diff --git a/.env.example b/.env.example
index 3335784a6c..c2b069c2da 100644
--- a/.env.example
+++ b/.env.example
@@ -56,10 +56,12 @@ STORAGE_ENCRYPTION_KEY_VERSION=v1
 DISABLE_SQLITE_AUTO_BACKUP=false
 
 # ── Redis (Rate Limiting) ──
-# Redis connection URL for the rate limiter backend.
+# Redis connection URL for the rate limiter backend. OPT-IN: leave this
+# commented out to use the built-in in-memory rate limiter. Setting it to a
+# non-running localhost (#4878) makes ioredis flood "[REDIS] Error:" logs.
 # Used by: src/shared/utils/rateLimiter.ts
-# Default: redis://localhost:6379 (or redis://redis:6379 in Docker)
-REDIS_URL=redis://localhost:6379
+# Example: redis://localhost:6379 (or redis://redis:6379 in Docker)
+# REDIS_URL=redis://localhost:6379
 
 # ═══════════════════════════════════════════════════════════════════════════════
 # 3. NETWORK & PORTS
@@ -551,6 +553,16 @@ PROVIDER_LIMITS_SYNC_SPACING_MS=1500
 # heuristic in instrumentation-node.ts.  Default: unset (tests skip background).
 #OMNIROUTE_ENABLE_RUNTIME_BACKGROUND_TASKS=1
 
+# Proactive connection-cooldown recovery (#8): re-validates connections whose
+# transient `rate_limited_until` window has elapsed OUTSIDE the request hot path,
+# so the first request after a cooldown does not pay the probe latency. Lazy
+# recovery in getProviderCredentials still applies regardless. Used by:
+# src/lib/quota/connectionRecovery.ts.
+# Tick cadence (ms). Default 60000, floor 5000.
+# OMNIROUTE_CONNECTION_RECOVERY_INTERVAL_MS=60000
+# Disable the proactive recovery scheduler entirely (default: false).
+# OMNIROUTE_DISABLE_CONNECTION_RECOVERY=false
+
 # Background job interval for budget reset checks (ms).  Default: 600000 (10m).
 # Used by: src/lib/jobs/budgetResetJob.ts.  Floor: 10000.
 #OMNIROUTE_BUDGET_RESET_JOB_INTERVAL_MS=600000
@@ -598,6 +610,11 @@ PROVIDER_LIMITS_SYNC_SPACING_MS=1500
 # Used by: scripts/postinstall.mjs.
 #OMNIROUTE_SKIP_POSTINSTALL=0
 
+# Operator-supplied JSON credentials for the offline compression-eval CLI
+# (parsed with JSON.parse; leave unset for a dry run). Developer tooling only.
+# Used by: scripts/compression-eval/index.ts.  Default: {} (empty).
+#OMNIROUTE_EVAL_CREDENTIALS={}
+
 # Skip the DB healthcheck entirely on startup (useful for short-lived tasks / tests).
 # Used by: src/lib/db/core.ts, src/lib/db/healthCheck.ts.  Set to 1 to disable.  Default: 0.
 #OMNIROUTE_SKIP_DB_HEALTHCHECK=0
@@ -792,7 +809,7 @@ GITHUB_OAUTH_CLIENT_ID=Iv1.b507a08c87ecfe98
 # Used by: open-sse/executors/base.ts — buildHeaders() dynamic lookup.
 # Update these when providers release new CLI versions to avoid blocks.
 
-CLAUDE_USER_AGENT="claude-cli/2.1.158 (external, cli)"
+CLAUDE_USER_AGENT="claude-cli/2.1.187 (external, cli)"
 
 # Disable the deterministic tool-name cloak applied on both Anthropic-bound paths
 # (executors/base.ts native OAuth + executors/cliproxyapi.ts CLIProxyAPI) —
@@ -801,7 +818,7 @@ CLAUDE_USER_AGENT="claude-cli/2.1.158 (external, cli)"
 # stream with a misleading 400 out-of-extra-usage placeholder. Set to true to
 # forward the original names verbatim (debugging only).
 # CLAUDE_DISABLE_TOOL_NAME_CLOAK=false
-CODEX_USER_AGENT="codex-cli/0.132.0 (Windows 10.0.26200; x64)"
+CODEX_USER_AGENT="codex-cli/0.142.0 (Windows 10.0.26200; x64)"
 GITHUB_USER_AGENT="GitHubCopilotChat/0.45.1"
 ANTIGRAVITY_USER_AGENT="antigravity/2.0.1 linux/arm64 google-api-nodejs-client/10.3.0"
 KIRO_USER_AGENT="AWS-SDK-JS/3.0.0 kiro-ide/1.0.0"
@@ -823,7 +840,13 @@ GEMINI_CLI_USER_AGENT="google-api-nodejs-client/10.3.0"
 
 # Override Codex client version sent in headers independently of the
 # CODEX_USER_AGENT string. Used by: open-sse/config/codexClient.ts.
-# CODEX_CLIENT_VERSION=0.132.0
+# CODEX_CLIENT_VERSION=0.142.0
+
+# Kill-switch to strip non-standard `codex.*` SSE events (e.g. codex.rate_limits)
+# from the Codex Responses stream. These frames break the OpenAI SDK's
+# responses.stream() with a 502 "Controller is already closed". Off by default;
+# set to true/1/yes to enable. Used by: open-sse/executors/codex.ts.
+# OMNIROUTE_CODEX_DROP_NONSTANDARD_EVENTS=true
 
 # ═══════════════════════════════════════════════════════════════════════════════
 # 13. CLI FINGERPRINT COMPATIBILITY (Anti-Detection)
@@ -950,6 +973,15 @@ GEMINI_CLI_USER_AGENT="google-api-nodejs-client/10.3.0"
 # OMNIROUTE_CIRCUIT_BREAKER_LOCAL_THRESHOLD=2
 # OMNIROUTE_CIRCUIT_BREAKER_LOCAL_RESET_MS=15000
 
+# ── Context-cache pin health gate ──
+# Used by: open-sse/services/combo.ts. When a context-cache pin points at a
+# provider that is durably unhealthy, the pin is dropped to allow failover.
+# PIN_DROP_BACKOFF_LEVEL gates how deep a connection's backoff must be before the
+# pin is considered durably unhealthy; PIN_DROP_GRACE_MS is the anti-flap window
+# that tolerates brief transient cooldowns before dropping the pin.
+# PIN_DROP_BACKOFF_LEVEL=2
+# PIN_DROP_GRACE_MS=20000
+
 # ── Stream idle detection ──
 # STREAM_IDLE_TIMEOUT_MS=600000      # Max silence between SSE chunks (default: 600000)
 #                                     # Extended-thinking models rarely pause >90s.
@@ -1200,6 +1232,34 @@ APP_LOG_TO_FILE=true
 # Used by: open-sse/executors/cloudflare-ai.ts
 # CLOUDFLARE_ACCOUNT_ID=
 
+# ── Deno Deploy proxy relay (#4643 / 9router#1437) ──
+# Override the Deno Deploy REST API base used by the proxy-pool relay deployer.
+# Default: https://api.deno.com/v2 (omit unless mocking).
+# Used by: src/app/api/settings/proxy/deno-deploy/route.ts
+# DENO_DEPLOY_API_BASE=https://api.deno.com/v2
+
+# Default Deno Deploy app name suggested in the "Deploy Relay" modal.
+# Used by: src/app/(dashboard)/dashboard/settings/components/proxy/DenoRelayModal.tsx
+# NEXT_PUBLIC_DENO_RELAY_DEFAULT_PROJECT=omniroute-deno-relay
+
+# Set to "false" to hide the Deno Deploy relay option from the Proxy Pool tab.
+# Used by: src/app/(dashboard)/dashboard/settings/components/proxy/ProxyPoolTab.tsx
+# NEXT_PUBLIC_DENO_RELAY_ENABLED=true
+
+# ── Cloudflare Workers proxy relay (#4640 / 9router#1360) ──
+# Override the Cloudflare REST API base used by the proxy-pool relay deployer.
+# Default: https://api.cloudflare.com/client/v4 (omit unless mocking).
+# Used by: src/app/api/settings/proxy/cloudflare-deploy/route.ts
+# CLOUDFLARE_API_BASE=https://api.cloudflare.com/client/v4
+
+# Default worker project name suggested in the "Deploy Relay" modal.
+# Used by: src/app/(dashboard)/dashboard/settings/components/proxy/CloudflareRelayModal.tsx
+# NEXT_PUBLIC_CLOUDFLARE_RELAY_DEFAULT_PROJECT=omniroute-relay
+
+# Set to "false" to hide the Cloudflare Workers relay option from the Proxy Pool tab.
+# Used by: src/app/(dashboard)/dashboard/settings/components/proxy/ProxyPoolTab.tsx
+# NEXT_PUBLIC_CLOUDFLARE_RELAY_ENABLED=true
+
 # ── Cloudflare Tunnel (cloudflared) ──
 # Custom path to cloudflared binary for tunnel management.
 # Used by: src/lib/cloudflaredTunnel.ts
@@ -1637,6 +1697,7 @@ QUOTA_STORE_DRIVER=sqlite              # sqlite | redis
 # QUOTA_STORE_REDIS_URL=               # ex.: redis://localhost:6379 (apenas quando driver=redis)
 # QUOTA_SATURATION_THRESHOLD=0.5       # 0..1; >= threshold ativa modo strict (sem empréstimo)
 # QUOTA_SOFT_DEPRIORITIZE_FACTOR=0.7   # 0..1; multiplicador do score quando soft policy ativa
+# STATUS_SOFT_DEPRIORITIZE_FACTOR=0.5  # 0..1; multiplicador do score p/ provider esgotado (credits_exhausted/rate_limited) quando preflight cutoff OFF (#4540)
 # QUOTA_CONSUMPTION_RETENTION_DAYS=14  # GC de buckets quota_consumption.updated_at antigos
 # QUOTA_PREFLIGHT_CUTOFF_ENABLED=false # opt-in (default OFF): hard quota cutoff drops low-quota candidates before auto-routing scoring
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0da08470d4..5181ebc246 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -846,6 +846,7 @@ jobs:
           path: |
             coverage/coverage-summary.json
             coverage/coverage-report.md
+            coverage/lcov.info
           if-no-files-found: warn
 
   sonarqube:
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index b6cfcb2e8e..1c3fdc5e36 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -40,6 +40,8 @@ jobs:
       - run: npm run check:fetch-targets
       - run: npm run check:openapi-routes
       - run: npm run check:docs-symbols
+      - name: Docs accuracy (fabricated-docs + i18n mirrors, strict)
+        run: npm run check:docs-all
       - run: npm run check:deps
       - run: npm run check:file-size
       - run: npm run check:error-helper
@@ -49,6 +51,7 @@ jobs:
       - run: npm run check:known-symbols
       - run: npm run check:route-guard-membership
       - run: npm run check:test-discovery
+      - run: npm run check:test-runner-api
       - run: npm run check:any-budget:t11
       - name: Typecheck (core)
         run: npm run typecheck:core
@@ -82,3 +85,48 @@ jobs:
           echo "Running impacted tests:"; echo "$SEL"
           mapfile -t FILES <<< "$SEL"
           node --import tsx --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 "${FILES[@]}"
+
+  fast-vitest:
+    name: Vitest (fast-path)
+    runs-on: ubuntu-latest
+    env:
+      JWT_SECRET: ci-lint-secret-with-sufficient-length-for-validation
+      API_KEY_SECRET: ci-lint-api-key-secret-long
+      DISABLE_SQLITE_AUTO_BACKUP: "true"
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.CI_NODE_VERSION }}
+          cache: npm
+      - run: npm ci
+      - run: npm run test:vitest
+
+  fast-unit:
+    name: Unit Tests fast-path (${{ matrix.shard }}/2)
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2]
+    env:
+      JWT_SECRET: ci-lint-secret-with-sufficient-length-for-validation
+      API_KEY_SECRET: ci-lint-api-key-secret-long
+      DISABLE_SQLITE_AUTO_BACKUP: "true"
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.CI_NODE_VERSION }}
+          cache: npm
+      - run: npm ci
+      - run: >
+          node --max-old-space-size=4096 --import tsx
+          --import ./tests/_setup/isolateDataDir.ts
+          --test --test-force-exit --test-concurrency=4 --test-shard=${{ matrix.shard }}/2
+          tests/unit/*.test.ts
+          "tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,dashboard,db,db-adapters,docs,gamification,guardrails,lib,mcp,runtime,security,services,settings,shared,ui}/**/*.test.ts"
diff --git a/@omniroute/opencode-plugin/src/index.ts b/@omniroute/opencode-plugin/src/index.ts
index 6aae7a8238..058b1cb8c7 100644
--- a/@omniroute/opencode-plugin/src/index.ts
+++ b/@omniroute/opencode-plugin/src/index.ts
@@ -4406,8 +4406,24 @@ export function createOmniRouteConfigHook(
       authJson = undefined;
     }
 
-    const entry = authJson?.[resolved.providerId] as AuthJsonApiEntry | undefined;
-    const apiKey = entry && entry.type === "api" && typeof entry.key === "string" ? entry.key : "";
+    // Try both prefixed (e.g. opencode-omniroute) and unprefixed (e.g. omniroute)
+    // keys so a user who ran `/connect omniroute` before the auto-prefix fix
+    // does not need to re-auth. Also handles dual-key for auth.json entries
+    // written by a newer OC dispatcher with the prefixed key.
+    const bareKey = resolved.providerId.startsWith("opencode-")
+      ? resolved.providerId.slice("opencode-".length)
+      : resolved.providerId;
+    const lookupKeys = [resolved.providerId];
+    if (bareKey !== resolved.providerId) lookupKeys.push(bareKey);
+    let entry;
+    for (const k of lookupKeys) {
+      const e = authJson?.[k];
+      if (e?.type === "api" && typeof e.key === "string" && e.key.length > 0) {
+        entry = e;
+        break;
+      }
+    }
+    const apiKey = entry?.type === "api" && typeof entry.key === "string" ? entry.key : "";
 
     if (!apiKey) {
       // (c) no apiKey — silent no-op (with debug breadcrumb). The operator
diff --git a/@omniroute/opencode-plugin/tests/config-shim.test.ts b/@omniroute/opencode-plugin/tests/config-shim.test.ts
index 16cb3253cf..63d7c277ac 100644
--- a/@omniroute/opencode-plugin/tests/config-shim.test.ts
+++ b/@omniroute/opencode-plugin/tests/config-shim.test.ts
@@ -256,6 +256,65 @@ test("config: with valid auth.json + apiKey + baseURL → mutates input.provider
   assert.equal(combo.limit?.context, 200_000, "LCD: min(200_000, 1_000_000)");
 });
 
+// ────────────────────────────────────────────────────────────────────────────
+// 1b. Dual-key fallback (#5027) — auth.json stored under the BARE providerId
+//     (pre-auto-prefix login) must still resolve when the active providerId is
+//     prefixed (`opencode-omniroute`). Without the fallback the lookup misses
+//     the stored key and the user is forced to re-auth.
+// ────────────────────────────────────────────────────────────────────────────
+
+test("config: auth.json under bare key (pre-prefix login) resolves via dual-key fallback", async () => {
+  // Stored under bare `omniroute` (the key OC wrote before the auto-prefix fix),
+  // but the resolved providerId is now `opencode-omniroute`.
+  const readAuthJson = stubReadAuthJson({
+    omniroute: { type: "api", key: "sk-bare-1", baseURL: "https://or.example.com/v1" },
+  });
+  const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
+  const combosFetcher = stubCombosFetcher([]);
+  const logger = captureWarn();
+
+  const hook = createOmniRouteConfigHook(
+    { providerId: "omniroute" }, // resolves to opencode-omniroute internally
+    { readAuthJson, fetcher, combosFetcher, logger }
+  );
+  const input = makeInput();
+  await hook(input);
+
+  const provider = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider;
+  const entry = provider["opencode-omniroute"];
+  assert.ok(entry, "provider entry published from bare-key apiKey");
+  assert.equal(entry.options.apiKey, "sk-bare-1", "apiKey resolved from the bare auth.json key");
+  assert.equal(entry.options.baseURL, "https://or.example.com/v1");
+});
+
+test("config: prefixed key wins over bare key when both present (dual-key precedence)", async () => {
+  const readAuthJson = stubReadAuthJson({
+    "opencode-omniroute": { type: "api", key: "sk-prefixed", baseURL: "https://pref.example/v1" },
+    omniroute: { type: "api", key: "sk-bare", baseURL: "https://bare.example/v1" },
+  });
+  const fetcher = stubModelsFetcher([MODEL_CLAUDE]);
+  const combosFetcher = stubCombosFetcher([]);
+  const logger = captureWarn();
+
+  const hook = createOmniRouteConfigHook(
+    { providerId: "omniroute" },
+    { readAuthJson, fetcher, combosFetcher, logger }
+  );
+  const input = makeInput();
+  await hook(input);
+
+  const entry = (input as { provider: Record<string, OmniRouteStaticProviderEntry> }).provider[
+    "opencode-omniroute"
+  ];
+  assert.ok(entry);
+  assert.equal(
+    entry.options.apiKey,
+    "sk-prefixed",
+    "prefixed key takes precedence (looked up first)"
+  );
+  assert.equal(entry.options.baseURL, "https://pref.example/v1");
+});
+
 // ────────────────────────────────────────────────────────────────────────────
 // 2. Missing auth.json → no-op, no throw, no mutation
 // ────────────────────────────────────────────────────────────────────────────
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8b4175f354..2a67ba8279 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,181 @@
 
 ---
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
@@ -19,6 +194,7 @@
 - **Dashboard**: remove the dead, unconditional `useLiveRequests()` call from `HomePageClient.tsx` — it crashed the `/home` page in production builds with `ReferenceError: useLiveRequests is not defined` (#4759, #4745) and opened the live-dashboard WebSocket even when Provider Topology was hidden (#4596). The live feed remains owned by the settings-gated `HomeProviderTopologySection` ([#4761](https://github.com/diegosouzapw/OmniRoute/pull/4761) — thanks @diegosouzapw).
 - **Providers dashboard**: dedupe provider nodes by id when adding a compatible provider (`upsertProviderNodeById`) so the same provider can no longer appear twice and no-op adds don't invalidate the compatible-provider memo ([#4768](https://github.com/diegosouzapw/OmniRoute/pull/4768) — closes #4746, thanks @diegosouzapw).
 - **Storage VACUUM**: the scheduled VACUUM job now follows the Storage page settings (`scheduledVacuum` / `vacuumHour`) as the single source of truth; the legacy env-flag control path was removed ([#4726](https://github.com/diegosouzapw/OmniRoute/pull/4726) — thanks @rdself).
+- **Storage SQLite tuning**: `Cache Size` is now a positive KiB setting (for example, `16384`) that applies to SQLite as `PRAGMA cache_size = -16384`; Page Size and Cache Size changes are applied to the live database instead of being persisted only in the settings table.
 - **Tiers**: no-auth providers are now counted as free, and the free-tier filter returns an empty set instead of falling through to every provider ([#4753](https://github.com/diegosouzapw/OmniRoute/pull/4753) — thanks @megamen32 / @diegosouzapw).
 - **Combos**: auto-promote `zeroLatencyOptimizationsEnabled` so legacy configs (pre-3.8.33 `fallbackCompressionMode="lite"`) round-trip cleanly on the first GUI edit ([#4774](https://github.com/diegosouzapw/OmniRoute/pull/4774) — thanks @KooshaPari / @diegosouzapw).
 
diff --git a/README.md b/README.md
index 150f630fd5..37bde4d92e 100644
--- a/README.md
+++ b/README.md
@@ -287,18 +287,19 @@ Result: 4 layers of fallback = zero downtime
 
 </div>
 
-> Recent highlights from **v3.8.20 → v3.8.35**. Full history in [`CHANGELOG.md`](CHANGELOG.md).
+> Recent highlights from **v3.8.20 → v3.8.36**. Full history in [`CHANGELOG.md`](CHANGELOG.md).
 
+- **⚖️ Quota-Share routing** — a dedicated combo strategy that spreads load across accounts by _available quota_: Deficit-Round-Robin scheduling, per-connection `max_concurrent` with cooldown-wait queueing, multi-window usage buckets (5h / 7d / per-model), per-(key,model) caps, session stickiness for prompt-cache integrity, and proactive saturation from upstream token-usage headers. → [Resilience Guide](docs/architecture/RESILIENCE_GUIDE.md)
 - **🤖 One-command CLI/agent setup** — a dedicated `setup-*` command configures each coding tool to route through OmniRoute (Claude Code, Codex, Cline, Continue, Cursor, Roo Code, Kilo Code, Crush, Goose, Qwen Code, Aider, OpenCode, Gemini CLI); `omniroute launch` / `omniroute launch-codex` are zero-config launchers. → [CLI Integrations](docs/guides/CLI-INTEGRATIONS.md)
 - **🛰️ Remote mode** — drive a remote OmniRoute from any machine with scoped access tokens (`omniroute connect` / `omniroute contexts` / `omniroute tokens`). → [Remote Mode](docs/guides/REMOTE-MODE.md)
-- **🧭 Smarter auto-routing** — OpenRouter-style `auto/<category>:<tier>` combos (e.g. `auto/coding:fast`, `auto/reasoning:pro`), live Arena-ELO + models.dev model intelligence, per-step account allowlists, provider-wildcard combo steps, nested combo-ref execution, sticky weighted selection, and `web_search`-aware routing to a configured model. → [Auto-Combo](docs/routing/AUTO-COMBO.md)
+- **🧭 Smarter auto-routing** — OpenRouter-style `auto/<category>:<tier>` combos (e.g. `auto/coding:fast`, `auto/reasoning:pro`), a **Fusion** strategy (16th — fan out to a panel of models in parallel, then synthesize via a judge), **task-aware routing** (best-fit connection per task type), per-request `X-Route-Model` override, live Arena-ELO + models.dev model intelligence, per-step account allowlists, provider-wildcard combo steps, nested combo-ref execution, sticky weighted selection, and `web_search`-aware routing. → [Auto-Combo](docs/routing/AUTO-COMBO.md)
 - **🗜️ Pluggable compression** — an async pipeline of **9 composable engines** with Compression Studios, an LLMLingua-2 ONNX engine and a heuristic/SLM two-tier **Ultra**, RTK, delegated Anthropic Context Editing, **Output Styles** (output-axis steering: terse-prose / less-code / terse-CJK), an **adaptive context-budget dial** (escalate only as far as needed to fit the context window), per-request `x-omniroute-compression` control, an opt-in offline eval harness, and a unified panel with named profiles + an active-profile selector. → [Compression](docs/compression/COMPRESSION_ENGINES.md)
 - **🕵️ Transparent MITM decrypt (TPROXY)** — capture & translate traffic from CLIs that ignore proxy env vars, with a per-SNI certificate authority and a trust-store installer. → [MITM/TPROXY](docs/security/MITM-TPROXY-DECRYPT.md)
 - **💸 Cost telemetry everywhere** — `X-OmniRoute-*` cost/usage headers on every endpoint (including media), a non-token cost engine, a cache-HIT `X-OmniRoute-Cost-Saved` header, and per-key USD spend quotas. → [API Reference](docs/reference/API_REFERENCE.md)
 - **🧠 Memory you control** — opt-in int8 vector quantization (Qdrant + sqlite-vec), memory off by default, and a per-request `x-omniroute-no-memory` header. → [Memory](docs/frameworks/MEMORY.md)
 - **🛡️ Security** — a prompt-injection guard across every LLM route (backed by a red-team suite), plus a free DuckDuckGo last-resort web search. → [Guardrails](docs/security/GUARDRAILS.md)
-- **🤝 More providers & agents** — Cursor Cloud Agent (a 4th cloud agent), a refreshed 231-provider catalog (OrcaRouter, Wafer AI, OpenAdapter, dit.ai, TokenRouter, …), Vertex AI media generation (speech / transcription / music / video), and one-click account import from CLIProxyAPI (`~/.cli-proxy-api/`). → [Providers](docs/reference/PROVIDER_REFERENCE.md)
-- **⚡ Local performance & infra** — a one-click local Redis launcher (`omniroute redis up`, plus a dashboard Redis panel) and an optional Bifrost Go sidecar that offloads the hottest relay path (`BIFROST_BASE_URL`, with automatic fallback to the TypeScript path on timeout). → [Environment](docs/reference/ENVIRONMENT.md)
+- **🤝 More providers & agents** — Cursor Cloud Agent (a 4th cloud agent), CodeBuddy CN (`copilot.tencent.com`), a Google Flow video-generation provider, a refreshed 231-provider catalog (OrcaRouter, Wafer AI, OpenAdapter, dit.ai, TokenRouter, …), Vertex AI media generation (speech / transcription / music / video), and one-click account import from CLIProxyAPI (`~/.cli-proxy-api/`). → [Providers](docs/reference/PROVIDER_REFERENCE.md)
+- **⚡ Local performance & infra** — a one-click local Redis launcher (`omniroute redis up`, plus a dashboard Redis panel), one-click **Cloudflare Workers** and **Deno Deploy** relay deployers wired into the proxy pool, and an optional Bifrost Go sidecar that offloads the hottest relay path (`BIFROST_BASE_URL`, with automatic fallback to the TypeScript path on timeout). → [Environment](docs/reference/ENVIRONMENT.md)
 
 <br/>
 
@@ -544,12 +545,12 @@ Code blocks, URLs, JSON and structured data are **always protected** by the pres
 
 The 9 engines above shrink what goes **in**. Three more layers shape **how**, **when**, and what comes **out**:
 
-- **🪄 Output Styles** *(output-axis steering)* — inject deterministic, cache-safe response-shaping instructions; combinable, each at `lite` / `full` / `ultra` intensity. Adding a style is a one-line registry entry:
+- **🪄 Output Styles** _(output-axis steering)_ — inject deterministic, cache-safe response-shaping instructions; combinable, each at `lite` / `full` / `ultra` intensity. Adding a style is a one-line registry entry:
   - **Terse prose** — drop filler / articles / hedging; keep technical substance exact.
   - **Less code** — "lazy senior dev" YAGNI: smallest working change, no unrequested scaffolding.
   - **Terse CJK (文言)** — classical-Chinese ultra-terse style (locale-gated to `zh`).
-- **🎯 Adaptive context-budget** *(the dial)* — instead of one on/off token threshold, escalate the cheapest, most-lossless engines only as far as needed to **fit the model's context window**. Policy: `reserve-output` (default, model-aware) · `percentage` · `absolute`. Mode: `floor` (guarantee fit) · `replace-autotrigger` (your explicit choice wins) · `off` (legacy threshold).
-- **🎛️ Where compression is decided** *(precedence, high → low)* — per-request `x-omniroute-compression` header › routing-combo override › active named profile › adaptive / auto-trigger › panel default › off. The applied plan echoes back in the `X-OmniRoute-Compression: <mode>; source=<source>` response header.
+- **🎯 Adaptive context-budget** _(the dial)_ — instead of one on/off token threshold, escalate the cheapest, most-lossless engines only as far as needed to **fit the model's context window**. Policy: `reserve-output` (default, model-aware) · `percentage` · `absolute`. Mode: `floor` (guarantee fit) · `replace-autotrigger` (your explicit choice wins) · `off` (legacy threshold).
+- **🎛️ Where compression is decided** _(precedence, high → low)_ — per-request `x-omniroute-compression` header › routing-combo override › active named profile › adaptive / auto-trigger › panel default › off. The applied plan echoes back in the `X-OmniRoute-Compression: <mode>; source=<source>` response header.
 
 Auto-trigger by token threshold, flip on the adaptive dial, pin a named profile, set a one-off per request, or assign a pipeline per routing combo — whichever fits the workload. An opt-in offline **eval harness** (`npm run eval:compression`) scores fidelity vs. savings on a pinned corpus before you promote a change.
 
@@ -574,7 +575,7 @@ Dashboard at `http://localhost:20128` · API at `http://localhost:20128/v1`.
 
 **2) Connect a FREE provider (no signup)**
 
-Dashboard → **Providers** → connect **Kiro AI** (free Claude unlimited) or **OpenCode Free** (no auth) → done.
+Dashboard → **Providers** → connect **Kiro AI** (free Claude, ~50 credits/month per account) or **OpenCode Free** (no auth) → done.
 
