completions cell: x-opencode-request (L4), x-opencode-project as global, folder or 40-hex (L5), and reasoning_effort: "none" (L10). They also record every 429's Retry-After (L9).
• The usage cap is its own verdict. A 429 FreeUsageLimitError is now free-usage-limited and is never retried (L3). It is not a rate limit, and it is not free-tier-gated, the name already used for the 403 session gate.
• The classifiers and outcome rules are pure and unit-tested offline. The mock serves every request that either endpoint setting dispatches and no root one. This is main's test(mock): the mock must serve every base the plugin can produce #142 mock-coverage gate, ported to work per request.
• Both suites write dated tables to the run summary and to the endpoint-families artifact, for §13.
• P-R2b (a conditional fix:) pastes the first CI run into §13. It flips the default only if that run shows flip evidence.

Dropped, because main or the parent now does it

• ModelDeprecated as a P-R2 gone rule. P-R1 brought it with live-probe.ts's gone rule. After the merge, keyless-matrix.ts's isModelGoneMessage carries it, so there is nothing left for P-R2 to add.
• "Probe the root family /inference/v1" (L3). P-R2 already probed the root shape as one of its three. The only new URL is System One's root.
• The name free-tier-gated for the usage cap. That name already means a 403 FreeTierError (a pass). The cap is free-usage-limited (a skip).
• D14' (pinned pi 1.3.0 with the harness patch) and the gate's patched alpha cell. The owner's no-patch, two-channel decision, which P-R1 carries, supersedes both.
• The combined Google User-Agent re-measure. It was closed offline. The fetch patch replaces the User-Agent on every protocol's request, and test/mock/protocol-compat.mock.ts pins Google's wire value to OPENCODE_UA on both planes. docs/redirect-planes.md §9 now says so.

Decisions applied

• D14'' / D22'' (supersede D14' / D22'): this repository carries no pi patch, and two channel records, rc and alpha, are named once. The dispatch set and the binary e2e cover both channels. patches/ is gone from the CI seam regex.
• D26 (with D16 and D17 as it rewrites them): baseUrlFor takes no pi argument, and legacy reads the fixed table. Test fixtures restate none of pi-ai's defaults, so test/endpoint-family.test.ts now uses stand-in window and output values.
• D24 and D25 do not touch this phase.

Live re-measures CI must confirm

1. The first e2e run on this PR uses the probes tier, because the PR touches src/utils/plane-model.ts and ci.yml. Paste its keyless and keyed tables into §13 (P-R2b). If a modern cell shows flip evidence, flip AUTO_ENDPOINT_FAMILY, together with the copy, TODAY_DISPATCH and the re-tagged wire facets.
2. From that run, record:
   • the free probe's verdict on the current gate (served, free-tier-gated or free-usage-limited);
   • the root /inference(/go)/v1 cells;
   • System One's three shapes;
   • x-opencode-request present vs absent (L4);
   • x-opencode-project as global, folder or 40-hex (L5);
   • Retry-After on Go's 429s (L9);
   • reasoning_effort none vs absent (L10).
3. The nightly full run should measure whether the legacy /zen/v1 cells still answer for plane models under the current gate.
4. These are inherited from P-R1 and were confirmed again locally. They belong to the alpha.3 bump and upstream, not to this PR:
   • On the alpha npm cell, the route claim does not engage (KNOWN_DEFECT).
   • On every cell, no config-editor save succeeds (HOST_LIMITATION).

---

Generated by Claude Code

[viztor]

catalog freshness fails on 4c491fe, in the Go limits half. The model catalog itself reports shim is current. The step that fails is limits:shim: it reports src/go-limits-data.ts as stale and notes a new row it resolves to gemini-4-argon, an id not in the bundled Go catalog.

This PR didn't cause it. scripts/generate-go-limits.ts and src/go-limits-data.ts are byte-identical to the base (#113), and the same check passed on #113 at 13:34 UTC. The vendor's Go limits page changed after that, so every branch, main included, fails this step on its next run.

No fix exists yet. Regenerating the table needs opencode.ai, which this machine can't reach, and the generated file is never edited by hand. The nightly scheduled run on main regenerates both tables into chore/generated-refresh (#111). Once it does, I'll port the new file down the stack the same way as 813e6f3. A re-run before then would fail the same way, so I haven't spent one.

---

Generated by Claude Code

[viztor]

This phase's first reviews ran on the general model because the dedicated reviewer was unavailable at the time. It has now had the dedicated review: three rounds through three lenses (correctness, repository rules, test matrix).

Rounds

Round	Found	Upheld	Fixed	Upheld by lens
1	16	15	15	correctness 5, rules 6, test matrix 4
2	7	6	6	correctness 3, test matrix 3
3	6	6	6	correctness 3, test matrix 3

Four pairs of upheld findings were the same defect reported by two lenses. Rounds 2 and 3 mostly reviewed the previous round's classifier fixes.

