[daimonbot]

Problem and result

Some Codex sessions appeared with an unknown model even though the recorded thread settings or SQLite thread row named one. The reader returned a truthy rollout with an empty model list, and synthesis discarded that available metadata. Atlas now retains declared models for display when per-turn contexts are absent and exposes their origin as modelSource.

codex-auto-review was already the correct recorded identifier: it is Codex's automatic approval-review model. The UI and terminal now identify it as internal and explain its Guardian permission-check role. The raw identifier remains unchanged for filtering, exports, and pricing. No parent-model tariff or assumed backend identity is substituted.

Sessions that recorded no execution model display model not recorded. The model that authored an instruction template is deliberately not used as proof of the executing model. Missing usage no longer produces the duplicate (usage unavailable) (usage unavailable) text.

Prepares patch v0.9.2.

Pricing and compatibility

• Per-turn model attribution and model-switch pricing remain unchanged.
• A model declared in session metadata never supplies a missing per-call model for pricing; those amounts remain unavailable.
• Guardian usage remains n/a unless a configured price catalogue or local override provides a rate.
• Friendly model labels retain raw option values, so existing filters and URLs continue to work.

Validation

• Reproduced on live data: 150 top-level Auto Review sessions, two model-less Guardian sessions whose recorded settings identified the model, and older executions with neither a turn model nor a thread model.
• Regression tests fail before the fix and pass after it, covering metadata recovery, thread settings, missing per-call attribution, model switches, instruction provenance, and Guardian pricing identity.
• Verified affected real Codex rollouts: the two Guardian sessions now display codex-auto-review with modelSource: thread_settings; executions that saved no model remain explicitly unrecorded.
• Typecheck, build, and the 50,000-session benchmark pass. CI passes all 42 tests, with none skipped, including model-label/filter behavior in the browser. Verification.
• A live refresh of both pricing catalogues succeeds and confirms neither currently supplies a rate for codex-auto-review.