 **3) Point your coding tool**
 
@@ -743,7 +744,7 @@ podman compose --profile base up -d
 **$0 forever:**
 
 ```
-1. kr/claude-sonnet-4.5   (Kiro — unlimited)
+1. kr/claude-sonnet-4.5   (Kiro — ~50 credits/mo per acct)
 2. if/kimi-k2-thinking    (Qoder — unlimited)
 3. pol/gpt-5              (Pollinations — no key)
 4. lc/longcat-flash-lite  (50M tok/day backup)
@@ -800,7 +801,7 @@ Compression: aggressive (~50%) → double your free quota · Cost: $0/mo
 | `DATA_DIR`        | `~/.omniroute` | Database & config storage        |
 
 **Will I be charged by OmniRoute?** No — it's free, open-source software on your machine. You only pay paid providers directly. OmniRoute has no billing system.
-**Are FREE providers really unlimited?** Yes — Kiro, Qoder, Pollinations, LongCat, Cloudflare. No catch.
+**Are FREE providers really unlimited?** Mostly — Qoder, Pollinations, LongCat, and Cloudflare are free with no per-account credit cap. Kiro is free too but capped at ~50 credits/month per account. Stack multiple free providers in a combo and auto-fallback keeps you serving for $0.
 **Will compression hurt quality?** No — it only compresses the **input**; code, URLs, JSON are always protected.
 **Does it work where AI is blocked?** Yes — 3-level proxy + 1proxy marketplace reach all 231 providers.
 
@@ -934,7 +935,7 @@ Compression: aggressive (~50%) → double your free quota · Cost: $0/mo
 | Document                                          | Description                                         |
 | ------------------------------------------------- | --------------------------------------------------- |
 | [API Reference](docs/reference/API_REFERENCE.md)  | All endpoints with examples                         |
-| [OpenAPI Spec](docs/openapi.yaml)       | OpenAPI 3.0 specification                           |
+| [OpenAPI Spec](docs/openapi.yaml)                 | OpenAPI 3.0 specification                           |
 | [MCP Server](open-sse/mcp-server/README.md)       | 87 MCP tools, IDE configs, Python/TS/Go clients     |
 | [MCP Server Guide](docs/frameworks/MCP-SERVER.md) | MCP installation, transports, and tool reference    |
 | [A2A Server](src/lib/a2a/README.md)               | JSON-RPC 2.0 protocol, skills, streaming, task mgmt |
@@ -1089,32 +1090,32 @@ OmniRoute stands on the shoulders of giants. It started as a fork of **[9router]
 
 ### 🗜️ Context & token compression — engines
 
-| Project                                                                      |    ⭐ | How it inspired OmniRoute                                                                                                                                             |
-| ---------------------------------------------------------------------------- | ----: | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **[Caveman](https://github.com/JuliusBrussee/caveman)** · JuliusBrussee      | 74.5k | The viral "why use many token when few token do trick" project — its caveman-speak philosophy powers our standard compression mode and 30+ filler/condensation rules. |
-| **[RTK – Rust Token Killer](https://github.com/rtk-ai/rtk)** · rtk-ai        | 63.6k | High-performance command-output compression — inspired our RTK engine, JSON filter DSL, raw-output recovery and the stacked RTK → Caveman pipeline.                   |
-| **[headroom](https://github.com/chopratejas/headroom)** · chopratejas        | 33.6k | Reversible context-compression (SmartCrusher) — inspired our `headroom` engine and the `ccr` retrieve-marker pattern.                                                 |
-| **[LLMLingua](https://github.com/microsoft/LLMLingua)** · Microsoft          |  6.3k | Prompt-compression research (LLMLingua / LLMLingua-2) — inspired our async, code-safe, fail-open `llmlingua` engine.                                                  |
-| **[llmlingua-2-js](https://github.com/atjsh/llmlingua-2-js)** · atjsh        |    27 | The JS/ONNX port (MobileBERT / XLM-RoBERTa) used as the worker-thread backend for our LLMLingua engine.                                                               |
-| **[Troglodita](https://github.com/leninejunior/troglodita)** · Lenine Júnior |    15 | PT-BR token compression — powers our pt-BR language pack: pleonasm reduction and filler removal tuned for Brazilian-Portuguese grammar.                               |
-| **[ponytail](https://github.com/DietrichGebert/ponytail)** · DietrichGebert  | 51.4k | The viral "lazy senior dev" YAGNI-coder skill — inspired our **less-code** Output Style: smallest-working-change steering that cuts *generated* code (the output-axis sibling to Caveman's terse prose).                  |
+| Project                                                                      |    ⭐ | How it inspired OmniRoute                                                                                                                                                                                |
+| ---------------------------------------------------------------------------- | ----: | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **[Caveman](https://github.com/JuliusBrussee/caveman)** · JuliusBrussee      | 74.5k | The viral "why use many token when few token do trick" project — its caveman-speak philosophy powers our standard compression mode and 30+ filler/condensation rules.                                    |
+| **[RTK – Rust Token Killer](https://github.com/rtk-ai/rtk)** · rtk-ai        | 63.6k | High-performance command-output compression — inspired our RTK engine, JSON filter DSL, raw-output recovery and the stacked RTK → Caveman pipeline.                                                      |
+| **[headroom](https://github.com/chopratejas/headroom)** · chopratejas        | 33.6k | Reversible context-compression (SmartCrusher) — inspired our `headroom` engine and the `ccr` retrieve-marker pattern.                                                                                    |
+| **[LLMLingua](https://github.com/microsoft/LLMLingua)** · Microsoft          |  6.3k | Prompt-compression research (LLMLingua / LLMLingua-2) — inspired our async, code-safe, fail-open `llmlingua` engine.                                                                                     |
+| **[llmlingua-2-js](https://github.com/atjsh/llmlingua-2-js)** · atjsh        |    27 | The JS/ONNX port (MobileBERT / XLM-RoBERTa) used as the worker-thread backend for our LLMLingua engine.                                                                                                  |
+| **[Troglodita](https://github.com/leninejunior/troglodita)** · Lenine Júnior |    15 | PT-BR token compression — powers our pt-BR language pack: pleonasm reduction and filler removal tuned for Brazilian-Portuguese grammar.                                                                  |
+| **[ponytail](https://github.com/DietrichGebert/ponytail)** · DietrichGebert  | 51.4k | The viral "lazy senior dev" YAGNI-coder skill — inspired our **less-code** Output Style: smallest-working-change steering that cuts _generated_ code (the output-axis sibling to Caveman's terse prose). |
 
 ### 🧩 Compact formats, token research & code-aware tooling
 
-| Project                                                                                        |    ⭐ | How it inspired OmniRoute                                                                                                            |
-| ---------------------------------------------------------------------------------------------- | ----: | ------------------------------------------------------------------------------------------------------------------------------------ |
-| **[TOON](https://github.com/toon-format/toon)** · toon-format                                  | 24.6k | Token-Oriented Object Notation — its columnar, header-plus-rows model shaped our tabular compaction stage.                           |
-| **[GCF – Graph Compact Format](https://github.com/blackwell-systems/gcf)** · Blackwell Systems |    11 | Schema-aware "JSON for LLMs" notation — co-inspired our lossless homogeneous-array compaction with `[N rows]` markers.               |
-| **[token-optimizer-mcp](https://github.com/ooples/token-optimizer-mcp)** · ooples              |   409 | Brotli/SQLite cache + per-session context-delta — inspired our `session-dedup` engine.                                               |
-| **[token-savior](https://github.com/Mibayy/token-savior)** · Mibayy                            |   993 | Bash-output compaction + MCP profiles — inspired our compression bail-out discipline and MCP tool-manifest reduction.                |
-| **[token-saver](https://github.com/ppgranger/token-saver)** · ppgranger                        |   103 | Content-aware, per-file-type output compression with failure-aware bail-out — validated our per-type dispatch and minimum-gain skip. |
-| **[token-optimizer](https://github.com/alexgreensh/token-optimizer)** · alexgreensh            |  1.4k | "Find the ghost tokens" — its offload + recoverable-handle pattern informed our CCR offload thinking.                                |
-| **[TokenMizer](https://github.com/Shweta-Mishra-ai/tokenmizer)** · Shweta-Mishra-ai            |     1 | A session-graph + cross-turn line-dedup blueprint that informed our session-dedup design.                                            |
-| **[OmniCompress](https://github.com/jessefreitas/OmniCompress)** · jessefreitas                |     2 | Rust columnar-JSON + content-addressed retrieve + cross-message dedup — validated our `headroom`/`ccr`/`session-dedup` engine design and the cache-stable "compressed form is position-independent" invariant.            |
-| **[mcp-compressor](https://github.com/atlassian-labs/mcp-compressor)** · Atlassian Labs        |    80 | MCP tool-schema/description compression — informed our MCP tool-manifest cardinality reduction.                                      |
-| **[RepoMapper](https://github.com/pdavis68/RepoMapper)** · pdavis68                            |   182 | Aider-style repo-map ranking — informed our repo-map / retrieval-ranking exploration.                                                |
-| **[quiet-shell-mcp](https://github.com/mrsimpson/quiet-shell-mcp)** · mrsimpson                |     4 | Declarative shell-output reduction over MCP — validated our declarative bash-output compaction.                                      |
-| **[ts-morph](https://github.com/dsherret/ts-morph)** · David Sherret                           |  6.1k | TypeScript Compiler API toolkit — inspired our parser-based comment removal that preserves string, template and regex literals.      |
+| Project                                                                                        |    ⭐ | How it inspired OmniRoute                                                                                                                                                                                      |
+| ---------------------------------------------------------------------------------------------- | ----: | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **[TOON](https://github.com/toon-format/toon)** · toon-format                                  | 24.6k | Token-Oriented Object Notation — its columnar, header-plus-rows model shaped our tabular compaction stage.                                                                                                     |
+| **[GCF – Graph Compact Format](https://github.com/blackwell-systems/gcf)** · Blackwell Systems |    11 | Schema-aware "JSON for LLMs" notation — co-inspired our lossless homogeneous-array compaction with `[N rows]` markers.                                                                                         |
+| **[token-optimizer-mcp](https://github.com/ooples/token-optimizer-mcp)** · ooples              |   409 | Brotli/SQLite cache + per-session context-delta — inspired our `session-dedup` engine.                                                                                                                         |
+| **[token-savior](https://github.com/Mibayy/token-savior)** · Mibayy                            |   993 | Bash-output compaction + MCP profiles — inspired our compression bail-out discipline and MCP tool-manifest reduction.                                                                                          |
+| **[token-saver](https://github.com/ppgranger/token-saver)** · ppgranger                        |   103 | Content-aware, per-file-type output compression with failure-aware bail-out — validated our per-type dispatch and minimum-gain skip.                                                                           |
+| **[token-optimizer](https://github.com/alexgreensh/token-optimizer)** · alexgreensh            |  1.4k | "Find the ghost tokens" — its offload + recoverable-handle pattern informed our CCR offload thinking.                                                                                                          |
+| **[TokenMizer](https://github.com/Shweta-Mishra-ai/tokenmizer)** · Shweta-Mishra-ai            |     1 | A session-graph + cross-turn line-dedup blueprint that informed our session-dedup design.                                                                                                                      |
+| **[OmniCompress](https://github.com/jessefreitas/OmniCompress)** · jessefreitas                |     2 | Rust columnar-JSON + content-addressed retrieve + cross-message dedup — validated our `headroom`/`ccr`/`session-dedup` engine design and the cache-stable "compressed form is position-independent" invariant. |
+| **[mcp-compressor](https://github.com/atlassian-labs/mcp-compressor)** · Atlassian Labs        |    80 | MCP tool-schema/description compression — informed our MCP tool-manifest cardinality reduction.                                                                                                                |
+| **[RepoMapper](https://github.com/pdavis68/RepoMapper)** · pdavis68                            |   182 | Aider-style repo-map ranking — informed our repo-map / retrieval-ranking exploration.                                                                                                                          |
+| **[quiet-shell-mcp](https://github.com/mrsimpson/quiet-shell-mcp)** · mrsimpson                |     4 | Declarative shell-output reduction over MCP — validated our declarative bash-output compaction.                                                                                                                |
+| **[ts-morph](https://github.com/dsherret/ts-morph)** · David Sherret                           |  6.1k | TypeScript Compiler API toolkit — inspired our parser-based comment removal that preserves string, template and regex literals.                                                                                |
 
 ### 🧠 Memory & RAG
 
diff --git a/bin/_ops-common.sh b/bin/_ops-common.sh
new file mode 100644
index 0000000000..820efccc30
--- /dev/null
+++ b/bin/_ops-common.sh
@@ -0,0 +1,70 @@
+# bin/_ops-common.sh — shared helpers for the OmniRoute ops runbook scripts.
+#
+# Sourced (not executed) by rollback.sh / snapshot-data.sh / restore-data.sh /
+# restore-policies.sh / cold-start-bench.sh. The runbook context lives in
+# docs/INCIDENT_RESPONSE.md and docs/PERF_BUDGETS.md.
+#
+# Path resolution mirrors the app (src/lib/db/core.ts): the SQLite store is
+# $DATA_DIR/storage.sqlite and managed backups go to $DATA_DIR/db_backups
+# (overridable via DB_BACKUPS_DIR), so snapshots created here are interchangeable
+# with the ones the server writes on migrations.
+
+# Recompute the data-dir-derived paths. Called once on source, and again by
+# scripts that accept a --data-dir override.
+ops_set_data_dir() {
+  OMNIROUTE_DATA_DIR="$1"
+  OMNIROUTE_SQLITE="${OMNIROUTE_DATA_DIR}/storage.sqlite"
+  OMNIROUTE_BACKUPS_DIR="${DB_BACKUPS_DIR:-${OMNIROUTE_DATA_DIR}/db_backups}"
+}
+ops_set_data_dir "${DATA_DIR:-$HOME/.omniroute}"
+
+ops_log() { printf '[%s] %s\n' "${SCRIPT_NAME:-ops}" "$*" >&2; }
+ops_die() {
+  printf '[%s] ERROR: %s\n' "${SCRIPT_NAME:-ops}" "$*" >&2
+  exit 1
+}
+
+ops_require_cmd() {
+  command -v "$1" >/dev/null 2>&1 || ops_die "required command not found: $1"
+}
+
+# ops_confirm "<prompt>" — return 0 to proceed. Honors ASSUME_YES=1 (set by the
+# --yes flag) and REFUSES a destructive action on a non-interactive stdin unless
+# ASSUME_YES is set, so an unattended/CI invocation can never silently destroy data.
+ops_confirm() {
+  local prompt="$1" reply
+  if [ "${ASSUME_YES:-0}" = "1" ]; then return 0; fi
+  if [ ! -t 0 ]; then
+    ops_die "refusing a destructive action without a TTY; pass --yes to proceed non-interactively"
+  fi
+  read -r -p "$prompt [y/N] " reply
+  case "$reply" in
+    [yY] | [yY][eE][sS]) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+# ops_find_snapshot <id> — resolve a snapshot identifier (a snapshot dir name,
+# a bare timestamp/sha, or an explicit path) to a directory containing
+# storage.sqlite. Echoes the resolved dir or dies.
+ops_find_snapshot() {
+  local id="$1" cand
+  [ -n "$id" ] || ops_die "snapshot id required (a timestamp/sha, dir name, or path)"
+  for cand in \
+    "$id" \
+    "$id/" \
+    "$OMNIROUTE_BACKUPS_DIR/$id" \
+    "$OMNIROUTE_BACKUPS_DIR/snapshot_$id"; do
+    if [ -f "${cand%/}/storage.sqlite" ]; then
+      printf '%s\n' "${cand%/}"
+      return 0
+    fi
+  done
+  # Fall back to a prefix match against snapshot_* dirs (e.g. a short sha/date).
+  if [ -d "$OMNIROUTE_BACKUPS_DIR" ]; then
+    for cand in "$OMNIROUTE_BACKUPS_DIR"/snapshot_*"$id"*; do
+      [ -f "$cand/storage.sqlite" ] && { printf '%s\n' "$cand"; return 0; }
+    done
+  fi
+  ops_die "no snapshot matching '$id' under $OMNIROUTE_BACKUPS_DIR (run bin/snapshot-data.sh first)"
+}
diff --git a/bin/cli/runtime/nativeDeps.mjs b/bin/cli/runtime/nativeDeps.mjs
index f74ab1eea9..852cff76b7 100644
--- a/bin/cli/runtime/nativeDeps.mjs
+++ b/bin/cli/runtime/nativeDeps.mjs
@@ -12,7 +12,7 @@ import { spawnSync } from "node:child_process";
 import { platform } from "node:os";
 import { resolveDataDir } from "../data-dir.mjs";
 
-const BETTER_SQLITE3_VERSION = "12.9.0";
+const BETTER_SQLITE3_VERSION = "12.10.1";
 
 function runtimeDir() {
   return join(resolveDataDir(), "runtime");
diff --git a/bin/cli/runtime/sqliteRuntime.mjs b/bin/cli/runtime/sqliteRuntime.mjs
index 19dd790764..506481a353 100644
--- a/bin/cli/runtime/sqliteRuntime.mjs
+++ b/bin/cli/runtime/sqliteRuntime.mjs
@@ -6,7 +6,7 @@ import { pathToFileURL } from "node:url";
 import { validateBinaryMagic, platformBinaryLabel } from "./magicBytes.mjs";
 
 const RUNTIME_DIR = join(homedir(), ".omniroute", "runtime");
-const BETTER_SQLITE3_VERSION = "better-sqlite3@^12.6.2";
+const BETTER_SQLITE3_VERSION = "better-sqlite3@^12.10.1";
 
 let resolvedCached = null;
 
diff --git a/bin/cli/runtime/trayRuntime.ts b/bin/cli/runtime/trayRuntime.ts
index c1d76a96fd..cc734b6f80 100644
--- a/bin/cli/runtime/trayRuntime.ts
+++ b/bin/cli/runtime/trayRuntime.ts
@@ -1,4 +1,4 @@
-import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, writeFileSync, chmodSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
 import { execSync } from "node:child_process";
@@ -6,7 +6,43 @@ import { execSync } from "node:child_process";
 const RUNTIME_DIR = join(homedir(), ".omniroute", "runtime");
 // systray2 is a maintained fork with prebuilt binaries — installed lazily at runtime,
 // not in dependencies, to avoid npm install overhead for users who don't use --tray.
-const SYSTRAY_VERSION = "systray2@1.4.5";
+//
+// Pin: stay on the 2.x line. The original `systray@1.0.5` package bundles a 2017
+// x86_64 Go binary whose Mach-O headers modern dyld (macOS 14+) rejects, so the
+// tray silently fails to register on Apple Silicon. systray2 2.x ships newer
+// getlantern/systray-portable binaries that work under Rosetta. Inherited from
+// upstream decolua/9router#1080.
+export const SYSTRAY_PACKAGE = "systray2";
+export const SYSTRAY_VERSION = "2.1.4";
+const SYSTRAY_SPEC = `${SYSTRAY_PACKAGE}@${SYSTRAY_VERSION}`;
+
+export function resolveSystrayBinName(platform: NodeJS.Platform): string | null {
+  if (platform === "win32") return null;
+  if (platform === "darwin") return "tray_darwin_release";
+  return "tray_linux_release";
+}
+
+export interface ChmodResult {
+  changed: boolean;
+  reason?: "win32-skip" | "missing" | "chmod-failed";
+}
+
+// systray2's npm tarball sometimes ships the bundled Go binary without the
+// executable bit set on macOS/Linux, causing spawn() to fail with EACCES.
+// Set +x best-effort so the tray actually starts. Inherited from
+// upstream decolua/9router#1080.
+export function chmodSystrayBinAt(runtimeRoot: string, platform: NodeJS.Platform): ChmodResult {
+  const binName = resolveSystrayBinName(platform);
+  if (!binName) return { changed: false, reason: "win32-skip" };
+  const binPath = join(runtimeRoot, "node_modules", SYSTRAY_PACKAGE, "traybin", binName);
+  if (!existsSync(binPath)) return { changed: false, reason: "missing" };
+  try {
+    chmodSync(binPath, 0o755);
+    return { changed: true };
+  } catch {
+    return { changed: false, reason: "chmod-failed" };
+  }
+}
 
 export async function loadSystray(): Promise<(new (...args: unknown[]) => unknown) | null> {
   if (process.platform === "win32") return null; // Windows uses tray.ps1 instead
@@ -15,15 +51,21 @@ export async function loadSystray(): Promise<(new (...args: unknown[]) => unknow
     try {
       installSystray();
     } catch (err) {
+      // Surface failures to stderr instead of staying silent — anyone hitting
+      // a tray problem otherwise has zero diagnostic. (PR #1080)
       console.warn(`[omniroute] tray runtime install failed: ${(err as Error).message}`);
       return null;
     }
   }
+  // Best-effort: ensure the bundled Go binary is executable. Some npm tarballs
+  // drop the +x bit on extraction (observed on macOS).
+  chmodSystrayBinAt(RUNTIME_DIR, process.platform);
   try {
-    const modPath = join(RUNTIME_DIR, "node_modules", "systray2");
+    const modPath = join(RUNTIME_DIR, "node_modules", SYSTRAY_PACKAGE);
     const mod = await import(modPath);
     return (mod.default ?? mod.SysTray ?? mod) as (new (...args: unknown[]) => unknown) | null;
-  } catch {
+  } catch (err) {
+    console.warn(`[omniroute] tray runtime import failed: ${(err as Error).message}`);
     return null;
   }
 }
@@ -37,12 +79,12 @@ function ensureRuntimeDir(): void {
 }
 
 function isInstalled(): boolean {
-  return existsSync(join(RUNTIME_DIR, "node_modules", "systray2", "package.json"));
+  return existsSync(join(RUNTIME_DIR, "node_modules", SYSTRAY_PACKAGE, "package.json"));
 }
 
 function installSystray(): void {
   execSync(
-    `npm install --prefix "${RUNTIME_DIR}" ${SYSTRAY_VERSION} --no-audit --no-fund --silent`,
+    `npm install --prefix "${RUNTIME_DIR}" ${SYSTRAY_SPEC} --no-audit --no-fund --silent`,
     { stdio: ["ignore", "ignore", "pipe"], timeout: 120_000 }
   );
 }
diff --git a/bin/cli/tray/tray.ts b/bin/cli/tray/tray.ts
index f9e3c642e1..502467bc92 100644
--- a/bin/cli/tray/tray.ts
+++ b/bin/cli/tray/tray.ts
@@ -124,6 +124,10 @@ async function initUnixTray(options: TrayOptions): Promise<TrayInstance | null>
   const systray = new SysTray({
     menu: {
       icon: getIconBase64(),
+      // isTemplateIcon: false on darwin — the bundled icon.png is a full-color
+      // RGBA logo; template mode would render it as a solid white square
+      // because macOS template icons only use the alpha channel. (PR #1080)
+      isTemplateIcon: false,
       title: "OmniRoute",
       tooltip: `OmniRoute :${options.port}`,
       items: menuItems.map((it) => ({
@@ -175,6 +179,8 @@ async function initUnixTray(options: TrayOptions): Promise<TrayInstance | null>
     setTooltip: () => {
       /* systray2 does not support runtime tooltip change */
     },
-    destroy: () => systray.kill(),
+    // Pass false so systray2's kill does NOT call process.exit(0) before the
+    // rest of cleanup (server SIGKILL, MITM/tunnel cleanup) runs. (PR #1080)
+    destroy: () => systray.kill(false),
   };
 }
diff --git a/bin/cli/tray/traySystray.mjs b/bin/cli/tray/traySystray.mjs
index bf0b7caee0..4c5bcb3c5e 100644
--- a/bin/cli/tray/traySystray.mjs
+++ b/bin/cli/tray/traySystray.mjs
@@ -100,8 +100,32 @@ export function initSystrayUnix({ port, onQuit, onOpenDashboard, onShowLogs }) {
   return tray;
 }
 
+/**
+ * Resolve the Go systray2 child subprocess PID from a tray instance.
+ * systray2 exposes the spawned binary either as the `_process` field or via a
+ * `process()` accessor depending on version. Returns the numeric PID or null.
+ */
+export function getSystrayChildPid(tray) {
+  if (!tray) return null;
+  try {
+    const proc = tray._process || (typeof tray.process === "function" ? tray.process() : null);
+    if (proc && typeof proc.pid === "number") return proc.pid;
+  } catch {}
+  return null;
+}
+
 export function killSystrayUnix(tray) {
   try {
+    // systray2.kill(false) closes the IPC channel but leaves the Go tray binary
+    // subprocess running, which keeps an orphan NSStatusItem on macOS and blocks
+    // a freshly spawned tray (e.g. on respawn / hide-to-tray) from registering.
+    // SIGKILL the child PID directly first, then close IPC.
+    const pid = getSystrayChildPid(tray);
+    if (pid) {
+      try {
+        process.kill(pid, "SIGKILL");
+      } catch {}
+    }
     tray.kill(false);
   } catch {}
 }
diff --git a/bin/cold-start-bench.sh b/bin/cold-start-bench.sh
new file mode 100755
index 0000000000..f879610712
--- /dev/null
+++ b/bin/cold-start-bench.sh
@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+# bin/cold-start-bench.sh — measure OmniRoute cold-start against the budgets in
+# docs/PERF_BUDGETS.md §5 (container start → HTTP listening ≤ 800 ms; first warm
+# TTFB ≤ 200 ms). Boots the server on a throwaway port, times until
+# /api/health/ping answers 200, measures a warm request, and reports PASS/FAIL.
+set -euo pipefail
+SCRIPT_NAME="cold-start-bench"
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/_ops-common.sh"
+
+usage() {
+  cat <<'EOF'
+Usage: bin/cold-start-bench.sh [--port <n>] [--start-cmd "<cmd>"] [--url <base>]
+                               [--listen-budget-ms <n>] [--ttfb-budget-ms <n>] [-h|--help]
+
+Boots OmniRoute, times cold-start to the first /api/health/ping 200, measures
+warm TTFB, and compares against the PERF_BUDGETS.md §5 budgets
+(listen ≤ 800 ms, TTFB ≤ 200 ms). Exits non-zero if a budget is exceeded.
+
+--url benches an already-running server instead of booting one (skips the boot
+timing; only TTFB is measured).
+EOF
+}
+
+PORT="${PORT:-21987}"
+START_CMD=""
+BASE_URL=""
+LISTEN_BUDGET_MS=800
+TTFB_BUDGET_MS=200
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --port) PORT="${2:?--port needs a value}"; shift 2 ;;
+    --start-cmd) START_CMD="${2:?--start-cmd needs a value}"; shift 2 ;;
+    --url) BASE_URL="${2:?--url needs a value}"; shift 2 ;;
+    --listen-budget-ms) LISTEN_BUDGET_MS="${2:?}"; shift 2 ;;
+    --ttfb-budget-ms) TTFB_BUDGET_MS="${2:?}"; shift 2 ;;
+    -h | --help) usage; exit 0 ;;
+    *) ops_die "unknown argument: $1 (see --help)" ;;
+  esac
+done
+
+ops_require_cmd curl
+
+now_ms() { date +%s%3N; } # ms since epoch (GNU date / Linux)
+ping_ok() { curl -fsS -o /dev/null --max-time 2 "$1/api/health/ping" 2>/dev/null; }
+
+SERVER_PID=""
+cleanup() { [ -n "$SERVER_PID" ] && kill "$SERVER_PID" 2>/dev/null || true; }
+trap cleanup EXIT
+
+if [ -n "$BASE_URL" ]; then
+  ops_log "benching already-running server at $BASE_URL (boot timing skipped)"
+  listen_ms=""
+else
+  BASE_URL="http://127.0.0.1:$PORT"
+  [ -n "$START_CMD" ] || START_CMD="npm start -- --port $PORT"
+  ops_log "booting: $START_CMD"
+  start_ms="$(now_ms)"
+  # shellcheck disable=SC2086
+  PORT="$PORT" $START_CMD >/tmp/omniroute-coldstart.log 2>&1 &
+  SERVER_PID="$!"
+  deadline=$(($(now_ms) + 30000))
+  until ping_ok "$BASE_URL"; do
+    kill -0 "$SERVER_PID" 2>/dev/null || ops_die "server process exited during boot (see /tmp/omniroute-coldstart.log)"
+    [ "$(now_ms)" -gt "$deadline" ] && ops_die "server did not answer /api/health/ping within 30s"
+    sleep 0.05
+  done
+  listen_ms=$(($(now_ms) - start_ms))
+fi
+
+ping_ok "$BASE_URL" || ops_die "server at $BASE_URL is not answering /api/health/ping"
+ttfb_ms="$(curl -fsS -o /dev/null -w '%{time_starttransfer}' "$BASE_URL/api/health/ping" | awk '{printf "%d", $1 * 1000}')"
+
+fail=0
+if [ -n "$listen_ms" ]; then
+  echo "cold-start (start → listening): ${listen_ms} ms (budget ${LISTEN_BUDGET_MS} ms)"
+  [ "$listen_ms" -le "$LISTEN_BUDGET_MS" ] || { echo "FAIL: listen budget exceeded"; fail=1; }
+fi
+echo "warm TTFB:                      ${ttfb_ms} ms (budget ${TTFB_BUDGET_MS} ms)"
+[ "$ttfb_ms" -le "$TTFB_BUDGET_MS" ] || { echo "FAIL: TTFB budget exceeded"; fail=1; }
+[ "$fail" -eq 0 ] && echo "PASS: within cold-start budgets"
+exit "$fail"
diff --git a/bin/restore-data.sh b/bin/restore-data.sh
new file mode 100755
index 0000000000..df907fb732
--- /dev/null
+++ b/bin/restore-data.sh
@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# bin/restore-data.sh — restore the OmniRoute SQLite data volume from a snapshot
+# created by bin/snapshot-data.sh. Used by the data-layer incident runbook
+# (docs/INCIDENT_RESPONSE.md §4.4) after stopping writers.
+#
+# Safety: takes a pre-restore snapshot of the CURRENT data, refuses to run
+# unattended without --yes, and verifies the snapshot before overwriting.
+set -euo pipefail
+SCRIPT_NAME="restore-data"
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/_ops-common.sh"
+
+usage() {
+  cat <<'EOF'
+Usage: bin/restore-data.sh <snapshot-id> [--data-dir <path>] [--yes|-y] [-h|--help]
+
+Restores storage.sqlite (and any sibling *.sqlite) from a snapshot. The current
+data is first copied to $DB_BACKUPS_DIR/pre-restore_<UTC> as a safety net.
+<snapshot-id> is a timestamp/sha, a snapshot dir name, or a path (see snapshot-data.sh).
+Stop OmniRoute before running, and restart it afterwards.
+EOF
+}
+
+ID=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --yes | -y) ASSUME_YES=1; shift ;;
+    --data-dir) ops_set_data_dir "${2:?--data-dir needs a value}"; shift 2 ;;
+    -h | --help) usage; exit 0 ;;
+    -*) ops_die "unknown argument: $1 (see --help)" ;;
+    *) ID="$1"; shift ;;
+  esac
+done
+
+[ -n "$ID" ] || ops_die "snapshot id required (see --help)"
+snap="$(ops_find_snapshot "$ID")"
+ops_log "restore source: $snap → $OMNIROUTE_DATA_DIR"
+ops_confirm "Overwrite storage.sqlite at $OMNIROUTE_DATA_DIR from $snap?" || ops_die "aborted"
+
+# Pre-restore safety copy of the live data.
+if [ -f "$OMNIROUTE_SQLITE" ]; then
+  safety="$OMNIROUTE_BACKUPS_DIR/pre-restore_$(date -u +%Y%m%dT%H%M%SZ)"
+  mkdir -p "$safety"
+  if command -v sqlite3 >/dev/null 2>&1; then
+    sqlite3 "$OMNIROUTE_SQLITE" "VACUUM INTO '$safety/storage.sqlite'" \
+      || cp -a "$OMNIROUTE_SQLITE" "$safety/storage.sqlite"
+  else
+    cp -a "$OMNIROUTE_SQLITE" "$safety/storage.sqlite"
+  fi
+  ops_log "current data saved to $safety"
+fi
+
+mkdir -p "$OMNIROUTE_DATA_DIR"
+# Drop stale WAL/SHM so the restored DB is authoritative, then copy in.
+rm -f "$OMNIROUTE_SQLITE" "${OMNIROUTE_SQLITE}-wal" "${OMNIROUTE_SQLITE}-shm"
+cp -a "$snap/storage.sqlite" "$OMNIROUTE_SQLITE"
+
+# Restore sibling DBs captured in the snapshot.
+for f in "$snap"/*.sqlite; do
+  [ -e "$f" ] || continue
+  [ "$(basename "$f")" = "storage.sqlite" ] && continue
+  cp -a "$f" "$OMNIROUTE_DATA_DIR/"
+done
+
+ops_log "restore complete — restart OmniRoute to pick up the restored data"
diff --git a/bin/restore-policies.sh b/bin/restore-policies.sh
new file mode 100755
index 0000000000..9cf4da03ef
--- /dev/null
+++ b/bin/restore-policies.sh
@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+# bin/restore-policies.sh — restore ONLY the API-key policy tables from a
+# snapshot, leaving request/audit/runtime state intact. Used by the auth-layer
+# incident runbook (docs/INCIDENT_RESPONSE.md §4.3) when policies_active is empty
+# but the rest of the database is healthy (so a full restore-data is overkill).
+#
+# "Policy" tables = api_key* definition tables (the key + its limits/allowed
+# quotas/context sources), EXCLUDING usage counters and reset logs so a restore
+# never rewinds live usage accounting.
+set -euo pipefail
+SCRIPT_NAME="restore-policies"
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/_ops-common.sh"
+
+usage() {
+  cat <<'EOF'
+Usage: bin/restore-policies.sh <snapshot-id> [--data-dir <path>] [--yes|-y] [-h|--help]
+
+Replaces the API-key policy tables (api_key*, excluding *counter* / *_log*) in
+the live DB with the copies from a snapshot, inside one transaction. The live DB
+is snapshotted to $DB_BACKUPS_DIR/pre-policy-restore_<UTC> first. Requires sqlite3.
+EOF
+}
+
+ID=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --yes | -y) ASSUME_YES=1; shift ;;
+    --data-dir) ops_set_data_dir "${2:?--data-dir needs a value}"; shift 2 ;;
+    -h | --help) usage; exit 0 ;;
+    -*) ops_die "unknown argument: $1 (see --help)" ;;
+    *) ID="$1"; shift ;;
+  esac
+done
+
+[ -n "$ID" ] || ops_die "snapshot id required (see --help)"
+ops_require_cmd sqlite3
+snap="$(ops_find_snapshot "$ID")"
+[ -f "$OMNIROUTE_SQLITE" ] || ops_die "no live DB at $OMNIROUTE_SQLITE (use restore-data.sh for a full restore)"
+
+# Policy definition tables present in BOTH the snapshot and the live DB. GLOB
+# keeps `_` literal; we drop usage counters / logs so accounting isn't rewound.
+readarray -t tables < <(
+  sqlite3 "$snap/storage.sqlite" \
+    "SELECT name FROM sqlite_master WHERE type='table' AND name GLOB 'api_key*' \
+       AND name NOT GLOB '*counter*' AND name NOT GLOB '*_log*' ORDER BY name;"
+)
+[ "${#tables[@]}" -gt 0 ] || ops_die "snapshot has no api_key* policy tables"
+
+ops_log "policy tables to restore: ${tables[*]}"
+ops_confirm "Replace ${#tables[@]} policy table(s) in $OMNIROUTE_SQLITE from $snap?" || ops_die "aborted"
+
+# Safety snapshot of the live DB before mutating it.
+safety="$OMNIROUTE_BACKUPS_DIR/pre-policy-restore_$(date -u +%Y%m%dT%H%M%SZ)"
+mkdir -p "$safety"
+sqlite3 "$OMNIROUTE_SQLITE" "VACUUM INTO '$safety/storage.sqlite'"
+ops_log "live DB saved to $safety"
+
+# Replace each policy table inside a single transaction, attaching the snapshot
+# (only tables that also exist in the live DB are touched).
+sql="ATTACH DATABASE '$snap/storage.sqlite' AS snap;
+PRAGMA foreign_keys=OFF;
+BEGIN;"
+for t in "${tables[@]}"; do
+  if [ -n "$(sqlite3 "$OMNIROUTE_SQLITE" "SELECT 1 FROM sqlite_master WHERE type='table' AND name='$t' LIMIT 1;")" ]; then
+    sql="$sql
+DELETE FROM main.\"$t\";
+INSERT INTO main.\"$t\" SELECT * FROM snap.\"$t\";"
+  else
+    ops_log "skipping '$t' — not present in live DB"
+  fi
+done
+sql="$sql
+COMMIT;
+DETACH DATABASE snap;"
+
+printf '%s\n' "$sql" | sqlite3 "$OMNIROUTE_SQLITE"
+ops_log "policies restored from $snap — restart OmniRoute to apply"
diff --git a/bin/rollback.sh b/bin/rollback.sh
new file mode 100755
index 0000000000..41d7bfcd43
--- /dev/null
+++ b/bin/rollback.sh
@@ -0,0 +1,102 @@
+#!/usr/bin/env bash
+# bin/rollback.sh — roll OmniRoute back to a previous release to mitigate a bad
+# deploy. Used by the incident runbook (docs/INCIDENT_RESPONSE.md §3 / §4).
+#
+# Methods (auto-detected; override with --method):
+#   • npm    — `npm install -g omniroute@<version>` and, if PM2 manages it,
+#              `pm2 restart omniroute`. This is how the VPS deploy runs.
+#   • docker — re-tag the local image omniroute:<version> to omniroute:prod and
+#              recreate the prod service from docker-compose.prod.yml. (That
+#              compose builds the `prod` tag locally rather than pulling a
+#              registry tag, so the versioned image must already exist locally.)
+# With no <version>, targets the highest published release strictly below the
+# current package.json version.
+set -euo pipefail
+SCRIPT_NAME="rollback"
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/_ops-common.sh"
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+usage() {
+  cat <<'EOF'
+Usage: bin/rollback.sh [<version>] [--method npm|docker] [--yes|-y] [-h|--help]
+
+Rolls OmniRoute back to <version> (e.g. 3.8.35 or v3.8.35). With no version,
+picks the highest published release below the current package.json version.
+Auto-detects npm vs docker deployment; override with --method.
+EOF
+}
+
+VERSION=""
+METHOD=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --yes | -y) ASSUME_YES=1; shift ;;
+    --method) METHOD="${2:?--method needs npm|docker}"; shift 2 ;;
+    -h | --help) usage; exit 0 ;;
+    -*) ops_die "unknown argument: $1 (see --help)" ;;
+    *) VERSION="${1#v}"; shift ;;
+  esac
+done
+
+if [ -z "$METHOD" ]; then
+  if command -v docker >/dev/null 2>&1 && [ -f "$REPO_ROOT/docker-compose.prod.yml" ] \
+    && docker compose -f "$REPO_ROOT/docker-compose.prod.yml" ps -q 2>/dev/null | grep -q .; then
+    METHOD="docker"
+  elif command -v npm >/dev/null 2>&1; then
+    METHOD="npm"
+  else
+    ops_die "no deploy method detected (no running prod compose, no npm) — pass --method npm|docker"
+  fi
+fi
+
+# Resolve the previous published version when none was given.
+if [ -z "$VERSION" ]; then
+  ops_require_cmd npm
+  ops_require_cmd node
+  current="$(node -p "require('$REPO_ROOT/package.json').version" 2>/dev/null || true)"
+  [ -n "$current" ] || ops_die "cannot read current version from package.json — pass <version>"
+  VERSION="$(npm view omniroute versions --json 2>/dev/null | node -e '
+    let s = "";
+    process.stdin.on("data", (d) => (s += d)).on("end", () => {
+      let vs;
+      try { vs = JSON.parse(s); } catch { vs = []; }
+      if (!Array.isArray(vs)) vs = [vs];
+      const ok = (v) => /^[0-9]+\.[0-9]+\.[0-9]+$/.test(v);
+      const cmp = (a, b) => {
+        const x = a.split(".").map(Number), y = b.split(".").map(Number);
+        return x[0] - y[0] || x[1] - y[1] || x[2] - y[2];
+      };
+      const cur = process.argv[1];
+      const prev = vs.filter(ok).filter((v) => cmp(v, cur) < 0).sort(cmp).pop() || "";
+      process.stdout.write(prev);
+    });
+  ' "$current")"
