feat: integrate v0.2.9 and fix authoritative model context capacity

.downstream/gpt6-routing-and-prompts.md

@@ -8,17 +8,17 @@
 
 同步返回的 `model_list_source` 单独标明型号名单来自实时上游还是配置回退，与能力补充来源分开；只有实时目录可用来确认账号当时公布了哪些型号。Anthropic（`limit=1000`、`after_id`/`has_more`）与 Gemini（`pageSize=1000`、`nextPageToken`）目录按页取全。
 
-容量对所有主机使用同一优先级：自定义覆盖 > 本账号上游声明 > 参考目录 > models.dev 参考 > 未知。声明与 models.dev 参考存放在账号 `extra.upstream_model_metadata` 的模型条目中（`context_window`、`max_context_window`、`max_input_tokens`、`max_output_tokens`、`source: upstream|registry`、`observed_at`），旧的 `upstream_model_context_capacities` 已由迁移 258 并入。`context_window` 是默认工作窗口，`max_context_window` 是真实最大值。分组对外容量取能服务该模型的全部 `active` 账号（含 OAuth）的最小值；未知容量不写入 `/v1/models`，Codex 清单保留上游描述模板；图像、视频和音频模型不带文本容量。
+容量对所有主机使用同一优先级：自定义覆盖 > 适用官方 API 规格 > 来源身份匹配的本账号上游声明 > models.dev 参考 > 未知。官方记录一旦胜出，缺失的独立输入/输出字段保持未知，不从中转或 Codex 订阅观测补齐。声明与 models.dev 参考存放在账号 `extra.upstream_model_metadata` 的模型条目中（`context_window`、`max_context_window`、`max_input_tokens`、`max_output_tokens`、`source: upstream|registry`、`observed_at`），旧的 `upstream_model_context_capacities` 已由迁移 258 并入；快照另存规范化 `source_identity`，缺失或不匹配的旧观测只供管理员诊断。有效窗口使用 `max_context_window`，否则 `context_window`，再否则独立输入限制。分组对外容量取能服务该模型的全部 `active` 账号（含 OAuth）的最小值；未知容量不写入 `/v1/models`，Codex 清单保留真实上游字段，无证据的本地生成条目不伪造容量；图像、视频和音频模型不带文本容量。
 
 `active` 的 API Key 账号每 24 小时分批重新同步（失败退避），创建或修改凭据后立即同步；OAuth 账号不轮询，Codex 清单经过网关时记录其声明。手动同步保留。
 
 | 来源 | GPT-6 Sol / Luna 上下文 | 输出与推理 |
 | --- | --- | --- |
-| 官方 API 文档 | 1,050,000（不作容量参考） | 最大输出 128,000；none、low、medium、high、xhigh、max |
-| 参考目录（Codex 订阅值，适用于所有账号类型） | 默认 272,000，最大 872,000 | 默认 medium；Sol 支持客户端 Ultra 委派，Luna 最高 Max |
-| 账号上游或中转声明 | 按实际声明，优先于参考目录 | 实时能力优先于旧快照和默认值 |
+| 官方 API 文档 | 1,050,000（有适用条目时作为有效容量） | 最大输出 128,000；none、low、medium、high、xhigh、max |
+| Codex 订阅或账号上游声明 | 仅在官方 API 规格缺失时作为完整来源 | 默认与最大值按来源原样保留；不覆盖已适用的官方 API 记录 |
+| models.dev | 仅在官方 API 与来源绑定的上游声明均缺失时使用 | 缺失字段不从其他低优先级来源拼接 |
 
-参考目录的其他 GPT 值同样取 Codex 订阅值：gpt-5.5 为 272,000/272,000，gpt-5.4 默认 272,000、最大 1,000,000，gpt-5.4-mini 与 gpt-5.2 为 272,000，gpt-5.6-* 为 272,000/872,000；Codex 目录中没有的型号保留 API 规格。只收录官方文档列出的日期快照别名；Qwen 参考只适用于百炼（dashscope）主机。
+GPT 参考目录按官方 API 规格维护：GPT-5.5/GPT-5.4/GPT-5.6/GPT-6 为 1,050,000，GPT-5.4-mini/GPT-5.2/Daybreak Red 为 400,000，最大输出按官方条目记录。只收录官方文档列出的日期快照别名；Qwen 参考只适用于百炼（dashscope）主机。
 
 API Key 使用完整 Responses。OAuth 目录保留实际 Lite 与上下文字段。Ultra 不作为原生 API reasoning effort 发送。Cindy 库存不因 OpenAI 发布新模型而扩大。
 