Fixed

• test/support/keyed-probes.ts: planeOutcome now reads each default cell beside the legacy and root cells of the same plane and protocol. A model that the other shapes serve is no longer passed as retired.
• test/support/keyed-probes.ts: a refused key reads "check the CI secret" when a sibling that read the key refused it and none accepted it. It reads "nothing else measured the key" only when no sibling refused it.
• test/support/keyed-probes.ts: a break that no flip could fix (accepted on the root shape only, or Go's Google) still fails, but is not counted as flip evidence.
• test/support/keyed-probes.ts: wrong-protocol and path-gone are now decided by the cell that endpoint: legacy dispatches to. They read refused ("a flip would not serve it") or unmeasured ("re-run"). These replace the protocol and gone reasons, which named causes nothing had measured.
• test/support/keyed-probes.ts: an account answer counts as acceptance only beside a refused key or a gone path, not beside a refused protocol or a retired model.
• test/support/keyed-probes.ts: the keyed auth-refused comment now says that a Go entry without apiKeyEnv sends the Zen key, which the probe does not measure.
• test/support/keyless-matrix.ts: the keyless free probe moves past a busy upstream (503/529) instead of failing the pull request.
• test/support/keyless-matrix.ts: the free probe's dated record names the model and status of the candidate that decided it.
• docs/redirect-planes.md: §13 now defines a busy upstream followed by no answer as transport-error, which is what the code does.
• docs/redirect-planes.md: the root shape is now described as the base the catalog declared until its 2026-10-16 regeneration. The same correction is in test/support/keyless-matrix.ts and CONTRIBUTING.md.
• test/endpoint-family.test.ts: comments no longer say P-R2 already measured the families. §13 is pending the first CI run, and test/support/keyless-matrix.ts now says so too.
• docs/improvement-plan.md: legacy (†) cells are "asserted nowhere live, except Go's Google".
• CONTRIBUTING.md: the key and mirror bullets now cover the keyed probes.
• docs/improvement-plan.md: the claim that P-R2 opens with a green pin is replaced with how its pins were checked on the base.
• docs/improvement-plan.md: the conditional flip of the default is now its own phase, P-R2b.
• docs/improvement-plan.md: the keyed probes decide a plane from the default cells read beside their siblings, not from those cells "alone". An unreadable answer is never flip evidence.
• test/keyed-probes.test.ts: a test for the tier wiring of the four keyed live suites.
• test/keyed-probes.test.ts: a test that no probe follows a redirect.
• test/keyed-probes.test.ts: a test for the CI wiring's push-to-none arm and the steps that publish and upload the dated record.
• test/keyed-probes.test.ts: a test that each suite rewrites its record after every cell.
• test/keyless-matrix.test.ts: tests for the free probe moving past a busy upstream.

Declined

• No upheld finding was declined. One finding in round 1 and one in round 2 were not upheld when verified.
• Two narrower choices within the round 3 fixes:
  • Every account answer is treated alike, with no special case for "Model access is disabled".
  • key-unmeasured stays a kind of its own instead of merging into unmeasured, because it is computed from every sibling that read the key, not from the flip target.

Check, unit suite, mock suite, build and bundle gate all pass on the commit.

Commit: 3ccd70c

---

Generated by Claude Code

[viztor]

Restacked onto main 1.8.0. This branch now carries main 1.8.0 through its parent, #113 (P-R1), which merged main. P-R2 merged P-R1. Pushed head: 24fcf009b840d126dbe9dc7f0b489c68939550e0.

Conflicts and how they were resolved

Source

• src/utils/plane-model.ts: kept P-R1's D16/D26 body. baseUrlFor takes no pi argument, and legacy reads the fixed table. Added P-R2's AUTO_ENDPOINT_FAMILY on top, and auto resolves through it. No pi base or protocol came back.

Test support

• test/support/host.ts: kept P-R1's per-channel PI_AI_DEFAULTS and S0_TODAY_BY_CELL/HostCell wording. Reworded the BASELINE exception to P-R2b flipping AUTO_ENDPOINT_FAMILY on §13's evidence.
• test/support/src.ts: kept P-R1's removal of usesCatalogThinkingLevels/ReasoningSpec. Added AUTO_ENDPOINT_FAMILY and EndpointChoice to the door.
• test/support/keyless-matrix.ts: TODAY_DISPATCH is now documented as holding on every host cell, built from the plugin's own endpoint table (D26). P-R2's "LEGACY_DISPATCH recorded, not guarded" decision replaces P-R1's "P-R2 decides" note.
• test/support/live-probe.ts: kept P-R1's ModelDeprecated gone rule. The identity user agent is OPENCODE_UA, the turn's own.