+  [ -n "$VERSION" ] || ops_die "could not resolve the previous published version — pass <version> explicitly"
+fi
+
+ops_log "target: omniroute@$VERSION via $METHOD"
+ops_confirm "Roll OmniRoute back to $VERSION via $METHOD?" || ops_die "aborted"
+
+case "$METHOD" in
+  npm)
+    ops_require_cmd npm
+    npm install -g "omniroute@$VERSION"
+    if command -v pm2 >/dev/null 2>&1 && pm2 jlist 2>/dev/null | grep -q '"name":"omniroute"'; then
+      pm2 restart omniroute --update-env
+      ops_log "pm2 restarted omniroute"
+    else
+      ops_log "installed omniroute@$VERSION — restart the service to apply (no PM2 'omniroute' process found)"
+    fi
+    ;;
+  docker)
+    ops_require_cmd docker
+    if ! docker image inspect "omniroute:$VERSION" >/dev/null 2>&1; then
+      ops_die "local image omniroute:$VERSION not found — build it from the $VERSION checkout first (this compose builds the 'prod' tag, it does not pull a registry tag)"
+    fi
+    docker tag "omniroute:$VERSION" omniroute:prod
+    docker compose -f "$REPO_ROOT/docker-compose.prod.yml" up -d --no-build
+    ops_log "recreated prod service from omniroute:$VERSION"
+    ;;
+  *) ops_die "unknown method: $METHOD (use npm or docker)" ;;
+esac
+ops_log "rollback to $VERSION complete"
diff --git a/bin/snapshot-data.sh b/bin/snapshot-data.sh
new file mode 100755
index 0000000000..f312a46b9a
--- /dev/null
+++ b/bin/snapshot-data.sh
@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+# bin/snapshot-data.sh — consistent point-in-time snapshot of the OmniRoute data
+# volume (the SQLite store under $DATA_DIR). Used by the data-layer incident
+# runbook (docs/INCIDENT_RESPONSE.md §4.4) before any restore.
+#
+# Output: a directory $DB_BACKUPS_DIR/snapshot_<UTC>[_<label>] holding a
+# `VACUUM INTO` copy of storage.sqlite (consistent even with WAL writers active)
+# plus any sibling *.sqlite files. The snapshot id (the timestamp) is printed on
+# stdout so it can be fed straight to restore-data.sh / restore-policies.sh.
+set -euo pipefail
+SCRIPT_NAME="snapshot-data"
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/_ops-common.sh"
+
+usage() {
+  cat <<'EOF'
+Usage: bin/snapshot-data.sh [--label <name>] [--data-dir <path>] [-h|--help]
+
+Creates a consistent snapshot of the OmniRoute SQLite data under the backups dir
+and prints the snapshot id (UTC timestamp) on stdout.
+
+Env: DATA_DIR (default ~/.omniroute), DB_BACKUPS_DIR (default $DATA_DIR/db_backups).
+EOF
+}
+
+LABEL=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --label) LABEL="${2:?--label needs a value}"; shift 2 ;;
+    --data-dir) ops_set_data_dir "${2:?--data-dir needs a value}"; shift 2 ;;
+    -h | --help) usage; exit 0 ;;
+    *) ops_die "unknown argument: $1 (see --help)" ;;
+  esac
+done
+
+[ -f "$OMNIROUTE_SQLITE" ] || ops_die "no storage.sqlite at $OMNIROUTE_SQLITE (set DATA_DIR?)"
+
+ts="$(date -u +%Y%m%dT%H%M%SZ)"
+id="${ts}${LABEL:+_$LABEL}"
+dest="$OMNIROUTE_BACKUPS_DIR/snapshot_$id"
+mkdir -p "$dest"
+
+if command -v sqlite3 >/dev/null 2>&1; then
+  # VACUUM INTO yields a transactionally-consistent copy under WAL.
+  sqlite3 "$OMNIROUTE_SQLITE" "VACUUM INTO '$dest/storage.sqlite'"
+else
+  ops_log "sqlite3 not found — copying files (stop writers first for a clean copy)"
+  cp -a "$OMNIROUTE_SQLITE" "$dest/storage.sqlite"
+  for ext in -wal -shm; do
+    [ -f "${OMNIROUTE_SQLITE}${ext}" ] && cp -a "${OMNIROUTE_SQLITE}${ext}" "$dest/" || true
+  done
+fi
+
+# Capture sibling SQLite DBs (analytics, etc.) if present.
+for f in "$OMNIROUTE_DATA_DIR"/*.sqlite; do
+  [ -e "$f" ] || continue
+  [ "$(basename "$f")" = "storage.sqlite" ] && continue
+  cp -a "$f" "$dest/" || true
+done
+
+printf '%s\n' "$id"
+ops_log "snapshot created: $dest"
diff --git a/config/quality/file-size-baseline.json b/config/quality/file-size-baseline.json
index 29575e70f9..9fc2e6d628 100644
--- a/config/quality/file-size-baseline.json
+++ b/config/quality/file-size-baseline.json
@@ -1,5 +1,10 @@
 {
   "_comment": "Catraca de tamanho (check-file-size.mjs). frozen so pode encolher; arquivos novos <= cap. --update ratcheta.",
+  "_rebaseline_2026_06_25_4976_ratelimit_400_failover": "Bug fix #4976: a 400 carrying rate-limit text (e.g. MiMoCode 'Detected high-frequency non-compliant requests') was classified as a non-fallbackable generic 400, so MiMo-auto never failed over -> 502 in Cline. open-sse/services/accountFallback.ts 1762->1773 (+11 = a bounded ReDoS-safe RATE_LIMIT_TEXT_PATTERNS array + a single check in the 400 branch returning buildRetryableFallback(RATE_LIMIT_EXCEEDED) at connection-cooldown scope, placed AFTER malformed/overflow detection so a malformed 400 keeps its #2101 MODEL_CAPACITY guard). Irreducible classification wiring at the existing 400 branch; the pattern array is the minimal addition. Covered by tests/unit/accountfallback-ratelimit-400-4976.test.ts (EN+zh rate-limit text -> fallback; generic 400 stays non-fallback; malformed 400 stays MODEL_CAPACITY).",
+  "_rebaseline_2026_06_24_4945_task_aware_router_precedence": "Base-red fix: the #4945 task-aware reordering (reorderByTaskWeight) runs for strategy \"auto\" and was applied AFTER the auto router (selectWithStrategy: lkgp/cost/etc) had already pinned orderedTargets[0], silently defeating the operator's explicit LKGP/cost choice (proven: tests/unit/combo-routing-engine.test.ts 'honors LKGP after filtering to tool-capable models' + 'falls back to the full pool when tool filtering empties candidates' selected gpt-oss-120b — the 1st target — instead of the LKGP/cost winner; instrumentation showed orderedTargets[0]=claude post-filter then gpt-oss post-task-reorder). open-sse/services/combo.ts 3306->3321 (+15 = a one-line `autoUsedExplicitRouter` flag set when the explicit router succeeds, and at the task-aware step: when that flag is set, pin orderedTargets[0] and let task-aware refine only the fallback tail — reorderByTaskWeight returns the same objects so identity filtering is safe). gpt-oss-120b correctly REMAINS tool-capable (model-capabilities-registry.test.ts asserts true), so this is NOT a tool-capability change. Irreducible chokepoint wiring at the existing auto-route boundary; not extractable. Covered by the two combo-routing-engine.test.ts cases above + combo-task-aware.test.ts (task-aware still active for non-router strategies).",
+  "_rebaseline_2026_06_24_per_connection_max_concurrent": "Feature (per-connection max_concurrent enforcement, issue #9 follow-up) own growth: open-sse/services/combo.ts 3225->3238 (+13 net). Provider connections already carry a maxConcurrent ceiling (provider_connections.max_concurrent, migration 029, set in the UI/API/DB) but routing ignored it, so low-concurrency subscription accounts (GLM/MiniMax ~1) got flooded -> 429 + cooldown, worse under quota-share where keys share one account. The new wiring lives at the two combo dispatch chokepoints: (1) the strategy===\"quota-share\" branch resolves each target connection's cap and passes it into selectQuotaShareTarget so an at-cap connection is deprioritized (fail-open, never hard-blocked); (2) handleRoundRobinCombo resolves the target connection's cap and uses it as the semaphore maxConcurrency (fallback = combo-level concurrency). ALL extractable logic was moved into the new pure leaf open-sse/services/combo/concurrencyCaps.ts (resolveMaxConcurrentByConnection + makeConnectionConcurrencyResolver, DB reads deduped per connectionId, fail-open) and the pure effectiveMaxConcurrency resolver into combo/comboPredicates.ts; combo.ts keeps only the irreducible chokepoint wiring (a 5-line import + the two call-site bindings). Cohesive at the existing dispatch boundaries, not further extractable. Structural shrink of combo.ts tracked in #3501. Covered by tests/unit/quota-share-strategy.test.ts (per-connection maxConcurrent gating cases) + tests/unit/combo/effective-max-concurrency.test.ts.",
+  "_rebaseline_2026_06_24_combo_cooldown_wait_quota_share": "Feature quota-share combo cooldown-aware retry (Variante A) own growth: open-sse/services/combo.ts 3225->3293 (+68 = the cooldown-wait wrap inside handleComboChat's quota-share path. The existing setTry loop body is LEFT at its original indentation: instead of an outer `while (true)` (which would re-indent ~1600 lines and bloat the review), the setTry loop is hoisted into a small recursive closure `dispatchWithCooldownRetry`, and a wait+redispatch is a tail `return dispatchWithCooldownRetry()` — re-running ONLY the set loop (exactly the prior continue-to-top-of-set-loop semantics) while selection/shadow-routing/setup above stay untouched. At the 429 crystallization point the lock reason is resolved via getModelLockoutInfo, the decision via the new pure resolveComboCooldownWaitDecision, then await waitForCooldownAwareRetry (499 on abort), decrement the budget, recurse. Gated to strategy==='quota-share' && comboCooldownWait.enabled. `git diff` == `git diff -w` for combo.ts (zero re-indentation noise). The gating policy + reason resolution are extracted to the new pure leaf open-sse/services/combo/comboCooldownRetry.ts (<cap, unit-tested) to keep combo.ts thin; only the wait orchestration (one getModelLockoutInfo lookup + one await) stays at the chokepoint, not extractable. The quota_exhausted/auth/not-found exclusions defend against isRetryableModelLockoutReason (auth.ts:533) treating quota_exhausted as retryable (locked-until-midnight). Covered by tests/unit/combo-cooldown-retry.test.ts (pure helper, all branches) + tests/unit/combo-quota-share-cooldown-wait.test.ts (integration: rate_limit waits+recovers, quota_exhausted no-wait, abort=499, non-quota-share unchanged) + tests/unit/resilience-settings-combo-cooldown-wait.test.ts (settings round-trip/clamp). Also src/app/(dashboard)/dashboard/settings/components/ResilienceTab.tsx 983->1098 (+115 = the ComboCooldownWaitCard exposing enabled/maxWaitMs/maxAttempts/budgetMs in Settings > Resilience, mirroring WaitForCooldownCard; wired through GET/PATCH in src/app/api/resilience/route.ts + comboCooldownWaitSettingsSchema in src/shared/validation/schemas/settings.ts; new UI labels use the t(key)||English-fallback pattern, en-only). Structural shrink of combo.ts + ResilienceTab tracked in #3501.",
+  "_rebaseline_2026_06_24_quota_share_concurrency_limit": "Feature FASE 2.1 (per-connection concurrency limit for quota-share combos) own growth. The quota-share gating in selectQuotaShareTarget is FAIL-OPEN (an at-cap connection is only deprioritized, never hard-blocked), so with a single-connection subscription-account pool concurrent requests still flood the account — empirically proven on the .15 deploy: 3 concurrent share-key calls to one minimax connection with max_concurrent=1 were all dispatched within 94ms. This adds a per-CONNECTION semaphore around the quota-share dispatch so excess concurrent requests WAIT in the queue instead of flooding (key = qsconn:<connectionId>, cap = the connection's max_concurrent; fail-open on a saturated queue/timeout to never worsen availability). open-sse/services/combo.ts 3306->3340 (+34 = the irreducible chokepoint wiring: the quotaShareConcurrencyEnabled gate, the acquire (lookupPositiveCap + acquireQuotaShareConcurrencySlot) around dispatchWithCooldownRetry, the release in the outer finally, and the updated cooldown-wait comment). ALL extractable logic lives in the new pure leaf open-sse/services/combo/quotaShareConcurrency.ts (<cap, unit-tested: key stability, no-cap/empty no-op, genuine serialization, fail-open). src/lib/resilience/settings.ts ->841 (+41 = QuotaShareConcurrencyLimitSettings interface + default {enabled:true} + normalizeQuotaShareConcurrencyLimitSettings + resolve/merge/legacy-fallback wiring; crossed the 800 new-file cap, mirrors the existing comboCooldownWait block). src/app/(dashboard)/dashboard/settings/components/ResilienceTab.tsx 1098->1183 (+85 = QuotaShareConcurrencyLimitCard, a kill-switch toggle mirroring ComboCooldownWaitCard; wired through GET/PATCH in src/app/api/resilience/route.ts + quotaShareConcurrencyLimitSettingsSchema in src/shared/validation/schemas/settings.ts; t(key)||English-fallback, en-only). Covered by tests/unit/combo/quota-share-concurrency.test.ts + tests/unit/resilience-settings-quota-share-concurrency.test.ts. Structural shrink of combo.ts + ResilienceTab tracked in #3501.",
   "_rebaseline_2026_06_23_4774_combo_legacy_strip": "PR #4774 (KooshaPari, #4382 round-trip) own growth: src/app/(dashboard)/dashboard/combos/page.tsx 4434->4456 (+22 = the client-side LEGACY_COMBO_RESILIENCE_KEYS Set gains queueTimeoutMs + the 12 v3.8.31-era removed keys (queueDepth/fallbackDelayMs/handoffProviders/maxComboDepth/manifestRouting/complexityAwareRouting/pipeline_enabled/pipelineConcurrency/shadowRouting/evalRouting/resetAwareEnabled/resetAwareWindow) with explanatory comments, mirroring the server-side strip list in src/app/api/combos/[id]/route.ts so the modal never re-introduces removed keys on Save). Functional strip list, not a movable block; combos/page.tsx structural shrink tracked in #3501. Covered by tests/unit/combo-config.test.ts (auto-promote + passthrough + legacy-key round-trip).",
   "_rebaseline_2026_06_21_4421_node_lookup": "Issue #4421 own growth: src/lib/db/providers.ts 1050->1063 (+13 = resolveProviderNodeForConnection at the existing provider-node lookup — resolves a connection node by exact id OR the bare derived type when unambiguous, + import). Pure selection logic in the new src/lib/db/providerNodeSelect.ts (<cap, unit-tested); cohesive DB wiring next to getProviderNodeById, not extractable. Covered by tests/unit/provider-node-select-4421.test.ts.",
   "_rebaseline_2026_06_21_v3833_release_basered_fixes": "Release v3.8.33: 5 deterministic base-reds inherited from parallel-session merges (fast-gates PR→release não rodam test:unit completo) consertados no PR de release. src/sse/services/auth.ts 2279->2289 (+10): #4530 só fiou maxCooldownMs nos 3 sites de combo.ts; os 4 sites de markAccountUnavailable (per-model quota, grok-web 403, per-model 403, local 404) nunca passavam o cap → resolvo mlSettings uma vez e passo maxCooldownMs em todos. tests/unit/db-core-init.test.ts 864->867 (+3): comentário explicando o cap intencional busy_timeout 5s->2s do v3.8.32. Wiring necessário ao chokepoint de lockout; não extraível. Coberto por model-lockout-max-cooldown.test.ts + db-core-init.test.ts. (Demais base-reds — áudio mp3 #912/#913 dedup de handler em geminiHelper.ts, e closure #3578 src/models/ no package.json files — não cresceram arquivo congelado.)",
@@ -8,6 +13,7 @@
   "_rebaseline_2026_06_21_4481_websearch_routing": "Feature #4481 layer 2 own growth: src/sse/handlers/chat.ts 1491->1513 (+22 = the CCR-style web-search routing hook at the request entrypoint, right after the T05 task-aware-routing block — a 5-line comment + one `if (hasNativeWebSearchTool(body)) { ... }` guard that reads getCachedSettings only when a web_search tool is present and overrides resolvedModelStr/body.model via the pure helper, plus a 4-line import). When a request carries a native web_search server tool and the operator set `webSearchRouteModel`, the whole request routes to that model instead of the default (some providers, e.g. MiniMax, don't implement Anthropic's web_search_20250305 server tool). The detection + override logic lives in the new pure leaf open-sse/services/webSearchRouting.ts (no DB, unit-testable); chat.ts is thin wiring mirroring the adjacent T05 override. Lands BEFORE auto/combo resolution + the layer-1 webSearchFallback so the target's own format/fallback handling applies. Not extractable further (it IS the entrypoint wiring). Covered by tests/unit/web-search-tool-routing-4481.test.ts. Structural shrink of this handler tracked separately.",
   "_rebaseline_2026_06_21_4483_auto_quota_cutoff": "PR #4483 (megamen32) own growth + review fix: open-sse/services/combo.ts 2611->2623 (+12). The PR adds an auto-routing hard quota cutoff in buildAutoCandidates (evaluateQuotaCutoff + buildAutoQuotaThresholds/clampPercent/asThresholdMap/quotaWindowLookupNames helpers) that drops low-quota candidates before scoring, plus a 429 guard when all candidates are below cutoff. On review (owner decision) the cutoff was made OPT-IN behind a new QuotaPreflightSettings.enabled flag (default OFF via QUOTA_PREFLIGHT_CUTOFF_ENABLED) so default behavior is unchanged, and the `...eligibleTargets` last-resort fallback the PR removed was restored (dedupe makes it identical to pre-cutoff when OFF; when ON a blocked target survives as final fallback rather than vanishing). Cohesive at the existing candidate-build/select chokepoints; not extractable. Covered by tests/unit/combo/auto-quota-cutoff.test.ts + tests/unit/resilience-settings-quota-preflight.test.ts (default-off + opt-in round-trip).",
   "_rebaseline_2026_06_21_4475_target_format_badge": "PR #4475 (adivekar-utexas) review: src/app/(dashboard)/dashboard/providers/[id]/providerPageHelpers.ts 955->974 (+19). Extracted the pure targetFormatBadgeI18nKey (the 6 targetFormat value->i18n-key mapping) out of the CustomModelsSection.tsx badge so it is unit-testable outside the .tsx (Rule #18 gap — the PR had no UI test). The .tsx now calls the helper instead of an inline if-chain. This leaf is the strangler-fig home for pure provider-page helpers (#3501), so receiving the extraction is on-purpose. Covered by tests/unit/provider-target-format-badge-4475.test.ts.",
+  "_rebaseline_2026_06_22_port_730_alias_backed_models": "Port of decolua/9router#730 own growth: src/app/api/v1/models/catalog.ts 1493->1574 (+81 = one import + one alias-backed walk after the customModels block, mirroring the existing static/custom emission path: resolve canonical providerId, gate on blocked/active/hidden, push aliasId + optional canonical providerPrefixedId with the same vision-fields enrichment). Surfaces models registered ONLY through the modelAliases key_value namespace (value = \"<providerKey>/<modelId>\", e.g. setModelAlias(\"kimi-k2.6\", \"custom/kimi-k2.6\")) so compatible-provider entries that resolve at request time but were silently dropped from /v1/models are now discoverable by OpenAI clients. Pair-extract is in the new pure leaf src/app/api/v1/models/aliasBackedModels.ts (no DB import, unit-testable via tests/unit/v1-models-aliases-included.test.ts). Cohesive wiring next to the other per-source push blocks; not extractable further without hiding the per-source dedupe boundary. Structural shrink of this god-file tracked in #3789.",
   "_rebaseline_2026_06_21_4424_exact_dup_dedupe": "Feature #4424 follow-up own growth: src/app/api/v1/models/catalog.ts 1486->1493 (+7 = the final exact-duplicate-id guard at the existing finalModels chokepoint — one import + a 4-line comment + one `finalModels = dedupeExactCatalogIds(finalModels)` call). #4427 added the opt-in prefix mode but the catalog still emitted 3 exact-duplicate ids (codex/gpt-5.5, veo-free/seedance, veo-free/veo each listed twice) because they originate from different push sources whose local guards don't see each other. The collapse logic lives in the new pure leaf src/app/api/v1/models/catalogDedupe.ts (no DB import, unit-testable). Keyed by listing identity (id, type, subtype) so the intentional same-id audio transcription/speech pair is preserved; keep-first, order-preserving, independent of MODELS_CATALOG_PREFIX_MODE. Thin cohesive wiring at the single serialization boundary; not extractable further. Covered by tests/unit/models-catalog-exact-dup-4424.test.ts. Structural shrink of this god-file tracked in #3789.",
   "_rebaseline_2026_06_21_4427_low_noise_catalog": "PR #4427 (Rahulsharma0810) own growth: src/app/api/v1/models/catalog.ts 1478->1486 (+8). The opt-in MODELS_CATALOG_PREFIX_MODE (dual default | alias | canonical, with ?prefix= per-request override) gates the dual alias+canonical model emission at the three /v1/models push sites (static, synced, custom) behind includeAlias/includeCanonical, suppressing the duplicate cross-prefix entries (net +3 from the feature). On review, 4 incidental explanatory comments removed by the PR were restored (synced-models resolve, skip-static, try-block intent, strip-modelIdPrefix; +5) since their code is unchanged — useful docs on a non-trivial catalog function. Default `dual` keeps byte-identical output; request-side alias resolution unchanged. Structural shrink of this route tracked in #3789. Covered by tests/unit/models-catalog-low-noise-flag.test.ts.",
   "_rebaseline_2026_06_21_phase2_active_selector": "Compression Phase 2 (named profiles + active selector) own growth: chatCore.ts 5110->5125 (+15 at the existing compression-dispatch chokepoint, just before the selectCompressionStrategy call). chatCore now loads the operator's named compression combos once into a `namedCombos` map (a best-effort try/catch dynamic-import of listCompressionCombos, debug-logged on failure) and passes it as the new `combos` arg to selectCompressionStrategy + selectCompressionPlan, plus an `&& !activeComboResolves(config, namedCombos)` guard term on the legacy default-combo block so the seeded default cannot shadow the operator's active profile. The resolver itself stays pure (the `combos` threading + activeComboResolves live in open-sse/services/compression/strategySelector.ts, <cap). The two UI files net SHRINK or stay flat: CompressionHub.tsx 521->277 (master toggle/mode/reorder removed, replaced by the thin active-profile selector + preview) and CompressionCombosPageClient.tsx grows a few lines under its frozen for the active badge. Cohesive wiring at the existing compression chokepoint, mirroring the prior compression rebaselines (#4217/#4210/#3890); not extractable without hiding the dispatch boundary. Structural shrink of chatCore.ts tracked in #3501. Covered by tests/unit/compression/active-combo-dispatch.test.ts + active-combo-integration.test.ts + tests/unit/ui/compressionHub-active-selector.test.tsx + namedCombos-active-badge.test.tsx.",
@@ -18,6 +24,7 @@
   "_rebaseline_2026_06_20_4023_web_cookie_noauth_validation": "PR #4023 (oyi77) own growth: src/lib/providers/validation.ts 4450->4518 (+68 = a new validateWebCookieProvider that probes the provider's /models endpoint — 401/403 => AUTH_007 SESSION_EXPIRED, any other status => valid session, empty cookie => invalid, provider-not-in-registry => unsupported — plus a local STANDARD_USER_AGENT const for the probe). Cohesive validator at the validateProviderApiKey dispatch; not extractable. Covered by tests/unit/provider-validation-web-cookie-auth007.test.ts. Heavily curated on merge — the PR's branch was badly stale-based (squash-base-stale), so its tree was DESTRUCTIVE: providers/index.ts deleted live providers openadapter/dit/tokenrouter (added by #4313) and the executor/base.ts edits reverted release fixes (#4037 duckduckgo host, theoldllm gpt5 models, base.ts fetch-start-timeout). Only the purely-additive validation feature was kept (validation.ts validateWebCookieProvider + errorCodes AUTH_007 + the test). Dropped: 5 malformed new registry entries (used non-RegistryEntry fields defaultModel/auth + referenced non-existent executors -> tsc TS2353), the destructive providers/index.ts + executor reverts, the unrelated pr-*.sh automation scripts, and evals/types.ts (belongs to the deferred evals modularization #4422). Also removed the PR's fragile 'Phase 2' executor probe (ran a live upstream chat during validation + classified any 'auth'-containing error as SESSION_EXPIRED) and rewrote the test to install its fetch mock before module load (the original mocked too late and silently hit live chatgpt.com).",
   "_rebaseline_2026_06_20_1308_model_lockout_honors_reset": "port from 9router#1308 own growth: open-sse/services/accountFallback.ts 1731->1752 (+21 = the new exported pure helper selectLockoutCooldownMs + its doc comment — picks the parsed upstream reset as the model-lockout exactCooldownMs when it exceeds the base cooldown, e.g. Antigravity \"Resets in 160h\", else preserves the existing 0/base behavior) and open-sse/executors/antigravity.ts 1680->1686 (this PR +1 = parseRetryFromErrorMessage regex `reset` -> `resets?` so plural \"Resets in 160h27m24s\" matches, plus a comment line; frozen set to the SUM 1686 with the concurrent #1944 which adds +5 at the disjoint passthroughFields region of the same file, so either merge order passes — pair-file rule). The combo lockout call sites in combo.ts now pass selectLockoutCooldownMs(cooldownMs, mlSettings) instead of always base/exponential, so an exhausted model honors the real upstream reset instead of being retried within minutes. Both edits are cohesive at the existing lockout/parse chokepoints; the helper is its own pure function (not extractable further). Covered by tests/unit/combo-model-lockout-honors-reset-1308.test.ts.",
   "_rebaseline_2026_06_20_1944_antigravity_strip_output_config": "port from 9router#1944: open-sse/executors/antigravity.ts frozen set to the measured cumulative 1687 of two concurrent PRs that touch disjoint regions of this file, so either merge order passes (pair-file rule). #1944 adds +6 at the envelope passthroughFields destructuring (~line 759: drop output_config/output_format — Anthropic/Claude-Code-only fields that Google's Cloud Code envelope rejects with `400 Unknown name \"output_config\"`, which broke every Claude model on Antigravity); #1308 adds +1 at parseRetryFromErrorMessage (~line 889: regex reset->resets?). Base 1680 + 6 + 1 = 1687 (re-measured on the real merge tip — the earlier 1686 estimate was off by one). Both edits are cohesive at their chokepoints; not extractable. Covered by tests/unit/antigravity-strip-output-config-1944.test.ts.",
+  "_rebaseline_2026_06_22_779_copilot_agent_antigravity_parity": "port from 9router#779 (@lukmanfauzie): open-sse/executors/antigravity.ts 1696->1721 (+25 = MAX_ANTIGRAVITY_OUTPUT_TOKENS constant + doc + final cap branch inside applyAntigravityGenerationDefaults + test-only export). Hard-caps generationConfig.maxOutputTokens at 16384 so VS Code GitHub Copilot Chat in Agent mode (which routinely requests 32K–65K tokens) stops triggering Antigravity upstream HTTP 400 'Invalid Argument'. The remaining items in upstream #779 (recursive JSON-schema sanitization, sanitizeFunctionName, $comment/enumDescriptions, functionResponse name resolution, VALIDATED mode) are already covered by OmniRoute's existing geminiHelper/geminiToolsSanitizer/openai-to-gemini pipeline — the cap is the only delta missing here. Cohesive guard at the existing generation-defaults chokepoint; not extractable. Covered by tests/unit/copilot-agent-antigravity-parity.test.ts.",
   "_rebaseline_2026_06_21_1926_antigravity_strip_thinking": "port from 9router#1926 (upstream fix PR decolua/9router#1949 by @Arcfoz): open-sse/executors/antigravity.ts 1687->1696 (+9 = 4 comment lines + 5 more destructured keys at the SAME envelope passthroughFields chokepoint the #1944 fix already owns). The unified thinking adapter can set Claude/OpenAI-native thinking fields (`thinking`, `reasoning_effort`, `reasoning`, `enable_thinking`, `thinking_budget`) at the body root; the envelope spreads `...passthroughFields`, so they leaked into the Google Cloud Code envelope and Google rejected the request with `400 Bad input: oneOf at '/' not met` (or `Unknown name \"thinking\"`), breaking every reasoning/thinking model served via Antigravity (e.g. claude-opus-4-x-thinking). Extends the existing destructuring strip to drop the whole thinking family. Cohesive at the same chokepoint as #1944; not extractable. Single PR (no concurrent pair-file this time). Covered by tests/unit/antigravity-strip-thinking-fields-1926.test.ts.",
   "_rebaseline_2026_06_20_1311_echo_requested_model": "port from 9router#1311 own growth: src/app/(dashboard)/dashboard/settings/components/RoutingTab.tsx 1580->1594 (+14 = one Settings → Routing card with a Toggle bound to the opt-in `echoRequestedModelName` setting, mirroring the adjacent LKGP/auto-routing toggles). When enabled, the response `model` field echoes the client-requested alias/combo name instead of the upstream model, so strict clients (Claude Desktop) that validate response.model === request.model stop rejecting with 401. The actual rewrite logic lives in the new pure leaf open-sse/services/responseModelEcho.ts (<cap, TDD'd); chatCore wires it at the non-streaming return + the final streaming pipe stage. chatCore.ts 5128->5137 reconciled after merging the current release base (base grew chatCore 5095->5120 via parallel merges; +~17 for the echoModel read + the two wiring chokepoints). The card is cohesive presentational wiring next to the existing toggles; not extractable. Covered by tests/unit/response-model-echo-1311.test.ts.",
   "_rebaseline_2026_06_21_4510_web_fetch_tool": "PR #4510 (@ponkcore) own growth: open-sse/mcp-server/schemas/tools.ts 1437->1497 (+60 = the omniroute_web_fetch tool definition — input/output Zod schema + description — added to MCP_TOOLS, mirroring omniroute_web_search) and open-sse/mcp-server/server.ts 1509->1555 (+46 = handleWebFetch handler + registerTool wiring with withScopeEnforcement scope execute:search + logToolCall/mcp_audit). Reconciled late: #4510 was MERGEABLE and squash-merged into release/v3.8.33; the quality.yml fast-gate on the PR did not flag file-size (it surfaced on the full tree check post-merge). Both edits are cohesive at the existing MCP tool-definition / tool-registration chokepoints, identical shape to the adjacent web_search tool; not extractable. Covered by tests/unit/mcp-web-fetch-tool.test.ts.",
@@ -81,6 +88,7 @@
   "_rebaseline_2026_06_15_3877_byteplus": "Issue #3877 own growth: providerRegistry.ts 4708->4730 (+22 = a byteplus (BytePlus ModelArk) registry entry — OpenAI-compatible, Ark base ap-southeast-1, Bearer, 4 seed models — modeled on the volcengine entry; byteplus was in APIKEY_PROVIDERS but unregistered here so validation returned {unsupported:true}). Cohesive provider registration; not extractable.",
   "_rebaseline_2026_06_15_3910_nested_combo_ctx": "PR #3910 net +1: providerRegistry.ts 4730->4731 (test-registry contextLength metadata for the nested combo-ref LCD regression test). opencode-plugin-only behavioral change; no core routing/virtualFactory touched.",
   "_rebaseline_2026_06_15_3929_vertex_media": "PR #3929 own growth: audioSpeech.ts 952->965 (+13) and videoGeneration.ts 1026->1078 (+52) = vertex/* media branches (Gemini TTS, Veo predictLongRunning poll) wired into the speech/video handlers; new logic lives in open-sse/executors/vertexMedia.ts (341, under cap). Cohesive media-provider feature.",
+  "_rebaseline_2026_06_23_4569_googleflow_video": "Issue #4569 net +5: videoGeneration.ts 1077->1083 = the google-flow dispatch branch + a single handler import. The whole Google Flow handler (145 lines) lives in the new co-located open-sse/handlers/videoGeneration/googleFlowHandler.ts (under cap) and the pure transforms in videoGeneration/googleFlow.ts; only the wiring remains in the god-file. Extracted-not-inlined; not further shrinkable.",
   "_rebaseline_2026_06_15_3879_redact_thinking": "PR #3879 + #3921 reconcile: AddApiKeyModal.tsx 843->845 (+2 = merging #3879's CcCompatibleRequestDefaultsFields (context1m + opt-in redact-thinking toggle) into #3921's preset-input block in the cc-compatible settings group). Cohesive UI; not extractable.",
   "_rebaseline_2026_06_15_3890_cache_preserve": "Issue #3890 own growth: chatCore.ts 5815->5823 (+8 = wire resolveCacheAwareConfig() into the compression apply step so the system prompt is never compressed in a caching context — honors the cache-aware skipSystemPrompt flag that selectCompressionStrategy could not carry). Cohesive cache-preservation guard at the existing compression chokepoint; not extractable.",
   "_rebaseline_2026_06_16_3974_toolsearch_beta": "Issue #3974 own growth: base.ts 1218->1222 (+4 = wrap selectBetaFlags() with mergeClientAnthropicBeta() at the ccHeaders anthropic-beta callsite, plus a 3-line comment, so the client's allowlisted tool-search beta survives). The shared helper + allowlist live in anthropicHeaders.ts (small file, well under cap); default.ts also gains the merge. Cohesive one-callsite fix; not extractable.",
@@ -109,11 +117,11 @@
   "frozen": {
     "_rebaseline_pr1043_minimax_tts": "Upstream port decolua/9router#1043 (toanalien) own growth: audioSpeech.ts 965->1061 (+96). Adds MiniMax T2A v2 TTS dispatch (handleMinimaxSpeech + hexToBytes helper) — provider entry was already in audioRegistry (format: minimax-tts) but no handler existed, falling through to the OpenAI-compatible default that fails (T2A has custom shape + hex-encoded audio + base_resp envelope). New branch sits next to the other inline provider branches (xiaomi-mimo, coqui, tortoise, aws-polly) — extracting would just create indirection. Covered by tests/unit/minimax-tts-1043.test.ts (3 tests, GREEN: success, base_resp error, invalid-hex).",
     "open-sse/config/providerRegistry.ts": 4731,
-    "open-sse/executors/antigravity.ts": 1696,
-    "open-sse/executors/base.ts": 1414,
+    "open-sse/executors/antigravity.ts": 1735,
+    "open-sse/executors/base.ts": 1416,
     "open-sse/executors/chatgpt-web.ts": 2870,
     "open-sse/executors/claude-web.ts": 1057,
-    "open-sse/executors/codex.ts": 1449,
+    "open-sse/executors/codex.ts": 1528,
     "open-sse/executors/cursor.ts": 1453,
     "open-sse/executors/deepseek-web.ts": 1148,
     "_rebaseline_2026_06_22_4644_deepseek_web_tools": "PR #4644 (BugsBag/robust deepseek-web tool-call parsing): open-sse/executors/deepseek-web.ts 1117->1125 (+8). The new agentic tool-call path emits surrounding text + reasoning before tool_calls and swaps to the dedicated deepseekWebTools.ts parser; the +8 lines are cohesive wiring at the existing transformSSE chokepoint (the parser itself lives in the new deepseekWebTools.ts file, already under cap). The PR's own fast-gate (PR->release) does not run check:file-size, so this surfaced only at release reconcile. Covered by tests/unit/deepseek-web-tools-variants.test.ts + deepseek-web-tools-execute.test.ts.",
@@ -128,36 +136,39 @@
     "open-sse/handlers/responseSanitizer.ts": 1103,
     "open-sse/handlers/search.ts": 1546,
     "open-sse/handlers/sseParser.ts": 830,
-    "open-sse/handlers/videoGeneration.ts": 1078,
+    "open-sse/handlers/videoGeneration.ts": 1083,
     "open-sse/mcp-server/schemas/tools.ts": 1497,
     "open-sse/mcp-server/server.ts": 1555,
     "open-sse/mcp-server/tools/advancedTools.ts": 1118,
-    "open-sse/services/accountFallback.ts": 1762,
+    "open-sse/services/accountFallback.ts": 1773,
     "open-sse/services/batchProcessor.ts": 828,
     "open-sse/services/browserBackedChat.ts": 850,
     "open-sse/services/claudeCodeCompatible.ts": 1202,
     "_rebaseline_pr4592_exclude_exhausted_auto": "Reconcile #4592 already-merged growth: combo.ts 2991->3036 (+45, terminal-status quota-cutoff exclusion in buildAutoCandidates + opt-in gate). Fast-gate PR->release does not run check:file-size.",
-    "open-sse/services/combo.ts": 3036,
+    "_rebaseline_2026_06_24_headroom_strategy": "Headroom-aware connection selection (dario technique): combo.ts 3168->3180 (+12 = a new `else if (strategy === \"headroom\")` dispatch branch in handleComboChat that delegates to orderTargetsByHeadroom + its log line, plus the import). The actual logic lives OUT of the god-file: the pure ranker rankByHeadroom/computeHeadroom is the new leaf open-sse/services/combo/headroomRanking.ts (91 LOC, <cap) and the async orderer orderTargetsByHeadroom is appended to the existing open-sse/services/combo/quotaStrategies.ts (<cap) next to its sibling reset-aware/reset-window orderers (reuses their connection-expansion machinery). headroom = 1 - max(util_5h, util_7d) from getSaturation (src/lib/quota/saturationSignals.ts), prefers the connection with the most free capacity. Only the dispatch wiring is irreducible at the existing combo strategy chokepoint (mirrors the reset-aware/reset-window/context-optimized branches); not extractable without hiding the call site. fill-first stays default; all existing strategies untouched. Covered by tests/unit/combo-headroom-ranking.test.ts (pure helper) + tests/unit/combo-headroom-strategy.test.ts (orderer, saturation injected). Structural shrink of combo.ts tracked in #3501.",
+    "_rebaseline_2026_06_24_quota_share_strategy": "Dedicated quota-share strategy (Phase 3 #9): combo.ts 3180->3190 (+10 = one new `else if (strategy === \"quota-share\")` dispatch branch in handleComboChat that delegates 100% to selectQuotaShareTarget + its log line, plus the import). All the new logic lives OUT of the god-file in two new leaves under open-sse/services/combo/: quotaShareInflight.ts (in-flight counter with TTL/lease, ~150 LOC <cap) and quotaShareStrategy.ts (per-model bucket gating via isBucketSaturated + DRR proportional to weight + P2C over in-flight, ~240 LOC <cap). Only the dispatch wiring is irreducible at the existing combo strategy chokepoint (mirrors the headroom/reset-aware/reset-window/context-optimized branches); not extractable without hiding the call site. ZERO existing strategy cases were modified — only this branch was added, and the qtSd/ combos switched from fill-first to quota-share in src/lib/quota/quotaCombos.ts. Covered by tests/unit/quota-share-strategy.test.ts (gating, DRR fairness, P2C in-flight, fail-open, activation). Structural shrink of combo.ts tracked in #3501.",
+    "_rebaseline_2026_06_24_task_aware_routing": "Task-aware routing strategy (port PR #2045, OmniRoute #4945): combo.ts 3190->3225 (+35) = one new `else if (strategy === \"task-aware\")` dispatch branch delegating 100% to selectTaskAwareTarget + its imports/log lines. All scoring/classification logic lives OUT of the god-file in the new leaf open-sse/services/taskAwareRouting.ts (553 LOC <cap). Only the dispatch wiring is irreducible at the existing combo strategy chokepoint (mirrors quota-share/headroom/reset-aware branches). ZERO existing strategy cases modified. Covered by tests/unit/combo-task-aware.test.ts (35 tests). Structural shrink of combo.ts tracked in #3501.",
+    "open-sse/services/combo.ts": 3368,
     "open-sse/services/compression/strategySelector.ts": 848,
     "open-sse/services/rateLimitManager.ts": 1035,
-    "open-sse/services/tokenRefresh.ts": 1997,
-    "open-sse/services/usage.ts": 3450,
-    "open-sse/translator/request/openai-to-gemini.ts": 864,
