chore: merge upstream v0.2.11 preserving downstream contracts

.downstream/upstream-base

@@ -1 +1 @@
-v0.2.10
+v0.2.11

.downstream/upstream-review-v0.2.11.md

@@ -0,0 +1,67 @@
+# Upstream v0.2.11 integration
+
+## Source
+
+- Downstream base: `3fa9b52ab5a6735f272ee9141f257a367c9116d4` (`v0.2.10-codexrip.4`, `origin/main`).
+- Upstream: stable tag `v0.2.11` (tag object `881a722349105e21aaa38e11de90dd05046ebe4a`), commit `96f4c115c9749078f90cbf210a01d39baf3f53b6`; merged at `upstream/main` `42bc7f6cffe24bcb471608e48e66b4a0afa1f882`, which only adds the VERSION sync.
+- v0.2.10 was integrated by a squash (#215), so git did not know it was merged. A first `merge -s ours v0.2.10` commit records it without changing the tree, which makes `2f3fed2fdb0787141294cec81487a5df30426f7f` (`v0.2.10`) the real shared ancestor.
+- Upstream delta: 24 commits, 90 paths, +5146/-296. 55 paths overlap downstream changes; 18 of them conflicted textually.
+- No upstream schema, migration or dependency changes. No new SQL migration is introduced by this integration.
+
+## Integration decisions
+
+The owner decided the four high-impact areas on 2026-10-01; all four follow official semantics.
+
+- **In-flight balance reservation (upstream #7681).** Adopted and enabled by default as upstream (`billing.inflight_reservation.*`). Balance-mode requests reserve a priced estimate in Redis after the eligibility check; the billing task takes over the reservation and the balance cache is deducted synchronously before it is released. Estimation or Redis failure fails open; `fail_closed_on_unpriced` stays `false`.
+- **API key creation limits (upstream #7752).** Adopted with upstream defaults: 200 active keys per user and 60 creations per user per hour (`api_key_create.*`).
+- **Remote Codex model catalog (upstream #7736).** Adopted: Codex tabs default to `model_catalog_url`, with the local catalog file as the alternative and the 1 MiB fallback. The server-side manifest still supplies the catalog and its capacity; capacity stays manifest-derived and is never hard-coded.
+- **Claude Code-only groups (upstream #7579).** Adopted verbatim: with a configured fallback group the OpenAI-compatible Chat Completions and Responses entries schedule in that group instead of returning 403. Without one the 403 is unchanged.
+- Everything else (GPT-6.1 Sol pricing and constants, Codex subscription plan recognition #7730, Astra Ultrafast capability and pricing, confirmed Claude limit-reset redemption #7726) is the union of upstream additions and downstream contracts, with upstream semantics where both define the same behavior.
+- **Claude limit-reset redemption (upstream #7726)** keeps upstream's outcome contract: the redeem response carries only known outcome and reason codes and cleared window names (no grant, organization or upstream request IDs), because an unknown answer fences the organization against a blind retry. What the response drops stays visible to administrators in the logs: every claim that does not end in a definite known result (transport error, non-200 status including 401/403, undecodable body, unknown result, indeterminate or unknown reason) is logged as `claude_reset_claim_upstream` with the account ID, the upstream HTTP status and the raw body (bounded to 2 KiB, not redacted), which reaches the server log and the Ops system log. Echoing that detail in the redeem response and cell is an open owner question, not part of this integration.
+
+## Deliberate downstream deviations kept
+
+- **Capacity stays manifest-derived.** Upstream's GPT-6.1 Sol Codex descriptor embeds the official client entry, including `context_window: 272000` and `max_context_window: 872000`. The locally generated descriptor drops those capacity fields (struct fields and the official-metadata merge in `MarshalJSON`), so GPT-6.1 Sol has no capacity default; the capacity resolver writes it when evidence exists, exactly as for GPT-5.6 and GPT-6 Sol/Luna. Upstream's static `configuredCodexGPT56MaxContext` assignment is not restored. The upstream assertion in `TestGPT61SolOfflineCodexCatalog` that required the embedded window was rewritten to the downstream contract (no `context_window`/`max_context_window`, null `auto_compact_token_limit`). Upstream's OpenCode profile for `gpt-6.1-sol` in `UseKeyModal.vue` also carried a static `limit` (1,050,000 / 128,000); that hunk auto-merged and is removed like every other static OpenCode limit in the v0.2.9 capacity unification (`862e84bbb`), so the exported limit comes only from resolver-tagged manifest rows and the spec asserts it stays undefined otherwise.