Tests and e2e

• test/keyless-matrix.test.ts: merged P-R1's per-host-cell derivation with P-R2's three-shape MATRIX_FAMILIES. A follow-up asserts that no default cell is a root cell.
• test/e2e/keyless-matrix.e2e.ts: kept P-R2's helpers and free-model probe, with P-R1's failure message. The timeout covers 24 cells.
• test/e2e/protocol-routing.e2e.ts and test/e2e/dispatch-levels.e2e.ts: kept P-R1's imports and its feature-detected level case, and added P-R2's full-tier key arming.

CI

• .github/workflows/ci.yml: kept P-R2's tier step, record publishing and 30-minute timeout. Kept P-R1's two-channel e2e-host job, with its patch-free seam regex written as P-R2's here-string grep.

Docs

• AGENTS.md: kept P-R1's two-channel host-versions line and its utils line. Added P-R2's keyless-matrix, keyed-probes and endpoint-record lines.
• CONTRIBUTING.md: kept P-R1's text. Added P-R2's tiers, record directory, keyed-probe text and three-shape matrix.
• docs/improvement-plan.md: kept P-R1's D14''/D22''/D26 and its two-channel status. Added P-R2's phase text and status row, the P-R2b row and the restack bullet with the L3/L4/L5/L9/L10/L13 records.
• docs/redirect-planes.md: kept P-R2's §13 against P-R1's routing prose. Added the free-usage-limited legend, plus the System One, keyed-variant and Retry-After records.

Follow-ups added in this restack

• The mock-coverage gate, per request. This is main's test(mock): the mock must serve every base the plugin can produce #142 gate, ported over TODAY_DISPATCH ∪ LEGACY_DISPATCH with the bundled catalog's models. Every root cell must answer no_route.
• The step-9 records:
  • L3: a 429 FreeUsageLimitError is its own verdict, free-usage-limited, and is never retried.
  • L13: System One's three shapes.
  • L4/L5/L10: the keyed variants.
  • L9: Retry-After on every keyed 429.
• No default cell is a root cell. This is now asserted.
• test/endpoint-family.test.ts uses stand-in window and output values. It no longer uses the rc channel's pi-ai defaults (D17, D26).

Dropped

• ModelDeprecated as a P-R2 gone rule. P-R1 already brought it.
• "Probe the root /inference/v1" (L3). P-R2 already had the root shape. Only System One's root URL is new.
• The verdict name free-tier-gated for the usage cap. That name already means the 403 session gate, so the cap is free-usage-limited.
• D14' (patched pi 1.3.0) and the patched alpha gate cell. The no-patch, two-channel decision supersedes both.
• The combined Google User-Agent re-measure. It was closed offline: the fetch patch replaces the User-Agent on every protocol's request, and the mock suite pins Google's wire value to OPENCODE_UA on both planes.

Review rounds

Round	Found	Upheld	Fixed
1	12	12	12 (round 2)
2	6	6	6 (round 3)
3	0	0	none needed

Round 1 found:

• classifiers missing the ModelDeprecated rule;
• the per-request mock gate counting unknown_endpoint as served;
• docs and report text still treating every 429 as a busy gateway;
• a misattributed restack row;
• README-pair gaps inherited from main.

Round 2 found:

• the plan's "every candidate" wording contradicting the tested "any candidate" usage-cap rule;
• the Google User-Agent item having no record;
• a stray * * in a module doc.

For the round-2 fixes:

• freeWalkGap keeps its rule.
• A new pure helper, freeWalkCappedReason, still prints the session gate when a walk met both the gate and the cap. Its test was written first and failed without the helper.

Live re-measures still owed

1. The first CI e2e run on this PR (probes tier). Paste its keyless and keyed tables into §13 (P-R2b). Flip AUTO_ENDPOINT_FAMILY only if a modern cell shows flip evidence.
2. Record from that run:
   • the free probe on the current gate (served, free-tier-gated or free-usage-limited);
   • the root /inference(/go)/v1 cells;
   • System One's three shapes;
   • x-opencode-request present vs absent (L4);
   • x-opencode-project as global, folder or 40-hex (L5);
   • Retry-After on Go's 429s (L9);
   • reasoning_effort none vs absent (L10).
3. For the nightly full run: whether the legacy /zen/v1 cells still answer for plane models under the current gate.
4. Inherited from P-R1, for the alpha.3 bump and upstream, not this PR:
   • On the alpha npm cell, the route claim does not engage (KNOWN_DEFECT).
   • On every cell, no config-editor save succeeds (HOST_LIMITATION).

The dedicated reviewer was unavailable, so every review and verify pass in this run used the general model. That covers all three rounds of the resolutions, both-kept and rules-docs reviews, and both verify passes.

---

Generated by Claude Code