+    "open-sse/services/tokenRefresh.ts": 2070,
+    "open-sse/services/usage.ts": 3454,
+    "open-sse/translator/request/openai-to-gemini.ts": 870,
     "open-sse/translator/request/openai-to-kiro.ts": 807,
-    "open-sse/translator/response/openai-responses.ts": 922,
+    "open-sse/translator/response/openai-responses.ts": 923,
     "open-sse/utils/cursorAgentProtobuf.ts": 1521,
     "open-sse/utils/stream.ts": 2710,
     "src/app/(dashboard)/dashboard/HomePageClient.tsx": 1385,
-    "src/app/(dashboard)/dashboard/analytics/ComboHealthTab.tsx": 1020,
+    "src/app/(dashboard)/dashboard/analytics/ComboHealthTab.tsx": 1028,
     "src/app/(dashboard)/dashboard/api-manager/ApiManagerPageClient.tsx": 2983,
     "src/app/(dashboard)/dashboard/cache/media/MediaPageClient.tsx": 1105,
-    "src/app/(dashboard)/dashboard/cache/page.tsx": 841,
+    "src/app/(dashboard)/dashboard/cache/page.tsx": 845,
     "src/app/(dashboard)/dashboard/cli-code/components/CodexToolCard.tsx": 900,
     "src/app/(dashboard)/dashboard/cloud-agents/page.tsx": 922,
-    "src/app/(dashboard)/dashboard/combos/page.tsx": 4456,
+    "src/app/(dashboard)/dashboard/combos/page.tsx": 4485,
     "src/app/(dashboard)/dashboard/costs/CostOverviewTab.tsx": 1495,
     "src/app/(dashboard)/dashboard/costs/quota-share/components/PoolWizard.tsx": 1007,
-    "src/app/(dashboard)/dashboard/endpoint/EndpointPageClient.tsx": 2570,
+    "src/app/(dashboard)/dashboard/endpoint/EndpointPageClient.tsx": 2612,
     "src/app/(dashboard)/dashboard/health/page.tsx": 1091,
     "src/app/(dashboard)/dashboard/playground/components/tabs/ApiTab.tsx": 847,
     "src/app/(dashboard)/dashboard/providers/[id]/ProviderDetailPageClient.tsx": 784,
@@ -170,37 +181,38 @@
     "src/app/(dashboard)/dashboard/providers/[id]/providerPageHelpers.ts": 974,
     "src/app/(dashboard)/dashboard/providers/components/onboarding/ProviderOnboardingWizard.tsx": 906,
     "src/app/(dashboard)/dashboard/providers/page.tsx": 1927,
-    "src/app/(dashboard)/dashboard/runtime/RuntimePageClient.tsx": 1198,
+    "src/app/(dashboard)/dashboard/runtime/RuntimePageClient.tsx": 1201,
     "src/app/(dashboard)/dashboard/settings/components/AppearanceTab.tsx": 819,
     "src/app/(dashboard)/dashboard/settings/components/ComboDefaultsTab.tsx": 846,
     "src/app/(dashboard)/dashboard/settings/components/CompressionSettingsTab.tsx": 974,
     "src/app/(dashboard)/dashboard/settings/components/MemorySkillsTab.tsx": 898,
     "src/app/(dashboard)/dashboard/settings/components/PricingTab.tsx": 1012,
     "src/app/(dashboard)/dashboard/settings/components/ProxyRegistryManager.tsx": 1089,
-    "src/app/(dashboard)/dashboard/settings/components/ResilienceTab.tsx": 983,
+    "src/app/(dashboard)/dashboard/settings/components/ResilienceTab.tsx": 1183,
     "src/app/(dashboard)/dashboard/settings/components/RoutingTab.tsx": 1629,
     "src/app/(dashboard)/dashboard/settings/components/SystemStorageTab.tsx": 1924,
     "src/app/(dashboard)/dashboard/usage/components/BudgetTab.tsx": 1016,
     "src/app/(dashboard)/dashboard/usage/components/EvalsTab.tsx": 2148,
     "src/app/(dashboard)/dashboard/usage/components/ProviderLimits/index.tsx": 1121,
-    "src/app/api/oauth/[provider]/[action]/route.ts": 918,
+    "src/app/api/oauth/[provider]/[action]/route.ts": 924,
     "src/app/api/providers/[id]/models/route.ts": 2590,
-    "src/app/api/providers/[id]/test/route.ts": 917,
+    "src/app/api/providers/[id]/test/route.ts": 924,
     "src/app/api/usage/analytics/route.ts": 941,
-    "src/app/api/v1/models/catalog.ts": 1493,
+    "src/app/api/v1/models/catalog.ts": 1615,
     "src/lib/cloudflaredTunnel.ts": 934,
     "src/lib/db/apiKeys.ts": 1662,
     "src/lib/db/core.ts": 1825,
     "src/lib/db/migrationRunner.ts": 1125,
     "src/lib/db/models.ts": 1259,
     "src/lib/db/providers.ts": 1063,
-    "src/lib/db/proxies.ts": 1048,
-    "src/lib/db/settings.ts": 1149,
-    "src/lib/db/usageAnalytics.ts": 873,
+    "src/lib/db/proxies.ts": 1060,
+    "src/lib/db/settings.ts": 1151,
+    "src/lib/db/usageAnalytics.ts": 925,
     "src/lib/evals/evalRunner.ts": 961,
     "src/lib/memory/retrieval.ts": 1171,
     "src/lib/modelsDevSync.ts": 934,
-    "src/lib/providers/validation.ts": 4522,
+    "src/lib/providers/validation.ts": 4523,
+    "src/lib/resilience/settings.ts": 841,
     "src/lib/tailscaleTunnel.ts": 1202,
     "src/lib/usage/callLogs.ts": 975,
     "src/lib/usage/providerLimits.ts": 950,
@@ -210,12 +222,12 @@
     "src/shared/components/analytics/charts.tsx": 1558,
     "src/shared/constants/cliTools.ts": 875,
     "src/shared/constants/pricing.ts": 1662,
-    "src/shared/constants/providers.ts": 3254,
+    "src/shared/constants/providers.ts": 3276,
     "src/shared/constants/sidebarVisibility.ts": 1100,
     "src/shared/services/cliRuntime.ts": 1090,
     "src/shared/validation/schemas.ts": 2523,
-    "src/sse/handlers/chat.ts": 1516,
-    "src/sse/services/auth.ts": 2289
+    "src/sse/handlers/chat.ts": 1525,
+    "src/sse/services/auth.ts": 2328
   },
   "testCap": 800,
   "testFrozen": {
@@ -228,7 +240,7 @@
     "tests/unit/cc-compatible-provider.test.ts": 1179,
     "tests/unit/chatcore-sanitization.test.ts": 829,
     "tests/unit/chatcore-translation-paths.test.ts": 2810,
-    "tests/unit/chatgpt-web.test.ts": 2809,
+    "tests/unit/chatgpt-web.test.ts": 2855,
     "tests/unit/combo-routing-engine.test.ts": 3213,
     "tests/unit/combo-strategy-fallbacks.test.ts": 880,
     "tests/unit/db-core-init.test.ts": 867,
@@ -239,11 +251,12 @@
     "tests/unit/executor-codex.test.ts": 1339,
     "tests/unit/executor-default-base.test.ts": 1339,
     "tests/unit/grok-web.test.ts": 2437,
-    "tests/unit/image-generation-handler.test.ts": 1996,
+    "tests/unit/image-generation-handler.test.ts": 2019,
     "tests/unit/model-sync-route.test.ts": 1016,
     "tests/unit/models-catalog-route.test.ts": 1507,
     "_rebaseline_pr4561_qwen_oauth_url": "Reconcile #4561 (port decolua/9router#683) already-merged growth: oauth-providers-config.test.ts 855->867 (+12, qwen.ai URL regression-pin test). Fast-gate PR->release does not run check:file-size, so this surfaced post-merge.",
-    "tests/unit/oauth-providers-config.test.ts": 867,
+    "_rebaseline_basered_codebuddy_cn": "Base-red fix (#4664 CodeBuddy CN): oauth-providers-config.test.ts 867->870 (+3) to align the EXPECTED provider list/config with the codebuddy-cn provider that #4664 added to the registry without updating this test (it asserts 'exactly once').",
+    "tests/unit/oauth-providers-config.test.ts": 870,
     "tests/unit/perplexity-web.test.ts": 959,
     "tests/unit/provider-models-route.test.ts": 1618,
     "tests/unit/provider-validation-specialty.test.ts": 2752,
@@ -256,7 +269,7 @@
     "tests/unit/stream-utils.test.ts": 2435,
     "tests/unit/token-refresh-service.test.ts": 1322,
     "tests/unit/translator-friendly-test-bench.test.tsx": 848,
-    "tests/unit/translator-helper-branches.test.ts": 850,
+    "tests/unit/translator-helper-branches.test.ts": 870,
     "tests/unit/translator-openai-responses-req.test.ts": 1047,
     "tests/unit/translator-openai-to-gemini.test.ts": 1579,
     "tests/unit/translator-openai-to-kiro.test.ts": 918,
diff --git a/config/quality/quality-baseline.json b/config/quality/quality-baseline.json
index d4e029c2b2..723c6f6b75 100644
--- a/config/quality/quality-baseline.json
+++ b/config/quality/quality-baseline.json
@@ -122,9 +122,10 @@
       "dedicatedGate": true
     },
     "zizmorFindings": {
-      "value": 155,
+      "value": 159,
       "direction": "down",
       "dedicatedGate": true,
+      "_rebaseline_2026_06_23_fastpath_gates": "155 -> 159 (+4). Two new jobs added to .github/workflows/quality.yml (fast-vitest, fast-unit) to run vitest + the full unit suite on the PR->release fast-path (release-acceleration plan, _tasks/release-bench/v3.8.35/PLANO-IMPLEMENTACAO.md). The +4 are unpinned-uses: actions/checkout@v7 + actions/setup-node@v6 in each of the 2 jobs — the SAME deliberate @vN convention as every other workflow (see _scanner_harden_workflows_2026_06_16). SHA-pinning only these would violate the convention. No new template-injection/artipacked/cache-poisoning. Measured locally via `npm run check:workflows -- --ratchet` = 159.",
       "_rebaseline_2026_06_23_v3834_release": "152 -> 155 (+3). The 3 new unpinned-uses are in .github/workflows/nightly-release-green.yml (added by #4622 this cycle): actions/checkout@v7, actions/setup-node@v6, actions/upload-artifact@v4 — the SAME deliberate @vN convention as ci.yml's own checkout@v7/setup-node@v6 and every other workflow (see _scanner_harden_workflows_2026_06_16 + _zizmor_rebaseline_2026_06_20_ci_build_artifact_reuse). SHA-pinning only this workflow would violate the convention. The workflow-lint ratchet does NOT run on PR->release fast-gates, so it surfaced only on the release PR; measured locally via `npm run check:workflows -- --ratchet` = 155. No new template-injection/artipacked/cache-poisoning."
     },
     "vulnCount": {
diff --git a/docs/INCIDENT_RESPONSE.md b/docs/INCIDENT_RESPONSE.md
new file mode 100644
index 0000000000..8e85b40d4b
--- /dev/null
+++ b/docs/INCIDENT_RESPONSE.md
@@ -0,0 +1,174 @@
+# Incident Response Runbook — OmniRoute (2026-06-18)
+
+**Status**: Authoritative. The 71-pillar audit (L61) references this doc
+for the `Obs > 2.00` gate.
+**Owner**: observability-circle (lead: security-circle lead).
+**SLOs**: see `docs/PERF_BUDGETS.md` § 1 (top-level SLOs) and
+`ops/slos.yaml` (machine-readable form, generated by the Bifrost team).
+**Disclosure policy**: see `SECURITY.md` (vulnerability disclosure only,
+separate flow).
+
+This runbook is the operational playbook for **non-security** incidents:
+outages, latency regressions, error-budget burn, and provider-side
+failures. Vulnerability disclosure stays on `SECURITY.md`; do not route
+those through this runbook.
+
+---
+
+## 1. Severity ladder
+
+| Sev | Definition | Examples | Page on | Resolve by |
+|---|---|---|---|---|
+| **SEV-1** | User-visible outage; > 50 % of requests failing or > 2x SLO breach for 5 min. | Cluster down; auth layer broken; 5xx flood. | On-call P0 (immediate) | 4 h |
+| **SEV-2** | Significant degradation; 1.5–2x SLO breach for 15 min, or single-tenant impact. | Single provider down; p95 > 1.5x budget; rate-limit runaway. | On-call P1 (15 min) | 24 h |
+| **SEV-3** | Latent bug or near-miss; no current user impact but error budget at risk. | Memory leak trending up; circuit breaker tripping on one provider. | Slack `#omniroute-ops` (next standup) | 7 d |
+| **SEV-4** | Cosmetic / informational. | Log line noise; non-binding UI glitch. | Next weekly review | Next refactor cycle |
+
+**Burn-rate escalation** (per `docs/PERF_BUDGETS.md` § 1): 6x for 5 min
+is SEV-1; 2x for 1 h is SEV-2; sustained < 1x for 7 d demotes to SEV-3.
+
+---
+
+## 2. Detection sources
+
+| Source | Signal | Routing |
+|---|---|---|
+| Prometheus (`/metrics`) | Counter deltas (5xx, latency) | Alertmanager → PagerDuty |
+| Grafana SLO dashboards | SLO burn-rate panels | Slack `#omniroute-ops` |
+| Uptime probe (`/api/health/ping`) | 3 consecutive failures from 3 regions | Alertmanager → PagerDuty |
+| Dependabot | New CVE in dependency | GitHub issue + Slack `#security` |
+| User report (support@) | Manual triage | Slack `#omniroute-triage` |
+| Error budget burn alert | `slo_burn_rate > threshold` | Alertmanager |
+
+Prometheus and Alertmanager are configured in the deploy repo (see
+`docs/operations/DEPLOY.md` once published; currently inline in
+`docker-compose.prod.yml`).
+
+---
+
+## 3. First-15-minutes checklist
+
+When paged, the on-call engineer runs this checklist verbatim. **Do
+not** skip steps; each is timed.
+
+1. **0:00** — Acknowledge the page in PagerDuty. Stops the escalation
+   timer and notifies the secondary.
+2. **0:02** — Open the [SLO dashboard][dash] and the [incident
+   channel][chan] (`#inc-YYYY-MM-DD-slug`). Post a single-line ack
+   with the alert name and the time.
+3. **0:05** — Classify severity per § 1. If SEV-1 or SEV-2, declare
+   the incident in the channel and tag `@incident-commander`.
+4. **0:08** — Capture the alert payload, the most recent deploy SHA,
+   and the top 5 slow / erroring endpoints. Post to the channel.
+5. **0:12** — Decide: **mitigate first, root-cause later**. Choose
+   one of:
+   - **Roll back** to the last green deploy (`bin/rollback.sh vX.Y.Z`).
+   - **Failover** to the healthy replicas (Caddy LB removes the bad
+     replica automatically; verify with `curl /api/health/ping`).
+   - **Disable** a broken provider connection via `PUT /api/providers/{id}`
+     with `{ "isActive": false }` (one-line toggle; safe by default).
+6. **0:15** — Post the chosen mitigation in the channel. If the page
+   is still firing after 5 more minutes, escalate to the secondary.
+
+[chan]: https://phenotype.slack.com/archives/incidents
+[dash]: https://grafana.phenotype.internal/d/omniroute-slos
+
+---
+
+## 4. Mitigation runbooks (per failure mode)
+
+### 4.1 Provider outage (single provider down)
+
+1. `PUT /api/providers/{id}` with `{ "isActive": false }` — toggles the
+   connection off in the registry; all routes re-resolve on next request.
+2. Verify p95 returns to budget within 5 min.
+3. If all providers for a model are down, **disable the model** (see
+   `src/lib/a2a/skills/providerDiscovery.ts` for the disable path).
+4. Update the [status page][status] with a banner if the outage
+   exceeds 15 min.
+
+[status]: https://status.phenotype.dev
+
+### 4.2 Cluster-wide latency regression
+
+1. Check the most recent deploy (`/api/system/version` returns the running version).
+2. If p95 doubled vs the 7-day baseline, **roll back** to the prior
+   SHA via `bin/rollback.sh`.
+3. If the regression is provider-side, see § 4.1.
+
+### 4.3 Auth layer broken (5xx on /v1/responses for all keys)
+
+1. Check the authz-inventory endpoint:
+   `curl https://api.omniroute.dev/api/settings/authz-inventory | jq`.
+2. If `policies_active` is empty, restore from the last good backup
+   (`bin/restore-policies.sh <sha>`).
+3. Roll back if the cause is unclear.
+
+### 4.4 Data-layer incident (sqlite corruption, audit log gap)
+
+1. **Stop the cluster** (`docker compose -f docker-compose.prod.yml
+   stop`) — preventing further writes is more important than uptime.
+2. Snapshot the data volume (`bin/snapshot-data.sh`).
+3. Open a SEV-1; this is data-loss territory. Page the data-team.
+4. Restore from the last verified backup (see `docs/BACKUP.md` once
+   published; currently the runbook is `bin/restore-data.sh <sha>`).
+
+### 4.5 Security incident (vulnerability disclosure)
+
+**Stop.** This is the `SECURITY.md` path, not this runbook. Page the
+security on-call (`@security-team`); do not post details to
+`#omniroute-ops`.
+
+---
+
+## 5. Communication
+
+| Audience | Channel | Cadence | Owner |
+|---|---|---|---|
+| Engineering | `#inc-YYYY-MM-DD-slug` | Real-time | Incident commander |
+| Status page | `status.phenotype.dev` | Every 30 min during SEV-1/2 | On-call |
+| Customers (email) | `announce@phenotype.dev` | At SEV-1 start + resolution | Comms lead |
+| Upstream providers | Direct contact | At SEV-1 start | Vendor mgmt |
+| Postmortem | `docs/postmortem/YYYY-MM-DD-slug.md` | Within 5 business days | Incident commander |
+
+Postmortem template is at `docs/postmortem/TEMPLATE.md` (forthcoming;
+see ADR-024 for the cadence and ADR-029 for the postmortem convention).
+
+---
+
+## 6. On-call rotation
+
+| Role | Primary | Secondary | Rotation |
+|---|---|---|---|
+| Engineering on-call | security-circle lead | @open-sse | Weekly, Mon 09:00 PDT |
+| Security on-call | @security-team | — | Weekly |
+| Data on-call | @db-team | — | Weekly |
+| Comms lead | @comms | — | As needed |
+
+**Handoff**: every Monday 09:00 PDT, the outgoing on-call posts a
+written handoff to the incoming in `#omnirouse-ops-handoff` covering:
+open SEV-3/4 items, scheduled maintenance windows, and any
+in-flight mitigations.
+
+---
+
+## 7. Postmortem expectations
+
+- **Blameless**. People did the best they could with the information
+  they had. Focus on systems, signals, and decision points.
+- **Within 5 business days** of resolution. File via
+  `gh issue create --label postmortem --label SEV-1` (or `--label SEV-2`).
+- **Action items** must be assigned, dated, and tracked in
+  `docs/TECH_DEBT.md` (P0 < 30 d, P1 < 90 d per that doc's SLA).
+- **Mandatory attendees**: incident commander, on-call, any engineer
+  who touched the mitigation, and one person who was *not* involved
+  (fresh-eyes review).
+
+---
+
+## 8. Review log
+
+| Date | Reviewer | Change |
+|---|---|---|
+| 2026-06-18 | security-circle lead | Initial runbook; severity ladder + 15-min checklist + 4.1–4.5 mitigation runbooks. Closes 71-pillar audit L61 (1/3 → 2/3). |
+| 2026-07-18 (planned) | observability-circle | Wire on-call rotation into PagerDuty schedule; add the postmortem template. |
diff --git a/docs/PERF_BUDGETS.md b/docs/PERF_BUDGETS.md
new file mode 100644
index 0000000000..f0cc08346e
--- /dev/null
+++ b/docs/PERF_BUDGETS.md
@@ -0,0 +1,222 @@
+# Performance Budgets — OmniRoute (2026-06-18)
+
+**Status**: Authoritative. SLO targets that the 71-pillar audit (L13)
+references for the `Perf > 2.00` gate.
+**Methodology**: per-endpoint p50/p95/p99 latency budgets, plus a
+top-level availability SLO. Budgets are derived from the 3-replica
+Caddy + Redis topology (commit `038439fa7`); adjust on infra change.
+**Enforcement**: `benches/perf-gate.k6.js` (k6 reference script) —
+**not** yet wired into CI; `bench/` already exists in the repo
+and the script can be added there in a follow-up PR.
+**Re-evaluation cadence**: quarterly, or on any major infra change.
+
+---
+
+## 1. Top-level SLOs
+
+| SLO | Target | Window | Page on breach |
+|---|---|---|---|
+| **Availability** (2xx or 4xx for /v1/* and /api/settings/*) | 99.9% | rolling 30 days | on-call P2 |
+| **Error budget burn rate** (1xx normalized rate) | < 2x for 1h, < 6x for 5m | 1h / 5m windows | on-call P1 |
+| **Aggregate p95 latency** (all /v1/*) | ≤ 1.5 s | rolling 5 min | on-call P2 |
+| **Aggregate p99 latency** (all /v1/*) | ≤ 4.0 s | rolling 5 min | on-call P2 |
+
+**Error budget**: 30-day window = 43.2 minutes of unavailability at
+99.9%. Burn rate > 2x is P2; > 6x is P1.
+
+---
+
+## 2. Per-endpoint latency budgets
+
+All budgets measured **server-side** (Next.js Route Handler entry to
+response start, or last byte for streaming). Stream endpoints are
+measured to time-of-first-byte (TTFB) since the body is incremental.
+
+### 2.1 Inference endpoints (the hot path)
+
+| Endpoint | Method | p50 | p95 | p99 | Notes |
+|---|---|---|---|---|---|
+| `/v1/responses` (non-stream) | POST | 800 ms | 1.8 s | 3.5 s | Includes translator + provider roundtrip |
+| `/v1/responses` (stream) | POST (TTFB) | 350 ms | 900 ms | 1.8 s | TTFB only; total duration unbounded |
+| `/v1/relay/chat/completions` (non-stream) | POST | 1.0 s | 2.2 s | 4.0 s | Includes per-(token,IP) rate-limit check |
+| `/v1/relay/chat/completions` (stream) | POST (TTFB) | 400 ms | 1.0 s | 2.0 s | |
+| `/v1/embeddings` | POST | 300 ms | 700 ms | 1.4 s | Pure provider roundtrip; cheap |
+| `/v1/rerank` | POST | 600 ms | 1.4 s | 2.8 s | |
+| `/v1/moderations` | POST | 250 ms | 600 ms | 1.2 s | Lightweight classification |
+| `/v1/audio/speech` | POST | 1.2 s | 3.0 s | 6.0 s | Audio synthesis is slow; budget reflects that |
+| `/v1/audio/transcriptions` | POST | 2.0 s | 5.0 s | 10.0 s | STT is bounded by audio duration + model size |
+| `/v1/images/generations` | POST | 4.0 s | 8.0 s | 15.0 s | Image gen is async-bound by provider |
+| `/v1/videos/generations` | POST (TTFB) | 600 ms | 1.5 s | 3.0 s | Async; client polls `/v1/videos/{id}` |
+| `/v1/music/generations` | POST | 3.0 s | 6.0 s | 12.0 s | |
+
+### 2.2 Files + batches
+
+| Endpoint | Method | p50 | p95 | p99 | Notes |
+|---|---|---|---|---|---|
+| `/v1/files` (GET) | GET | 80 ms | 200 ms | 400 ms | Cached list |
+| `/v1/files` (POST upload) | POST | 500 ms | 1.2 s | 2.5 s | 25 MB cap; multipart parse |
+| `/v1/files/{id}` (GET) | GET | 60 ms | 150 ms | 300 ms | |
+| `/v1/files/{id}` (DELETE) | DELETE | 80 ms | 200 ms | 400 ms | |
+| `/v1/files/{id}/content` (download) | GET | 100 ms | 300 ms | 600 ms | + per-MB throughput |
+| `/v1/batches` (GET) | GET | 150 ms | 400 ms | 800 ms | |
+| `/v1/batches` (POST create) | POST | 200 ms | 500 ms | 1.0 s | Validates input file then enqueues |
+| `/v1/batches/{id}` (GET) | GET | 100 ms | 300 ms | 600 ms | |
+| `/v1/batches/{id}` (DELETE) | DELETE | 100 ms | 300 ms | 600 ms | |
+| `/v1/batches/delete-completed` (POST) | POST | 400 ms | 1.0 s | 2.0 s | Mass delete; n rows |
+
+### 2.3 Agents
+
+| Endpoint | Method | p50 | p95 | p99 | Notes |
+|---|---|---|---|---|---|
+| `/v1/agents/health` | GET | 1.5 s | 4.5 s | 5.0 s | 5s per-provider timeout cap; expect 3-provider total |
+| `/v1/agents/credentials` | GET | 100 ms | 250 ms | 500 ms | Metadata only; values never returned |
+| `/v1/agents/tasks` (GET list) | GET | 150 ms | 400 ms | 800 ms | |
+| `/v1/agents/tasks` (POST create) | POST | 250 ms | 600 ms | 1.2 s | Just enqueues; doesn't run agent |
+| `/v1/agents/tasks/{id}` (GET) | GET | 100 ms | 300 ms | 600 ms | |
+| `/v1/agents/tasks/{id}` (DELETE) | DELETE | 150 ms | 400 ms | 800 ms | |
+
+### 2.4 Combos / me / providers
+
+| Endpoint | Method | p50 | p95 | p99 |
+|---|---|---|---|---|
+| `/v1/combos` | GET | 80 ms | 200 ms | 400 ms |
+| `/v1/me/status` | GET | 60 ms | 150 ms | 300 ms |
+| `/v1/providers/{provider}/models` | GET | 100 ms | 250 ms | 500 ms |
+
+### 2.5 Web / search
+
+| Endpoint | Method | p50 | p95 | p99 | Notes |
+|---|---|---|---|---|---|
+| `/v1/web/fetch` | POST | 1.5 s | 4.0 s | 8.0 s | 10s timeout cap; recurse depth 3 |
+| `/v1/search` | POST | 800 ms | 2.0 s | 4.0 s | Provider search latency varies |
+
+### 2.6 VSCode-CLI shim (token-scoped)
+
+These are the legacy passthrough paths. Budgets are tighter because
+they're called frequently by the VSCode-CLI extension in tight loops.
+
+| Endpoint | Method | p50 | p95 | p99 |
+|---|---|---|---|---|
+| `/v1/vscode/{token}/v1/chat/completions` | POST | 700 ms | 1.6 s | 3.0 s |
+| `/v1/vscode/{token}/v1/models` | GET | 60 ms | 150 ms | 300 ms |
+| `/v1/vscode/{token}/combos` | GET | 80 ms | 200 ms | 400 ms |
+| `/v1/vscode/{token}/chat/completions` (legacy) | POST | 700 ms | 1.6 s | 3.0 s |
+| `/v1/vscode/{token}/models` (legacy) | GET | 60 ms | 150 ms | 300 ms |
+| `/v1/vscode/{token}/responses` | POST | 800 ms | 1.8 s | 3.5 s |
+
+### 2.7 Management / settings
+
+Management endpoints are operator-only and not part of the hot path.
+Budgets are set conservatively; breaches don't page on-call but do
+flag in the weekly perf review.
+
+| Endpoint group | p50 | p95 | p99 |
+|---|---|---|---|
+| `/api/settings/*` (GET) | 100 ms | 300 ms | 600 ms |
+| `/api/settings/*` (POST/PATCH/DELETE) | 200 ms | 500 ms | 1.0 s |
+| `/api/keys/*` (CRUD) | 150 ms | 400 ms | 800 ms |
+| `/api/quota/*` (CRUD) | 150 ms | 400 ms | 800 ms |
+| `/api/monitoring/health` (heavy) | 500 ms | 1.5 s | 3.0 s |
+
+### 2.8 Public probes
+
+| Endpoint | Method | p50 | p95 | p99 |
+|---|---|---|---|---|
+| `/api/health/ping` | GET | 5 ms | 20 ms | 50 ms |
+| `/api/system/version` | GET | 5 ms | 20 ms | 50 ms |
+| `/api/docs` | GET | 20 ms | 80 ms | 200 ms (HTML shell, no provider call) |
+
+---
+
+## 3. Throughput targets
+
+| Tier | Per-replica RPS | Cluster RPS (3 replicas) | Notes |
+|---|---|---|---|
+| Inference (non-stream) | 50 RPS | 150 RPS | Bounded by provider quota + translator CPU |
+| Inference (stream) | 25 concurrent streams | 75 streams | Bounded by Node event-loop + memory |
+| Embeddings | 200 RPS | 600 RPS | Cheap |
+| Files (upload) | 10 RPS | 30 RPS | Multipart parse + DB write |
+| Files (download) | 100 RPS | 300 RPS | Static-content via Next.js |
+| Combos / me / providers | 500 RPS | 1,500 RPS | Cached |
+| WebSocket | 100 concurrent connections | 300 | Per-IP cap 5 |
+
+**Cluster ceiling** (all endpoints combined, sustained): ~1,000 RPS
+before p95 latency begins to climb. Scale horizontally beyond that
+by adding replicas; the Caddy LB is stateless.
+
+---
+
+## 4. Resource budgets
+
+| Resource | Per-replica cap | Notes |
+|---|---|---|
+| RSS memory | 1.5 GB | Spikes during audio/video gen; expect brief 2 GB |
+| Event-loop lag (p99) | 50 ms | Alert via `clinic doctor` regression |
+| Heap retained | 800 MB | Old-gen GC tuning in `node --max-old-space-size` |
+| File descriptors | 2,000 | `ulimit -n 4096` recommended at host |
+| DB connections (sql.js) | 1 per replica | sql.js is in-process; no pool needed |
+| Redis connections | 20 per replica | Pooled; idle reaped at 5 min |
+
+---
+
+## 5. Cold-start budget
+
+Next.js App Router cold-start on a fresh container:
+
+| Phase | Budget |
+|---|---|
+| Container start → HTTP listening | ≤ 800 ms |
+| First request TTFB (warm) | ≤ 200 ms |
+| Translator registry bootstrap | ≤ 500 ms (one-time, first /v1/responses) |
+
+**Measurement script**: `bin/cold-start-bench.sh` (not yet committed;
+`bin/` is the canonical scripts dir).
+
+---
+
+## 6. Regression gate (k6 reference)
+
+The `benches/perf-gate.k6.js` script asserts the SLOs above. Not yet
+wired into CI; the JSON output is the contract for the next infra PR.
+
+```javascript
+// benches/perf-gate.k6.js — pseudo-code; not yet committed
+import http from 'k6/http';
+import { check, Trend } from 'k6';
+
+const responsesTTFB = new Trend('v1_responses_ttfb', true);
+
+export const options = {
+  scenarios: {
+    smoke: {
+      executor: 'constant-vus',
+      vus: 10,
+      duration: '1m',
+    },
+  },
+  thresholds: {
+    'http_req_duration{endpoint:v1_responses}': ['p(95)<1800', 'p(99)<3500'],
+    'http_req_failed': ['rate<0.01'],
+    'v1_responses_ttfb': ['p(95)<900'],
+  },
+};
+
+export default function () {
+  const res = http.post(`${__ENV.BASE_URL}/api/v1/responses`, JSON.stringify({
+    model: 'gpt-4o-mini',
+    input: 'ping',
+  }), { headers: { 'Authorization': `Bearer ${__ENV.API_KEY}` }});
+  check(res, { 'status is 200': (r) => r.status === 200 });
+  responsesTTFB.add(res.timings.waiting);
+}
+```
+
+---
+
+## 7. Review log
+
+| Date | Reviewer | Change |
+|---|---|---|
+| 2026-06-18 | security-circle lead | Initial per-endpoint budgets derived from 3-replica Caddy + Redis topology |
+| 2026-07-18 (planned) | observability-circle | Wire `benches/perf-gate.k6.js` into CI; gate on p95 + p99 breach |
+| 2026-09-18 (planned) | observability-circle | Quarterly review; adjust after real-traffic baseline data |
diff --git a/docs/architecture/RESILIENCE_GUIDE.md b/docs/architecture/RESILIENCE_GUIDE.md
index d64af0a745..9c5187b92d 100644
--- a/docs/architecture/RESILIENCE_GUIDE.md
+++ b/docs/architecture/RESILIENCE_GUIDE.md
@@ -159,6 +159,46 @@ lockout *state* is ephemeral.
 
 ---
 
+## 4. Quota-Share Concurrency Control (v3.8.36)
+
+Subscription accounts (GLM, MiniMax, etc.) often accept only ~1–3 concurrent
+requests; exceeding that triggers 429s and cooldowns. This is acute under
+**quota-share** (`qtSd/…`) combos, where several API keys share one upstream
+account. Three layers keep a shared account from being flooded.
+
+### Per-connection concurrency cap (`max_concurrent`)
+
+Each provider connection can declare a `max_concurrent` ceiling
+(`provider_connections.max_concurrent`, set in the connection modal / API / DB).
+Leave it empty for no limit. This is the single knob that drives the serialization
+layer below — set it to the account's real concurrency (e.g. GLM ~1, MiniMax ~2).
+
+### Quota-share request serialization
+
+When a quota-share dispatch targets a connection that declares a positive
+`max_concurrent`, concurrent requests to that **account** are serialized through a
+per-connection semaphore (key `qsconn:<connectionId>`): excess requests **wait in
+the queue** instead of flooding the account. It is **fail-open** — a saturated
+queue or timeout proceeds without a slot rather than ever rejecting a dispatchable
+request. Toggle in **Settings → Resilience → Quota-share per-connection
+concurrency** (`resilienceSettings.quotaShareConcurrencyLimit.enabled`, default
+on). Without a `max_concurrent` cap the behavior is unchanged.
+
+> The quota-share routing gate (`selectQuotaShareTarget`, DRR + P2C) is itself
+> fail-open and only *deprioritizes* an at-cap connection — with a
+> single-connection pool it cannot hard-limit, so this semaphore is what actually
+> contains the flood.
+
+### Combo cooldown-aware retry
+
+For quota-share combos only, a request that would crystallize a 429 for a SHORT
+transient cooldown waits it out and re-dispatches instead of returning the 429.
+Bounded by `comboCooldownWait` (`enabled`, `maxWaitMs` 5s, `maxAttempts` 2,
+`budgetMs` 8s) in **Settings → Resilience**. It never waits on `quota_exhausted`
+(locked until midnight) or auth/not-found reasons.
+
+---
+
 ## Other Resilience Features
 
 - **14 routing strategies** (priority, weighted, round-robin, context-relay, fill-first, p2c, random, least-used, cost-optimized, reset-aware, strict-random, auto, lkgp, context-optimized) — see [AUTO-COMBO.md](../routing/AUTO-COMBO.md).
diff --git a/docs/compression/COMPRESSION_ENGINES.md b/docs/compression/COMPRESSION_ENGINES.md
index 616c8c68a8..4fadec80b4 100644
--- a/docs/compression/COMPRESSION_ENGINES.md
+++ b/docs/compression/COMPRESSION_ENGINES.md
@@ -116,7 +116,7 @@ override points it at a local copy instead (offline / air-gapped installs).
 
 ### Optional dependencies & on-demand install
 
-The LLMLingua runtime stack is **optional**. Three packages are declared as
+The prunable LLMLingua runtime peer stack is **optional**. Three packages are declared as
 `optionalDependencies` in `package.json` and kept **external** by the production build
 (`scripts/build/prepublish.ts` does not bundle them):
 
@@ -126,9 +126,12 @@ The LLMLingua runtime stack is **optional**. Three packages are declared as
 | `@tensorflow/tfjs`   | `4.22.0`      | Heaviest dep — dominates the ~800 MB footprint |
 | `js-tiktoken`        | `^1.0.20`     | Tokenizer                                      |
 
-`@huggingface/transformers` is pinned at `3.5.2` as a **regular** dependency (shared with
-the local embeddings path), so it always ships — only the three packages above are
-prunable. A standard `npm install` (dev) installs them automatically.
+`@huggingface/transformers` is pinned at `3.5.2` as an **optional** dependency (shared with
+the local embeddings path and also traced into the standalone bundle). Keeping it optional prevents
+`onnxruntime-node` CUDA provider postinstall failures on CUDA 11 hosts from aborting the whole
+OmniRoute install; when the optional stack is absent, LLMLingua still fail-opens. Only the three
+packages above are prunable SLM peers. A standard `npm install` (dev) installs the optional stack
+automatically unless optional dependencies are omitted.
 
 **Why on-demand:** the npm-published package, the standalone bundle, and the Docker image
 ship **without** these deps to stay slim. When they are absent, the worker's dependency
diff --git a/docs/frameworks/AGENTBRIDGE.md b/docs/frameworks/AGENTBRIDGE.md
index 29cc6b8ce5..9cf32a67e9 100644
--- a/docs/frameworks/AGENTBRIDGE.md
+++ b/docs/frameworks/AGENTBRIDGE.md
@@ -200,6 +200,29 @@ certutil -addstore -f Root $env:USERPROFILE\.omniroute\mitm\ca.crt
 
 Or use the "Trust Cert" button in the dashboard (runs the appropriate command for your OS, with sudo prompt if needed).
 
+#### Electron-based IDEs ignore the OS trust store (`NODE_EXTRA_CA_CERTS`)
+
+Some IDEs — notably **Antigravity IDE**, and other Electron / VS Code-derived apps — bundle
+their own Node.js runtime that **does not consult the OS trust store** for outbound
+`fetch`/HTTPS. Trusting the CA at the OS/NSS level is enough for the IDE's native **backend**
+(e.g. a Go language server, which uses the OS CA bundle), but the **Electron frontend** will
+still fail TLS — it surfaces as the app being *logged out* or showing a *"connection error"*
+even though the MITM log shows the backend's bootstrap calls returning `200`. Two steps are
+required, and both matter:
+
+1. Point the runtime at the CA explicitly:
+   ```bash
+   export NODE_EXTRA_CA_CERTS=/path/to/omniroute-agentbridge-ca.crt
+   ```
+2. **Launch the IDE from that shell.** Starting it from the desktop icon / Dock / Start menu
+   does **not** inherit shell exports, and `~/.config/environment.d/*.conf` only applies after
+   a fresh graphical login. Fully quit the IDE first — Electron's singleton lock means a second
+   launch just focuses the existing process and the new environment is ignored.
+
+The OS-trust + NSS step above remains necessary (the Chromium network stack used by some auth
+flows reads the per-user NSS store, and has its own static pins for `*.googleapis.com` that a
+locally-trusted CA overrides). `NODE_EXTRA_CA_CERTS` covers the Node `fetch` path on top of it.
+
 ### 3.3 DNS routing
 
 For each agent you want to intercept, its API host(s) must resolve to `127.0.0.1`. AgentBridge manages `/etc/hosts` entries automatically when you toggle DNS for an agent in the Setup Wizard.
@@ -221,6 +244,13 @@ Use the Model Mapping Table in each agent card to define source → target mappi
 
 Wildcard `*` maps any unrecognized model to the specified target. Persisted in `agent_bridge_mappings` table.
 
+> **Tip — discover the agent's real model IDs.** An IDE may send model names that differ from
+> its UI labels and that change between major versions. For example **Antigravity 2** sends
+> `gemini-3.1-pro-low`, `gemini-pro-agent`, and `gemini-3.1-flash-lite` over the wire — not the
+> `gemini-2.5-pro` shown in older docs. Send one chat with no matching mapping in place: the MITM
+> logs the exact incoming `model:` and passes the request through. Map that literal value, then
+> the next request is intercepted and routed to your target.
+
 ### 3.5 Risk notice
 
 AgentBridge intercepts credentials (OAuth tokens, API keys) that the IDE uses to authenticate with upstream providers. These are **masked before logging** (see §2.7) but are visible to OmniRoute's MITM layer. First activation of each agent shows a dismissible risk notice modal.
@@ -358,6 +388,9 @@ When `AGENTBRIDGE_UPSTREAM_CA_CERT` is set, the file is read at startup. If the
 - **Port 443 requires privilege**: On Linux, AgentBridge needs `setcap 'cap_net_bind_service=+ep'` on the Node binary, or run via `authbind`. The Setup Wizard displays OS-specific instructions.
 - **IDE restart required**: After DNS redirect, the IDE must be restarted for the new host resolution to take effect.
 - **Hardcoded OAuth tokens**: Some agents (Kiro, Antigravity) store OAuth refresh tokens locally. These are transparent to AgentBridge — it sees the Bearer token in each request, which is masked before logging.
+- **Electron frontends need `NODE_EXTRA_CA_CERTS`**: IDEs whose frontend runs on a bundled Node/Electron runtime ignore the OS/NSS trust store and must be launched from a shell with `NODE_EXTRA_CA_CERTS` set (see §3.2). Symptom when missing: the IDE backend authenticates (MITM shows `200`s) but the UI stays logged out.
+- **Multiple installs of the same IDE are independent**: a system install (e.g. `/usr/share/antigravity/antigravity`) and a user-local "Full" install (e.g. `~/AntigravityIDE_Full/antigravity-ide`) are separate processes with their own runtimes — each must be relaunched with the CA injected. Identify which one is running by its binary path before relaunching.
+- **Identity is set by the agent's system prompt, not the routed model**: when you remap an agent's model to a different provider, the reply still claims the agent's native identity (e.g. Antigravity answers "I am powered by Gemini") because the IDE injects that into the system prompt. Confirm the real backend in `call_logs` / `proxy_logs` (`provider`, `model`, `target_format`), not by asking the model who it is.
 
 ---
 
@@ -382,6 +415,22 @@ If the IDE shows TLS errors after starting AgentBridge:
 2. Some apps maintain their own trust store (Firefox, Chrome on Linux). Run "Trust Cert" again and check the NSS/Firefox-specific cert store.
 3. Restart the IDE after trusting — in-flight TLS sessions use the old trust state.
 
+### IDE logged out / "connection error" despite a trusted CA
+
+Symptom: after redirecting DNS and trusting the CA, an Electron-based IDE (e.g. Antigravity)
+opens **logged out** or shows an authentication/connection error, yet the MITM log shows the
+bootstrap calls (`loadCodeAssist`, `fetchAvailableModels`, …) returning `200`.
+
+Cause: the IDE's **bundled Node/Electron runtime ignores the OS trust store**. The native
+backend (a Go language server) trusts the OS CA and authenticates, but the Electron frontend
+does not — so the UI believes it is offline.
+
+Fix (both steps): export `NODE_EXTRA_CA_CERTS=<ca.crt>` **and relaunch the IDE from that
+shell**, not from the desktop icon. Fully quit the IDE first — Electron's singleton lock means
+a second launch just focuses the existing process and the new environment is ignored. See §3.2.
+This mirrors an open upstream report where a standalone agent works through a MITM but the IDE
+variant fails under the same setup.
+
 ### DNS not propagated
 
 Check that `/etc/hosts` was updated:
diff --git a/docs/guides/USER_GUIDE.md b/docs/guides/USER_GUIDE.md
index 1fb4a419fe..6c57463125 100644
--- a/docs/guides/USER_GUIDE.md
+++ b/docs/guides/USER_GUIDE.md
@@ -57,7 +57,7 @@ Complete guide for configuring providers, creating combos, integrating CLI tools
 |                     | Kimi K2           | $9/mo flat  | 10M tokens/mo    | Predictable cost     |
 | **🆓 FREE**         | Qoder             | $0          | Unlimited        | 8 models free        |
 |                     | Qwen              | $0          | Unlimited        | 3 models free        |
-|                     | Kiro              | $0          | Unlimited        | Claude free          |
+|                     | Kiro              | $0          | ~50 credits/mo   | Claude free          |
 
 **💡 Pro Tip:** Start with Gemini CLI (180K free/month) + Qoder (unlimited free) combo = $0 cost!
 
@@ -240,7 +240,7 @@ Models: if/kimi-k2, if/qwen3-coder-plus, if/qwen3-max, if/qwen3-235b, if/deepsee
 #### Kiro (Claude FREE)
 