+- **Unknown GPT-6.x names stay unpriced.** The downstream guard that leaves unrecognized `gpt-6-*` names without a price also covers `gpt-6.*` names other than the recognized GPT-6.1 Sol spellings: dated snapshots such as `gpt-6.1-sol-2026-10-01` (passed through verbatim, see below) and names such as `gpt-6.1-luna` no longer fall back to the `gpt-5.4` default card. Exact price cards (including compact `-YYYYMMDD` dates matched by base name) are still found first; the guard only replaces the default-card fallback.
+- **Dated GPT-6 snapshots pass through unchanged (#192), now including GPT-6.1 Sol.** `gpt-6.1-sol` joins the exact Codex model map, but no `codexVersionModelPrefixes` rule is added for it or for Sol/Luna; its finite effort and compact aliases are recognized by `normalizeKnownOpenAICodexModel`.
+- **Codex manifest download keeps the ChatGPT-style route.** The fetched and downloaded catalog still comes from `{root}/backend-api/codex/models` without a pinned `client_version`. The remote `model_catalog_url` written into `config.toml` is upstream's version-free `{root}/v1/models`; Codex appends its own `client_version` to that URL (openai/codex `catalog_request_url`), which routes to the same Codex manifest handler.
+- **OpenCode keeps the manifest.** The catalog panel and manifest fetch remain available on the `opencode` tab for every platform, because OpenCode capacity is read from resolver-tagged manifest rows.
+- **Raw Chat Completions keeps no early ops model write.** The downstream raw Chat Completions path has never set `SetOpsUpstreamModel` before dispatch (kept through every previous integration); only upstream's new GPT-6.1 Sol request validation is added there.
+- The fork's scheduler reporting, composite routing (`wsRoutingModel = wsForwardModel`), synchronous cyber session-block write, GPT-5.6 family pricing fallbacks, DeepSeek pricing identity, profit gate, quota-activity tracking, palette C console, stacked table cells, static `data-ui` hooks and `#overlay-root` are untouched.
+
+## Conflict resolutions
+
+- `backend/cmd/server/VERSION`: `0.2.11`; `.downstream/upstream-base`: `v0.2.11`.
+- `backend/cmd/server/wire_gen.go`: hand-merged against `wire.go`: the idempotency coordinator is created before the new `ProvideClaudeResetCreditService(..., idempotencyCoordinator, leaderLockCache)`, and the fork's admin handler arguments (account jobs, system prompts, traffic observer, settings, gateway) and Image Studio providers are kept.
+- `backend/internal/handler/gateway_handler.go`, `openai_gateway_handler.go`: the four usage-task submitters use the new `wrapTrackedUsageRecordTask`, which composes upstream's reservation hand-off (`wrapUsageRecordTaskContext` now returns an abandon func) with the downstream quota-activity receipt (`TrackQuotaUsageTask`). A dropped task returns both; an executed or synchronously recovered task releases both through its defers.
+- `backend/internal/pkg/openai/constants.go`: `gpt-6.1-sol` joins the default models ahead of the downstream GPT-6 ordering; the downstream Sol/Luna instruction embeds and upstream's `CodexGPT61SolMetadata` embed coexist (the Sol/Luna switch does not match 6.1).
+- `backend/internal/service/openai_codex_models_service.go`: kept the downstream Sol/Luna Codex metadata block, dropped upstream's static 5.6 window assignment, added GPT-6.1 Sol to the Ultra reasoning level union, and stripped capacity from the embedded descriptor as described above.
+- `backend/internal/service/openai_codex_model_metadata.go`: official-host tool defaults apply to Astra, Sol/Luna and GPT-6.1 Sol; Responses Lite is disabled for GPT-6.1 Sol aliases on API-key accounts like the other named GPT-6 models. Duplicate `openai` import removed.
+- `backend/internal/service/openai_codex_transform.go`: union of the exact model map; prefix rules as described above.
+- `backend/internal/service/openai_gateway_chat_completions_raw.go`: upstream GPT-6.1 Sol validation added after the downstream model policy resolution.
+- `backend/internal/service/billing_service.go`: `ModelPricing` keeps the DeepSeek identity and gains upstream's `UltrafastMultiplier`; the GPT-6 fallback switch is one `gpt-6.1-sol/gpt-6-sol/gpt-6-luna` case; the catalog path keeps the downstream `modelPricingFromCatalog` + `applyModelSpecificPricingPolicy` and extends the explicit cache-write flag to GPT-6.1 Sol.
+- `backend/internal/service/pricing_service.go`: downstream GPT-5.6 family fallbacks followed by upstream's GPT-6.1 Sol price card.
+- `frontend/src/api/codex.ts` (+ spec): see the manifest route deviation; `responseBytes` and `buildCodexModelCatalogUrl` adopted.
+- `frontend/src/components/keys/UseKeyModal.vue` (+ spec): upstream's catalog mode selector and oversized warning are shown for Codex tabs only; the panel shows for Codex tabs (OpenAI included, per #7736) and the OpenCode tab. A downstream OpenCode capacity spec mocked `json()`; its fixture now supplies `text()`, which the manifest fetch reads to measure the remote-catalog size.