.downstream/upstream-base

@@ -1 +1 @@
-v0.2.8
+v0.2.9

.downstream/upstream-review-v0.2.9.md

@@ -0,0 +1,37 @@
+# Upstream v0.2.9 integration and API context capacity
+
+## Source
+
+- Downstream base: `fb7467b7a2479cd9092fc4b1e659c6c8e9bba7b4` (`v0.2.8-codexrip.12`).
+- Upstream: stable tag `v0.2.9`, tag object `8532ec28b56188d3c845ed97070e6ee5136bd9bd`, commit `4c00df2e0183e2c70b7fa8ba45914205e36aad0c`.
+- Upstream delta: 70 commits, 117 paths; 61 overlap downstream changes and 37 match the existing critical-path classifier. Six actual conflict paths were resolved by semantic review. The complete classifier output remains in `upstream-risk.json`.
+- There are no upstream schema, migration or dependency changes. Existing migration names and checksums are unchanged. The snapshot extension uses an optional JSON field, without SQL backfill.
+
+## Integration decisions
+
+- Adopt arbitrary-position allowlist globs and passthrough model discovery without hiding configured models. Capacity still resolves actual account/channel mapping targets, not public aliases.
+- Adopt `thinking.type=disabled`, GPT-5-or-newer reasoning detection, Responses message item types, seeded tool input preservation and streamed text recovery. Keep explicit `none`, downstream `max` semantics, exact date aliases, opaque reasoning state and authoritative terminal-event requirements.
+- Forward the upstream-supported `OpenAI-Beta` header with its legacy Responses token cleanup. Keep downstream session/thread/request headers and body-only installation identity.
+- On a Codex WebSocket window rollover, remove the previous response ID and do not infer an anchor from the old window. Keep the existing owner, identity and verified-replay rules. Do not resurrect retired encrypted-lineage rewriting.
+- Combine upstream client-disconnect 499 handling with downstream quality-request isolation, selection-scoped reporting and cooldown behavior. Antigravity keeps both upstream empty-stream errors and downstream adapter protocol errors.
+- Keep `OpenAIQuotaWindows` as the source of primary/secondary quota deadlines, including future reset deadlines. Adopt scheduler snapshot auto-reset fields and retry/backoff improvements.
+- Carry the account long-context pricing flag through the complete account-cost call chain. Adopt inherited image pricing, zero-cost Free Fast records and terminal-success alpha-search billing while preserving downstream reasoning-effort accounting.
+- Adopt the admin/client bug fixes and Redis exec-list compose templates while retaining the Apple theme and complete admin visibility. Production deployment does not apply compose-template changes or rebuild Redis.
+- Draft PR #208 and its production hold remain separate; this merge contains no commits from that branch.
+
+## Capacity contract
+
+- All account types and providers use `custom > applicable official API > source-bound upstream > registry > unknown`.
+- Select one complete automatic evidence record. A winning official record never borrows omitted input/output limits from a relay or Codex subscription observation. A custom window overlays that record, retaining only its compatible independently declared I/O limits; unknown independent limits stay absent.
+- The effective planning window is the explicit `max_context_window`, otherwise `context_window`, otherwise the independently declared input limit. A smaller explicit maximum remains authoritative. Group aggregation takes the minimum of the resolved real targets among active accounts, independent of the schedulable toggle.
+- GPT primary records now contain API specifications and precise source links. Old Codex reference records are diagnostic only. Provider/product host constraints and finite identity aliases remain unchanged.
+- `upstream_model_metadata.source_identity` binds observations and endpoint-derived registry enrichment to their normalized endpoint and protocol contract, including OpenAI Responses mode and escaped URL paths. Old unbound observations remain visible for diagnosis but do not become current evidence. Source changes and late asynchronous responses cannot rebind them. Conditional writes use the existing row revision gate with one bounded reread/retry only when the source and complete stored catalog (including an empty catalog) are unchanged; they never refetch upstream merely to retry persistence. Deduplication also checks the current snapshot.
+- No new hard TTL, no invented default capacity, no SQL backfill and no changes to administrator overrides or account mappings.
+- Admin rows, ordinary models and Codex manifests use the same resolver. Locally generated Codex descriptors contain no capacity defaults; real upstream fields are preserved when no effective evidence supersedes them. OpenCode configuration reads the existing manifest instead of maintaining a second numeric table; it emits a limit only when the client schema's required values are known.
+- Runtime self-test contract is version 4 with `priority=custom,official,upstream,registry`; companion operational fixtures follow that exact line.
+
+## Validation and release
+
+- Validation is limited to the changed resolver, source lifecycle, projection, protocol and frontend behavior, plus normal required PR checks. Successful checks for the same code are reused; no real model requests or production migration exercises are part of this release.
+- Target release: `v0.2.9-codexrip.1`, fixed downstream image digest, `deploy-preserve`, resource profile `preserve`, natural drain, only the Sub2API container recreated.
+- The final source SHA, PR/check results, image digest and production outcome belong to the operational delivery evidence. Source integration alone does not claim a successful deployment or model-quality acceptance.