 ```bash
-Dashboard → Connect Kiro → AWS Builder ID or Google/GitHub → Unlimited
+Dashboard → Connect Kiro → AWS Builder ID or Google/GitHub → ~50 credits/month
 
 Models: kr/claude-sonnet-4.5, kr/claude-haiku-4.5
 ```
diff --git a/docs/i18n/ar/CHANGELOG.md b/docs/i18n/ar/CHANGELOG.md
index 3fb1aaae7c..89afe8ca7d 100644
--- a/docs/i18n/ar/CHANGELOG.md
+++ b/docs/i18n/ar/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/az/CHANGELOG.md b/docs/i18n/az/CHANGELOG.md
index befb8a4bdd..cf2d935f24 100644
--- a/docs/i18n/az/CHANGELOG.md
+++ b/docs/i18n/az/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/bg/CHANGELOG.md b/docs/i18n/bg/CHANGELOG.md
index befb8a4bdd..cf2d935f24 100644
--- a/docs/i18n/bg/CHANGELOG.md
+++ b/docs/i18n/bg/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/bn/CHANGELOG.md b/docs/i18n/bn/CHANGELOG.md
index 4f51520a96..9b58d0487d 100644
--- a/docs/i18n/bn/CHANGELOG.md
+++ b/docs/i18n/bn/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/cs/CHANGELOG.md b/docs/i18n/cs/CHANGELOG.md
index 4b1318a093..f8b3eca0c9 100644
--- a/docs/i18n/cs/CHANGELOG.md
+++ b/docs/i18n/cs/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/da/CHANGELOG.md b/docs/i18n/da/CHANGELOG.md
index fb1402cf2a..51948487a1 100644
--- a/docs/i18n/da/CHANGELOG.md
+++ b/docs/i18n/da/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/de/CHANGELOG.md b/docs/i18n/de/CHANGELOG.md
index 5282b4d980..97f29ab9e4 100644
--- a/docs/i18n/de/CHANGELOG.md
+++ b/docs/i18n/de/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/es/CHANGELOG.md b/docs/i18n/es/CHANGELOG.md
index 09c3fcd90f..863cd1e9b1 100644
--- a/docs/i18n/es/CHANGELOG.md
+++ b/docs/i18n/es/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/fa/CHANGELOG.md b/docs/i18n/fa/CHANGELOG.md
index 5e6d805209..f5d31c7a06 100644
--- a/docs/i18n/fa/CHANGELOG.md
+++ b/docs/i18n/fa/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/fi/CHANGELOG.md b/docs/i18n/fi/CHANGELOG.md
index c834444ed4..99a417809b 100644
--- a/docs/i18n/fi/CHANGELOG.md
+++ b/docs/i18n/fi/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/fr/CHANGELOG.md b/docs/i18n/fr/CHANGELOG.md
index 89e5fffecb..bfd7145007 100644
--- a/docs/i18n/fr/CHANGELOG.md
+++ b/docs/i18n/fr/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/gu/CHANGELOG.md b/docs/i18n/gu/CHANGELOG.md
index bf599d7ca2..de18b7c00c 100644
--- a/docs/i18n/gu/CHANGELOG.md
+++ b/docs/i18n/gu/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/he/CHANGELOG.md b/docs/i18n/he/CHANGELOG.md
index 2ababd3676..80a9cb71ca 100644
--- a/docs/i18n/he/CHANGELOG.md
+++ b/docs/i18n/he/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/hi/CHANGELOG.md b/docs/i18n/hi/CHANGELOG.md
index 0994d0bc6d..7c9f3b6775 100644
--- a/docs/i18n/hi/CHANGELOG.md
+++ b/docs/i18n/hi/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/hu/CHANGELOG.md b/docs/i18n/hu/CHANGELOG.md
index 24a4e835ae..cfa2904521 100644
--- a/docs/i18n/hu/CHANGELOG.md
+++ b/docs/i18n/hu/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/id/CHANGELOG.md b/docs/i18n/id/CHANGELOG.md
index aeff9316ab..c2b0948921 100644
--- a/docs/i18n/id/CHANGELOG.md
+++ b/docs/i18n/id/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/in/CHANGELOG.md b/docs/i18n/in/CHANGELOG.md
index e69e52b781..6e6652edec 100644
--- a/docs/i18n/in/CHANGELOG.md
+++ b/docs/i18n/in/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/it/CHANGELOG.md b/docs/i18n/it/CHANGELOG.md
index bb5efc0ede..ddd1c6c2c7 100644
--- a/docs/i18n/it/CHANGELOG.md
+++ b/docs/i18n/it/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/ja/CHANGELOG.md b/docs/i18n/ja/CHANGELOG.md
index 1d899e787d..6f06951f86 100644
--- a/docs/i18n/ja/CHANGELOG.md
+++ b/docs/i18n/ja/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/ko/CHANGELOG.md b/docs/i18n/ko/CHANGELOG.md
index edb856a759..b914a8a7b9 100644
--- a/docs/i18n/ko/CHANGELOG.md
+++ b/docs/i18n/ko/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/mr/CHANGELOG.md b/docs/i18n/mr/CHANGELOG.md
index 6aadafcb8b..161ac93e23 100644
--- a/docs/i18n/mr/CHANGELOG.md
+++ b/docs/i18n/mr/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/ms/CHANGELOG.md b/docs/i18n/ms/CHANGELOG.md
index 714553f8b6..cea2a3444c 100644
--- a/docs/i18n/ms/CHANGELOG.md
+++ b/docs/i18n/ms/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/nl/CHANGELOG.md b/docs/i18n/nl/CHANGELOG.md
index c4009f11c9..edd232ab2d 100644
--- a/docs/i18n/nl/CHANGELOG.md
+++ b/docs/i18n/nl/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/no/CHANGELOG.md b/docs/i18n/no/CHANGELOG.md
index d10ce083b8..b5389638a0 100644
--- a/docs/i18n/no/CHANGELOG.md
+++ b/docs/i18n/no/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/phi/CHANGELOG.md b/docs/i18n/phi/CHANGELOG.md
index 659de62030..6e2e331cfa 100644
--- a/docs/i18n/phi/CHANGELOG.md
+++ b/docs/i18n/phi/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/pl/CHANGELOG.md b/docs/i18n/pl/CHANGELOG.md
index cd2a237e0d..bbe5cc859b 100644
--- a/docs/i18n/pl/CHANGELOG.md
+++ b/docs/i18n/pl/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/pt-BR/CHANGELOG.md b/docs/i18n/pt-BR/CHANGELOG.md
index 867ad9df5e..b3676533c1 100644
--- a/docs/i18n/pt-BR/CHANGELOG.md
+++ b/docs/i18n/pt-BR/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/pt/CHANGELOG.md b/docs/i18n/pt/CHANGELOG.md
index f6389d6d11..685fed1c2e 100644
--- a/docs/i18n/pt/CHANGELOG.md
+++ b/docs/i18n/pt/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/ro/CHANGELOG.md b/docs/i18n/ro/CHANGELOG.md
index 2cf563eaa1..293cc84ad0 100644
--- a/docs/i18n/ro/CHANGELOG.md
+++ b/docs/i18n/ro/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/ru/CHANGELOG.md b/docs/i18n/ru/CHANGELOG.md
index a472d9f1b6..ea2ed3f8d4 100644
--- a/docs/i18n/ru/CHANGELOG.md
+++ b/docs/i18n/ru/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/sk/CHANGELOG.md b/docs/i18n/sk/CHANGELOG.md
index e880533c56..a8bbe4ecfc 100644
--- a/docs/i18n/sk/CHANGELOG.md
+++ b/docs/i18n/sk/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/sv/CHANGELOG.md b/docs/i18n/sv/CHANGELOG.md
index a4bbbad3cb..5be49ed849 100644
--- a/docs/i18n/sv/CHANGELOG.md
+++ b/docs/i18n/sv/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/sw/CHANGELOG.md b/docs/i18n/sw/CHANGELOG.md
index ad39acd71a..3371ce8419 100644
--- a/docs/i18n/sw/CHANGELOG.md
+++ b/docs/i18n/sw/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/ta/CHANGELOG.md b/docs/i18n/ta/CHANGELOG.md
index 88ec475e41..8a038bf8f8 100644
--- a/docs/i18n/ta/CHANGELOG.md
+++ b/docs/i18n/ta/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/te/CHANGELOG.md b/docs/i18n/te/CHANGELOG.md
index 967431a1fb..840fbb9a3f 100644
--- a/docs/i18n/te/CHANGELOG.md
+++ b/docs/i18n/te/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/th/CHANGELOG.md b/docs/i18n/th/CHANGELOG.md
index e6db8ab2b9..c29add6041 100644
--- a/docs/i18n/th/CHANGELOG.md
+++ b/docs/i18n/th/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/tr/CHANGELOG.md b/docs/i18n/tr/CHANGELOG.md
index 246f00f4cf..243c717932 100644
--- a/docs/i18n/tr/CHANGELOG.md
+++ b/docs/i18n/tr/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/uk-UA/CHANGELOG.md b/docs/i18n/uk-UA/CHANGELOG.md
index a5982c4203..af94f3ff56 100644
--- a/docs/i18n/uk-UA/CHANGELOG.md
+++ b/docs/i18n/uk-UA/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/ur/CHANGELOG.md b/docs/i18n/ur/CHANGELOG.md
index c18abff9a6..0817f3ab1b 100644
--- a/docs/i18n/ur/CHANGELOG.md
+++ b/docs/i18n/ur/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/vi/CHANGELOG.md b/docs/i18n/vi/CHANGELOG.md
index 93f997a436..e15d11cd74 100644
--- a/docs/i18n/vi/CHANGELOG.md
+++ b/docs/i18n/vi/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/i18n/zh-CN/CHANGELOG.md b/docs/i18n/zh-CN/CHANGELOG.md
index d6b101062d..f102ef23d6 100644
--- a/docs/i18n/zh-CN/CHANGELOG.md
+++ b/docs/i18n/zh-CN/CHANGELOG.md
@@ -6,6 +6,181 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.36] — 2026-06-25
+
+### ✨ New Features
+
+**Quota-Share system**
+
+- **feat(quota):** introduce a dedicated `quota-share` combo strategy (Fase 3 #9) — Deficit Round Robin scheduling with per-model in-flight gating (P2C), automatic DB migration that promotes existing `qtSd/*` combos, and per-policy gating so invalid allocations cannot bleed `allow` to unintended connections. ([#4939](https://github.com/diegosouzapw/OmniRoute/pull/4939), [#4901](https://github.com/diegosouzapw/OmniRoute/pull/4901))
+- **feat(quota):** multi-window usage buckets, per-(key,model) caps, and session stickiness — connections now track consumption across 5 h, 7 d, and per-model windows; `quota_allocation_model_caps` enforces per-key/model limits; session stickiness preserves prompt-cache integrity across turns. ([#4928](https://github.com/diegosouzapw/OmniRoute/pull/4928), [#4927](https://github.com/diegosouzapw/OmniRoute/pull/4927), [#4929](https://github.com/diegosouzapw/OmniRoute/pull/4929))
+- **feat(quota):** headroom strategy + proactive saturation — new `headroom` combo strategy selects connections by available quota margin; universal proactive saturation via upstream token-usage response headers; real Claude quota saturation sourced from `/api/oauth/usage`. ([#4908](https://github.com/diegosouzapw/OmniRoute/pull/4908), [#4907](https://github.com/diegosouzapw/OmniRoute/pull/4907), [#4885](https://github.com/diegosouzapw/OmniRoute/pull/4885))
+- **feat(quota):** concurrency control + cooldown-wait (Fase 2.1) — `max_concurrent` is enforced at dispatch time; quota-share combos queue concurrent requests with a short cooldown-wait and re-dispatch on slot availability (Variant A); a cron heal proactively restores connections after their window resets. ([#4965](https://github.com/diegosouzapw/OmniRoute/pull/4965), [#4970](https://github.com/diegosouzapw/OmniRoute/pull/4970), [#4967](https://github.com/diegosouzapw/OmniRoute/pull/4967), [#4900](https://github.com/diegosouzapw/OmniRoute/pull/4900))
+
+**Combo routing**
+
+- **feat(combo):** task-aware routing strategy — routes requests to the best-fit connection based on task-type metadata, enabling per-task provider specialization within a combo. ([#4945](https://github.com/diegosouzapw/OmniRoute/pull/4945))
+- **feat(combo):** Fusion strategy (16th strategy) — fan out to a configurable panel of models in parallel, then synthesize results through a judge model. ([#4652](https://github.com/diegosouzapw/OmniRoute/pull/4652))
+- **feat(combos):** add an editable per-combo `description` field. The routing-combo form now has a Description input, persisted in the combo `data` blob via `/api/combos` (POST/PUT) and round-tripped through GET — no new DB column. ([#5005](https://github.com/diegosouzapw/OmniRoute/issues/5005))
+- **feat(routing):** honor `X-Route-Model` request header to override `body.model`, enabling per-request model switching without modifying the request body. ([#4863](https://github.com/diegosouzapw/OmniRoute/pull/4863) — thanks @costaeder)
+
+**Providers & models**
+
+- **feat(providers):** update volcengine-ark model list, adding DeepSeek-V4-Flash and DeepSeek-V4-Pro. ([#4905](https://github.com/diegosouzapw/OmniRoute/pull/4905) — thanks @kenlin8827)
+- **feat(provider):** add CodeBuddy CN (`copilot.tencent.com`) — full OAuth + executor + model catalog stack. ([#4664](https://github.com/diegosouzapw/OmniRoute/pull/4664))
+- **feat(opencode-go):** advertise `glm-5.2` and `kimi-k2.7-code` to align with official Go endpoints. ([#4711](https://github.com/diegosouzapw/OmniRoute/pull/4711))
+- **feat(sse):** add Google Flow video-generation provider. ([#4769](https://github.com/diegosouzapw/OmniRoute/pull/4769))
+- **feat(api/v1):** include alias-backed models in the `/v1/models` listing. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630))
+
+**Proxy pool**
+
+- **feat(proxy-pool):** Cloudflare Workers proxy deployer + pool integration — deploy Cloudflare Workers relays directly from the dashboard and register them in the proxy pool. ([#4640](https://github.com/diegosouzapw/OmniRoute/pull/4640))
+- **feat(proxy-pool):** Deno Deploy relays + group action buttons — deploy Deno Deploy relay workers and manage proxy groups with new bulk-action controls. ([#4643](https://github.com/diegosouzapw/OmniRoute/pull/4643))
+
+**Compression & infrastructure**
+
+- **feat(compression):** Kiro/CodeWhisperer tool-result compression engine — dedicated compressor for Kiro/CodeWhisperer tool outputs integrated into the streaming pipeline. ([#4635](https://github.com/diegosouzapw/OmniRoute/pull/4635))
+- **feat(endpoint):** per-endpoint custom system prompt injection. A toggle + text field in the Endpoint settings card lets users inject a custom system prompt into every model request, applied via the existing system-prompt engine. Stored in settings DB. ([#5022](https://github.com/diegosouzapw/OmniRoute/pull/5022) — thanks @whale9820)
+- **feat(live-ws):** allow non-loopback clients via `LIVE_WS_ALLOWED_HOSTS` env var, enabling multi-host setups to access the live WebSocket API. ([#4877](https://github.com/diegosouzapw/OmniRoute/pull/4877) — thanks @KooshaPari)
+- **feat(db):** track API endpoint dimension on `usage_history` for per-endpoint cost and usage analytics. ([#4676](https://github.com/diegosouzapw/OmniRoute/pull/4676))
+
+---
+
+### 🔧 Bug Fixes
+
+**Translator**
+
+- **fix(translator):** regroup parallel tool results to be adjacent to their originating assistant turn, fixing tool-message ordering for providers that require strict interleaving. ([#4882](https://github.com/diegosouzapw/OmniRoute/pull/4882))
+- **fix(translator):** preserve literal empty-string tool arguments in OpenAI-to-Claude streaming — they were previously dropped, causing tool calls to arrive with missing parameters. ([#4959](https://github.com/diegosouzapw/OmniRoute/pull/4959))
+- **fix(translator):** normalize tools to Anthropic-native shape for non-Anthropic providers, ensuring tool definitions pass validation regardless of the format at the call site. ([#4650](https://github.com/diegosouzapw/OmniRoute/pull/4650))
+- **fix(translator):** provider thinking compatibility — correct thinking-block serialization for DeepSeek and Gemini providers. ([#4946](https://github.com/diegosouzapw/OmniRoute/pull/4946))
+- **fix(translator):** emit `</think>` close marker for Anthropic thinking blocks, fixing truncated reasoning output in streamed responses. ([#4633](https://github.com/diegosouzapw/OmniRoute/pull/4633))
+- **fix(translator):** normalize `developer` role to `system` for OpenAI-format providers. ([#4625](https://github.com/diegosouzapw/OmniRoute/pull/4625))
+- **fix(translator):** strip top-level `client_metadata` on the OpenAI passthrough path (port from 9router#1157). ([#4624](https://github.com/diegosouzapw/OmniRoute/pull/4624))
+- **fix(translator):** replay `reasoning_content` on plain Xiaomi MiMo turns (port from 9router#1321). ([#4639](https://github.com/diegosouzapw/OmniRoute/pull/4639))
+
+**Copilot / GitHub executor**
+
+- **fix(copilot):** never route Gemini/Claude model variants to the `/responses` endpoint — these models require the chat-completions path only. ([#4627](https://github.com/diegosouzapw/OmniRoute/pull/4627))
+- **fix(github):** route Copilot Codex models to `/responses` (port from 9router#102). ([#4626](https://github.com/diegosouzapw/OmniRoute/pull/4626))
+- **fix(copilot,antigravity):** cap `maxOutputTokens` at 16384 to stop "Invalid Argument" 400 errors on high-token requests. ([#4636](https://github.com/diegosouzapw/OmniRoute/pull/4636))
+- **fix(codex):** drop non-standard `codex.*` streaming events that break `responses.stream` consumers. ([#4715](https://github.com/diegosouzapw/OmniRoute/pull/4715) — thanks @jeffer1312)
+
+**Claude / Anthropic**
+
+- **fix(claude):** omit `adaptive_thinking` and `output_config.effort` for Haiku model variants, which reject those parameters. ([#4661](https://github.com/diegosouzapw/OmniRoute/pull/4661))
+- **fix(claude):** skip `mcp__` tool-name cloaking and guard against missing `connectionId` to prevent crashes on Claude-native MCP tool calls. ([#4861](https://github.com/diegosouzapw/OmniRoute/pull/4861) — thanks @costaeder)
+- **fix(claude-oauth):** respect `429` backoff headers on the Claude OAuth usage endpoint to reduce polling spam during quota checks. ([#4655](https://github.com/diegosouzapw/OmniRoute/pull/4655))
+
+**Routing & SSE**
+
+- **fix(sse):** fail over on `400` responses that carry rate-limit text in the body, not just on canonical `429` status codes. ([#4986](https://github.com/diegosouzapw/OmniRoute/pull/4986))
+- **fix(sse):** honor per-account proxy and fingerprint-rotation settings in the opencode executor. ([#4989](https://github.com/diegosouzapw/OmniRoute/pull/4989))
+- **fix(sse):** soft-penalize exhausted providers in auto-combo scoring instead of hard-excluding them, improving fallback resilience. ([#4990](https://github.com/diegosouzapw/OmniRoute/pull/4990))
+- **fix(sse):** drop the CCP pin when the pinned provider is durably unhealthy, with anti-flap logic to prevent oscillation. ([#4864](https://github.com/diegosouzapw/OmniRoute/pull/4864) — thanks @costaeder)
+- **fix(combo):** fetch models dynamically from custom provider endpoints instead of relying on a static list. ([#4860](https://github.com/diegosouzapw/OmniRoute/pull/4860))
+- **fix(combo):** propagate the selected connection ID to fallback error responses so model lockout applies to the correct connection rather than the wrong fallback target. ([#4809](https://github.com/diegosouzapw/OmniRoute/pull/4809) — thanks @Chewji9875)
+- **fix(sse):** skip third-party tool-name cloaking for Anthropic-native server tools to prevent naming conflicts. ([#4808](https://github.com/diegosouzapw/OmniRoute/pull/4808) — thanks @NomenAK)
+
+**Quota**
+
+- **fix(quota):** quota-exclusive `qtSd/*` connections now appear in `/v1/models` listings; EPSILON-threshold check no longer falsely blocks under-budget allocations. ([#4830](https://github.com/diegosouzapw/OmniRoute/pull/4830))
+- **fix(quota):** migration 107 correctly activates the `quota-share` strategy on existing `qtSd/*` combos. ([#4962](https://github.com/diegosouzapw/OmniRoute/pull/4962))
+
+**API / responses**
+
+- **fix(api):** parse the `/v1/responses` request body once instead of 3–4 times on the hot path, reducing per-request overhead. ([#4958](https://github.com/diegosouzapw/OmniRoute/pull/4958))
+- **fix(api):** evict stale in-memory rate-limit windows to stop a slow heap leak on long-running instances. ([#4957](https://github.com/diegosouzapw/OmniRoute/pull/4957))
+- **fix(api):** require authentication on the compression `run-telemetry` endpoint; document `OMNIROUTE_EVAL_CREDENTIALS` env var. ([#4796](https://github.com/diegosouzapw/OmniRoute/pull/4796))
+- **fix(api):** stop `GET /api/system/env/repair` returning HTTP `500` on packaged installs (it broke the onboarding wizard). `createRequire(import.meta.url)` ran at module top-level; once webpack bundles the route into the standalone build, `import.meta.url` is frozen to the build-machine path and `createRequire` throws during evaluation, so the whole route failed to load. `createRequire` is now resolved lazily inside the guarded `better-sqlite3` block, root-dir resolution falls back to `process.cwd()`, and the route passes an explicit `rootDir`. ([#5028](https://github.com/diegosouzapw/OmniRoute/pull/5028))
+
+**Dashboard**
+
+- **fix(dashboard):** show custom provider given-name instead of internal id across dashboard pages — cache, combo health, compression analytics, cost overview, health/autopilot, provider stats, route explainability, provider utilization, runtime. Adds shared `resolveProviderName` resolver and `useProviderNodeMap` hook. (#4603)
+- **fix(dashboard):** on OAuth providers (e.g. GLM Coding), "Test all models" with auto-hide-failed now switches the model list to the "visible" filter after the run, so just-hidden failed models actually disappear on-screen — parity with the passthrough-provider path (#3610). Previously they were hidden in the DB but stayed visible under the "All" filter, so it looked like nothing was hidden. (#4887)
+- **fix(dashboard):** restore the home-page provider topology card that was hidden by a default state change in #4596. ([#4963](https://github.com/diegosouzapw/OmniRoute/pull/4963))
+- **fix(dashboard):** proxy-pool success gating, sync-timestamp persistence, and opt-in Redis backend. ([#4988](https://github.com/diegosouzapw/OmniRoute/pull/4988))
+- **fix(dashboard):** show custom vision models in the LLM selector dropdown. ([#4653](https://github.com/diegosouzapw/OmniRoute/pull/4653))
+
+**Providers**
+
+- **fix(pollinations):** stop forcing `jsonMode` on every request. Pollinations treats `jsonMode=true` as "the model MUST return JSON" and rejects (HTTP 400 "messages must contain the word 'json'") any normal chat request whose messages don't mention "json", so all non-JSON chat was broken. `jsonMode` is now only enabled when the caller actually requests JSON output (`response_format.type` of `json_object` or `json_schema`). (#3981)
+- **fix(antigravity):** default `safetySettings` to all-OFF for parity with the native Gemini paths. The Antigravity (Google Cloud Code) request builder set `safetySettings: undefined`, which `JSON.stringify` drops — so no safety settings reached Google and its server-side defaults false-flagged benign technical prompts as `prohibited_content` (HTTP 200 + blocked body, which combo failover treats as terminal). Now honors a caller-supplied value and otherwise defaults to `DEFAULT_SAFETY_SETTINGS`, matching the claude-to-gemini / openai-to-gemini paths. (#5003)
+- **fix(antigravity):** exclude the standard Gemini rate-limit message from quota-exhaustion keyword matching to prevent false-positive saturation flags. ([#4810](https://github.com/diegosouzapw/OmniRoute/pull/4810) — thanks @Chewji9875)
+- **fix(chatgpt-web):** map the advertised `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.4-pro` and `gpt-5.2-pro` catalog ids to their dash-form ChatGPT backend slugs. They were missing from `MODEL_MAP`, so the executor sent the dot-form id verbatim, which the ChatGPT backend silently ignored and served the default Plus model instead of the requested one. Adds a drift guard asserting no advertised dot-form id reaches the backend verbatim. (#4665)
+- **fix(gemini):** preserve the `pattern` field in the Antigravity tool schema sanitizer to avoid stripping valid regex constraints from tool definitions. ([#4651](https://github.com/diegosouzapw/OmniRoute/pull/4651))
+- **fix(opencode):** preserve DeepSeek reasoning content in streamed responses. ([#4631](https://github.com/diegosouzapw/OmniRoute/pull/4631))
+- **fix(perplexity):** validate API keys via the `/v1/models` endpoint instead of issuing a full chat request. ([#4654](https://github.com/diegosouzapw/OmniRoute/pull/4654))
+- **fix(qoder):** exchange PAT for `jt-*` job token before initiating Cosy chat, fixing auth failures after the Qoder credential format change. ([#4884](https://github.com/diegosouzapw/OmniRoute/pull/4884))
+- **fix(executors):** strip parameters unsupported by the target provider/model to prevent `400 Invalid parameter` errors on strict endpoints. ([#4658](https://github.com/diegosouzapw/OmniRoute/pull/4658))
+- **fix(executors):** preserve literal `reasoning_effort: "max"` for Ollama Cloud instead of normalizing to `xhigh`. Ollama Cloud accepts `high|medium|low|max|none` and rejects `xhigh` (`invalid reasoning value: 'xhigh'`); OpenRouter DeepSeek `max→xhigh` normalization is unaffected. ([#4993](https://github.com/diegosouzapw/OmniRoute/pull/4993) — thanks @Thinkscape)
+- **fix(headroom):** translate openai-responses input through OpenAI for external compression. `adaptBodyForCompression` now serialises `function_call_output` items whose `output` field is a JSON object (not a string) so compression engines can process the content — previously those items were excluded from compression because `hasTextContent()` returned false for object values. ([#5023](https://github.com/diegosouzapw/OmniRoute/pull/5023) — thanks @anki1kr)
+- **fix(proxy):** fan out direct dispatcher streams to all registered proxy endpoints. ([#4803](https://github.com/diegosouzapw/OmniRoute/pull/4803) — thanks @makcimbx)
+
+**Compression**
+
+- **fix(compression):** eliminate ReDoS in the `math_inline` preservation regex — the previous pattern could catastrophically backtrack on untrusted input. ([#4838](https://github.com/diegosouzapw/OmniRoute/pull/4838))
+- **fix(compression):** stop RTK over-truncating file-read tool results — RTK now respects the full content length for file-read outputs. ([#4987](https://github.com/diegosouzapw/OmniRoute/pull/4987))
+
+**Build / CLI / infrastructure**
+
+- **fix(build):** drop `@omniroute/open-sse` from `optimizePackageImports` to fix the Next.js build OOM crash. ([#4968](https://github.com/diegosouzapw/OmniRoute/pull/4968))
+- **fix(cli):** SIGKILL the systray child PID before closing the IPC channel to prevent macOS NSStatusItem orphan processes. ([#4732](https://github.com/diegosouzapw/OmniRoute/pull/4732))
+- **fix(cli):** bump `better-sqlite3` runtime pin to 12.10.1 for Node 26 compatibility. ([#4685](https://github.com/diegosouzapw/OmniRoute/pull/4685))
+- **fix(cli):** harden the systray2 tray runtime (port from 9router#1080). ([#4628](https://github.com/diegosouzapw/OmniRoute/pull/4628))
+- **fix(cli-tools):** tolerate JSONC (comments and trailing commas) in tool settings files. ([#4659](https://github.com/diegosouzapw/OmniRoute/pull/4659))
+- **fix(install):** make the `transformers` dependency optional so CUDA-host installs that lack Python bindings succeed. ([#4807](https://github.com/diegosouzapw/OmniRoute/pull/4807) — thanks @megamen32)
+- **fix(db):** correct storage tuning settings to prevent WAL runaway on high-write workloads. ([#4834](https://github.com/diegosouzapw/OmniRoute/pull/4834) — thanks @rdself)
+- **fix(image):** prevent compatible nodes from shadowing provider aliases in the image routing table. ([#4656](https://github.com/diegosouzapw/OmniRoute/pull/4656))
+
+**Plugin**
+
+- **fix(plugin):** opencode `auth.json` dual-key fallback for the auto-prefix migration. The config hook now looks up both the prefixed (`opencode-omniroute`) and bare (`omniroute`) keys, so users who authenticated before the `opencode-` prefix landed no longer need to re-auth. ([#5027](https://github.com/diegosouzapw/OmniRoute/pull/5027) — thanks @herjarsa)
+
+---
+
+### 🔒 Security
+
+- **fix(security):** block SSRF allowlist bypass via `x-relay-path` header manipulation on Deno/Vercel relays. ([#4899](https://github.com/diegosouzapw/OmniRoute/pull/4899))
+- **fix(security):** pin image-fetch DNS resolution to prevent SSRF DNS-rebinding attacks (GHSA-cmhj-wh2f-9cgx). ([#4634](https://github.com/diegosouzapw/OmniRoute/pull/4634))
+- **fix(security):** do not trust the loopback socket as local-only when the server is behind a reverse proxy, closing a potential auth bypass path. ([#4632](https://github.com/diegosouzapw/OmniRoute/pull/4632))
+- **fix(security):** validate the Kiro region parameter to prevent SSRF via crafted region strings (GHSA-6mwv-4mrm-5p3m). ([#4629](https://github.com/diegosouzapw/OmniRoute/pull/4629))
+- **fix(copilot):** replace `execSync` shell interpolation with `execFile` in the `runOmniRouteCli` tool to prevent command injection. The user-supplied command is now split into an argv array and passed to `execFile` (no shell), so shell metacharacters are treated as literal text; error output is routed through `sanitizeErrorMessage()`. ([#5024](https://github.com/diegosouzapw/OmniRoute/pull/5024) — thanks @hamsa0x7)
+
+---
+
+### 📝 Maintenance
+
+**God-file decomposition (continued, #3501)**
+
+- **refactor(chatCore):** extracted 12 focused helpers from `chatCore.ts` covering the streaming pipeline (`assembleStreamingPipeline`), cache-store logic (`storeStreamingSemanticCacheResponse`, `storeSemanticCacheResponse`), response headers (`assembleStreamingResponseHeaders`, `buildNonStreamingResponseHeaders`), JSON→SSE bridge (`maybeConvertJsonBodyToSse`), guardrail context (`buildPostCallGuardrailContext`), usage buffer (`applyClientUsageBuffer`), plugin hook (`runPluginOnRequestHook`), analytics (`writeCompressionAnalytics`, `emitOutputStyleTelemetry`), and compression predicates/settings (`resolveCompressionSettings`, et al.). ([#4811](https://github.com/diegosouzapw/OmniRoute/pull/4811)–[#4837](https://github.com/diegosouzapw/OmniRoute/pull/4837))
+- **refactor(sse/db/api):** continued decomposition of `services/usage.ts` (extracted quota-core, scalar/format helpers, Antigravity/GLM/MiniMax usage families), `db/core.ts` (schema-column reconciliation, snake↔camel column-mapping), `db/apiKeys.ts` (row-parsers, model-permission matching), and `validation.ts` (URL/headers/transport leaf layer, web-cookie/Meta-AI validators, enterprise-cloud + probe, audio/speech/apikey, search/embedding/rerank, and OpenAI/Anthropic format validators). ([#4921](https://github.com/diegosouzapw/OmniRoute/pull/4921)–[#4956](https://github.com/diegosouzapw/OmniRoute/pull/4956))
+- **refactor(pricing/providers):** decomposed `pricing.ts` into shared tiers + partitioned `DEFAULT_PRICING` modules, and split the `providers.ts` catalog into semantic data modules organized by provider family. ([#4917](https://github.com/diegosouzapw/OmniRoute/pull/4917), [#4918](https://github.com/diegosouzapw/OmniRoute/pull/4918))
+- **refactor(open-sse):** extract `safeParseJSON` utility and dedup `tryParseJSON` call sites; extract and dedup the fallback `tool_call` ID generation helper. ([#4735](https://github.com/diegosouzapw/OmniRoute/pull/4735), [#4736](https://github.com/diegosouzapw/OmniRoute/pull/4736))
+
+**Quality & CI**
+
+- **chore(quality):** release base-red reconciliation + ratchet rebaselines — file-size, env-doc, and catalog baseline updates across multiple gates. ([#4630](https://github.com/diegosouzapw/OmniRoute/pull/4630), [#4879](https://github.com/diegosouzapw/OmniRoute/pull/4879), [#4886](https://github.com/diegosouzapw/OmniRoute/pull/4886), [#4915](https://github.com/diegosouzapw/OmniRoute/pull/4915), [#4961](https://github.com/diegosouzapw/OmniRoute/pull/4961), [#4973](https://github.com/diegosouzapw/OmniRoute/pull/4973))
+- **ci(quality):** shift heavy validation gates to the PR→release merge fast-path to accelerate the release cycle. ([#4857](https://github.com/diegosouzapw/OmniRoute/pull/4857))
+- **fix(ci):** include `coverage/lcov.info` in the coverage-report artifact so SonarQube can consume it. ([#4670](https://github.com/diegosouzapw/OmniRoute/pull/4670))
+- **fix(test):** validate Anthropic-compatible connections via `POST /v1/messages` for accurate connectivity testing. ([#4657](https://github.com/diegosouzapw/OmniRoute/pull/4657))
+
+**Docs**
+
+- **docs(resilience):** document Quota-Share Concurrency Control — `max_concurrent` enforcement, serialization behavior, and cooldown-wait semantics. ([#4980](https://github.com/diegosouzapw/OmniRoute/pull/4980))
+- **docs(perf):** add per-endpoint p50/p95/p99 latency and cost budgets reference. ([#4867](https://github.com/diegosouzapw/OmniRoute/pull/4867) — thanks @KooshaPari)
+- **docs(ops):** add canonical incident response runbook. ([#4868](https://github.com/diegosouzapw/OmniRoute/pull/4868) — thanks @KooshaPari)
+- **docs(ops):** document the release-green family — `green-prs`, `check:release-green`, `babysit`, and nightly gate workflows. ([#4679](https://github.com/diegosouzapw/OmniRoute/pull/4679))
+- **docs(agentbridge):** document Electron `NODE_EXTRA_CA_CERTS`, real model IDs, and identity caveat for agent bridge integrations. ([#4718](https://github.com/diegosouzapw/OmniRoute/pull/4718))
+- **docs:** clarify Kiro provides ~50 credits/month per account, not unlimited. ([#4690](https://github.com/diegosouzapw/OmniRoute/pull/4690))
+
+**Misc**
+
+- **chore(claude,codex):** bump pinned CLI identities — Claude `2.1.158 → 2.1.187`, Codex `0.132.0 → 0.142.0`. ([#4883](https://github.com/diegosouzapw/OmniRoute/pull/4883))
+- **chore(dashboard):** rename Qoder display label from "Qoder AI" to "Qoder". ([#4733](https://github.com/diegosouzapw/OmniRoute/pull/4733))
+
+---
+
 ## [3.8.35] — 2026-06-23
 
 ### ✨ New Features
diff --git a/docs/openapi.yaml b/docs/openapi.yaml
index ca00d23623..94c3865437 100644
--- a/docs/openapi.yaml
+++ b/docs/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OmniRoute API
-  version: 3.8.35
+  version: 3.8.36
   description: |
     OmniRoute is a local-first AI API proxy router. It provides an OpenAI-compatible
     endpoint that routes requests to multiple AI providers with load balancing,
diff --git a/docs/ops/DATABASE_GUIDE.md b/docs/ops/DATABASE_GUIDE.md
index d2262a47dd..b681e30ebf 100644
--- a/docs/ops/DATABASE_GUIDE.md
+++ b/docs/ops/DATABASE_GUIDE.md
@@ -40,9 +40,10 @@ For **single-user, single-instance** deployments (the primary OmniRoute use case
 ```ts
 // src/lib/db/core.ts
 db.pragma("journal_mode = WAL");
-db.pragma("busy_timeout = 5000");
+db.pragma("busy_timeout = 2000");
 db.pragma("synchronous = NORMAL");
-db.pragma("cache_size = -2048");
+// Settings > System & Storage > Cache Size is applied as KiB.
+db.pragma("cache_size = -16384");
 ```
 
 WAL allows **concurrent reads** during writes — important for the dashboard, which queries while requests are being recorded.
diff --git a/docs/ops/RELEASE_CHECKLIST.md b/docs/ops/RELEASE_CHECKLIST.md
index fffe182769..ab9c37032b 100644
--- a/docs/ops/RELEASE_CHECKLIST.md
+++ b/docs/ops/RELEASE_CHECKLIST.md
@@ -8,6 +8,10 @@ lastUpdated: 2026-05-13
 
 > **Last updated:** 2026-05-13 — v3.8.0
 > Streamlined release flow that leverages Claude Code skills for automation.
+>
+> **Manter a fila/branch verdes entre releases:** veja [RELEASE_GREEN.md](./RELEASE_GREEN.md)
+> (família `/green-prs` + `npm run check:release-green` + `/babysit` + nightly). Rodar
+> periodicamente — e principalmente **antes** deste checklist — faz a release PR nascer verde.
 
 ## TL;DR
 
@@ -269,14 +273,15 @@ Before shipping any v3.8.x release, verify these additional items:
 - [ ] Update path keeps optional deps: `omniroute update --apply` and the auto-updater
       run `npm install -g … --include=optional` so `optionalDependencies` (better-sqlite3,
       keytar, tls-client, and the llmlingua SLM stack: `@atjsh/llmlingua-2`,
-      `@tensorflow/tfjs`, `js-tiktoken`) survive an update. The ultra `modelPath` SLM tier
-      additionally needs `@huggingface/transformers@3.5.2` (pinned — llmlingua-2 uses the 3.x
-      tokenizer API) and the tinybert model, auto-downloaded to `${DATA_DIR}/models/llmlingua`
-      on first use. Postinstall (`scripts/build/colocateOptionals.mjs`) then co-locates the SLM
-      optional closure into `dist/node_modules` so the worker resolves a SINGLE
-      `@huggingface/transformers` 3.5.2 instance — the standalone trace bundles only transformers,
-      not the dynamically-imported optionals, so without this the worker would load llmlingua-2
-      against the root's transformers and the SLM tier would silently fail-open.
+      `@huggingface/transformers@3.5.2`, `@tensorflow/tfjs`, `js-tiktoken`) survive an update.
+      `@huggingface/transformers` stays optional so its `onnxruntime-node` CUDA provider postinstall
+      cannot abort installation on CUDA 11 hosts. The ultra `modelPath` SLM tier also needs the
+      tinybert model, auto-downloaded to `${DATA_DIR}/models/llmlingua` on first use. Postinstall
+      (`scripts/build/colocateOptionals.mjs`) then co-locates the SLM optional closure into
+      `dist/node_modules` so the worker resolves a SINGLE `@huggingface/transformers` 3.5.2
+      optional instance — the standalone trace bundles only transformers, not the dynamically-imported
+      optionals, so without this the worker would load llmlingua-2 against the root's transformers
+      and the SLM tier would silently fail-open.
 - [ ] `omniroute status` works with no `.env` (CLI token path, loopback only)
 - [ ] `curl http://localhost:20128/api/shutdown` returns 401 (always-protected route)
 - [ ] `curl -H "host: evil.com" http://localhost:20128/api/mcp/sse` returns 401 (loopback guard)
diff --git a/docs/ops/RELEASE_GREEN.md b/docs/ops/RELEASE_GREEN.md
new file mode 100644
index 0000000000..72a6f60a84
--- /dev/null
+++ b/docs/ops/RELEASE_GREEN.md
@@ -0,0 +1,89 @@
+---
+title: "Release-Green — fila e release branch verdes"
+---
+
+# Release-Green: mantendo a fila e a release branch verdes
+
+## O problema que isto resolve
+
+O **gate completo** (`.github/workflows/ci.yml` — unit shards, vitest, ratchets,
+`package-artifact`, SonarQube, E2E) roda **apenas na release PR** (PR → `main`). PRs para
+`release/**` recebem só as **fast-gates** (`quality.yml`: testes TIA-impactados + typecheck +
+lint). Consequência: reds se acumulam silenciosamente na release branch e **explodem em camadas
+de ~40 min** no momento do release, uma de cada vez.
+
+A "família release-green" existe para **antecipar** esses reds — validar o equivalente ao gate
+completo **localmente / fora do release**, a qualquer momento, para que a release PR já nasça
+verde na primeira CI.
+
+> **Princípio inegociável:** nada disto bloqueia o contribuidor. Não adicionamos um required
+> check que falhe o PR dele. O **drift** (ratchets) é do mantenedor rebaselinar no release —
+> nunca uma preocupação do contribuidor. Nenhuma peça **fecha** um PR (roubo de crédito) nem
+> **enfraquece** um teste para passar.
+
+## A família (4 peças) — e como cada uma roda à parte
+
+| Peça                                                                      | O que é                                                                              | Quando rodar                                                                  | Escopo                               |
+| ------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------- | ------------------------------------ |
+| **`/green-prs`** (Solução A)                                              | Varredura sob demanda do mantenedor sobre a **fila de PRs abertos**                  | **À parte, periódico** — e principalmente **antes** de um `/generate-release` | Fila inteira de PRs → `release/**`   |
+| **`/validate-release-green`** (Solução C — `npm run check:release-green`) | Motor de validação: reproduz o gate completo contra uma branch OU um merge-candidato | À parte, a qualquer momento                                                   | Uma branch específica ou um PR-merge |
+| **`/babysit <PR#>`**                                                      | Conduz a **CI ao vivo** de **um** PR até o verde                                     | À parte, por PR                                                               | Um PR                                |
+| **`nightly-release-green.yml`** (Solução D)                               | Workflow noturno automático; abre issue em HARD red                                  | Automático (cron)                                                             | A release branch ativa               |
+
+**Resposta curta à pergunta "é só para release?":** **não.** O `/green-prs` foi desenhado para
+rodar **de tempos em tempos, entre releases**. Rodar à parte é o uso normal — o release é apenas
+o momento em que rodá-lo dá mais retorno.
+
+## Solução C — `npm run check:release-green` (o motor)
+
+Reproduz a validação release-equivalente contra a árvore de trabalho atual e classifica cada red:
+
+- **HARD** (typecheck, lint errors, unit, vitest, db-rules, public-creds, opcional
+  `package-artifact`) → **defeito real**; `exit 1`. Conserta-se na branch de origem (TDD, Rule #18).
+- **DRIFT** (eslint **warnings**, cognitive-complexity, file-size) → drift de ratchet acumulado no
+  ciclo, **não é culpa do contribuidor**; é só reportado e **rebaselinado pelo mantenedor no
+  release**. Drift **nunca** muda o exit code — então nunca bloqueia ninguém.
+
+```bash
+npm run check:release-green                 # branch atual (working tree)
+node scripts/quality/validate-release-green.mjs --json   # saída estruturada
+node scripts/quality/validate-release-green.mjs --quick  # pula unit+vitest (só drift+typecheck+lint)
+node scripts/quality/validate-release-green.mjs --with-build  # inclui package-artifact (lento)
+```
+
+Diagnostica e **reporta** apenas (sem auto-fix). A orquestração de fix-to-green vive no
+`/green-prs` e no `/review-prs`.
+
+## Solução A — `/green-prs` (a varredura da fila)
+
+Procedimento (resumo — ver a skill `green-prs` para o detalhe):
+
+1. **Inventariar** a fila de PRs abertos contra a release branch ativa.
+2. **Triar** cada PR (viável / reject-worthy / needs-author) — reject/needs-author são
+   **reportados, não fechados** (o dono decide).
+3. Para cada viável, em **worktree isolado** (Rule #19), trazer o PR ao tip da release e rodar
+   `npm run check:release-green`:
+   - **HARD** → consertar **na branch do contribuidor** via coautoria (mantém o "Merged" do autor),
+     re-rodar até zerar os HARD.
+   - **DRIFT** → deixar; é rebaselinado no release.
+4. **Reportar** uma tabela PR × (verdict, HARD reds, fixado?, DRIFT, release-green agora?).
+
+Pode **preparar** a fila sem mergear; só mergeia quando explicitamente pedido — e nunca fecha PR.
+
+## Cadência recomendada
+
+- Rode **`/green-prs` periodicamente** (ex.: semanalmente) e **sempre antes de um
+  `/generate-release`**.
+- Deixe o **`nightly-release-green.yml`** (Solução D) como sinal contínuo: quando ele abrir issue
+  de HARD red, é hora de uma varredura.
+- Use **`/validate-release-green`** ad-hoc para checar uma branch ou um merge-candidato pontual.
+- Use **`/babysit <PR#>`** quando um PR específico precisa ser conduzido ao verde na CI ao vivo.
+
+## Relação com o release
+
+- `/generate-release` chama a validação na **Fase 0 (pré-flight)**: rebaselina o DRIFT e conserta
+  o HARD antes de abrir a release PR.
+- `/review-prs` usa o gate release-green no passo de decisão de merge (verde-antes-de-merge).
+
+O objetivo de todas as peças é o mesmo: **a release PR verde na primeira CI**, em vez de surfar
+reds em camadas de 40 min no dia do release.
diff --git a/docs/ops/meta.json b/docs/ops/meta.json
index dfc1af0180..5060d2c17f 100644
--- a/docs/ops/meta.json
+++ b/docs/ops/meta.json
@@ -2,6 +2,7 @@
   "title": "Operations",
   "pages": [
     "RELEASE_CHECKLIST",
+    "RELEASE_GREEN",
     "VM_DEPLOYMENT_GUIDE",
     "FLY_IO_DEPLOYMENT_GUIDE",
     "TUNNELS_GUIDE",
diff --git a/docs/providers/AGENTROUTER.md b/docs/providers/AGENTROUTER.md
index dcb9e18e7b..7130cc53d8 100644
--- a/docs/providers/AGENTROUTER.md
+++ b/docs/providers/AGENTROUTER.md
@@ -124,7 +124,7 @@ request (see `open-sse/services/claudeCodeCompatible.ts`):
 | Header                                      | Value                                                                                               |
 | ------------------------------------------- | --------------------------------------------------------------------------------------------------- |
 | `Authorization`                             | `Bearer <api-key>`                                                                                  |
-| `User-Agent`                                | `claude-cli/2.1.158 (external, sdk-cli)`                                                            |
+| `User-Agent`                                | `claude-cli/2.1.187 (external, sdk-cli)`                                                            |
 | `anthropic-version`                         | `2023-06-01`                                                                                        |
 | `anthropic-beta`                            | `claude-code-20250219,interleaved-thinking-2025-05-14,effort-2025-11-24`                            |
 | Per-connection redact-thinking beta toggle  | Adds `redact-thinking-2026-02-12` for upstreams that specifically require redacted thinking streams |
diff --git a/docs/reference/ENVIRONMENT.md b/docs/reference/ENVIRONMENT.md
index ffebb7a27d..9828821bed 100644
--- a/docs/reference/ENVIRONMENT.md
+++ b/docs/reference/ENVIRONMENT.md
@@ -386,6 +386,8 @@ detection above).
 | `OMNIROUTE_DISABLE_BACKGROUND_SERVICES`         | `false`                                             | `src/instrumentation-node.ts`                               | Disable all background services (sync, pricing, model refresh). Useful for CI/test.                                                                                    |
 | `OMNIROUTE_ENABLE_RUNTIME_BACKGROUND_TASKS`     | _(unset)_                                           | `src/lib/config/runtimeSettings.ts`                         | Force background tasks on under automated test detection. Set `1` to override the test heuristic.                                                                      |
 | `OMNIROUTE_BUDGET_RESET_JOB_INTERVAL_MS`        | `600000`                                            | `src/lib/jobs/budgetResetJob.ts`                            | Budget reset check cadence (ms). Floor `10000`.                                                                                                                        |
+| `OMNIROUTE_CONNECTION_RECOVERY_INTERVAL_MS`     | `60000`                                             | `src/lib/quota/connectionRecovery.ts`                       | Proactive connection-cooldown recovery cadence (ms): re-validates connections whose transient `rate_limited_until` has elapsed, off the request hot path. Floor `5000`. |
+| `OMNIROUTE_DISABLE_CONNECTION_RECOVERY`         | `false`                                             | `src/lib/quota/connectionRecovery.ts`                       | Disable the proactive connection-cooldown recovery scheduler (lazy recovery in `getProviderCredentials` still applies).                                                |
 | `OMNIROUTE_REASONING_CACHE_CLEANUP_INTERVAL_MS` | `1800000`                                           | `src/lib/jobs/reasoningCacheCleanupJob.ts`                  | Reasoning cache cleanup cadence (ms). Floor `60000`.                                                                                                                   |
 | `OMNIROUTE_CONFIG_HOT_RELOAD_MS`                | `5000`                                              | `src/lib/config/hotReload.ts`                               | Polling interval (ms) for config hot-reload. Lower than `1000` is rejected.                                                                                            |
 | `OMNIROUTE_DISABLE_REDIS_AUTH_CACHE`            | _(enabled)_                                         | `src/lib/db/apiKeys.ts`                                     | Set `1` to bypass the Redis-backed API-key auth cache (forces DB reads).                                                                                               |
@@ -471,7 +473,7 @@ process.env[`${PROVIDER_ID}_USER_AGENT`]
 | -------------------------------- | --------------------------------------------- | ------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
 | `CLAUDE_USER_AGENT`              | `claude-cli/2.1.145 (external, cli)`          | When Anthropic releases a new CLI version                                                        |
 | `CLAUDE_DISABLE_TOOL_NAME_CLOAK` | `false`                                       | `executors/base.ts` + `executors/cliproxyapi.ts`                                                 | Set to `1`/`true` to forward third-party harness tool names verbatim to Anthropic on both Anthropic-bound paths (native OAuth and CLIProxyAPI). By default the executor deterministically aliases non-Claude-Code tool names (Claude Code canonical mapping where one exists, otherwise PascalCase) and reverses them on the response via `_toolNameMap`, so harnesses with snake_case tools are not refused as fingerprinted third-party clients. Debugging only. |
-| `CODEX_USER_AGENT`               | `codex-cli/0.132.0 (Windows 10.0.26200; x64)` | When OpenAI updates the Codex CLI                                                                |
+| `CODEX_USER_AGENT`               | `codex-cli/0.142.0 (Windows 10.0.26200; x64)` | When OpenAI updates the Codex CLI                                                                |
 | `CODEX_CLIENT_VERSION`           | `0.131.0`                                     | Override Codex client version independently of full UA string                                    |