+- `frontend/src/utils/planType.ts`, `components/common/PlatformTypeBadge.vue`: upstream's Codex plan names (Pro 100/200/500, Business, Enterprise, Edu, analytics families) replace the downstream `Business Standard` and `Business (usage-based)` labels; `isOpenAIBusinessPlanType` now covers every organization SKU and colours the badge. The two downstream specs that asserted the old labels were updated to the upstream names; their SKU-preservation and no-personal-tier intent is unchanged.
+- `frontend/src/composables/useModelWhitelist.ts`: `GPT-6.1 Sol` preset added once, inside the downstream GPT-6 preset group.
+
+## Auto-merged areas checked
+
+- **Every gateway handler takes the reservation.** Upstream wires Messages, Chat Completions and Responses (both gateways), Gemini, embeddings, images, web/x search, alpha search, Grok media and voice, OpenAI-platform Messages and the Responses WebSocket (session-level, per-turn billing takes over). Downstream paths reach the same handlers: Image Studio (in-process router to `OpenAIGatewayHandler.Images`), async image tasks, the `/backend-api/codex` Responses, WebSocket and alpha-search routes, Seedance task creation through Grok media, the OpenAI-compatible provider platforms (Kimi, Zhipu, DeepSeek, MiniMax, OpenCode Go), and Cindy accounts, which are served by the OpenAI gateway handlers.
+- **Deliberately exempt (no reservation):** token counting, model lists, usage and key billing info, the Codex manifest, Live/realtime calls (identical to upstream; eligibility check only), batch images (separate batch billing flow), media status/content polling and custom voices (zero estimate by design).
+- **Balance and pricing composition.** `syncBalanceCacheAfterDeduction` first invalidates an exhausted balance (downstream threshold), otherwise deducts the cache synchronously while reservations are enabled. The estimate uses the same `GetModelPricing` (GPT-5.6 family fallbacks, DeepSeek identity), resolver, channel mapping, user group rate and peak multipliers as billing; time-of-day DeepSeek discounts are not applied to the estimate, so it stays conservative. Overdraft accounting and the profit gate are unchanged.
+- **Claude reset redemption (#7726)** renders inside the existing `ClaudeResetCreditsCell`. The irreversible reset button and its confirmation follow `canInteract` like `OpenAIQuotaResetCell`: they appear only in the account details drawer, while the read-only table and card cells keep just the reset-count query they already showed. `redeemed` therefore refreshes usage only in the drawer, which loads its own usage rather than the table's batch. The button matches the console's small ghost-button rule for usage actions, and its confirmation uses the shared dialog in `#overlay-root`.
+
+## Validation
+
+- `GOOS=linux GOARCH=amd64 go build ./...` passes.
+- Focused `go test -tags=unit` runs pass in `handler` (reservation helpers, usage-task submitters, Claude Code-only fallback, GPT-6 discovery), `service` (reservation and estimate, API key create limits, Claude reset redemption, GPT-6.1 Sol and GPT-6 pricing, Codex catalogs, quota activity), `repository` (Redis reservation scripts, create-count window), `pkg/openai`, `pkg/apicompat`, `handler/admin`, `server/routes` and the server API contract test.
+- `golangci-lint` 2.13 reports 0 issues on `handler`, `service`, `repository`, `config`, `pkg/openai`, `pkg/apicompat`, `server` and `cmd/server`.
+- `vue-tsc --noEmit` passes. 368 focused frontend tests (conflicted components, `ClaudeResetCreditsCell`, usage cells, all `AccountsView` specs, i18n completeness and compile specs) pass; the one initial failure was the outdated `json()` fetch mock described above, rerun green after the fixture fix. ESLint passes on every changed frontend file.
+- Review fixes (OpenCode GPT-6.1 Sol limit, read-only reset control, GPT-6.x pricing guard, claim logging) were re-checked on their own tree: `go build ./...` (linux/amd64); `service` tests for GPT-6/GPT-6.1 Sol pricing and every `TestClaudeResetRedeem*` case; `golangci-lint` on `service` (0 issues); `vue-tsc`; the `UseKeyModal`, `ClaudeResetCreditsCell`, `AccountUsageCell` and `AccountUsageCell.list` specs; ESLint on the changed frontend files.
+- Not run: full suites, integration tests, production migration rehearsal, real model calls, deploy or canary. Source integration does not claim a successful deployment or model-quality acceptance.
+
+## Release target
+
+- `v0.2.11-codexrip.1`, fixed downstream image digest, `deploy-preserve`, resource profile `preserve`, natural drain, only the Sub2API container recreated. The in-flight reservation is active from this release on (owner decision). Final source SHA, PR and check results, image digest and production outcome belong to the operational delivery evidence.

backend/cmd/server/VERSION

@@ -1 +1 @@
-0.2.10
+0.2.11