 | `GITHUB_USER_AGENT`              | `GitHubCopilotChat/0.45.1`                    | When GitHub Copilot Chat updates                                                                 |
 | `ANTIGRAVITY_USER_AGENT`         | `antigravity/2.0.1 darwin/arm64`              | When Antigravity IDE updates                                                                     |
@@ -576,6 +578,7 @@ REQUEST_TIMEOUT_MS (global override)
 | `FETCH_TIMEOUT_MS`                       | `600000`             | Total HTTP request timeout for upstream provider calls.                                                     |
 | `STREAM_IDLE_TIMEOUT_MS`                 | `600000`             | Max silence between SSE chunks before aborting. Extended-thinking models rarely pause >90s.                 |
 | `STREAM_READINESS_TIMEOUT_MS`            | `80000`              | Time to receive the first non-ping SSE event. Inherits `REQUEST_TIMEOUT_MS` when set.                       |
+| `OMNIROUTE_CODEX_DROP_NONSTANDARD_EVENTS` | _(off)_             | Strip non-standard `codex.*` SSE events (e.g. `codex.rate_limits`) that break the OpenAI SDK's `responses.stream()` with a 502. Set `true`/`1`/`yes` to enable. |
 | `FETCH_HEADERS_TIMEOUT_MS`               | = `FETCH_TIMEOUT_MS` | Time to receive response headers.                                                                           |
 | `FETCH_BODY_TIMEOUT_MS`                  | = `FETCH_TIMEOUT_MS` | Time to receive the full response body.                                                                     |
 | `FETCH_CONNECT_TIMEOUT_MS`               | `30000`              | TCP connection establishment timeout.                                                                       |
@@ -616,6 +619,8 @@ Provider-level circuit breaker tuning. Defaults reflect the scaled values used s
 | `OMNIROUTE_CIRCUIT_BREAKER_API_KEY_RESET_MS`  | `30000` | `open-sse/config/constants.ts` | Reset window (ms) for API-key provider breaker.                             |
 | `OMNIROUTE_CIRCUIT_BREAKER_LOCAL_THRESHOLD`   | `2`     | `open-sse/config/constants.ts` | Consecutive failure threshold for local providers (Ollama, LM Studio, ...). |
 | `OMNIROUTE_CIRCUIT_BREAKER_LOCAL_RESET_MS`    | `15000` | `open-sse/config/constants.ts` | Reset window (ms) for local provider breaker.                               |
+| `PIN_DROP_BACKOFF_LEVEL`                      | `2`     | `open-sse/services/combo.ts`   | Backoff depth at which a context-cache pin's provider is deemed durably unhealthy and the pin is dropped for failover. |
+| `PIN_DROP_GRACE_MS`                           | `20000` | `open-sse/services/combo.ts`   | Anti-flap window (ms) tolerating brief transient cooldowns before dropping a context-cache pin.                       |
 
 ### Scenarios
 
@@ -745,7 +750,13 @@ Automatic model pricing data synchronization from external sources.
 | `AWS_REGION`                              | _(unset)_          | `src/lib/providers/validation.ts`, `open-sse/handlers/audioSpeech.ts` | Region used to construct AWS Bedrock endpoints (Kiro, audio).                                               |
 | `AWS_DEFAULT_REGION`                      | _(unset)_          | `src/lib/providers/validation.ts`, `open-sse/handlers/audioSpeech.ts` | Fallback when `AWS_REGION` is not set.                                                                      |
 | `CLOUDFLARE_ACCOUNT_ID`                   | _(unset)_          | `open-sse/executors/cloudflare-ai.ts`                                 | Account ID for Cloudflare Workers AI.                                                                       |
+| `CLOUDFLARE_API_BASE`                     | `https://api.cloudflare.com/client/v4` | `src/app/api/settings/proxy/cloudflare-deploy/route.ts`           | Override the Cloudflare REST API base used by the proxy-pool Workers relay deployer (#4640 / 9router#1360). |
+| `NEXT_PUBLIC_CLOUDFLARE_RELAY_DEFAULT_PROJECT` | `omniroute-relay`  | `src/app/(dashboard)/dashboard/settings/components/proxy/CloudflareRelayModal.tsx` | Default worker project name suggested in the proxy-pool "Deploy Relay" modal.                                |
+| `NEXT_PUBLIC_CLOUDFLARE_RELAY_ENABLED`    | `true`             | `src/app/(dashboard)/dashboard/settings/components/proxy/ProxyPoolTab.tsx`        | Set to `false` to hide the Cloudflare Workers relay option from the Proxy Pool tab.                          |
 | `CLOUDFLARED_BIN`                         | auto-detect        | `src/lib/cloudflaredTunnel.ts`                                        | Custom path to `cloudflared` binary.                                                                        |
+| `DENO_DEPLOY_API_BASE`                    | `https://api.deno.com/v2` | `src/app/api/settings/proxy/deno-deploy/route.ts`              | Override the Deno Deploy REST API base used by the proxy-pool relay deployer (#4643 / 9router#1437).        |
+| `NEXT_PUBLIC_DENO_RELAY_DEFAULT_PROJECT`  | `omniroute-deno-relay` | `src/app/(dashboard)/dashboard/settings/components/proxy/DenoRelayModal.tsx` | Default Deno Deploy app name suggested in the proxy-pool "Deploy Relay" modal.                              |
+| `NEXT_PUBLIC_DENO_RELAY_ENABLED`          | `true`             | `src/app/(dashboard)/dashboard/settings/components/proxy/ProxyPoolTab.tsx` | Set to `false` to hide the Deno Deploy relay option from the Proxy Pool tab.                                |
 | `SEARCH_CACHE_TTL_MS`                     | `300000` (5 min)   | `open-sse/services/searchCache.ts`                                    | TTL for search API (Perplexity, Brave, etc.) response caching.                                              |
 | `ALLOW_MULTI_CONNECTIONS_PER_COMPAT_NODE` | `false`            | `src/app/api/providers/route.ts`                                      | Allow multiple simultaneous connections per OpenAI-compatible provider.                                     |
 | `ENABLE_CC_COMPATIBLE_PROVIDER`           | `false`            | `src/shared/utils/featureFlags.ts`                                    | Reveal the experimental CC-compatible provider UI for Claude Code-only relays.                              |
@@ -966,6 +977,7 @@ Provider quota endpoints, network tunnels (Tailscale, Ngrok, MITM debug proxy),
 | `QUOTA_STORE_REDIS_URL`                    | _(unset)_                                                                   | `src/lib/quota/storeFactory.ts`                                           | Redis connection string used when `QUOTA_STORE_DRIVER=redis` (e.g. `redis://localhost:6379`).                                                                                                                                                                                                                                                                         |
 | `QUOTA_SATURATION_THRESHOLD`               | `0.5`                                                                       | `src/lib/quota/enforce.ts`                                                | Pool saturation ratio (0..1); at/above it the pool enters strict mode (no borrowing).                                                                                                                                                                                                                                                                                 |
 | `QUOTA_SOFT_DEPRIORITIZE_FACTOR`           | `0.7`                                                                       | `open-sse/services/combo.ts`                                              | Score multiplier (0..1) applied to a target when the soft quota policy deprioritizes it.                                                                                                                                                                                                                                                                              |
+| `STATUS_SOFT_DEPRIORITIZE_FACTOR`          | `0.5`                                                                       | `open-sse/services/combo/autoStrategy.ts`                                | Score multiplier (0..1) applied to an exhausted provider (`credits_exhausted`/`rate_limited`) in auto-combo scoring when the preflight quota cutoff is OFF (#4540).                                                                                                                                                                                                     |
 | `QUOTA_CONSUMPTION_RETENTION_DAYS`         | `14`                                                                        | `src/lib/db/quotaConsumption.ts`                                          | Retention window (days) for `quota_consumption` buckets before GC (`gcQuotaConsumption`).                                                                                                                                                                                                                                                                             |
 | `QUOTA_PREFLIGHT_CUTOFF_ENABLED`           | `false`                                                                     | `src/lib/resilience/settings.ts`                                          | Opt-in (default OFF): enables the auto-routing hard quota cutoff that drops low-quota candidates before scoring.                                                                                                                                                                                                                                                      |
 | `OMNIROUTE_AUTO_FREE_FALLBACK_TO_FULL_POOL` | `false`                                                                    | `open-sse/services/autoCombo/virtualFactory.ts`                          | Opt-in (default OFF): when an `auto/<category>:<tier>` filter matches no connected candidates, restore the legacy behavior of falling back to the full (unfiltered) pool instead of returning an empty pool. Default OFF makes `:free` mean "free tier only".                                                                                                          |
@@ -1082,3 +1094,12 @@ is developer tooling only.
 | `OMNIROUTE_URL`    | `http://localhost:20128` | `scripts/ad-hoc/regen-opencode-config.ts` | Base URL of the OmniRoute instance to query for `/v1/models`.                                                             |
 | `OMNIROUTE_KEY`    | _(unset)_                | `scripts/ad-hoc/regen-opencode-config.ts` | API key to authenticate against the OmniRoute `/v1/models` endpoint. Falls back to `OPENCODE_API_KEY` when unset.         |
 | `OPENCODE_API_KEY` | _(unset)_                | `scripts/ad-hoc/regen-opencode-config.ts` | OpenCode-style API key (`sk-...`) written into the regenerated `opencode.json`. Falls back to `OMNIROUTE_KEY` when unset. |
+
+### Compression offline-eval harness (ad-hoc tooling)
+
+Used by `scripts/compression-eval/index.ts`, the offline compression evaluation CLI.
+Not required for normal operation — developer tooling only.
+
+| Variable                    | Default      | Source File                       | Description                                                                                                                                              |
+| --------------------------- | ------------ | --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `OMNIROUTE_EVAL_CREDENTIALS` | `{}` (empty) | `scripts/compression-eval/index.ts` | Operator-supplied JSON credentials for the provider exercised by the offline compression-eval CLI (parsed with `JSON.parse`). Leave unset for a dry run. |
diff --git a/docs/security/STEALTH_GUIDE.md b/docs/security/STEALTH_GUIDE.md
index 0983a126bf..8250882c68 100644
--- a/docs/security/STEALTH_GUIDE.md
+++ b/docs/security/STEALTH_GUIDE.md
@@ -88,7 +88,7 @@ Applied to: `system` blocks, all `messages[].content`, and `tools[].description`
 
 For third-party Anthropic relays that only accept "real Claude Code" traffic:
 
-- `CLAUDE_CODE_COMPATIBLE_USER_AGENT = "claude-cli/2.1.158 (external, sdk-cli)"`
+- `CLAUDE_CODE_COMPATIBLE_USER_AGENT = "claude-cli/2.1.187 (external, sdk-cli)"`
 - `CLAUDE_CODE_COMPATIBLE_STAINLESS_PACKAGE_VERSION = "0.94.0"`
 - `CLAUDE_CODE_COMPATIBLE_STAINLESS_RUNTIME_VERSION = "v24.3.0"`
 - `anthropic-beta = "claude-code-20250219,interleaved-thinking-2025-05-14,effort-2025-11-24"` by default
@@ -213,8 +213,8 @@ All MITM endpoints require management auth (`requireCliToolsAuth`). The sudo pas
 
 | Variable                 | Default                                       |
 | ------------------------ | --------------------------------------------- |
-| `CLAUDE_USER_AGENT`      | `claude-cli/2.1.158 (external, cli)`          |
-| `CODEX_USER_AGENT`       | `codex-cli/0.132.0 (Windows 10.0.26200; x64)` |
+| `CLAUDE_USER_AGENT`      | `claude-cli/2.1.187 (external, cli)`          |
+| `CODEX_USER_AGENT`       | `codex-cli/0.142.0 (Windows 10.0.26200; x64)` |
 | `GITHUB_USER_AGENT`      | `GitHubCopilotChat/0.45.1`                    |
 | `ANTIGRAVITY_USER_AGENT` | `antigravity/2.0.1 darwin/arm64`              |
 | `KIRO_USER_AGENT`        | `AWS-SDK-JS/3.0.0 kiro-ide/1.0.0`             |
diff --git a/electron/package-lock.json b/electron/package-lock.json
index fd59e11874..54c681a2c2 100644
--- a/electron/package-lock.json
+++ b/electron/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "omniroute-desktop",
-  "version": "3.8.35",
+  "version": "3.8.36",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "omniroute-desktop",
-      "version": "3.8.35",
+      "version": "3.8.36",
       "license": "MIT",
       "dependencies": {
         "electron-updater": "^6.8.9"
diff --git a/electron/package.json b/electron/package.json
index c66f0d6b51..f7eaf45c7e 100644
--- a/electron/package.json
+++ b/electron/package.json
@@ -1,6 +1,6 @@
 {
   "name": "omniroute-desktop",
-  "version": "3.8.35",
+  "version": "3.8.36",
   "description": "OmniRoute Desktop Application",
   "main": "main.js",
   "author": {
diff --git a/next.config.mjs b/next.config.mjs
index 5a6d13722e..2f06962ee2 100644
--- a/next.config.mjs
+++ b/next.config.mjs
@@ -113,6 +113,17 @@ const nextConfig = {
     // PR-2 of diegosouzapw/OmniRoute#3932: tree-shake barrel re-exports so
     // route bundles don't pull in 14 locale files, every lucide-react icon,
     // or the full date-fns surface when only one helper is used.
+    //
+    // NOTE: this list must only contain EXTERNAL barrel libraries. Do NOT add
+    // the internal `@omniroute/open-sse` workspace here: optimizePackageImports
+    // makes Next.js resolve every export of the package's barrel at build time,
+    // and open-sse's `index.ts` re-exports the entire streaming engine
+    // (executors/translators/services/handlers/mcp-server — thousands of
+    // modules). Combined with the #3501 god-file splits (which multiplied the
+    // re-export edges), this drove the webpack production pass into a heap
+    // runaway that OOM'd even at a 28 GB --max-old-space-size (RSS pinned at the
+    // ceiling in a GC death-spiral). Removing it keeps the build's heap bounded.
+    // optimizePackageImports is designed for external libs, not workspaces.
     optimizePackageImports: [
       "lobehub/icons",
       "@lobehub/icons",
@@ -122,7 +133,6 @@ const nextConfig = {
       "lodash-es",
       "material-symbols",
       "next-intl",
-      "@omniroute/open-sse",
     ],
   },
   outputFileTracingRoot: projectRoot,
diff --git a/open-sse/config/anthropicHeaders.ts b/open-sse/config/anthropicHeaders.ts
index 0cad3c043c..3ddcadc550 100644
--- a/open-sse/config/anthropicHeaders.ts
+++ b/open-sse/config/anthropicHeaders.ts
@@ -64,7 +64,7 @@ export function mergeClientAnthropicBeta(
   return baseList.join(",");
 }
 
-export const CLAUDE_CLI_VERSION = "2.1.158";
+export const CLAUDE_CLI_VERSION = "2.1.187";
 export const CLAUDE_CLI_USER_AGENT = `claude-cli/${CLAUDE_CLI_VERSION} (external, cli)`;
 export const CLAUDE_CLI_STAINLESS_PACKAGE_VERSION = "0.94.0";
 export const CLAUDE_CLI_STAINLESS_RUNTIME_VERSION = "v24.3.0";
diff --git a/open-sse/config/codexClient.ts b/open-sse/config/codexClient.ts
index 746870df73..1b6afa395f 100644
--- a/open-sse/config/codexClient.ts
+++ b/open-sse/config/codexClient.ts
@@ -1,4 +1,4 @@
-const DEFAULT_CODEX_CLIENT_VERSION = "0.132.0";
+const DEFAULT_CODEX_CLIENT_VERSION = "0.142.0";
 const DEFAULT_CODEX_USER_AGENT_PLATFORM = "Windows 10.0.26200";
 const DEFAULT_CODEX_USER_AGENT_ARCH = "x64";
 const CODEX_VERSION_OVERRIDE_ENV = "CODEX_CLIENT_VERSION";
diff --git a/open-sse/config/providers/index.ts b/open-sse/config/providers/index.ts
index 21a74252fc..ef02d0697f 100644
--- a/open-sse/config/providers/index.ts
+++ b/open-sse/config/providers/index.ts
@@ -166,6 +166,7 @@ import { kiroProvider } from "./registry/kiro/index.ts";
 import { openadapterProvider } from "./registry/openadapter/index.ts";
 import { ditProvider } from "./registry/dit/index.ts";
 import { tokenrouterProvider } from "./registry/tokenrouter/index.ts";
+import { codebuddy_cnProvider } from "./registry/codebuddy-cn/index.ts";
 
 export const REGISTRY: Record<string, RegistryEntry> = {
   aimlapi: aimlapiProvider,
@@ -334,4 +335,5 @@ export const REGISTRY: Record<string, RegistryEntry> = {
   openadapter: openadapterProvider,
   dit: ditProvider,
   tokenrouter: tokenrouterProvider,
+  "codebuddy-cn": codebuddy_cnProvider,
 };
diff --git a/open-sse/config/providers/registry/codebuddy-cn/index.ts b/open-sse/config/providers/registry/codebuddy-cn/index.ts
new file mode 100644
index 0000000000..e72492a029
--- /dev/null
+++ b/open-sse/config/providers/registry/codebuddy-cn/index.ts
@@ -0,0 +1,151 @@
+import type { RegistryEntry } from "../../shared.ts";
+
+/**
+ * CodeBuddy CN (Tencent) — copilot.tencent.com.
+ *
+ * Unified OpenAI-compatible gateway behind Tencent's CodeBuddy CLI. Carries 15
+ * models (GLM, Kimi, MiniMax, DeepSeek, Hunyuan) and reasons via OpenAI-style
+ * `reasoning_effort` (not vendor-native thinking shapes). Streaming is forced
+ * by the executor because non-stream requests are rejected with code 11101.
+ *
+ * Short alias "cbcn" reserves "cbai" for a future CodeBuddy intl variant.
+ * Per-model context windows/vision are advertised in the catalog below.
+ */
+export const codebuddy_cnProvider: RegistryEntry = {
+  id: "codebuddy-cn",
+  alias: "cbcn",
+  format: "openai",
+  executor: "codebuddy-cn",
+  baseUrl: "https://copilot.tencent.com/v2/chat/completions",
+  authType: "oauth",
+  authHeader: "bearer",
+  headers: {
+    "User-Agent": "CLI/2.108.1 CodeBuddy/2.108.1",
+    "X-Product": "SaaS",
+    "X-IDE-Type": "CLI",
+    "X-IDE-Name": "CLI",
+    "x-requested-with": "XMLHttpRequest",
+    "x-codebuddy-request": "1",
+  },
+  models: [
+    // contextLength is the OmniRoute analogue of upstream's contextWindow;
+    // supportsReasoning + supportsVision drive UI affordances and translator
+    // decisions. Sourced from the gateway's model config.
+    {
+      id: "glm-5.2",
+      name: "GLM-5.2",
+      contextLength: 1000000,
+      maxOutputTokens: 48000,
+      supportsReasoning: true,
+    },
+    {
+      id: "glm-5.1",
+      name: "GLM-5.1",
+      contextLength: 200000,
+      maxOutputTokens: 48000,
+      supportsReasoning: true,
+    },
+    {
+      id: "glm-5.0",
+      name: "GLM-5.0",
+      contextLength: 200000,
+      maxOutputTokens: 48000,
+      supportsReasoning: true,
+    },
+    {
+      id: "glm-5.0-turbo",
+      name: "GLM-5.0-Turbo",
+      contextLength: 200000,
+      maxOutputTokens: 48000,
+      supportsReasoning: true,
+    },
+    {
+      id: "glm-5v-turbo",
+      name: "GLM-5v-Turbo",
+      contextLength: 200000,
+      maxOutputTokens: 38000,
+      supportsReasoning: true,
+      supportsVision: true,
+    },
+    {
+      id: "glm-4.7",
+      name: "GLM-4.7",
+      contextLength: 200000,
+      maxOutputTokens: 48000,
+      supportsReasoning: true,
+    },
+    {
+      id: "minimax-m3",
+      name: "MiniMax-M3",
+      contextLength: 512000,
+      maxOutputTokens: 48000,
+      supportsReasoning: true,
+      supportsVision: true,
+    },
+    {
+      id: "minimax-m2.7",
+      name: "MiniMax-M2.7",
+      contextLength: 200000,
+      maxOutputTokens: 48000,
+      supportsReasoning: true,
+      supportsVision: true,
+    },
+    {
+      id: "kimi-k2.7",
+      name: "Kimi-K2.7-Code",
+      contextLength: 256000,
+      maxOutputTokens: 32000,
+      supportsReasoning: true,
+      supportsVision: true,
+    },
+    {
+      id: "kimi-k2.6",
+      name: "Kimi-K2.6",
+      contextLength: 256000,
+      maxOutputTokens: 32000,
+      supportsReasoning: true,
+      supportsVision: true,
+    },
+    {
+      id: "kimi-k2.5",
+      name: "Kimi-K2.5",
+      contextLength: 164000,
+      maxOutputTokens: 32000,
+      supportsReasoning: true,
+      supportsVision: true,
+    },
+    {
+      id: "hy3-preview",
+      name: "Hy3 Preview",
+      contextLength: 192000,
+      maxOutputTokens: 64000,
+      supportsReasoning: true,
+      supportsVision: true,
+    },
+    {
+      id: "deepseek-v4-pro",
+      name: "DeepSeek-V4-Pro",
+      contextLength: 1000000,
+      maxOutputTokens: 50000,
+      supportsReasoning: true,
+      supportsVision: true,
+    },
+    {
+      id: "deepseek-v4-flash",
+      name: "DeepSeek-V4-Flash",
+      contextLength: 1000000,
+      maxOutputTokens: 50000,
+      supportsReasoning: true,
+      supportsVision: true,
+    },
+    {
+      id: "deepseek-v3-2-volc",
+      name: "DeepSeek-V3.2",
+      contextLength: 96000,
+      maxOutputTokens: 32000,
+      supportsReasoning: true,
+    },
+  ],
+};
+
+export default codebuddy_cnProvider;
diff --git a/open-sse/config/providers/registry/opencode/go/index.ts b/open-sse/config/providers/registry/opencode/go/index.ts
index 224d3deab1..b1c0b4f12e 100644
--- a/open-sse/config/providers/registry/opencode/go/index.ts
+++ b/open-sse/config/providers/registry/opencode/go/index.ts
@@ -13,8 +13,14 @@ export const opencode_goProvider: RegistryEntry = {
   authPrefix: "Bearer",
   defaultContextLength: 200000,
   models: [
+    // Port from decolua/9router 8efacc11: align with official Go endpoints —
+    // glm-5.2 is now advertised and Kimi chat traffic must route through
+    // `kimi-k2.7-code` (the live API rejects the plain `kimi-k2.7` alias for
+    // `/chat/completions`, even though the docs config example uses it).
+    { id: "glm-5.2", name: "GLM-5.2" },
     { id: "glm-5.1", name: "GLM-5.1" },
     { id: "glm-5", name: "GLM-5" },
+    { id: "kimi-k2.7-code", name: "Kimi K2.7 Code" },
     { id: "kimi-k2.6", name: "Kimi K2.6" },
     { id: "kimi-k2.5", name: "Kimi K2.5" },
     { id: "mimo-v2.5-pro", name: "MiMo-V2.5-Pro" },
diff --git a/open-sse/config/providers/registry/perplexity/index.ts b/open-sse/config/providers/registry/perplexity/index.ts
index 97f1844ad9..14b90d413d 100644
--- a/open-sse/config/providers/registry/perplexity/index.ts
+++ b/open-sse/config/providers/registry/perplexity/index.ts
@@ -6,6 +6,11 @@ export const perplexityProvider: RegistryEntry = {
   format: "openai",
   executor: "default",
   baseUrl: "https://api.perplexity.ai/chat/completions",
+  // Perplexity deprecated the unversioned `/models` endpoint (returns 404), so
+  // pin an explicit `modelsUrl` here. Without it, validateOpenAILikeProvider
+  // (src/lib/providers/validation.ts) derives `<baseUrl>/models` via
+  // addModelsSuffix and probes the dead endpoint, misclassifying valid keys.
+  modelsUrl: "https://api.perplexity.ai/v1/models",
   authType: "apikey",
   authHeader: "bearer",
   models: [
diff --git a/open-sse/config/providers/shared.ts b/open-sse/config/providers/shared.ts
index 5f41f90c4a..0447b7bb23 100644
--- a/open-sse/config/providers/shared.ts
+++ b/open-sse/config/providers/shared.ts
@@ -380,6 +380,9 @@ export const CHAT_OPENAI_COMPAT_MODELS: Record<string, RegistryModel[]> = {
     // notices); replaced by kimi-k2-5-260127.
     "kimi-k2-5-260127",
     "glm-4-7-251222",
+    // DeepSeek V4 models available on Volcengine Ark (port from upstream PR #1473)
+    "DeepSeek-V4-Flash",
+    "DeepSeek-V4-Pro",
   ]),
   ai21: buildModels(["jamba-large-1.7", "jamba-mini-2"]),
   gigachat: buildModels(["GigaChat-2-Max", "GigaChat-2-Pro", "GigaChat-2-Lite"]),
diff --git a/open-sse/config/videoRegistry.ts b/open-sse/config/videoRegistry.ts
index 12d0c8cbc3..af1f3652b4 100644
--- a/open-sse/config/videoRegistry.ts
+++ b/open-sse/config/videoRegistry.ts
@@ -39,6 +39,23 @@ export const VIDEO_PROVIDERS: Record<string, VideoProvider> = {
     ],
   },
 
+  googleflow: {
+    id: "googleflow",
+    alias: "flow",
+    // ⚠️ Wire host isolated for live HAR validation (Rule #18). The handler reuses
+    // the Google account OAuth credential (accessToken + Cloud Code projectId) that
+    // the Antigravity provider already establishes; no separate OAuth flow is added.
+    baseUrl: "https://aisandbox-pa.googleapis.com",
+    authType: "oauth",
+    authHeader: "bearer",
+    format: "google-flow",
+    models: [
+      { id: "veo-3.1-generate", name: "Veo 3.1 (Google Flow)" },
+      { id: "veo-3.1-fast-generate", name: "Veo 3.1 Fast (Google Flow)" },
+      { id: "veo-3.0-generate", name: "Veo 3.0 (Google Flow)" },
+    ],
+  },
+
   kie: {
     id: "kie",
     baseUrl: "https://api.kie.ai",
diff --git a/open-sse/executors/antigravity.ts b/open-sse/executors/antigravity.ts
index b8b136673c..178601dd44 100644
--- a/open-sse/executors/antigravity.ts
+++ b/open-sse/executors/antigravity.ts
@@ -45,6 +45,7 @@ import {
   stripCloudCodeThinkingConfig,
 } from "../services/cloudCodeThinking.ts";
 import { buildGeminiTools } from "../translator/helpers/geminiToolsSanitizer.ts";
+import { DEFAULT_SAFETY_SETTINGS } from "../translator/helpers/geminiHelper.ts";
 import {
   applyAntigravityClientProfileHeaders,
   removeHeaderCaseInsensitive,
@@ -494,6 +495,17 @@ function getRequestTargetModel(body: Record<string, unknown>): string {
   return typeof target === "string" && target.length > 0 ? target : "unknown";
 }
 
+/**
+ * Hard ceiling on `generationConfig.maxOutputTokens` for Antigravity Cloud Code.
+ *
+ * Ports decolua/9router#779 (lukmanfauzie): VS Code GitHub Copilot Chat in
+ * Agent mode regularly requests 32K–65K output tokens, which the Antigravity
+ * backend rejects with HTTP 400 "Invalid Argument". 16384 matches the
+ * upstream-accepted ceiling confirmed via successful 200 OK runs with
+ * claude-sonnet-4-6 and gemini-3.1-pro-high across both Ask and Agent modes.
+ */
+export const MAX_ANTIGRAVITY_OUTPUT_TOKENS = 16384;
+
 function applyAntigravityGenerationDefaults(request: Record<string, unknown>): void {
   const generationConfig =
     request.generationConfig && typeof request.generationConfig === "object"
@@ -521,9 +533,23 @@ function applyAntigravityGenerationDefaults(request: Record<string, unknown>): v
     generationConfig.maxOutputTokens = Math.floor(thinkingBudget) + 1;
   }
 
+  // Final cap (after the thinkingBudget bump may have raised the value):
+  // GitHub Copilot Agent envelopes commonly carry oversized maxOutputTokens
+  // (32K–65K) that trigger upstream 400 "Invalid Argument". Clamp silently
+  // — the cap is provider-driven, not client-driven, and only matters when
+  // the request would otherwise be rejected outright.
+  const finalMax = Number(generationConfig.maxOutputTokens);
+  if (Number.isFinite(finalMax) && finalMax > MAX_ANTIGRAVITY_OUTPUT_TOKENS) {
+    generationConfig.maxOutputTokens = MAX_ANTIGRAVITY_OUTPUT_TOKENS;
+  }
+
   request.generationConfig = generationConfig;
 }
 
+// Test-only export so the unit suite can exercise the cap logic in isolation
+// without spinning up the full executor.
+export const __test_applyAntigravityGenerationDefaults = applyAntigravityGenerationDefaults;
+
 function asRecord(value: unknown): Record<string, unknown> | null {
   return value && typeof value === "object" && !Array.isArray(value)
     ? (value as Record<string, unknown>)
@@ -559,6 +585,14 @@ function sanitizeAntigravityGeminiRequest(
     clean.sessionId = request.sessionId;
   }
 
+  // #5003: preserve safetySettings through the Claude-path whitelist so the all-OFF
+  // default (or a caller-supplied value) actually reaches Google Cloud Code. Without
+  // this the field is dropped and Google applies its own safety defaults that
+  // false-flag benign technical prompts as `prohibited_content`.
+  if (Array.isArray(request.safetySettings)) {
+    clean.safetySettings = request.safetySettings;
+  }
+
   return clean;
 }
 
@@ -729,7 +763,12 @@ export class AntigravityExecutor extends BaseExecutor {
         credentials,
         typeof normalizedRequest?.sessionId === "string" ? normalizedRequest.sessionId : undefined
       ),
-      safetySettings: undefined,
+      // #5003: default to all-OFF safety for parity with the native Gemini paths
+      // (claude-to-gemini / openai-to-gemini both default to DEFAULT_SAFETY_SETTINGS).
+      // Previously this was `undefined`, which JSON.stringify drops, so Google Cloud Code
+      // applied its server-side defaults that false-flag benign technical prompts as
+      // `prohibited_content` (HTTP 200 + blocked body → terminal combo failover).
+      safetySettings: normalizedRequest?.safetySettings ?? DEFAULT_SAFETY_SETTINGS,
       toolConfig:
         Array.isArray(normalizedRequest?.tools) && normalizedRequest.tools.length > 0
           ? { functionCallingConfig: { mode: "VALIDATED" } }
diff --git a/open-sse/executors/base.ts b/open-sse/executors/base.ts
index de3c41135a..51a0e1389c 100644
--- a/open-sse/executors/base.ts
+++ b/open-sse/executors/base.ts
@@ -236,10 +236,10 @@ function hasActiveClaudeThinking(body: Record<string, unknown>): boolean {
  * provider. Apply provider-aware sanitation here (after transformRequest, so
  * reintroductions by per-provider transforms are also caught) before fetch.
  * xhigh support is opt-out: pass through unchanged unless the registry marks
- * a model as unsupported. Literal max support is Claude/CC-compatible only and
- * intentionally separate: older Opus/Sonnet models may support max even when
- * they do not support xhigh. For OpenAI-shape providers, max normalizes to
- * xhigh by default and falls back to high only for explicit xhigh opt-outs.
+ * a model as unsupported. Literal max support is provider-specific and
+ * intentionally separate: some upstreams accept max even when they do not
+ * accept xhigh. For OpenAI-shape providers, max normalizes to xhigh by default
+ * and falls back to high only for explicit xhigh opt-outs.
  */
 const MISTRAL_NO_REASONING_EFFORT_PATTERN = /devstral/i;
 // GitHub Copilot Claude routing is granular (upstream port: decolua/9router#791):
@@ -264,9 +264,12 @@ function supportsMaxEffortForProvider(provider: string, model: string): boolean
   // normalized to xhigh (the OmniRoute-internal top tier) and rejected by the
   // upstream. Scoped to opencode-go deliberately: OpenRouter's DeepSeek path
   // (pi#4055) is the documented inverse and expects xhigh, not max.
+  // Ollama Cloud also accepts literal max (for example GLM 5.2 supports
+  // low|medium|high|max|none) and rejects xhigh.
   const isOpencodeGoDeepSeek =
     provider === "opencode-go" && model.toLowerCase().includes("deepseek");
-  return isClaude || isOpencodeGoDeepSeek;
+  const isOllamaCloud = provider === "ollama-cloud";
+  return isClaude || isOpencodeGoDeepSeek || isOllamaCloud;
 }
 
 export function sanitizeReasoningEffortForProvider(
diff --git a/open-sse/executors/chatgpt-web.ts b/open-sse/executors/chatgpt-web.ts
index f269ee14d1..498ef604cb 100644
--- a/open-sse/executors/chatgpt-web.ts
+++ b/open-sse/executors/chatgpt-web.ts
@@ -82,9 +82,13 @@ const MODEL_MAP: Record<string, string> = {
   "gpt-5.3-instant": "gpt-5-3-instant",
   "gpt-5.3": "gpt-5-3",
   "gpt-5.3-mini": "gpt-5-3-mini",
+  "gpt-5.5-pro": "gpt-5-5-pro",
   "gpt-5.5-thinking": "gpt-5-5-thinking",
+  "gpt-5.5": "gpt-5-5",
+  "gpt-5.4-pro": "gpt-5-4-pro",
   "gpt-5.4-thinking": "gpt-5-4-thinking",
   "gpt-5.4-thinking-mini": "gpt-5-4-t-mini",
+  "gpt-5.2-pro": "gpt-5-2-pro",
   "gpt-5.2-instant": "gpt-5-2-instant",
   "gpt-5.2": "gpt-5-2",
   "gpt-5.2-thinking": "gpt-5-2-thinking",
diff --git a/open-sse/executors/claudeIdentity.ts b/open-sse/executors/claudeIdentity.ts
index 470fd62313..41728f8d5d 100644
--- a/open-sse/executors/claudeIdentity.ts
+++ b/open-sse/executors/claudeIdentity.ts
@@ -12,7 +12,7 @@ import { createHash, randomBytes, randomUUID } from "node:crypto";
 
 // ---------- Versions ------------------------------------------------------
 
-export const CLAUDE_CODE_VERSION = "2.1.158";
+export const CLAUDE_CODE_VERSION = "2.1.187";
 /** Bundled @anthropic-ai/sdk version for the pinned CLI release. */
 export const CLAUDE_CODE_STAINLESS_VERSION = "0.94.0";
 
diff --git a/open-sse/executors/codebuddy-cn.ts b/open-sse/executors/codebuddy-cn.ts
new file mode 100644
index 0000000000..83840ca254
--- /dev/null
+++ b/open-sse/executors/codebuddy-cn.ts
@@ -0,0 +1,48 @@
+import { DefaultExecutor } from "./default.ts";
+import type { ProviderCredentials } from "./base.ts";
+
+/**
+ * CodeBuddyCnExecutor — talks to https://copilot.tencent.com/v2/chat/completions
+ *
+ * CodeBuddy CN is an OpenAI-compatible Tencent gateway but it rejects non-stream
+ * chat requests (HTTP 400, code 11101 "Non-stream chat request is currently not
+ * supported"). The same-format (openai→openai) translator path leaves body.stream
+ * as the client sent it, so we force it true here — OmniRoute still re-aggregates
+ * the SSE into a JSON response for non-streaming clients.
+ *
+ * CodeBuddy CN only surfaces model reasoning when the request carries the
+ * official CLI's OpenAI-style params: reasoning_effort + reasoning_summary:"auto".
+ * Mirror the CLI here. When the caller explicitly asks for "none"/"off" we drop
+ * the field entirely (the gateway has no "none" value).
+ */
+export class CodeBuddyCnExecutor extends DefaultExecutor {
+  constructor() {
+    super("codebuddy-cn");
+  }
+
+  transformRequest(
+    model: string,
+    body: unknown,
+    stream: boolean,
+    credentials: ProviderCredentials
+  ): unknown {
+    const transformed = super.transformRequest(model, body, stream, credentials);
+    if (!transformed || typeof transformed !== "object" || Array.isArray(transformed)) {
+      return transformed;
+    }
+    const out = transformed as Record<string, unknown>;
+    out.stream = true;
+
+    const eff = out.reasoning_effort;
+    if (eff === "none" || eff === "off") {
+      // Gateway has no "none" — just omit. Do NOT set reasoning_summary.
+      delete out.reasoning_effort;
+    } else {
+      if (!eff) out.reasoning_effort = "medium";
+      out.reasoning_summary = "auto";
+    }
+    return out;
+  }
+}
+
+export default CodeBuddyCnExecutor;
diff --git a/open-sse/executors/codex.ts b/open-sse/executors/codex.ts
index 03c2769beb..ffa7b0d81d 100644
--- a/open-sse/executors/codex.ts
+++ b/open-sse/executors/codex.ts
@@ -754,6 +754,57 @@ function toCodexResponseFailedEvent(parsed: Record<string, unknown>): Record<str
   };
 }
 
+// Env-gated kill-switch: drop ALL non-standard `codex.*` SSE events (notably
+// `codex.rate_limits`) from the Responses stream. These events are NOT part of
+// the OpenAI Responses API — strict clients (e.g. the OpenAI SDK's
+// `responses.stream()`) choke on the unknown event type / empty data field and
+// tear the stream down, surfacing as "Invalid state: Controller is already
+// closed". Opt-in so the default still forwards them for clients that want them.
+function codexDropNonstandardEvents(): boolean {
+  const v = process.env.OMNIROUTE_CODEX_DROP_NONSTANDARD_EVENTS;
+  return v === "true" || v === "1" || v === "yes";
+}
+
+// SSE block filter for the HTTP Responses path (super.execute). The HTTP
+// transport forwards the upstream stream verbatim — including the non-standard
+// `event: codex.rate_limits` frame (no data line) — so the WS-only filter in
+// encodeResponseSseEvent never runs for it. When the kill-switch is on, strip
+// every `codex.*` event block from the byte stream before it reaches the client.
+// Exported for unit testing (#4715). Strips `codex.*` SSE event blocks from a
+// streaming Response when the OMNIROUTE_CODEX_DROP_NONSTANDARD_EVENTS kill-switch is on.
+export function filterNonstandardCodexSse(response: Response): Response {
+  const contentType = response.headers.get("content-type") || "";
+  if (!response.body || !contentType.includes("text/event-stream")) {
+    return response;
+  }
+  const decoder = new TextDecoder();
+  const encoder = new TextEncoder();
+  let buffer = "";
+  const dropBlock = (block: string): boolean => {
+    const match = /^event:\s*(.+)$/m.exec(block);
+    return !!match && match[1].trim().startsWith("codex.");
+  };
+  const transform = new TransformStream<Uint8Array, Uint8Array>({
+    transform(chunk, controller) {
+      buffer += decoder.decode(chunk, { stream: true });
+      let sep: number;
+      while ((sep = buffer.indexOf("\n\n")) !== -1) {
+        const block = buffer.slice(0, sep + 2);
+        buffer = buffer.slice(sep + 2);
+        if (!dropBlock(block)) controller.enqueue(encoder.encode(block));
+      }
+    },
+    flush(controller) {
+      if (buffer && !dropBlock(buffer)) controller.enqueue(encoder.encode(buffer));
+    },
+  });
+  return new Response(response.body.pipeThrough(transform), {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers,
+  });
+}
+
 export function encodeResponseSseEvent(raw: string): { sse: string; terminal: boolean } {
   let eventType = "message";
   let payload = raw;
@@ -775,6 +826,27 @@ export function encodeResponseSseEvent(raw: string): { sse: string; terminal: bo
     // Keep message as the generic SSE event for non-JSON upstream payloads.
   }
 
+  // Env-gated: drop non-standard `codex.*` events (notably `codex.rate_limits`)
+  // before they reach the client. They are NOT part of the OpenAI Responses API
+  // and break strict consumers: the OpenAI SDK's responses.stream() chokes on
+  // the unknown event type / empty data and tears the stream down, surfacing as
+  // "Invalid state: Controller is already closed". The earlier empty-payload
+  // check below never caught codex.rate_limits — over WS the frame carries a
+  // non-empty JSON payload (`{"type":"codex.rate_limits", ...}`), so
+  // `!payload.trim()` is false. Match by event type instead. Opt-in via
+  // OMNIROUTE_CODEX_DROP_NONSTANDARD_EVENTS (the HTTP transport is handled
+  // separately by filterNonstandardCodexSse, since super.execute forwards the
+  // upstream stream verbatim and never runs this function).
+  if (eventType.startsWith("codex.") && codexDropNonstandardEvents()) {
+    return { sse: "", terminal };
+  }
+
+  // Drop frames whose raw payload is empty (defensive; non-JSON / blank upstream
+  // chunks). Frames that carry a payload are preserved.
+  if (!payload.trim()) {
+    return { sse: "", terminal };
+  }
+
   return { sse: `event: ${eventType}\ndata: ${payload}\n\n`, terminal };
 }
 
@@ -840,7 +912,14 @@ export class CodexExecutor extends BaseExecutor {
     const nextInput = { ...input, credentials };
 
     if (!isCodexResponsesWebSocketRequired(nextInput.model, nextInput.credentials)) {
-      return super.execute(nextInput);
+      const httpResult = await super.execute(nextInput);
+      if (codexDropNonstandardEvents()) {
+        const resp = (httpResult as { response?: Response }).response;
+        if (resp?.body) {
+          (httpResult as { response: Response }).response = filterNonstandardCodexSse(resp);
+        }
+      }
+      return httpResult;
     }
 
     const url = CODEX_RESPONSES_WS_URL;
@@ -973,15 +1052,19 @@ export class CodexExecutor extends BaseExecutor {
                 : Buffer.from(event.data as Buffer).toString("utf8");
             const sseEvent = encodeResponseSseEvent(raw);
             if (closed) return;
-            try {
-              controller.enqueue(encoder.encode(sseEvent.sse));
-            } catch {
-              finishStream({
-                reason: "downstream_closed",
-                emitDone: false,
-                closeController: false,
-              });
-              return;
+            // Filtered events (codex.* / empty payload) return an empty `sse` —
+            // skip them so no empty frame reaches the client.
+            if (sseEvent.sse) {
+              try {
+                controller.enqueue(encoder.encode(sseEvent.sse));
+              } catch {
+                finishStream({
+                  reason: "downstream_closed",
+                  emitDone: false,
+                  closeController: false,
+                });
+                return;
+              }
             }
             if (sseEvent.terminal) {
               finishStream({ reason: "terminal_event" });
diff --git a/open-sse/executors/default.ts b/open-sse/executors/default.ts
index 034477ec48..0eceec4530 100644
--- a/open-sse/executors/default.ts
+++ b/open-sse/executors/default.ts
@@ -16,6 +16,7 @@ import { getGigachatAccessToken } from "../services/gigachatAuth.ts";
 import { getRegistryEntry } from "../config/providerRegistry.ts";
 import { mergeClientAnthropicBeta } from "../config/anthropicHeaders.ts";
 import { applyProviderRequestDefaults } from "../services/providerRequestDefaults.ts";
+import { stripUnsupportedParams } from "../translator/paramSupport.ts";
 import {
   detectFormat,
   getOpenAICompatibleType,
@@ -651,6 +652,17 @@ export class DefaultExecutor extends BaseExecutor {
       );
     }
 
+    // Config-driven strip of params unsupported by the target provider/model
+    // (e.g. claude-opus-4 deprecated `temperature` → Anthropic 400). Port from
+    // 9router#7ae9fff6 (fixes upstream #1748). Rules live in
+    // ../translator/paramSupport.ts so adding one means editing one table.
+    if (typeof withDefaults === "object" && withDefaults !== null) {
+      const bodyRecord = withDefaults as Record<string, unknown>;
+      const outboundModel =
+        typeof bodyRecord.model === "string" ? bodyRecord.model : model;
+      stripUnsupportedParams(this.provider, outboundModel, bodyRecord);
+    }
+
     // Apply modelIdPrefix from RegistryEntry (e.g. "accounts/fireworks/models/")
     // so registry can store short model IDs while the upstream API receives the full path.
     if (typeof withDefaults === "object" && withDefaults !== null) {
diff --git a/open-sse/executors/github.ts b/open-sse/executors/github.ts
index eadc46d90e..f2507bd9cf 100644
--- a/open-sse/executors/github.ts
+++ b/open-sse/executors/github.ts
@@ -6,6 +6,7 @@ import {
   getGitHubCopilotRefreshHeaders,
 } from "../config/providerHeaderProfiles.ts";
 import { sanitizeResponsesInputItems } from "../services/responsesInputSanitizer.ts";
+import { stripUnsupportedParams } from "../translator/paramSupport.ts";
 
 export class GithubExecutor extends BaseExecutor {
   constructor() {
@@ -24,9 +25,31 @@ export class GithubExecutor extends BaseExecutor {
     );
   }
 
+  // GitHub Copilot's /responses endpoint only serves OpenAI (gpt/codex) models.
+  // Gemini and Claude variants on Copilot reject with HTTP 400
+  //   "model <id> does not support Responses API." (unsupported_api_for_model)
+  // Pin a defensive invariant: even if a future registry edit (or an upstream
+  // model-discovery refresh) tagged a Claude/Gemini entry as openai-responses,
+  // the executor must still route it to /chat/completions. Port of 9router#1536
+  // (follow-up to #663); also reinforces the existing comments on the gh
+  // registry entries (claude-opus-4-5-20251101, claude-opus-4.7, gemini-*).
+  supportsResponsesEndpoint(model: string | null | undefined): boolean {
+    const m = (model || "").toLowerCase();
+    if (!m) return true;
+    return !(m.includes("gemini") || m.includes("claude"));
+  }
+
   buildUrl(model: string, _stream: boolean, _urlIndex = 0) {
     const targetFormat = getModelTargetFormat("gh", model);
-    if (targetFormat === "openai-responses") {
+    // 9router#102: Copilot Codex models advertise supported_endpoints: ["/responses"]
+    // and 400 on /chat/completions. Route any *-codex id to /responses even when it
+    // isn't in the curated registry, so newly-shipped Codex models work out of the box.
+    // 9router#1536: but never route Gemini/Claude variants to /responses (they 400) —
+    // gate the whole decision on supportsResponsesEndpoint().
+    if (
+      (targetFormat === "openai-responses" || /codex/i.test(model)) &&
+      this.supportsResponsesEndpoint(model)
+    ) {
       return (
         this.config.responsesBaseUrl ||
         this.config.baseUrl?.replace(/\/chat\/completions\/?$/, "/responses") ||
@@ -126,6 +149,13 @@ export class GithubExecutor extends BaseExecutor {
       );
     }
 
+    // Config-driven strip of params unsupported by the target provider/model.
+    // For GitHub Copilot this removes Claude-style `thinking` and
+    // `reasoning_effort` for Claude models that reject them upstream
+    // (Haiku 4.5 / Opus 4.7 — Opus 4.6 / Sonnet 4.6 keep them).
+    // Port from 9router#7ae9fff6 (fixes upstream #1748, #713).
+    stripUnsupportedParams("github", model, modifiedBody);
+
     return modifiedBody;
   }
 
diff --git a/open-sse/executors/index.ts b/open-sse/executors/index.ts
index cc13453ec9..3dc638711f 100644
--- a/open-sse/executors/index.ts
+++ b/open-sse/executors/index.ts
@@ -52,6 +52,7 @@ import { TheOldLlmExecutor } from "./theoldllm.ts";
 import { ChipotleExecutor } from "./chipotle.ts";
 import { LMArenaExecutor } from "./lmarena.ts";
 import { MimocodeExecutor } from "./mimocode.ts";
+import { CodeBuddyCnExecutor } from "./codebuddy-cn.ts";
 
 const executors = {
   antigravity: new AntigravityExecutor(),
@@ -148,6 +149,8 @@ const executors = {
   lma: new LMArenaExecutor(), // Alias
   mimocode: new MimocodeExecutor(),
   mcode: new MimocodeExecutor(), // Alias
+  "codebuddy-cn": new CodeBuddyCnExecutor(),
+  cbcn: new CodeBuddyCnExecutor(), // Alias for codebuddy-cn
 };
 
 const defaultCache = new Map();
@@ -208,3 +211,4 @@ export { TheOldLlmExecutor } from "./theoldllm.ts";
 export { ChipotleExecutor } from "./chipotle.ts";
 export { LMArenaExecutor } from "./lmarena.ts";
 export { MimocodeExecutor } from "./mimocode.ts";
+export { CodeBuddyCnExecutor } from "./codebuddy-cn.ts";
diff --git a/open-sse/executors/opencode.ts b/open-sse/executors/opencode.ts
index af0cf431b3..ce68ef694c 100644
--- a/open-sse/executors/opencode.ts
+++ b/open-sse/executors/opencode.ts
@@ -7,18 +7,181 @@ import {
 } from "./base.ts";
 import { PROVIDERS } from "../config/constants.ts";
 import { getModelTargetFormat } from "../config/providerModels.ts";
+import {
+  injectReasoningContentForThinkingModel,
+  isThinkingMessageModel,
+} from "../utils/reasoningContentInjector.ts";
+import { runWithProxyContext } from "../utils/proxyFetch.ts";
+
+/**
+ * Per-account proxy configuration, persisted by NoAuthAccountCard under
+ * `providerSpecificData.accountProxies` (keyed by the account id, which the UI
+ * stores in `providerSpecificData.fingerprints`). Same shape mimocode uses.
+ */
+export interface OpencodeAccountProxyConfig {
+  fingerprint: string;
+  proxy: {
+    type: string;
+    host: string;
+    port: number;
+    username?: string;
+    password?: string;
+  } | null;
+}
+
+/** Runtime rotation/cooldown state for one "OpenCode Free" account. */
+interface OpencodeAccountState {
+  /** Account id (UI: providerSpecificData.fingerprints[i]); "" for the default direct account. */
+  fingerprint: string;
+  cooldownUntil: number;
+  consecutiveFails: number;
+  /** Resolved proxy config for this account (null = direct egress). */
+  proxy: OpencodeAccountProxyConfig["proxy"];
+}
+
+const OPENCODE_COOLDOWN_BASE_MS = 5_000;
+const OPENCODE_COOLDOWN_MAX_MS = 60_000;
 
 export class OpencodeExecutor extends BaseExecutor {
   _requestFormat: string | null = null;
 
+  /**
+   * Per-account rotation state, rebuilt from credentials on each request. The
+   * default entry (fingerprint "") represents the single anonymous account with
+   * no configured proxy — preserves the historical direct pass-through when the
+   * user has not configured any per-account proxy.
+   */
+  private accounts: OpencodeAccountState[] = [
+    { fingerprint: "", cooldownUntil: 0, consecutiveFails: 0, proxy: null },
+  ];
+  private nextAccountIdx = 0;
+
   constructor(provider: string) {
     super(provider, PROVIDERS[provider] || PROVIDERS.openai);
   }
 
+  /**
+   * Rebuild `accounts` from `providerSpecificData.fingerprints` +
+   * `providerSpecificData.accountProxies`. Each configured account id becomes a
+   * rotation slot carrying its own proxy. When the user configured no accounts
+   * at all, the single default direct account is kept (backward compatible).
+   */
+  private syncAccountsFromCredentials(credentials: ProviderCredentials): void {
+    const psd = credentials?.providerSpecificData;
+    const fingerprints = Array.isArray(psd?.fingerprints)
+      ? (psd!.fingerprints as unknown[]).filter((f): f is string => typeof f === "string")
+      : [];
+
+    const accountProxies = psd?.accountProxies as OpencodeAccountProxyConfig[] | undefined;
+    const proxyMap = Array.isArray(accountProxies)
+      ? new Map(accountProxies.map((ap) => [ap.fingerprint, ap.proxy ?? null] as const))
+      : null;
+
+    if (fingerprints.length === 0) {
+      // No configured accounts — keep a single direct account.
+      this.accounts = [{ fingerprint: "", cooldownUntil: 0, consecutiveFails: 0, proxy: null }];
+      this.nextAccountIdx = 0;
+      return;
+    }
+
+    const previous = new Map(this.accounts.map((a) => [a.fingerprint, a] as const));
+    this.accounts = fingerprints.map((fp) => {
+      const prior = previous.get(fp);
+      return {
+        fingerprint: fp,
+        cooldownUntil: prior?.cooldownUntil ?? 0,
+        consecutiveFails: prior?.consecutiveFails ?? 0,
+        proxy: proxyMap ? (proxyMap.get(fp) ?? null) : null,
+      };
+    });
+    if (this.nextAccountIdx >= this.accounts.length) this.nextAccountIdx = 0;
+  }
+
+  private isAccountReady(account: OpencodeAccountState): boolean {
+    return account.cooldownUntil <= Date.now();
+  }
+
+  /** Round-robin pick, skipping accounts in cooldown; falls back to the next index. */
+  private pickAccount(): OpencodeAccountState {
+    for (let i = 0; i < this.accounts.length; i++) {
+      const idx = (this.nextAccountIdx + i) % this.accounts.length;
+      const acct = this.accounts[idx];
+      if (this.isAccountReady(acct)) {
+        this.nextAccountIdx = (idx + 1) % this.accounts.length;
+        return acct;
+      }
+    }
+    const fallbackIdx = this.nextAccountIdx % this.accounts.length;
+    this.nextAccountIdx = (this.nextAccountIdx + 1) % this.accounts.length;
+    return this.accounts[fallbackIdx];
+  }
+
+  private markCooldown(account: OpencodeAccountState): void {
+    account.consecutiveFails++;
+    const backoff = Math.min(
+      OPENCODE_COOLDOWN_BASE_MS * Math.pow(2, account.consecutiveFails - 1),
+      OPENCODE_COOLDOWN_MAX_MS
+    );
+    account.cooldownUntil = Date.now() + backoff + Math.random() * 1000;
+  }
+
+  private markSuccess(account: OpencodeAccountState): void {
+    account.consecutiveFails = 0;
+  }
+
+  /** Mask an account id for logs (UI calls it a fingerprint). */
+  private static maskAccountId(fingerprint: string): string {
+    if (!fingerprint) return "direct";
+    return `${fingerprint.slice(0, 8)}…`;
+  }
+
   async execute(input: ExecuteInput) {
     this._requestFormat = getModelTargetFormat(this.provider, input.model) || "openai";
     try {
-      return await super.execute(input);
+      this.syncAccountsFromCredentials(input.credentials);
+
+      const hasProxies = this.accounts.some((a) => a.proxy !== null);
+      // Fast path: no multi-account proxy wiring configured → original behavior.
+      if (this.accounts.length === 1 && !hasProxies) {
+        return await super.execute(input);
+      }
+
+      const { log } = input;
+      let lastResult: Awaited<ReturnType<BaseExecutor["execute"]>> | null = null;
+
+      for (let attempt = 0; attempt < this.accounts.length; attempt++) {
+        const account = this.pickAccount();
+        const masked = OpencodeExecutor.maskAccountId(account.fingerprint);
+        log?.debug?.(
+          "OPENCODE",
+          `dispatch via account ${masked} (idx ${attempt + 1}/${this.accounts.length})` +
+            (account.proxy ? ` through proxy ${account.proxy.host}:${account.proxy.port}` : " direct")
+        );
+
+        // Pin egress to this account's proxy for the whole BaseExecutor dispatch
+        // (incl. its intra-URL 429 retries). skipUpstreamRetry lets THIS loop own
+        // the cross-account 429 fallback instead of BaseExecutor's same-key retry.
+        const result = await runWithProxyContext(account.proxy, () =>
+          super.execute({ ...input, skipUpstreamRetry: true })
+        );
+        lastResult = result;
+
+        const status = result.response.status;
+        if (status === 429) {
+          this.markCooldown(account);
+          log?.warn?.(
+            "OPENCODE",
+            `Rate limited (429) on account ${masked}, rotating to next…`
+          );
+          continue;
+        }
+
+        this.markSuccess(account);
+        return result;
+      }
+
+      // All accounts returned 429 (or errored) — surface the last response.
+      return lastResult ?? (await super.execute(input));
     } finally {
       this._requestFormat = null;
     }
@@ -138,7 +301,7 @@ export class OpencodeExecutor extends BaseExecutor {
     stream: boolean,
     credentials: ProviderCredentials
   ): any {
-    const modifiedBody = super.transformRequest(model, body, stream, credentials);
+    let modifiedBody = super.transformRequest(model, body, stream, credentials);
     if (
       modifiedBody &&
       typeof modifiedBody === "object" &&
@@ -162,6 +325,14 @@ export class OpencodeExecutor extends BaseExecutor {
         }
       }
     }
+    // #1543 / upstream PR #1099: thinking-mode upstreams routed through OpenCode
+    // (DeepSeek V4 Flash, Kimi, MiniMax, ...) require reasoning_content echoed
+    // back on assistant messages, or they 400 with "reasoning_content must be
+    // passed back". OpenAI clients drop it across turns, so we inject a
+    // placeholder for the affected model families.
+    if (isThinkingMessageModel(model)) {
+      modifiedBody = injectReasoningContentForThinkingModel(modifiedBody);
+    }
     return modifiedBody;
   }
 }
diff --git a/open-sse/executors/pollinations.ts b/open-sse/executors/pollinations.ts
index 30ea33ef85..b14144ef64 100644
--- a/open-sse/executors/pollinations.ts
+++ b/open-sse/executors/pollinations.ts
@@ -38,7 +38,13 @@ export class PollinationsExecutor extends BaseExecutor {
     if (typeof body === "object" && body !== null) {
       body.model = model;
       body.stream = stream;
-      body.jsonMode = true;
+      // #3981: Pollinations treats jsonMode=true as "the model MUST return JSON"
+      // and rejects (HTTP 400) any request whose messages don't mention "json".
+      // Only enable it when the caller actually asked for JSON output.
+      const responseFormatType = body.response_format?.type;
+      if (responseFormatType === "json_object" || responseFormatType === "json_schema") {
+        body.jsonMode = true;
+      }
     }
     return body;
   }
diff --git a/open-sse/executors/qoder.ts b/open-sse/executors/qoder.ts
index 3c96e6b61a..8e251d94ec 100644
--- a/open-sse/executors/qoder.ts
+++ b/open-sse/executors/qoder.ts
@@ -11,7 +11,7 @@ import {
   QODER_DEFAULT_USER_AGENT,
 } from "../config/providerHeaderProfiles.ts";
 import { sanitizeQwenThinkingToolChoice } from "../services/qwenThinking.ts";
-import { buildCosyHeadersForValidation } from "../services/qoderCli.ts";
+import { buildCosyHeadersForValidation, resolveQoderJobToken } from "../services/qoderCli.ts";
 import { sanitizeErrorMessage } from "../utils/error.ts";
 
 function getAuthToken(credentials: ProviderCredentials): string {
@@ -131,7 +131,10 @@ export class QoderExecutor extends BaseExecutor {
       // PAT tokens (pt-*) are not accepted as Bearer tokens by api.qoder.com/v1/chat/completions.
       // They return 401 TOKEN_INVALID. Fallback to Cosy auth against api1.qoder.sh.
       if (!response.ok && response.status === 401 && isPatToken) {
-        const cosyHeaders = buildCosyHeadersForValidation(bodyStr, token);
+        // #4683: exchange the PAT (pt-*) for a job token (jt-*) before the Cosy call;
+        // Cosy rejects a raw pt-* in security_oauth_token with a generic 500.
+        const cosyToken = await resolveQoderJobToken(token, { signal });
+        const cosyHeaders = buildCosyHeadersForValidation(bodyStr, cosyToken);
         const cosyEndpoint =
           "https://api1.qoder.sh/algo/api/v2/service/pro/sse/agent_chat_generation?AgentId=agent_common";
         const cosyRes = await fetch(cosyEndpoint, {
diff --git a/open-sse/handlers/chatCore.ts b/open-sse/handlers/chatCore.ts
index 2344be85c5..b9b1f00093 100644
--- a/open-sse/handlers/chatCore.ts
+++ b/open-sse/handlers/chatCore.ts
@@ -5,6 +5,14 @@ import { extractSystemRoleMessages } from "./chatCore/claudeSystemRole.ts";
 export { extractSystemRoleMessages } from "./chatCore/claudeSystemRole.ts";
 import { checkIdempotencyCache } from "./chatCore/idempotency.ts";
 import { checkSemanticCache } from "./chatCore/semanticCache.ts";
+import { applyClientUsageBuffer } from "./chatCore/clientUsageBuffer.ts";
+import { buildPostCallGuardrailContext } from "./chatCore/postCallGuardrailContext.ts";
+import { storeSemanticCacheResponse } from "./chatCore/semanticCacheStore.ts";
+import { buildNonStreamingResponseHeaders } from "./chatCore/nonStreamingResponseHeaders.ts";
+import { maybeConvertJsonBodyToSse } from "./chatCore/jsonBodyToSse.ts";
+import { assembleStreamingResponseHeaders } from "./chatCore/streamingResponseHeaders.ts";
+import { storeStreamingSemanticCacheResponse } from "./chatCore/streamingSemanticCacheStore.ts";
+import { assembleStreamingPipeline } from "./chatCore/streamingPipeline.ts";
 import { sanitizeChatRequestBody } from "./chatCore/sanitization.ts";
 import {
   getHeaderValueCaseInsensitive,
@@ -52,7 +60,7 @@ import { checkHeapPressureGuard } from "../utils/heapPressure.ts";
 import { normalizeHeaders } from "../utils/headers.ts";
 import { resolveChatCoreRequestFormat } from "./chatCore/requestFormat.ts";
 import { resolveChatCoreTargetFormat } from "./chatCore/targetFormat.ts";
-import { injectSystemPrompt } from "../services/systemPrompt.ts";
+import { injectSystemPrompt, injectCustomSystemPrompt } from "../services/systemPrompt.ts";
 import { translateRequest, needsTranslation } from "../translator/index.ts";
 import { FORMATS } from "../translator/formats.ts";
 import { splitMisplacedToolResults } from "../translator/helpers/claudeHelper.ts";
@@ -63,9 +71,8 @@ import {
   withBodyTimeout,
 } from "../utils/stream.ts";
 import { ensureStreamReadiness } from "../utils/streamReadiness.ts";
-import { synthesizeOpenAiSseFromJson } from "../utils/jsonToSse.ts";
 import { resolveStreamReadinessTimeout } from "../utils/streamReadinessPolicy.ts";
-import { createStreamController, pipeWithDisconnect } from "../utils/streamHandler.ts";
+import { createStreamController } from "../utils/streamHandler.ts";
 import * as streamFailure from "../utils/streamFailureFinalization.ts";
 import { createSseHeartbeatTransform, shapeForClientFormat } from "../utils/sseHeartbeat.ts";
 import { addBufferToUsage, filterUsageForFormat, estimateUsage } from "../utils/usageTracking.ts";
@@ -86,7 +93,8 @@ import {
 import { resolveModelAlias } from "../services/modelDeprecation.ts";
 import { normalizeMimoThinking } from "../services/mimoThinking.ts";
 import { normalizeClaudeAdaptiveThinking } from "../services/claudeAdaptiveThinking.ts";
-import { echoModelInObject, createModelEchoTransform } from "../services/responseModelEcho.ts";
+import { normalizeClaudeHaikuConstraints } from "../services/claudeHaikuConstraints.ts";
+import { echoModelInObject } from "../services/responseModelEcho.ts";
 import { stripGpt5SamplingWhenReasoning } from "../services/gpt5SamplingGuard.ts";
 import { getUnsupportedParams } from "../config/providerRegistry.ts";
 import { supportsMaxTokens } from "@/lib/modelCapabilities.ts";
@@ -107,7 +115,6 @@ import {
   HTTP_STATUS,
   FETCH_BODY_TIMEOUT_MS,
   PROVIDER_MAX_TOKENS,
-  SSE_HEARTBEAT_INTERVAL_MS,
   STREAM_IDLE_TIMEOUT_MS,
   STREAM_READINESS_TIMEOUT_MS,
   ANTIGRAVITY_PRE_RESPONSE_TIMEOUT_CODE,
@@ -159,12 +166,20 @@ import { saveRequestUsage, trackPendingRequest, appendRequestLog } from "@/lib/u
 import { finalizePendingScope, updatePendingScope } from "@/lib/usage/pendingRequestScope";
 import { recordCost } from "@/domain/costRules";
 import { calculateCost } from "@/lib/usage/costCalculator";
-import { attachOmniRouteMetaHeaders } from "@/domain/omnirouteResponseMeta";
 import {
   buildClaudePassthroughToolNameMap,
   restoreClaudePassthroughToolNames,
   mergeResponseToolNameMap,
 } from "./chatCore/passthroughToolNames.ts";
+import { resolveCompressionSettings } from "./chatCore/compressionSettings.ts";
+import {
+  isBuiltinStackedPipeline,
+  isStackedCompressionCombo,
+  type RuntimeCompressionCombo,
+} from "./chatCore/compressionComboPredicates.ts";
+import { emitOutputStyleTelemetry } from "./chatCore/outputStyleTelemetry.ts";
+import { writeCompressionAnalytics } from "./chatCore/compressionAnalyticsWrite.ts";
+import { runPluginOnRequestHook } from "./chatCore/pluginOnRequest.ts";
 import { recordContextEditingTelemetryHook } from "./chatCore/contextEditingTelemetry.ts";
 import { recordCompressionCacheStats } from "./chatCore/compressionCacheStats.ts";
 import { writeCavemanOutputAnalytics } from "./chatCore/cavemanOutputAnalytics.ts";
@@ -191,7 +206,7 @@ import { getModelNormalizeToolCallId, getModelPreserveOpenAIDeveloperRole } from
 import { getProviderCredentials, extractSessionAffinityKey } from "@/sse/services/auth";
 import { deleteSessionAccountAffinity } from "@/lib/db/sessionAccountAffinity";
 import { getCacheControlSettings } from "@/lib/cacheControlSettings";
-import { guardrailRegistry, resolveDisabledGuardrails } from "@/lib/guardrails";
+import { guardrailRegistry } from "@/lib/guardrails";
 import { shouldPreserveCacheControl } from "../utils/cacheControlPolicy.ts";
 import { getCachedSettings } from "@/lib/db/readCache";
 import { applyCodexGlobalFastServiceTier } from "@/lib/providers/codexFastTier";
@@ -234,9 +249,6 @@ import {
   isCacheableForWrite,
 } from "@/lib/semanticCache";
 import { saveIdempotency } from "@/lib/idempotencyLayer";
-import { createProgressTransform, wantsProgress } from "../utils/progressTracker.ts";
-import { createPiiSseTransform } from "@/lib/streamingPiiTransform";
-import { isFeatureFlagEnabled } from "@/shared/utils/featureFlags";
 import {
   isModelUnavailableError,
   getNextFamilyFallback,
@@ -375,52 +387,37 @@ export async function handleChatCore({
     stageTrace(label, extra, { traceEnabled, startTime, traceId, log });
   let tokensCompressed: number | null = null;
   body = injectSystemPrompt(body);
+  // ── Per-endpoint custom system prompt (port of upstream #2063) ──
+  // Reads from cachedSettings if available (passed in from combo/chat layer)
+  // to avoid an extra DB read on the hot path. Falls through to getCachedSettings()
+  // only when this function is called outside the normal chat dispatch.
+  {
+    const _s = cachedSettings ?? (await getCachedSettings());
+    if (_s.customSystemPromptEnabled === true && typeof _s.customSystemPrompt === "string" && _s.customSystemPrompt) {
+      body = injectCustomSystemPrompt(body as Record<string, unknown>, _s.customSystemPrompt);
+      log?.debug?.("CUSTOMSP", "custom system prompt injected");
+    }
+  }
   // ── Plugin onRequest hook ──
   // Dynamic import cached by Node.js after first call — minimal overhead
-  try {
-    const { runOnRequest } = await import("@/lib/plugins/hooks");
-    const pluginCtx = {
-      requestId: traceId,
-      body,
-      model,
-      provider,
-      apiKeyInfo,
-      metadata: {},
+  const pluginGate = await runPluginOnRequestHook({
+    requestId: traceId,
+    body,
+    model,
+    provider,
+    apiKeyInfo,
+    log,
+  });
+  if (pluginGate.blocked) {
+    return {
+      success: false,
+      status: 403,
+      error: "Request blocked by plugin",
+      response: pluginGate.response,
     };
-    const pluginResult = await runOnRequest(pluginCtx);
-    if (pluginResult?.blocked) {
-      log?.info?.("PLUGIN", `Request blocked by plugin`);
-      return {
-        success: false,
-        status: 403,
-        error: "Request blocked by plugin",
-        response: pluginResult.response
-          ? new Response(JSON.stringify(pluginResult.response), {
-              status: 403,
-              headers: { "Content-Type": "application/json" },
-            })
-          : new Response(
-              JSON.stringify({
-                error: { message: "Request blocked by plugin", type: "plugin_block" },
-              }),
-              {
-                status: 403,
-                headers: { "Content-Type": "application/json" },
-              }
-            ),
-      };
-    }
-    if (pluginResult?.body) {
-      body = pluginResult.body;
-    }
-    if (pluginResult?.metadata) {
-      Object.assign(pluginCtx.metadata, pluginResult.metadata);
-    }
-  } catch (pluginErr) {
-    log?.debug?.(
-      "PLUGIN",
-      `onRequest hook error (non-fatal): ${pluginErr instanceof Error ? pluginErr.message : String(pluginErr)}`
-    );
+  }
+  if (pluginGate.body) {
+    body = pluginGate.body;
   }
 
   let effectiveServiceTier: EffectiveServiceTier = "standard";
@@ -447,6 +444,7 @@ export async function handleChatCore({
         statusCode,
         errorCode,
         latencyMs: Date.now() - startTime,
+        endpoint: endpointPath,
       })
     ).catch(() => {});
   };
@@ -875,20 +873,10 @@ export async function handleChatCore({
   let contextEditingEnabled = false;
   if (body && Array.isArray(allMessages) && allMessages.length > 0) {
     let estimatedTokens = estimateTokens(allMessages);
-    let promptCompressionEnabled = false;
-    let compressionSettings: CompressionConfig | null = null;
-
-    try {
-      const { getCompressionSettings } = await import("../../src/lib/db/compression.ts");
-      compressionSettings = await getCompressionSettings();
-      promptCompressionEnabled = compressionSettings.enabled;
-      contextEditingEnabled = compressionSettings.contextEditing?.enabled === true;
-    } catch (err) {
-      log?.warn?.(
-        "COMPRESSION",
-        "Compression settings lookup skipped: " + (err instanceof Error ? err.message : String(err))
-      );
-    }
+    const compressionSettingsResult = await resolveCompressionSettings(log);
+    const compressionSettings: CompressionConfig | null = compressionSettingsResult.settings;
+    const promptCompressionEnabled = compressionSettingsResult.enabled;
+    contextEditingEnabled = compressionSettingsResult.contextEditingEnabled;
 
     // --- Modular Compression Pipeline (Phase 1 Lite + Phase 2 Standard/Caveman + Phase 3 Aggressive) ---
     // Runs BEFORE the existing reactive compressContext() to proactively reduce tokens.
@@ -917,27 +905,6 @@ export async function handleChatCore({
       }
       let compressionComboKey = comboName ?? null;
       let compressionComboApplied = false;
-      type RuntimeCompressionCombo = {
-        id: string;
-        pipeline: NonNullable<CompressionConfig["stackedPipeline"]>;
-        languagePacks: string[];
-        outputMode: boolean;
-        outputModeIntensity: string;
-      };
-      const isBuiltinStackedPipeline = (
-        pipeline: CompressionConfig["stackedPipeline"] | undefined
-      ): boolean => {
-        if (!Array.isArray(pipeline) || pipeline.length !== 2) return false;
-        const [first, second] = pipeline;
-        return (
-          first?.engine === "rtk" &&
-          (first.intensity === undefined || first.intensity === "standard") &&
-          !first.config &&
-          second?.engine === "caveman" &&
-          (second.intensity === undefined || second.intensity === "full") &&
-          !second.config
-        );
-      };
       const applyCompressionComboConfig = (
         compressionCombo: RuntimeCompressionCombo | null,
         routingOverrideIds: string[] = []
@@ -996,14 +963,6 @@ export async function handleChatCore({
         compressionComboApplied = true;
         return true;
       };
-      const isStackedCompressionCombo = (
-        compressionCombo: RuntimeCompressionCombo | null
-      ): compressionCombo is RuntimeCompressionCombo => {
-        // >= 1: a single-engine default combo (user enabled exactly one layer via the
-        // per-engine config page) must still apply. applyCompressionComboConfig already
-        // guards length === 0.
-        return Boolean(compressionCombo && compressionCombo.pipeline.length >= 1);
-      };
       if (isCombo && comboName) {
         try {
           const { getComboByName } = await import("../../src/lib/localDb");
@@ -1309,74 +1268,19 @@ export async function handleChatCore({
           if (result.compressed || result.stats.fallbackApplied || cavemanOutputModeApplied) {
             trackCompressionStats(result.stats);
             compressionAnalyticsRecorded = true;
-            compressionAnalyticsWritePromise = (async () => {
-              try {
-                const { insertCompressionAnalyticsRow, insertCompressionEngineBreakdown } =
-                  await import("../../src/lib/db/compressionAnalytics.ts");
-                const { calculateCost } = await import("../../src/lib/usage/costCalculator.ts");
-                const tokensSaved = Math.max(
-                  0,
-                  result.stats.originalTokens - result.stats.compressedTokens
-                );
-                const rtkPointers = result.stats.rtkRawOutputPointers ?? [];
-                const estimatedUsdSaved = await calculateCost(
-                  provider ?? "",
-                  effectiveModel ?? "",
-                  {
-                    input: tokensSaved,
-                  },
-                  { serviceTier: effectiveServiceTier }
-                );
-                insertCompressionAnalyticsRow({
-                  timestamp: new Date().toISOString(),
-                  combo_id: comboName ?? null,
-                  provider: provider ?? null,
-                  mode,
-                  engine: result.stats.engine ?? mode,
-                  compression_combo_id:
-                    result.stats.compressionComboId ?? config.compressionComboId ?? null,
-                  original_tokens: result.stats.originalTokens,
-                  compressed_tokens: result.stats.compressedTokens,
-                  tokens_saved: tokensSaved,
-                  duration_ms: result.stats.durationMs ?? null,
-                  request_id: skillRequestId,
-                  estimated_usd_saved: estimatedUsdSaved || null,
-                  validation_fallback: result.stats.fallbackApplied ? 1 : 0,
-                  output_mode: cavemanOutputModeApplied ? cavemanOutputModeIntensity : null,
-                  rtk_raw_output_pointer: rtkPointers[0]?.id ?? null,
-                  rtk_raw_output_bytes: rtkPointers[0]?.bytes ?? null,
-                  rtk_raw_output_pointers: rtkPointers.length
-                    ? JSON.stringify(rtkPointers.map((pointer) => pointer.id))
-                    : null,
-                  rtk_raw_output_total_bytes: rtkPointers.length
-                    ? rtkPointers.reduce((total, pointer) => total + pointer.bytes, 0)
-                    : null,
-                });
-                // Persist the per-engine breakdown of a stacked run so per-engine
-                // analytics (getPerEngineAnalytics) is accurate historically, not just
-                // in the live `compression.completed` event.
-                const engineBreakdown = result.stats.engineBreakdown ?? [];
-                if (engineBreakdown.length > 0) {
-                  insertCompressionEngineBreakdown(
-                    engineBreakdown.map((b) => ({
-                      timestamp: new Date().toISOString(),
-                      request_id: skillRequestId,
-                      engine: b.engine,
-                      original_tokens: b.originalTokens,
-                      compressed_tokens: b.compressedTokens,
-                      tokens_saved: Math.max(0, b.originalTokens - b.compressedTokens),
-                      duration_ms: b.durationMs ?? null,
-                    }))
-                  );
-                }
-              } catch (err) {
-                log?.debug?.(
-                  "COMPRESSION",
-                  "Compression analytics write skipped: " +
-                    (err instanceof Error ? err.message : String(err))
-                );
-              }
-            })();
+            compressionAnalyticsWritePromise = writeCompressionAnalytics({
+              stats: result.stats,
+              provider,
+              effectiveModel,
+              effectiveServiceTier,
+              comboName,
+              mode,
+              compressionComboId: config.compressionComboId,
+              skillRequestId,
+              cavemanOutputModeApplied,
+              cavemanOutputModeIntensity,
+              log,
+            });
           }
 
           if (result.compressed) {
@@ -1407,33 +1311,16 @@ export async function handleChatCore({
           log,
         });
       }
-      if (outputStyleResult) {
-        void (async () => {
-          try {
-            const { buildOutputStyleTelemetry } =
-              await import("../services/compression/outputStyles/telemetry.ts");
-            const { insertCompressionRunTelemetryRow } =
-              await import("../../src/lib/db/compressionRunTelemetry.ts");
-            const record = buildOutputStyleTelemetry({
-              requestId: skillRequestId ?? traceId ?? "",
-              model: effectiveModel ?? "",
-              provider: provider ?? "",
-              source: config.compressionComboId ? "active-profile" : "default",
-              tokensBefore: estimatedTokens,
-              tokensAfter: estimatedTokens,
-              applied: outputStyleResult.applied,
-              appliedStyles: outputStyleResult.appliedStyles,
-              skippedReason: outputStyleResult.skippedReason,
-            });
-            insertCompressionRunTelemetryRow(record);
-          } catch (err) {
-            log?.debug?.(
-              "COMPRESSION",
-              "Run-telemetry emit skipped: " + (err instanceof Error ? err.message : String(err))
-            );
-          }
-        })();
-      }
+      emitOutputStyleTelemetry({
+        outputStyleResult,
+        skillRequestId,
+        traceId,
+        effectiveModel,
+        provider,
+        compressionComboId: config.compressionComboId,
+        estimatedTokens,
+        log,
+      });
     } catch (err) {
       log?.warn?.(
         "COMPRESSION",
@@ -1922,6 +1809,13 @@ export async function handleChatCore({
     // defaults) to `{type:"adaptive"}` — effort stays on `output_config.effort`. Keyed on
     // the resolved upstream model, so it covers every routing mode. See claudeAdaptiveThinking.ts.
     translatedBody = normalizeClaudeAdaptiveThinking(translatedBody, finalModelToUpstream);
+    // Claude Haiku rejects `thinking.type:"adaptive"` and `output_config.effort`
+    // (both Sonnet 4.6 / Opus 4.5+ only). Several paths can still emit those
+    // shapes on a Haiku target — native passthrough, reasoning_effort buckets,
+    // per-model defaults — so collapse them to a Haiku-valid shape here, after
+    // model substitution. Mirrors upstream 9router 401d93bd5. See
+    // services/claudeHaikuConstraints.ts.
+    translatedBody = normalizeClaudeHaikuConstraints(translatedBody, finalModelToUpstream);
   }
 
   // Xiaomi MiMo controls reasoning ONLY via `thinking:{type:"enabled"|"disabled"}` and
@@ -2044,6 +1938,9 @@ export async function handleChatCore({
         apiKeyId: apiKeyInfo.id,
         connectionId: credentials.connectionId,
         provider: provider ?? "unknown",
+        // Resolved model id (post background-redirect / alias) — the same scope the
+        // router/log use. Operators configure per-(key,model) caps against THIS id.
+        model: model || undefined,
         estimatedCost: {},
       }).catch((err: unknown) => {
         log?.warn?.(
@@ -3540,6 +3437,7 @@ export async function handleChatCore({
       effectiveServiceTier,
       isCombo,
       comboStrategy,
+      endpoint: endpointPath,
     });
 
     // Translate response to client's expected format (usually OpenAI)
@@ -3598,20 +3496,7 @@ export async function handleChatCore({
       translatedResponse = sanitizeOpenAIResponse(translatedResponse);
     }
 
-    // Add buffer and filter usage for client (to prevent CLI context errors)
-    if (translatedResponse?.usage) {
-      const buffered = addBufferToUsage(translatedResponse.usage);
-      translatedResponse.usage = filterUsageForFormat(buffered, clientResponseFormat);
-    } else {
-      // Fallback: estimate usage when provider returned no usage block
-      const contentLength = JSON.stringify(
-        translatedResponse?.choices?.[0]?.message?.content || ""
-      ).length;
-      if (contentLength > 0) {
-        const estimated = estimateUsage(body, contentLength, clientResponseFormat);
-        translatedResponse.usage = filterUsageForFormat(estimated, clientResponseFormat);
-      }
-    }
+    applyClientUsageBuffer(translatedResponse, body, clientResponseFormat);
 
     if (memoryOwnerId && memorySettings?.enabled && memorySettings.maxTokens > 0) {
       const requestMemoryText = extractMemoryTextFromRequestBody(body as Record<string, unknown>);
@@ -3644,23 +3529,16 @@ export async function handleChatCore({
       );
     }
 
-    const guardrailContext = {
+    const guardrailContext = buildPostCallGuardrailContext({
       apiKeyInfo,
-      disabledGuardrails: resolveDisabledGuardrails({
-        apiKeyInfo: (apiKeyInfo as Record<string, unknown> | null) ?? null,
-        body,
-        headers: (clientRawRequest?.headers as Headers | Record<string, unknown> | null) ?? null,
-      }),
-      endpoint: clientRawRequest?.endpoint || null,
-      headers: (clientRawRequest?.headers as Headers | Record<string, unknown> | null) ?? null,
+      body,
+      clientRawRequest,
       log,
-      method: "POST",
       model,
       provider,
-      sourceFormat: responsePayloadFormat,
-      stream: false,
-      targetFormat: clientResponseFormat,
-    } as const;
+      responsePayloadFormat,
+      clientResponseFormat,
+    });
     const postCallGuardrails = await guardrailRegistry.runPostCallHooks(
       translatedResponse,
       guardrailContext
@@ -3710,22 +3588,16 @@ export async function handleChatCore({
     }
 
     // ── Phase 9.1: Cache store (non-streaming, temp=0) ──
-    if (
-      semanticCacheEnabled &&
-      isCacheableForWrite(body, clientRawRequest?.headers) &&
-      isSmallEnoughForSemanticCache(translatedResponse)
-    ) {
-      const signature = generateSignature(
-        model,
-        body.messages ?? body.input,
-        body.temperature,
-        body.top_p,
-        apiKeyInfo?.id ?? undefined
-      );
-      const tokensSaved = usage?.prompt_tokens + usage?.completion_tokens || 0;
-      setCachedResponse(signature, model, translatedResponse, tokensSaved);
-      log?.debug?.("CACHE", `Stored response for ${model} (${tokensSaved} tokens)`);
-    }
+    storeSemanticCacheResponse({
+      enabled: semanticCacheEnabled,
+      body,
+      headers: clientRawRequest?.headers,
+      translatedResponse,
+      model,
+      apiKeyId: apiKeyInfo?.id ?? undefined,
+      usage,
+      log,
+    });
 
     // ── Phase 9.2: Save for idempotency ──
     // Reuse the key resolved by checkIdempotencyCache() above (single derivation per
@@ -3758,6 +3630,7 @@ export async function handleChatCore({
       apiKeyId: apiKeyInfo?.id,
       connectionId: credentials?.connectionId,
       provider,
+      model,
       usage,
       estimatedCost,
       log,
@@ -3771,22 +3644,15 @@ export async function handleChatCore({
       providerResponse: responseBody,
       clientResponse: translatedResponse,
     });
-    const responseHeaders: Record<string, string> = {
-      "Content-Type": "application/json",
-      [OMNIROUTE_RESPONSE_HEADERS.cache]: "MISS",
-    };
-    attachOmniRouteMetaHeaders(responseHeaders, {
+    const responseHeaders = buildNonStreamingResponseHeaders({
       provider,
       model,
-      cacheHit: false,
-      latencyMs: Date.now() - startTime,
-      usage: responseUsage,
-      costUsd: estimatedCost,
+      startTime,
+      responseUsage,
+      estimatedCost,
       requestId: skillRequestId,
+      compressionResponseMeta,
     });
-    if (compressionResponseMeta) {
-      responseHeaders[OMNIROUTE_RESPONSE_HEADERS.compression] = compressionResponseMeta;
-    }
     // #1311: echo the requested alias/combo name in the non-streaming response model.
     if (echoModel) echoModelInObject(translatedResponse, echoModel);
     return {
@@ -3805,40 +3671,7 @@ export async function handleChatCore({
   // though it carried valid content/reasoning_content. Detect a JSON (non-SSE)
   // upstream body and synthesize an equivalent OpenAI SSE stream so the
   // streaming pipeline (and the client) get a valid stream.
-  {
-    const upstreamContentType = (providerResponse.headers.get("content-type") || "").toLowerCase();
-    const isNonSseJsonBody =
-      !!providerResponse.body &&
-      upstreamContentType.includes("application/json") &&
-      !upstreamContentType.includes("text/event-stream") &&
-      !upstreamContentType.includes("application/x-ndjson");
-    if (isNonSseJsonBody) {
-      const jsonText = await withBodyTimeout<string>(providerResponse.text());
-      const synthesizedSse = synthesizeOpenAiSseFromJson(jsonText);
-      const rebuiltHeaders = new Headers(providerResponse.headers);
-      rebuiltHeaders.delete("content-length");
-      if (synthesizedSse) {
-        log?.debug?.(
-          "STREAM",
-          `Upstream returned application/json on a streaming request — converting to SSE (${provider}/${model})`
-        );
-        rebuiltHeaders.set("content-type", "text/event-stream");
-        providerResponse = new Response(synthesizedSse, {
-          status: providerResponse.status,
-          statusText: providerResponse.statusText,
-          headers: rebuiltHeaders,
-        });
-      } else {
-        // Not a convertible chat-completion JSON — rebuild the consumed body so
-        // the existing readiness/error path still runs unchanged.
-        providerResponse = new Response(jsonText, {
-          status: providerResponse.status,
-          statusText: providerResponse.statusText,
-          headers: rebuiltHeaders,
-        });
-      }
-    }
-  }
+  providerResponse = await maybeConvertJsonBodyToSse(providerResponse, { log, provider, model });
   const streamReadinessPolicy = resolveStreamReadinessTimeout({
     baseTimeoutMs: STREAM_READINESS_TIMEOUT_MS,
     provider,
@@ -3901,20 +3734,13 @@ export async function handleChatCore({
     await onRequestSuccess();
   }
 
-  const responseHeaders: Record<string, string> = {
-    ...buildStreamingResponseHeaders(providerResponse.headers, {
-      provider,
-      model,
-      cacheHit: false,
-      latencyMs: 0,
-      usage: null,
-      costUsd: 0,
-    }),
-    "x-omniroute-request-id": pendingRequestId,
-  };
-  if (compressionResponseMeta) {
-    responseHeaders[OMNIROUTE_RESPONSE_HEADERS.compression] = compressionResponseMeta;
-  }
+  const responseHeaders = assembleStreamingResponseHeaders({
+    providerHeaders: providerResponse.headers,
+    provider,
+    model,
+    pendingRequestId,
+    compressionResponseMeta,
+  });
 
   // Create transform stream with logger for streaming response
   let transformStream;
@@ -3997,6 +3823,7 @@ export async function handleChatCore({
       effectiveServiceTier,
       isCombo,
       comboStrategy,
+      endpoint: endpointPath,
     });
 
     persistAttemptLogs({
@@ -4059,32 +3886,17 @@ export async function handleChatCore({
     }
 
     // Semantic cache: store assembled streaming response for future cache hits
-    if (
-      semanticCacheEnabled &&
-      streamStatus === 200 &&
-      streamResponseBody &&
-      isCacheableForWrite(body, clientRawRequest?.headers)
-    ) {
-      try {
-        const cleanBody = { ...streamResponseBody };
-        delete cleanBody._streamed;
-        if (!isSmallEnoughForSemanticCache(cleanBody)) return;
-        const sig = generateSignature(
-          model,
-          body.messages ?? body.input,
-          body.temperature,
-          body.top_p,
-          apiKeyInfo?.id ?? undefined
-        );
-        const u = streamUsage as Record<string, unknown> | null;
-        const tokensSaved =
-          (Number(u?.prompt_tokens ?? 0) || 0) + (Number(u?.completion_tokens ?? 0) || 0);
-        setCachedResponse(sig, model, cleanBody, tokensSaved);
-        log?.debug?.("CACHE", `Stored streaming response for ${model} (${tokensSaved} tokens)`);
-      } catch {
-        // Cache write failed — non-critical
-      }
-    }
+    storeStreamingSemanticCacheResponse({
+      enabled: semanticCacheEnabled,
+      streamStatus,
+      streamResponseBody,
+      body,
+      headers: clientRawRequest?.headers,
+      model,
+      apiKeyId: apiKeyInfo?.id ?? undefined,
+      streamUsage,
+      log,
+    });
   };
 
   const streamFailureFinalizers = streamFailure.createStreamFailureFinalizers({
@@ -4155,36 +3967,16 @@ export async function handleChatCore({
     );
   }
 
-  // ── Phase 9.3: Progress tracking (opt-in) ──
-  const progressEnabled = wantsProgress(clientRawRequest?.headers);
-  let finalStream;
-
-  let piiStream = pipeWithDisconnect(providerResponse, transformStream, streamController);
-  if (typeof createPiiTransform === "function") {
-    piiStream = piiStream.pipeThrough((createPiiTransform as () => TransformStream)());
-  } else if (isFeatureFlagEnabled("PII_RESPONSE_SANITIZATION")) {
-    piiStream = piiStream.pipeThrough(createPiiSseTransform());
-  }
-
-  if (progressEnabled) {
-    const progressTransform = createProgressTransform({ signal: streamController.signal });
-    // Chain: provider → transform → progress → client
-    finalStream = piiStream.pipeThrough(progressTransform);
-    responseHeaders[OMNIROUTE_RESPONSE_HEADERS.progress] = "enabled";
-  } else {
-    finalStream = piiStream;
-  }
-  finalStream = finalStream.pipeThrough(
-    createSseHeartbeatTransform({
-      signal: streamController.signal,
-      intervalMs: SSE_HEARTBEAT_INTERVAL_MS,
-      shape: shapeForClientFormat(clientResponseFormat),
-    })
-  );
-  // #1311: echo the requested alias/combo name in each streamed SSE chunk's model field.
-  if (echoModel) {
-    finalStream = finalStream.pipeThrough(createModelEchoTransform(echoModel));
-  }
+  const finalStream = assembleStreamingPipeline({
+    providerResponse,
+    transformStream,
+    streamController,
+    createPiiTransform,
+    clientRawRequestHeaders: clientRawRequest?.headers,
+    clientResponseFormat,
+    echoModel,
+    responseHeaders,
+  });
 
   // ── Gamification event (fire-and-forget) ──
   await emitRequestGamificationEvent({ apiKeyId: apiKeyInfo?.id, model, provider });
diff --git a/open-sse/handlers/chatCore/clientUsageBuffer.ts b/open-sse/handlers/chatCore/clientUsageBuffer.ts
new file mode 100644
index 0000000000..12101b73d0
--- /dev/null
+++ b/open-sse/handlers/chatCore/clientUsageBuffer.ts
@@ -0,0 +1,54 @@
+/**
+ * chatCore client usage buffer/estimate (Quality Gate v2 / Fase 9 — chatCore god-file
+ * decomposition, #3501).
+ *
+ * Extracted from handleChatCore's non-streaming success path: add a buffer to the response usage
+ * and filter it for the client format (to prevent CLI context errors); if the provider returned no
+ * usage block, fall back to estimating from the serialized content length. Mutates
+ * `translatedResponse.usage` in place — byte-identical to the previous inline block, including the
+ * `?.usage` guard, the `JSON.stringify(... || "")` content-length, and the `> 0` estimate gate.
+ */
+import {
+  addBufferToUsage as defaultAddBuffer,
+  filterUsageForFormat as defaultFilterUsage,
+  estimateUsage as defaultEstimateUsage,
+} from "../../utils/usageTracking.ts";
+
+type ResponseLike = {
+  usage?: unknown;
+  choices?: Array<{ message?: { content?: unknown } }>;
+} | null | undefined;
+
+export interface ClientUsageBufferDeps {
+  addBufferToUsage: typeof defaultAddBuffer;
+  filterUsageForFormat: typeof defaultFilterUsage;
+  estimateUsage: typeof defaultEstimateUsage;
+}
+
+const DEFAULT_DEPS: ClientUsageBufferDeps = {
+  addBufferToUsage: defaultAddBuffer,
+  filterUsageForFormat: defaultFilterUsage,
+  estimateUsage: defaultEstimateUsage,
+};
+
+export function applyClientUsageBuffer(
+  translatedResponse: ResponseLike,
+  body: unknown,
+  clientResponseFormat: unknown,
+  deps: ClientUsageBufferDeps = DEFAULT_DEPS
+): void {
+  // Add buffer and filter usage for client (to prevent CLI context errors)
+  if (translatedResponse?.usage) {
+    const buffered = deps.addBufferToUsage(translatedResponse.usage);
+    translatedResponse.usage = deps.filterUsageForFormat(buffered, clientResponseFormat);
+  } else {
+    // Fallback: estimate usage when provider returned no usage block
+    const contentLength = JSON.stringify(
+      translatedResponse?.choices?.[0]?.message?.content || ""
+    ).length;
+    if (contentLength > 0) {
+      const estimated = deps.estimateUsage(body, contentLength, clientResponseFormat);
+      translatedResponse.usage = deps.filterUsageForFormat(estimated, clientResponseFormat);
+    }
+  }
+}
diff --git a/open-sse/handlers/chatCore/compressionAnalyticsWrite.ts b/open-sse/handlers/chatCore/compressionAnalyticsWrite.ts
new file mode 100644
index 0000000000..40319e3c52
--- /dev/null
+++ b/open-sse/handlers/chatCore/compressionAnalyticsWrite.ts
@@ -0,0 +1,113 @@
+/**
+ * chatCore compression analytics write (Quality Gate v2 / Fase 9 — chatCore god-file
+ * decomposition, #3501).
+ *
+ * Extracted from handleChatCore's request-setup compression path: persist the per-run compression
+ * analytics row (cost saved, RTK raw-output pointers) plus the per-engine breakdown of a stacked
+ * run. Returns the write promise (the caller assigns it to compressionAnalyticsWritePromise) and
+ * swallows its own errors — best-effort, off the hot path, never throws into a request. Behaviour
+ * is byte-identical to the previous inline block. Split into small builders so each stays under the
+ * complexity cap.
+ */
+
+import { type CompressionStats } from "../../services/compression/stats.ts";
+
+type LoggerLike = { debug?: (...args: unknown[]) => void } | null | undefined;
+
+type WriteOpts = {
+  stats: CompressionStats;
+  provider: string | null | undefined;
+  effectiveModel: string | null | undefined;
+  effectiveServiceTier: string | undefined;
+  comboName: string | null | undefined;
+  mode: string;
+  compressionComboId: string | null | undefined;
+  skillRequestId: string;
+  cavemanOutputModeApplied: boolean;
+  cavemanOutputModeIntensity: string | null | undefined;
+  log?: LoggerLike;
+};
+
+type RtkPointer = { id?: string | null; bytes?: number | null };
+
+function buildRtkPointerFields(rtkPointers: RtkPointer[]) {
+  return {
+    rtk_raw_output_pointer: rtkPointers[0]?.id ?? null,
+    rtk_raw_output_bytes: rtkPointers[0]?.bytes ?? null,
+    rtk_raw_output_pointers: rtkPointers.length
+      ? JSON.stringify(rtkPointers.map((pointer) => pointer.id))
+      : null,
+    rtk_raw_output_total_bytes: rtkPointers.length
+      ? rtkPointers.reduce((total, pointer) => total + (pointer.bytes ?? 0), 0)
+      : null,
+  };
+}
+
+function buildAnalyticsRow(
+  opts: WriteOpts,
+  tokensSaved: number,
+  rtkPointers: RtkPointer[],
+  estimatedUsdSaved: number
+) {
+  const { stats } = opts;
+  return {
+    timestamp: new Date().toISOString(),
+    combo_id: opts.comboName ?? null,
+    provider: opts.provider ?? null,
+    mode: opts.mode,
+    engine: stats.engine ?? opts.mode,
+    compression_combo_id: stats.compressionComboId ?? opts.compressionComboId ?? null,
+    original_tokens: stats.originalTokens,
+    compressed_tokens: stats.compressedTokens,
+    tokens_saved: tokensSaved,
+    duration_ms: stats.durationMs ?? null,
+    request_id: opts.skillRequestId,
+    estimated_usd_saved: estimatedUsdSaved || null,
+    validation_fallback: stats.fallbackApplied ? 1 : 0,
+    output_mode: opts.cavemanOutputModeApplied ? opts.cavemanOutputModeIntensity : null,
+    ...buildRtkPointerFields(rtkPointers),
+  };
+}
+
+function buildEngineBreakdownRows(stats: CompressionStats, requestId: string) {
+  const engineBreakdown = stats.engineBreakdown ?? [];
+  return engineBreakdown.map((b) => ({
+    timestamp: new Date().toISOString(),
+    request_id: requestId,
+    engine: b.engine,
+    original_tokens: b.originalTokens,
+    compressed_tokens: b.compressedTokens,
+    tokens_saved: Math.max(0, b.originalTokens - b.compressedTokens),
+    duration_ms: b.durationMs ?? null,
+  }));
+}
+
+export function writeCompressionAnalytics(opts: WriteOpts): Promise<void> {
+  return (async () => {
+    try {
+      const { insertCompressionAnalyticsRow, insertCompressionEngineBreakdown } = await import(
+        "@/lib/db/compressionAnalytics"
+      );
+      const { calculateCost } = await import("@/lib/usage/costCalculator");
+      const { stats } = opts;
+      const tokensSaved = Math.max(0, stats.originalTokens - stats.compressedTokens);
+      const rtkPointers = (stats.rtkRawOutputPointers ?? []) as RtkPointer[];
+      const estimatedUsdSaved = await calculateCost(
+        opts.provider ?? "",
+        opts.effectiveModel ?? "",
+        { input: tokensSaved },
+        { serviceTier: opts.effectiveServiceTier }
+      );
+      insertCompressionAnalyticsRow(buildAnalyticsRow(opts, tokensSaved, rtkPointers, estimatedUsdSaved));
+      const breakdownRows = buildEngineBreakdownRows(stats, opts.skillRequestId);
+      if (breakdownRows.length > 0) {
+        insertCompressionEngineBreakdown(breakdownRows);
+      }
+    } catch (err) {
+      opts.log?.debug?.(
+        "COMPRESSION",
+        "Compression analytics write skipped: " + (err instanceof Error ? err.message : String(err))
+      );
+    }
+  })();
+}
diff --git a/open-sse/handlers/chatCore/compressionComboPredicates.ts b/open-sse/handlers/chatCore/compressionComboPredicates.ts
new file mode 100644
index 0000000000..d73b4324cb
--- /dev/null
+++ b/open-sse/handlers/chatCore/compressionComboPredicates.ts
@@ -0,0 +1,41 @@
+/**
+ * chatCore compression-combo predicates (Quality Gate v2 / Fase 9 — chatCore god-file
+ * decomposition, #3501).
+ *
+ * Pure predicates extracted from handleChatCore's compression setup: detect the built-in
+ * RTK→caveman stacked pipeline and whether a runtime combo has at least one pipeline layer.
+ * No handler state is captured; behaviour is byte-identical to the previous inline closures.
+ */
+
+import type { CompressionConfig } from "../../services/compression/types.ts";
+
+export type RuntimeCompressionCombo = {
+  id: string;
+  pipeline: NonNullable<CompressionConfig["stackedPipeline"]>;
+  languagePacks: string[];
+  outputMode: boolean;
+  outputModeIntensity: string;
+};
+
+export function isBuiltinStackedPipeline(
+  pipeline: CompressionConfig["stackedPipeline"] | undefined
+): boolean {
+  if (!Array.isArray(pipeline) || pipeline.length !== 2) return false;
+  const [first, second] = pipeline;
+  return (
+    first?.engine === "rtk" &&
+    (first.intensity === undefined || first.intensity === "standard") &&
+    !first.config &&
+    second?.engine === "caveman" &&
+    (second.intensity === undefined || second.intensity === "full") &&
+    !second.config
+  );
+}
+
+export function isStackedCompressionCombo(
+  compressionCombo: RuntimeCompressionCombo | null
+): compressionCombo is RuntimeCompressionCombo {
+  // >= 1: a single-engine default combo (user enabled exactly one layer via the per-engine config
+  // page) must still apply. applyCompressionComboConfig already guards length === 0.
+  return Boolean(compressionCombo && compressionCombo.pipeline.length >= 1);
+}
diff --git a/open-sse/handlers/chatCore/compressionSettings.ts b/open-sse/handlers/chatCore/compressionSettings.ts
new file mode 100644
index 0000000000..5642fb5028
--- /dev/null
+++ b/open-sse/handlers/chatCore/compressionSettings.ts
@@ -0,0 +1,35 @@
+/**
+ * chatCore compression settings resolution (Quality Gate v2 / Fase 9 — chatCore god-file
+ * decomposition, #3501).
+ *
+ * Extracted from handleChatCore's Proactive Context Compression setup: read the canonical
+ * compression settings and derive the prompt-compression and delegated context-editing flags.
+ * Best-effort — on a lookup error it logs and falls back to disabled, exactly like the previous
+ * inline try/catch. Behaviour is byte-identical.
+ */
+
+import type { CompressionConfig } from "../../services/compression/types.ts";
+
+type LoggerLike = { warn?: (...args: unknown[]) => void } | null | undefined;
+
+export async function resolveCompressionSettings(log?: LoggerLike): Promise<{
+  settings: CompressionConfig | null;
+  enabled: boolean;
+  contextEditingEnabled: boolean;
+}> {
+  try {
+    const { getCompressionSettings } = await import("@/lib/db/compression");
+    const settings = await getCompressionSettings();
+    return {
+      settings,
+      enabled: settings.enabled,
+      contextEditingEnabled: settings.contextEditing?.enabled === true,
+    };
+  } catch (err) {
+    log?.warn?.(
+      "COMPRESSION",
+      "Compression settings lookup skipped: " + (err instanceof Error ? err.message : String(err))
+    );
+    return { settings: null, enabled: false, contextEditingEnabled: false };
+  }
+}
diff --git a/open-sse/handlers/chatCore/failureUsage.ts b/open-sse/handlers/chatCore/failureUsage.ts
index fd1860eba9..52f70fbfee 100644
--- a/open-sse/handlers/chatCore/failureUsage.ts
+++ b/open-sse/handlers/chatCore/failureUsage.ts
@@ -19,6 +19,7 @@ export function buildFailureUsageRecord(opts: {
   statusCode: number;
   errorCode: string | null | undefined;
   latencyMs: number;
+  endpoint?: string | null | undefined;
 }) {
   return {
     provider: opts.provider || "unknown",
@@ -35,5 +36,6 @@ export function buildFailureUsageRecord(opts: {
     apiKeyName: opts.apiKeyInfo?.name || undefined,
     serviceTier: opts.effectiveServiceTier,
     comboStrategy: opts.isCombo ? opts.comboStrategy || undefined : undefined,
+    endpoint: opts.endpoint || undefined,
   };
 }
diff --git a/open-sse/handlers/chatCore/jsonBodyToSse.ts b/open-sse/handlers/chatCore/jsonBodyToSse.ts
new file mode 100644
index 0000000000..fa4db8867d
--- /dev/null
+++ b/open-sse/handlers/chatCore/jsonBodyToSse.ts
@@ -0,0 +1,68 @@
+/**
+ * chatCore non-SSE JSON → SSE conversion (Quality Gate v2 / Fase 9 — chatCore god-file
+ * decomposition, #3501).
+ *
+ * Extracted from handleChatCore's streaming entry (#3089): some "reasoning" openai-compatible
+ * upstreams ignore `stream:true` and return a complete application/json chat-completion body
+ * instead of an SSE stream. The readiness check only recognizes SSE `data:` frames, so that body
+ * produced a spurious STREAM_EARLY_EOF / HTTP 502. Detect a JSON (non-SSE) upstream body and
+ * synthesize an equivalent OpenAI SSE stream so the streaming pipeline gets a valid stream.
+ *
+ * Returns the (possibly rebuilt) provider response — unchanged when the body is not a non-SSE JSON
+ * body, an SSE stream when convertible, or a rebuilt-with-consumed-body response otherwise (so the
+ * existing readiness/error path still runs unchanged). Behaviour is byte-identical to the previous
+ * inline block.
+ */
+import { withBodyTimeout as defaultWithBodyTimeout } from "../../utils/stream.ts";
+import { synthesizeOpenAiSseFromJson as defaultSynthesize } from "../../utils/jsonToSse.ts";
+
+type LoggerLike = { debug?: (...args: unknown[]) => void } | null | undefined;
+
+export interface JsonBodyToSseDeps {
+  withBodyTimeout: typeof defaultWithBodyTimeout;
+  synthesizeOpenAiSseFromJson: typeof defaultSynthesize;
+}
+
+const DEFAULT_DEPS: JsonBodyToSseDeps = {
+  withBodyTimeout: defaultWithBodyTimeout,
+  synthesizeOpenAiSseFromJson: defaultSynthesize,
+};
+
+export async function maybeConvertJsonBodyToSse(
+  providerResponse: Response,
+  ctx: { log?: LoggerLike; provider: string | null | undefined; model: string | null | undefined },
+  deps: JsonBodyToSseDeps = DEFAULT_DEPS
+): Promise<Response> {
+  const upstreamContentType = (providerResponse.headers.get("content-type") || "").toLowerCase();
+  const isNonSseJsonBody =
+    !!providerResponse.body &&
+    upstreamContentType.includes("application/json") &&
+    !upstreamContentType.includes("text/event-stream") &&
+    !upstreamContentType.includes("application/x-ndjson");
+  if (!isNonSseJsonBody) {
+    return providerResponse;
+  }
+  const jsonText = await deps.withBodyTimeout<string>(providerResponse.text());
+  const synthesizedSse = deps.synthesizeOpenAiSseFromJson(jsonText);
+  const rebuiltHeaders = new Headers(providerResponse.headers);
+  rebuiltHeaders.delete("content-length");
+  if (synthesizedSse) {
+    ctx.log?.debug?.(
+      "STREAM",
+      `Upstream returned application/json on a streaming request — converting to SSE (${ctx.provider}/${ctx.model})`
+    );
+    rebuiltHeaders.set("content-type", "text/event-stream");
+    return new Response(synthesizedSse, {
+      status: providerResponse.status,
+      statusText: providerResponse.statusText,
+      headers: rebuiltHeaders,
+    });
+  }
+  // Not a convertible chat-completion JSON — rebuild the consumed body so the existing
+  // readiness/error path still runs unchanged.
+  return new Response(jsonText, {
+    status: providerResponse.status,
+    statusText: providerResponse.statusText,
+    headers: rebuiltHeaders,
+  });
+}
diff --git a/open-sse/handlers/chatCore/nonStreamingResponseHeaders.ts b/open-sse/handlers/chatCore/nonStreamingResponseHeaders.ts
new file mode 100644
index 0000000000..4306ace464
--- /dev/null
+++ b/open-sse/handlers/chatCore/nonStreamingResponseHeaders.ts
@@ -0,0 +1,46 @@
+/**
+ * chatCore non-streaming success response headers (Quality Gate v2 / Fase 9 — chatCore god-file
+ * decomposition, #3501).
+ *
+ * Extracted from handleChatCore's non-streaming success path: build the response header map for a
+ * cache-MISS JSON response — the static Content-Type + cache marker, the OmniRoute meta headers
+ * (provider/model/latency/usage/cost/request-id), and the optional compression header. Pure builder
+ * (returns a fresh map; only mutates the map it owns). Behaviour is byte-identical to the previous
+ * inline block, including `latencyMs: now - startTime`.
+ */
+import { OMNIROUTE_RESPONSE_HEADERS } from "@/shared/constants/headers";
+import { attachOmniRouteMetaHeaders as defaultAttachMeta } from "@/domain/omnirouteResponseMeta";
+
+export function buildNonStreamingResponseHeaders(
+  args: {
+    provider: string | null | undefined;
+    model: string | null | undefined;
+    startTime: number;
+    responseUsage: unknown;
+    estimatedCost: number;
+    requestId: unknown;
+    compressionResponseMeta?: string | null | undefined;
+  },
+  deps: { attachOmniRouteMetaHeaders: typeof defaultAttachMeta; now: () => number } = {
+    attachOmniRouteMetaHeaders: defaultAttachMeta,
+    now: Date.now,
+  }
+): Record<string, string> {
+  const responseHeaders: Record<string, string> = {
+    "Content-Type": "application/json",
+    [OMNIROUTE_RESPONSE_HEADERS.cache]: "MISS",
+  };
+  deps.attachOmniRouteMetaHeaders(responseHeaders, {
+    provider: args.provider,
+    model: args.model,
+    cacheHit: false,
+    latencyMs: deps.now() - args.startTime,
+    usage: args.responseUsage,
+    costUsd: args.estimatedCost,
+    requestId: args.requestId,
+  });
+  if (args.compressionResponseMeta) {
+    responseHeaders[OMNIROUTE_RESPONSE_HEADERS.compression] = args.compressionResponseMeta;
+  }
+  return responseHeaders;
+}
diff --git a/open-sse/handlers/chatCore/nonStreamingUsageStats.ts b/open-sse/handlers/chatCore/nonStreamingUsageStats.ts
index d7514e5d44..13e4a9ae91 100644
--- a/open-sse/handlers/chatCore/nonStreamingUsageStats.ts
+++ b/open-sse/handlers/chatCore/nonStreamingUsageStats.ts
@@ -27,6 +27,7 @@ export type RecordNonStreamingUsageStatsContext = {
   effectiveServiceTier: EffectiveServiceTier;
   isCombo: boolean;
   comboStrategy: string | null | undefined;
+  endpoint?: string | null | undefined;
 };
 
 function logUsageTrace(
@@ -55,6 +56,7 @@ function persistUsageRow(usage: object, ctx: RecordNonStreamingUsageStatsContext
     apiKeyName: apiKeyInfo?.name || undefined,
     serviceTier: effectiveServiceTier,
     comboStrategy: ctx.isCombo ? ctx.comboStrategy || undefined : undefined,
+    endpoint: ctx.endpoint || undefined,
   }).catch((err) => {
     console.error("Failed to save usage stats:", err.message);
   });
diff --git a/open-sse/handlers/chatCore/outputStyleTelemetry.ts b/open-sse/handlers/chatCore/outputStyleTelemetry.ts
new file mode 100644
index 0000000000..4bfa2e1158
--- /dev/null
+++ b/open-sse/handlers/chatCore/outputStyleTelemetry.ts
@@ -0,0 +1,53 @@
+/**
+ * chatCore output-style run-telemetry hook (Quality Gate v2 / Fase 9 — chatCore god-file
+ * decomposition, #3501).
+ *
+ * Extracted from handleChatCore's request-setup compression path: when the unified output styles
+ * ran, emit the per-run telemetry record so output-style usage surfaces in compression analytics.
+ * Best-effort, fire-and-forget — an un-awaited IIFE that swallows its own errors and never affects
+ * the request. Behaviour is byte-identical to the previous inline block.
+ */
+
+import { type OutputStylesResult } from "../../services/compression/outputStyles/apply.ts";
+
+type LoggerLike = { debug?: (...args: unknown[]) => void } | null | undefined;
+
+export function emitOutputStyleTelemetry(args: {
+  outputStyleResult: OutputStylesResult | null | undefined;
+  skillRequestId: string | null | undefined;
+  traceId: string | null | undefined;
+  effectiveModel: string | null | undefined;
+  provider: string | null | undefined;
+  compressionComboId: string | null | undefined;
+  estimatedTokens: number;
+  log?: LoggerLike;
+}): void {
+  const result = args.outputStyleResult;
+  if (!result) return;
+
+  void (async () => {
+    try {
+      const { buildOutputStyleTelemetry } = await import(
+        "../../services/compression/outputStyles/telemetry.ts"
+      );
+      const { insertCompressionRunTelemetryRow } = await import("@/lib/db/compressionRunTelemetry");
+      const record = buildOutputStyleTelemetry({
+        requestId: args.skillRequestId ?? args.traceId ?? "",
+        model: args.effectiveModel ?? "",
+        provider: args.provider ?? "",
+        source: args.compressionComboId ? "active-profile" : "default",
+        tokensBefore: args.estimatedTokens,
+        tokensAfter: args.estimatedTokens,
+        applied: result.applied,
+        appliedStyles: result.appliedStyles,
+        skippedReason: result.skippedReason,
+      });
+      insertCompressionRunTelemetryRow(record);
+    } catch (err) {
+      args.log?.debug?.(
+        "COMPRESSION",
+        "Run-telemetry emit skipped: " + (err instanceof Error ? err.message : String(err))
+      );
+    }
+  })();
+}
diff --git a/open-sse/handlers/chatCore/pluginOnRequest.ts b/open-sse/handlers/chatCore/pluginOnRequest.ts
new file mode 100644
index 0000000000..170c276c5e
--- /dev/null
+++ b/open-sse/handlers/chatCore/pluginOnRequest.ts
@@ -0,0 +1,65 @@
+/**
+ * chatCore plugin onRequest hook (Quality Gate v2 / Fase 9 — chatCore god-file decomposition,
+ * #3501).
+ *
+ * Extracted from handleChatCore's request entry: run the registered plugin `onRequest` hooks. The
+ * hook may block the request (→ the handler returns a 403), rewrite the body (→ the handler
+ * reassigns `body`), or do nothing. Fail-open — a misbehaving plugin is logged and ignored. Returns
+ * a discriminated result so the early-return + body reassignment stay in the handler; behaviour is
+ * byte-identical to the previous inline block.
+ */
+
+type LoggerLike =
+  | { info?: (...args: unknown[]) => void; debug?: (...args: unknown[]) => void }
+  | null
+  | undefined;
+
+export type PluginOnRequestGate =
+  | { blocked: true; response: Response }
+  | { blocked: false; body?: unknown };
+
+const JSON_HEADERS = { status: 403, headers: { "Content-Type": "application/json" } } as const;
+
+export async function runPluginOnRequestHook(args: {
+  requestId: string;
+  body: unknown;
+  model: string | null | undefined;
+  provider: string | null | undefined;
+  apiKeyInfo: unknown;
+  log?: LoggerLike;
+}): Promise<PluginOnRequestGate> {
+  try {
+    const { runOnRequest } = await import("@/lib/plugins/hooks");
+    const pluginCtx = {
+      requestId: args.requestId,
+      body: args.body,
+      model: args.model,
+      provider: args.provider,
+      apiKeyInfo: args.apiKeyInfo,
+      metadata: {},
+    };
+    const pluginResult = await runOnRequest(pluginCtx);
+    if (pluginResult?.blocked) {
+      args.log?.info?.("PLUGIN", `Request blocked by plugin`);
+      const response = pluginResult.response
+        ? new Response(JSON.stringify(pluginResult.response), JSON_HEADERS)
+        : new Response(
+            JSON.stringify({
+              error: { message: "Request blocked by plugin", type: "plugin_block" },
+            }),
+            JSON_HEADERS
+          );
+      return { blocked: true, response };
+    }
+    if (pluginResult?.metadata) {
+      Object.assign(pluginCtx.metadata, pluginResult.metadata);
+    }
+    return { blocked: false, body: pluginResult?.body };
+  } catch (pluginErr) {
+    args.log?.debug?.(
+      "PLUGIN",
+      `onRequest hook error (non-fatal): ${pluginErr instanceof Error ? pluginErr.message : String(pluginErr)}`
+    );
+    return { blocked: false };
+  }
+}
diff --git a/open-sse/handlers/chatCore/postCallGuardrailContext.ts b/open-sse/handlers/chatCore/postCallGuardrailContext.ts
new file mode 100644
index 0000000000..001c9c2f80
--- /dev/null
+++ b/open-sse/handlers/chatCore/postCallGuardrailContext.ts
@@ -0,0 +1,47 @@
+/**
+ * chatCore post-call guardrail context builder (Quality Gate v2 / Fase 9 — chatCore god-file
+ * decomposition, #3501).
+ *
+ * Extracted from handleChatCore's non-streaming success path: assemble the context object passed to
+ * `guardrailRegistry.runPostCallHooks`. Pure value builder — no side effects, no early-returns. The
+ * `disabledGuardrails` field is resolved via `resolveDisabledGuardrails` (injectable for tests).
+ * Behaviour is byte-identical to the previous inline literal, including the `method: "POST"` /
+ * `stream: false` constants and the headers/endpoint null-coalescing.
+ */
+import { resolveDisabledGuardrails as defaultResolveDisabled } from "@/lib/guardrails";
+
+type LoggerLike = unknown;
+type HeadersLike = Headers | Record<string, unknown> | null;
+
+export function buildPostCallGuardrailContext(
+  args: {
+    apiKeyInfo: unknown;
+    body: unknown;
+    clientRawRequest: { headers?: unknown; endpoint?: unknown } | null | undefined;
+    log?: LoggerLike;
+    model: string | null | undefined;
+    provider: string | null | undefined;
+    responsePayloadFormat: unknown;
+    clientResponseFormat: unknown;
+  },
+  resolveDisabledGuardrails: typeof defaultResolveDisabled = defaultResolveDisabled
+) {
+  const headers = (args.clientRawRequest?.headers as HeadersLike) ?? null;
+  return {
+    apiKeyInfo: args.apiKeyInfo,
+    disabledGuardrails: resolveDisabledGuardrails({
+      apiKeyInfo: (args.apiKeyInfo as Record<string, unknown> | null) ?? null,
+      body: args.body,
+      headers,
+    }),
+    endpoint: args.clientRawRequest?.endpoint || null,
+    headers,
+    log: args.log,
+    method: "POST",
+    model: args.model,
+    provider: args.provider,
+    sourceFormat: args.responsePayloadFormat,
+    stream: false,
+    targetFormat: args.clientResponseFormat,
+  } as const;
+}
diff --git a/open-sse/handlers/chatCore/quotaShareConsumption.ts b/open-sse/handlers/chatCore/quotaShareConsumption.ts
index e38a413e8b..cb50ea2e22 100644
--- a/open-sse/handlers/chatCore/quotaShareConsumption.ts
+++ b/open-sse/handlers/chatCore/quotaShareConsumption.ts
@@ -14,6 +14,7 @@ export async function scheduleQuotaShareConsumption(args: {
   apiKeyId: string | null | undefined;
   connectionId: string | null | undefined;
   provider: string | null | undefined;
+  model?: string | null | undefined;
   usage: unknown;
   estimatedCost: number;
   log?: LoggerLike;
@@ -28,6 +29,8 @@ export async function scheduleQuotaShareConsumption(args: {
         apiKeyId: args.apiKeyId,
         connectionId: args.connectionId,
         provider: args.provider ?? "unknown",
+        // Per-(key,model) cap accounting — same resolved model id used at enforce time.
+        model: args.model ?? undefined,
         cost: buildConsumptionCost(args.usage, args.estimatedCost),
       },
       args.log
diff --git a/open-sse/handlers/chatCore/semanticCacheStore.ts b/open-sse/handlers/chatCore/semanticCacheStore.ts
new file mode 100644
index 0000000000..8d119a863f
--- /dev/null
+++ b/open-sse/handlers/chatCore/semanticCacheStore.ts
@@ -0,0 +1,73 @@
+/**
+ * chatCore semantic-cache store (Quality Gate v2 / Fase 9 — chatCore god-file decomposition,
+ * #3501).
+ *
+ * Extracted from handleChatCore's non-streaming success path (Phase 9.1): when semantic caching is
+ * enabled and the request/response are cacheable, store the translated response under its signature
+ * so a later temp=0 request can be served from cache. Side-effect only (cache write + debug log);
+ * no early-return, no outer-variable reassignment. Behaviour is byte-identical to the previous
+ * inline block, including the `prompt + completion || 0` token-saved precedence.
+ */
+import {
+  generateSignature as defaultGenerateSignature,
+  setCachedResponse as defaultSetCachedResponse,
+  isCacheableForWrite as defaultIsCacheableForWrite,
+} from "@/lib/semanticCache";
+import { isSmallEnoughForSemanticCache as defaultIsSmallEnough } from "../../utils/estimateSize.ts";
+
+type LoggerLike = { debug?: (...args: unknown[]) => void } | null | undefined;
+
+type CacheBody = {
+  messages?: unknown;
+  input?: unknown;
+  temperature?: unknown;
+  top_p?: unknown;
+};
+
+type UsageLike = { prompt_tokens?: number; completion_tokens?: number } | null | undefined;
+
+export interface SemanticCacheStoreDeps {
+  isCacheableForWrite: typeof defaultIsCacheableForWrite;
+  isSmallEnoughForSemanticCache: typeof defaultIsSmallEnough;
+  generateSignature: typeof defaultGenerateSignature;
+  setCachedResponse: typeof defaultSetCachedResponse;
+}
+
+const DEFAULT_DEPS: SemanticCacheStoreDeps = {
+  isCacheableForWrite: defaultIsCacheableForWrite,
+  isSmallEnoughForSemanticCache: defaultIsSmallEnough,
+  generateSignature: defaultGenerateSignature,
+  setCachedResponse: defaultSetCachedResponse,
+};
+
+export function storeSemanticCacheResponse(
+  args: {
+    enabled: boolean;
+    body: CacheBody;
+    headers: unknown;
+    translatedResponse: unknown;
+    model: string;
+    apiKeyId?: string | number;
+    usage?: UsageLike;
+    log?: LoggerLike;
+  },
+  deps: SemanticCacheStoreDeps = DEFAULT_DEPS
+): void {
+  if (
+    !args.enabled ||
+    !deps.isCacheableForWrite(args.body, args.headers) ||
+    !deps.isSmallEnoughForSemanticCache(args.translatedResponse)
+  ) {
+    return;
+  }
+  const signature = deps.generateSignature(
+    args.model,
+    args.body.messages ?? args.body.input,
+    args.body.temperature,
+    args.body.top_p,
+    args.apiKeyId ?? undefined
+  );
+  const tokensSaved = args.usage?.prompt_tokens + args.usage?.completion_tokens || 0;
+  deps.setCachedResponse(signature, args.model, args.translatedResponse, tokensSaved);
+  args.log?.debug?.("CACHE", `Stored response for ${args.model} (${tokensSaved} tokens)`);
+}
diff --git a/open-sse/handlers/chatCore/streamingPipeline.ts b/open-sse/handlers/chatCore/streamingPipeline.ts
new file mode 100644
index 0000000000..d67803918b
--- /dev/null
+++ b/open-sse/handlers/chatCore/streamingPipeline.ts
@@ -0,0 +1,99 @@
+/**
+ * chatCore streaming response pipeline assembly (Quality Gate v2 / Fase 9 — chatCore god-file
+ * decomposition, #3501).
+ *
+ * Extracted from handleChatCore's streaming success path: chain the response transforms onto the
+ * provider stream — disconnect-aware pipe → PII sanitization (explicit transform or feature-flagged
+ * SSE transform) → optional progress tracking (Phase 9.3) → SSE heartbeat → optional model-echo
+ * (#1311). Returns the assembled `finalStream`; mutates the passed `responseHeaders` to add the
+ * progress marker when progress is enabled. Behaviour is byte-identical to the previous inline
+ * block, including the exact transform order and branch conditions.
+ */
+import { pipeWithDisconnect as defaultPipeWithDisconnect } from "../../utils/streamHandler.ts";
+import {
+  createSseHeartbeatTransform as defaultHeartbeat,
+  shapeForClientFormat as defaultShape,
+} from "../../utils/sseHeartbeat.ts";
+import { createModelEchoTransform as defaultModelEcho } from "../../services/responseModelEcho.ts";
+import {
+  createProgressTransform as defaultProgress,
+  wantsProgress as defaultWantsProgress,
+} from "../../utils/progressTracker.ts";
+import { createPiiSseTransform as defaultPiiSse } from "@/lib/streamingPiiTransform";
+import { isFeatureFlagEnabled as defaultFeatureFlag } from "@/shared/utils/featureFlags";
+import { OMNIROUTE_RESPONSE_HEADERS } from "@/shared/constants/headers";
+import { SSE_HEARTBEAT_INTERVAL_MS } from "../../config/constants.ts";
+
+type HeadersLike = Headers | Record<string, unknown> | null | undefined;
+
+export interface StreamingPipelineDeps {
+  wantsProgress: typeof defaultWantsProgress;
+  pipeWithDisconnect: typeof defaultPipeWithDisconnect;
+  isFeatureFlagEnabled: typeof defaultFeatureFlag;
+  createPiiSseTransform: typeof defaultPiiSse;
+  createProgressTransform: typeof defaultProgress;
+  createSseHeartbeatTransform: typeof defaultHeartbeat;
+  shapeForClientFormat: typeof defaultShape;
+  createModelEchoTransform: typeof defaultModelEcho;
+}
+
+const DEFAULT_DEPS: StreamingPipelineDeps = {
+  wantsProgress: defaultWantsProgress,
+  pipeWithDisconnect: defaultPipeWithDisconnect,
+  isFeatureFlagEnabled: defaultFeatureFlag,
+  createPiiSseTransform: defaultPiiSse,
+  createProgressTransform: defaultProgress,
+  createSseHeartbeatTransform: defaultHeartbeat,
+  shapeForClientFormat: defaultShape,
+  createModelEchoTransform: defaultModelEcho,
+};
+
+export function assembleStreamingPipeline(
+  args: {
+    providerResponse: unknown;
+    transformStream: unknown;
+    streamController: { signal: AbortSignal };
+    createPiiTransform: unknown;
+    clientRawRequestHeaders: HeadersLike;
+    clientResponseFormat: unknown;
+    echoModel: string | null | undefined;
+    responseHeaders: Record<string, string>;
+  },
+  deps: StreamingPipelineDeps = DEFAULT_DEPS
+) {
+  // ── Phase 9.3: Progress tracking (opt-in) ──
+  const progressEnabled = deps.wantsProgress(args.clientRawRequestHeaders);
+  let finalStream;
+
+  let piiStream = deps.pipeWithDisconnect(
+    args.providerResponse,
+    args.transformStream,
+    args.streamController
+  );
+  if (typeof args.createPiiTransform === "function") {
+    piiStream = piiStream.pipeThrough((args.createPiiTransform as () => TransformStream)());
+  } else if (deps.isFeatureFlagEnabled("PII_RESPONSE_SANITIZATION")) {
+    piiStream = piiStream.pipeThrough(deps.createPiiSseTransform());
+  }
+
+  if (progressEnabled) {
+    const progressTransform = deps.createProgressTransform({ signal: args.streamController.signal });
+    // Chain: provider → transform → progress → client
+    finalStream = piiStream.pipeThrough(progressTransform);
+    args.responseHeaders[OMNIROUTE_RESPONSE_HEADERS.progress] = "enabled";
+  } else {
+    finalStream = piiStream;
+  }
+  finalStream = finalStream.pipeThrough(
+    deps.createSseHeartbeatTransform({
+      signal: args.streamController.signal,
+      intervalMs: SSE_HEARTBEAT_INTERVAL_MS,
+      shape: deps.shapeForClientFormat(args.clientResponseFormat),
+    })
+  );
+  // #1311: echo the requested alias/combo name in each streamed SSE chunk's model field.
+  if (args.echoModel) {
+    finalStream = finalStream.pipeThrough(deps.createModelEchoTransform(args.echoModel));
+  }
+  return finalStream;
+}
diff --git a/open-sse/handlers/chatCore/streamingResponseHeaders.ts b/open-sse/handlers/chatCore/streamingResponseHeaders.ts
new file mode 100644
index 0000000000..a978a0a212
--- /dev/null
+++ b/open-sse/handlers/chatCore/streamingResponseHeaders.ts
@@ -0,0 +1,39 @@
+/**
+ * chatCore streaming response headers (Quality Gate v2 / Fase 9 — chatCore god-file decomposition,
+ * #3501).
+ *
+ * Extracted from handleChatCore's streaming success path: assemble the streaming response header map
+ * — the upstream-derived streaming headers (via buildStreamingResponseHeaders, with zeroed
+ * latency/usage/cost since those are not yet known at stream start), the per-request id, and the
+ * optional compression header. Pure builder (returns a fresh map). Behaviour is byte-identical to
+ * the previous inline block.
+ */
+import { OMNIROUTE_RESPONSE_HEADERS } from "@/shared/constants/headers";
+import { buildStreamingResponseHeaders as defaultBuildStreaming } from "./responseHeaders.ts";
+
+export function assembleStreamingResponseHeaders(
+  args: {
+    providerHeaders: Headers;
+    provider: string | null | undefined;
+    model: string | null | undefined;
+    pendingRequestId: string;
+    compressionResponseMeta?: string | null | undefined;
+  },
+  buildStreamingResponseHeaders: typeof defaultBuildStreaming = defaultBuildStreaming
+): Record<string, string> {
+  const responseHeaders: Record<string, string> = {
+    ...buildStreamingResponseHeaders(args.providerHeaders, {
+      provider: args.provider,
+      model: args.model,
+      cacheHit: false,
+      latencyMs: 0,
+      usage: null,
+      costUsd: 0,
+    }),
+    "x-omniroute-request-id": args.pendingRequestId,
+  };
+  if (args.compressionResponseMeta) {
+    responseHeaders[OMNIROUTE_RESPONSE_HEADERS.compression] = args.compressionResponseMeta;
+  }
+  return responseHeaders;
+}
diff --git a/open-sse/handlers/chatCore/streamingSemanticCacheStore.ts b/open-sse/handlers/chatCore/streamingSemanticCacheStore.ts
new file mode 100644
index 0000000000..3aa16a9781
--- /dev/null
+++ b/open-sse/handlers/chatCore/streamingSemanticCacheStore.ts
@@ -0,0 +1,95 @@
+/**
+ * chatCore streaming semantic-cache store (Quality Gate v2 / Fase 9 — chatCore god-file
+ * decomposition, #3501).
+ *
+ * Extracted from handleChatCore's onStreamComplete callback: after a 200 streaming response is
+ * assembled, store it under its signature so a future temp=0 request can be served from cache.
+ * Side-effect only (cache write + debug log), wrapped in fail-open try/catch. Behaviour is
+ * byte-identical to the previous inline block — including the `_streamed` strip, the early
+ * skip-on-too-large, and the `Number(...) || 0` token accounting. The early return was the last
+ * statement of the callback, so returning from this helper is equivalent.
+ */
+import {
+  generateSignature as defaultGenerateSignature,
+  setCachedResponse as defaultSetCachedResponse,
+  isCacheableForWrite as defaultIsCacheableForWrite,
+} from "@/lib/semanticCache";
+import { isSmallEnoughForSemanticCache as defaultIsSmallEnough } from "../../utils/estimateSize.ts";
+
+type LoggerLike = { debug?: (...args: unknown[]) => void } | null | undefined;
+
+type CacheBody = {
+  messages?: unknown;
+  input?: unknown;
+  temperature?: unknown;
+  top_p?: unknown;
+};
+
+export interface StreamingSemanticCacheStoreDeps {
+  isCacheableForWrite: typeof defaultIsCacheableForWrite;
+  isSmallEnoughForSemanticCache: typeof defaultIsSmallEnough;
+  generateSignature: typeof defaultGenerateSignature;
+  setCachedResponse: typeof defaultSetCachedResponse;
+}
+
+const DEFAULT_DEPS: StreamingSemanticCacheStoreDeps = {
+  isCacheableForWrite: defaultIsCacheableForWrite,
+  isSmallEnoughForSemanticCache: defaultIsSmallEnough,
+  generateSignature: defaultGenerateSignature,
+  setCachedResponse: defaultSetCachedResponse,
+};
+
+interface StreamingCacheArgs {
+  enabled: boolean;
+  streamStatus: number;
+  streamResponseBody: Record<string, unknown> | null | undefined;
+  body: CacheBody;
+  headers: unknown;
+  model: string;
+  apiKeyId?: string | number;
+  streamUsage?: Record<string, unknown> | null;
+  log?: LoggerLike;
+}
+
+function streamTokensSaved(streamUsage: Record<string, unknown> | null | undefined): number {
+  const u = streamUsage as Record<string, unknown> | null;
+  return (Number(u?.prompt_tokens ?? 0) || 0) + (Number(u?.completion_tokens ?? 0) || 0);
+}
+
+function writeStreamingCacheEntry(
+  args: StreamingCacheArgs,
+  deps: StreamingSemanticCacheStoreDeps
+): void {
+  try {
+    const cleanBody = { ...(args.streamResponseBody as Record<string, unknown>) };
+    delete cleanBody._streamed;
+    if (!deps.isSmallEnoughForSemanticCache(cleanBody)) return;
+    const sig = deps.generateSignature(
+      args.model,
+      args.body.messages ?? args.body.input,
+      args.body.temperature,
+      args.body.top_p,
+      args.apiKeyId ?? undefined
+    );
+    const tokensSaved = streamTokensSaved(args.streamUsage);
+    deps.setCachedResponse(sig, args.model, cleanBody, tokensSaved);
+    args.log?.debug?.("CACHE", `Stored streaming response for ${args.model} (${tokensSaved} tokens)`);
+  } catch {
+    // Cache write failed — non-critical
+  }
+}
+
+export function storeStreamingSemanticCacheResponse(
+  args: StreamingCacheArgs,
+  deps: StreamingSemanticCacheStoreDeps = DEFAULT_DEPS
+): void {
+  if (
+    !args.enabled ||
+    args.streamStatus !== 200 ||
+    !args.streamResponseBody ||
+    !deps.isCacheableForWrite(args.body, args.headers)
+  ) {
+    return;
+  }
+  writeStreamingCacheEntry(args, deps);
+}
diff --git a/open-sse/handlers/chatCore/streamingUsageStats.ts b/open-sse/handlers/chatCore/streamingUsageStats.ts
index 0561f8099b..1a48b8d857 100644
--- a/open-sse/handlers/chatCore/streamingUsageStats.ts
+++ b/open-sse/handlers/chatCore/streamingUsageStats.ts
@@ -27,6 +27,7 @@ export type RecordStreamingUsageStatsContext = {
   effectiveServiceTier: EffectiveServiceTier;
   isCombo: boolean;
   comboStrategy: string | null | undefined;
+  endpoint?: string | null | undefined;
 };
 
 function persistStreamingUsageRow(usage: object, ctx: RecordStreamingUsageStatsContext): void {
@@ -46,6 +47,7 @@ function persistStreamingUsageRow(usage: object, ctx: RecordStreamingUsageStatsC
     apiKeyName: ctx.apiKeyInfo?.name || undefined,
     serviceTier: ctx.effectiveServiceTier,
     comboStrategy: ctx.isCombo ? ctx.comboStrategy || undefined : undefined,
+    endpoint: ctx.endpoint || undefined,
   }).catch((err) => {
     console.error("Failed to save usage stats:", err.message);
   });
diff --git a/open-sse/handlers/embeddings.ts b/open-sse/handlers/embeddings.ts
index 05ecda2d9f..d88d13888d 100644
--- a/open-sse/handlers/embeddings.ts
+++ b/open-sse/handlers/embeddings.ts
@@ -209,6 +209,8 @@ export async function handleEmbedding({
           apiKeyId,
           connectionId,
           provider,
+          // Per-(key,model) cap — resolved embedding model id (same scope used in logs/routing).
+          model: model || undefined,
         });
         if (quotaDecision.kind === "block") {
           return {
@@ -324,6 +326,8 @@ export async function handleEmbedding({
           apiKeyId,
           connectionId,
           provider,
+          // Per-(key,model) cap accounting — same resolved model id used at enforce time.
+          model: model || undefined,
           cost: {
             tokens: data.usage?.prompt_tokens || data.usage?.total_tokens || 0,
             requests: 1,
diff --git a/open-sse/handlers/videoGeneration.ts b/open-sse/handlers/videoGeneration.ts
index 1581133b7f..d3708fa4be 100644
--- a/open-sse/handlers/videoGeneration.ts
+++ b/open-sse/handlers/videoGeneration.ts
@@ -18,6 +18,7 @@
 import { getVideoProvider, parseVideoModel } from "../config/videoRegistry.ts";
 import { kieExecutor } from "../executors/kie.ts";
 import { vertexGenerateVideo } from "../executors/vertexMedia.ts";
+import { handleGoogleFlowVideoGeneration } from "./videoGeneration/googleFlowHandler.ts";
 import { getExecutor } from "../executors/index.ts";
 import { isJsonObject, parseKieResultJson } from "../utils/kieTask.ts";
 import {
@@ -61,6 +62,10 @@ export async function handleVideoGeneration({ body, credentials, log }) {
     return handleVertexVeoGeneration({ model, body, credentials, log });
   }
 
+  if (providerConfig.format === "google-flow") {
+    return handleGoogleFlowVideoGeneration({ model, providerConfig, body, credentials, log });
+  }
+
   if (providerConfig.format === "comfyui") {
     return handleComfyUIVideoGeneration({ model, provider, providerConfig, body, log });
   }
diff --git a/open-sse/handlers/videoGeneration/googleFlow.ts b/open-sse/handlers/videoGeneration/googleFlow.ts
new file mode 100644
index 0000000000..3bef710857
--- /dev/null
+++ b/open-sse/handlers/videoGeneration/googleFlow.ts
@@ -0,0 +1,219 @@
+/**
+ * Google Flow (labs.google/flow) video generation — pure helpers.
+ *
+ * Google Flow drives Veo video generation through Google's internal AI Sandbox
+ * endpoint (`aisandbox-pa.googleapis.com`) using a Google account OAuth bearer
+ * token — the same Google OAuth credential family that the Antigravity provider
+ * already uses (accessToken + Cloud Code projectId). The request/response shape
+ * mirrors the *documented* Veo `predictLongRunning` long-running-operation API
+ * (see `open-sse/executors/vertexMedia.ts::vertexGenerateVideo`):
+ *
+ *   submit  →  { instances: [{ prompt, image? }], parameters: { sampleCount, ... } }  →  { name: <operation> }
+ *   poll    →  { operationName }  →  { done, error?, response: { videos: [{ bytesBase64Encoded | gcsUri }] } }
+ *
+ * ⚠️ PENDING LIVE VALIDATION (Hard Rule #18): the exact AI-Sandbox URL path and
+ * whether Flow wraps the Veo body in the Cloud-Code `{ project, request }` envelope
+ * cannot be unit-tested — they require a real Google Flow account + a captured HAR.
+ * Everything that depends on the wire host/path is isolated in the two constants
+ * below and in the handler, so confirming a captured HAR is a one-line change.
+ * The transformation logic in this file is grounded in the documented Veo shape
+ * and is fully unit-tested.
+ */
+
+/**
+ * Google Flow has no standalone connection — it reuses the Antigravity Google
+ * OAuth credential (accessToken + Cloud Code projectId). Credential lookups for
+ * the `googleflow` provider resolve against this provider id.
+ */
+export const GOOGLE_FLOW_CREDENTIAL_PROVIDER = "antigravity";
+
+/** Map a video provider id to the provider id whose stored credentials it uses. */
+export function resolveVideoCredentialProvider(provider: string): string {
+  return provider === "googleflow" ? GOOGLE_FLOW_CREDENTIAL_PROVIDER : provider;
+}
+
+// --- Wire endpoint (isolated; confirm against a real Flow HAR — Rule #18) ---
+export const GOOGLE_FLOW_HOST = "https://aisandbox-pa.googleapis.com";
+export const GOOGLE_FLOW_SUBMIT_PATH = "/v1:generateVideo";
+export const GOOGLE_FLOW_POLL_PATH = "/v1:fetchOperation";
+
+export interface FlowVideoParams {
+  prompt: string;
+  aspectRatio?: string;
+  durationSeconds?: number;
+  sampleCount: number;
+  negativePrompt?: string;
+  resolution?: string;
+}
+
+export interface FlowOperationResult {
+  done: boolean;
+  error?: string;
+  base64?: string;
+  url?: string;
+  format?: string;
+}
+
+function asTrimmedString(value: unknown): string | undefined {
+  if (typeof value !== "string") return undefined;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : undefined;
+}
+
+const ASPECT_RATIO_RE = /^\d{1,2}:\d{1,2}$/;
+
+/**
+ * Normalize an OpenAI-style /v1/videos/generations body into Veo parameters.
+ * Accepts both snake_case (OpenAI) and camelCase (native) field names, and
+ * treats a `size` that looks like a ratio (e.g. "16:9") as the aspect ratio.
+ */
+export function normalizeFlowVideoParams(body: Record<string, unknown> | null | undefined): FlowVideoParams {
+  const b = body ?? {};
+  const prompt = typeof b.prompt === "string" ? b.prompt : String(b.prompt ?? "");
+
+  const sizeMaybeRatio = asTrimmedString(b.size);
+  const aspectRatio =
+    asTrimmedString(b.aspect_ratio) ??
+    asTrimmedString(b.aspectRatio) ??
+    (sizeMaybeRatio && ASPECT_RATIO_RE.test(sizeMaybeRatio) ? sizeMaybeRatio : undefined);
+
+  const durationRaw =
+    typeof b.duration === "number"
+      ? b.duration
+      : typeof b.durationSeconds === "number"
+        ? b.durationSeconds
+        : undefined;
+  const durationSeconds =
+    typeof durationRaw === "number" && Number.isFinite(durationRaw) && durationRaw > 0
+      ? Math.floor(durationRaw)
+      : undefined;
+
+  const nRaw = typeof b.n === "number" ? b.n : undefined;
+  const sampleCount =
+    typeof nRaw === "number" && Number.isFinite(nRaw) && nRaw > 0 ? Math.floor(nRaw) : 1;
+
+  return {
+    prompt,
+    aspectRatio,
+    durationSeconds,
+    sampleCount,
+    negativePrompt: asTrimmedString(b.negative_prompt) ?? asTrimmedString(b.negativePrompt),
+    resolution: asTrimmedString(b.resolution),
+  };
+}
+
+/**
+ * Build the documented Veo `predictLongRunning` request body for the submit call.
+ * Only includes optional parameters that were actually provided.
+ */
+export function buildGoogleFlowSubmitBody(params: FlowVideoParams): {
+  instances: Array<Record<string, unknown>>;
+  parameters: Record<string, unknown>;
+} {
+  const parameters: Record<string, unknown> = { sampleCount: params.sampleCount };
+  if (params.aspectRatio) parameters.aspectRatio = params.aspectRatio;
+  if (typeof params.durationSeconds === "number") parameters.durationSeconds = params.durationSeconds;
+  if (params.negativePrompt) parameters.negativePrompt = params.negativePrompt;
+  if (params.resolution) parameters.resolution = params.resolution;
+
+  return {
+    instances: [{ prompt: params.prompt }],
+    parameters,
+  };
+}
+
+/**
+ * Extract the long-running-operation name from a submit response.
+ * Tolerates both `{ name }` and `{ operation: { name } }` envelopes.
+ */
+export function parseFlowOperationName(json: unknown): string | null {
+  if (!json || typeof json !== "object") return null;
+  const direct = (json as { name?: unknown }).name;
+  if (typeof direct === "string" && direct.length > 0) return direct;
+  const op = (json as { operation?: { name?: unknown } }).operation;
+  if (op && typeof op === "object" && typeof op.name === "string" && op.name.length > 0) {
+    return op.name;
+  }
+  return null;
+}
+
+function extractVideoFromResponse(response: unknown): { base64?: string; url?: string } | null {
+  if (!response || typeof response !== "object") return null;
+
+  // Documented Veo LRO shape: response.videos[].bytesBase64Encoded | gcsUri
+  const videos = (response as { videos?: unknown }).videos;
+  if (Array.isArray(videos) && videos.length > 0) {
+    const v = videos[0];
+    if (v && typeof v === "object") {
+      const rec = v as Record<string, unknown>;
+      if (typeof rec.bytesBase64Encoded === "string") return { base64: rec.bytesBase64Encoded };
+      if (typeof rec.gcsUri === "string") return { url: rec.gcsUri };
+      if (typeof rec.uri === "string") return { url: rec.uri };
+    }
+  }
+
+  // Alternate Veo shape: response.generateVideoResponse.generatedSamples[].video.uri
+  const gen = (response as { generateVideoResponse?: { generatedSamples?: unknown } })
+    .generateVideoResponse;
+  const samples = gen && typeof gen === "object" ? gen.generatedSamples : undefined;
+  if (Array.isArray(samples) && samples.length > 0) {
+    const sample = samples[0];
+    const video =
+      sample && typeof sample === "object"
+        ? (sample as { video?: unknown }).video
+        : undefined;
+    if (video && typeof video === "object") {
+      const rec = video as Record<string, unknown>;
+      if (typeof rec.uri === "string") return { url: rec.uri };
+      if (typeof rec.bytesBase64Encoded === "string") return { base64: rec.bytesBase64Encoded };
+    }
+  }
+
+  return null;
+}
+
+/**
+ * Interpret a poll/fetch-operation response into a normalized result.
+ * `done: false` means still running; callers should keep polling.
+ */
+export function parseFlowOperationResult(json: unknown): FlowOperationResult {
+  if (!json || typeof json !== "object") return { done: false };
+
+  const done = Boolean((json as { done?: unknown }).done);
+  if (!done) return { done: false };
+
+  const opError = (json as { error?: { message?: unknown } }).error;
+  if (opError && typeof opError === "object") {
+    return { done: true, error: String(opError.message || "Google Flow video operation failed") };
+  }
+
+  const response = (json as { response?: unknown }).response;
+  const video = extractVideoFromResponse(response);
+  if (video?.base64) return { done: true, base64: video.base64, format: "mp4" };
+  if (video?.url) return { done: true, url: video.url, format: "mp4" };
+
+  return { done: true, error: "Google Flow operation completed but returned no video" };
+}
+
+/** Resolve the Cloud Code projectId from the OAuth credential record (mirrors Antigravity). */
+export function resolveFlowProjectId(
+  credentials: Record<string, unknown> | null | undefined
+): string | null {
+  const cred = credentials ?? {};
+  const direct = asTrimmedString(cred.projectId);
+  if (direct) return direct;
+  const psd = cred.providerSpecificData;
+  if (psd && typeof psd === "object") {
+    const fromPsd = asTrimmedString((psd as Record<string, unknown>).projectId);
+    if (fromPsd) return fromPsd;
+  }
+  return null;
+}
+
+/** Resolve the OAuth bearer token from the credential record. */
+export function resolveFlowAccessToken(
+  credentials: Record<string, unknown> | null | undefined
+): string | null {
+  const cred = credentials ?? {};
+  return asTrimmedString(cred.accessToken) ?? asTrimmedString(cred.apiKey) ?? null;
+}
diff --git a/open-sse/handlers/videoGeneration/googleFlowHandler.ts b/open-sse/handlers/videoGeneration/googleFlowHandler.ts
new file mode 100644
index 0000000000..9b09d00fd9
--- /dev/null
+++ b/open-sse/handlers/videoGeneration/googleFlowHandler.ts
@@ -0,0 +1,145 @@
+/**
+ * Veo video generation via Google Flow (labs.google/flow) — request orchestration.
+ *
+ * Uses the Google account OAuth bearer + Cloud Code projectId that the Antigravity
+ * provider already establishes — no separate OAuth flow is added. Submits the
+ * documented Veo `predictLongRunning` body to Google's AI Sandbox endpoint, polls
+ * the long-running operation, and returns the MP4 (base64 or URL).
+ *
+ * ⚠️ PENDING LIVE VALIDATION (Hard Rule #18): the AI-Sandbox host/path and the
+ * Cloud-Code request envelope cannot be unit-tested — they require a real Google
+ * Flow account + a captured HAR. The wire surface is isolated to the two path
+ * constants (`GOOGLE_FLOW_SUBMIT_PATH`/`GOOGLE_FLOW_POLL_PATH`) and the `project`
+ * wrap below, so confirming a captured HAR is a one-line change. The pure
+ * transformation helpers are fully unit-tested (google-flow-video-4569.test.ts).
+ */
+
+import { sanitizeErrorMessage } from "../../utils/error.ts";
+import {
+  GOOGLE_FLOW_POLL_PATH,
+  GOOGLE_FLOW_SUBMIT_PATH,
+  buildGoogleFlowSubmitBody,
+  normalizeFlowVideoParams,
+  parseFlowOperationName,
+  parseFlowOperationResult,
+  resolveFlowAccessToken,
+  resolveFlowProjectId,
+} from "./googleFlow.ts";
+
+interface GoogleFlowHandlerArgs {
+  model: string;
+  providerConfig: { baseUrl: string };
+  body: Record<string, unknown>;
+  credentials: Record<string, unknown> | null;
+  log?: { info?: (tag: string, msg: string) => void; error?: (tag: string, msg: string) => void };
+}
+
+const POLL_INTERVAL_MS = 10_000;
+const MAX_WAIT_MS = 5 * 60 * 1000;
+
+const sleep = (ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms));
+
+export async function handleGoogleFlowVideoGeneration({
+  model,
+  providerConfig,
+  body,
+  credentials,
+  log,
+}: GoogleFlowHandlerArgs) {
+  const token = resolveFlowAccessToken(credentials);
+  if (!token) {
+    return {
+      success: false,
+      status: 401,
+      error:
+        "Missing Google OAuth token for Google Flow. Connect a Google account in Providers (the Antigravity/Cloud Code connection) first.",
+    };
+  }
+
+  const projectId = resolveFlowProjectId(credentials);
+  if (!projectId) {
+    return {
+      success: false,
+      status: 400,
+      error:
+        "Missing Google projectId for Google Flow. Please reconnect OAuth in Providers so OmniRoute can fetch your Cloud Code project.",
+    };
+  }
+
+  const params = normalizeFlowVideoParams(body);
+  const submitBody = buildGoogleFlowSubmitBody(params);
+  // PENDING LIVE VALIDATION: Cloud-Code envelope wraps the Veo body with `project`/`model`.
+  const wireBody = { ...submitBody, project: projectId, model };
+
+  const baseUrl = providerConfig.baseUrl.replace(/\/$/, "");
+  const headers = {
+    "Content-Type": "application/json",
+    Authorization: `Bearer ${token}`,
+  };
+
+  try {
+    log?.info?.(
+      "VIDEO",
+      `googleflow/${model} (veo) | submitting | aspect: ${params.aspectRatio ?? "default"}`
+    );
+    const submitRes = await fetch(`${baseUrl}${GOOGLE_FLOW_SUBMIT_PATH}`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(wireBody),
+    });
+    if (!submitRes.ok) {
+      const errorText = await submitRes.text();
+      return {
+        success: false,
+        status: submitRes.status,
+        error: sanitizeErrorMessage(`Google Flow submit failed: ${errorText.slice(0, 300)}`),
+      };
+    }
+
+    const operationName = parseFlowOperationName(await submitRes.json());
+    if (!operationName) {
+      return { success: false, status: 502, error: "Google Flow did not return an operation name" };
+    }
+
+    const deadline = Date.now() + MAX_WAIT_MS;
+    while (Date.now() < deadline) {
+      await sleep(POLL_INTERVAL_MS);
+      const pollRes = await fetch(`${baseUrl}${GOOGLE_FLOW_POLL_PATH}`, {
+        method: "POST",
+        headers,
+        body: JSON.stringify({ operationName }),
+      });
+      if (!pollRes.ok) {
+        const errorText = await pollRes.text();
+        return {
+          success: false,
+          status: pollRes.status,
+          error: sanitizeErrorMessage(`Google Flow poll failed: ${errorText.slice(0, 300)}`),
+        };
+      }
+
+      const result = parseFlowOperationResult(await pollRes.json());
+      if (!result.done) continue;
+      if (result.error) {
+        return { success: false, status: 502, error: sanitizeErrorMessage(result.error) };
+      }
+      const item = result.base64
+        ? { b64_json: result.base64, format: result.format }
+        : { url: result.url, format: result.format };
+      return {
+        success: true,
+        data: { created: Math.floor(Date.now() / 1000), data: [item] },
+      };
+    }
+
+    return { success: false, status: 504, error: "Google Flow video generation timed out" };
+  } catch (err) {
+    const e = (err ?? {}) as { message?: string; status?: number };
+    log?.error?.("VIDEO", `Google Flow generation failed: ${e.message}`);
+    return {
+      success: false,
+      status: typeof e.status === "number" ? e.status : 502,
+      error: sanitizeErrorMessage(e.message || "Google Flow generation failed"),
+    };
+  }
+}
diff --git a/open-sse/package.json b/open-sse/package.json
index 109198faad..3c06fd0eca 100644
--- a/open-sse/package.json
+++ b/open-sse/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@omniroute/open-sse",
-  "version": "3.8.35",
+  "version": "3.8.36",
   "description": "Express SSE sidecar for OmniRoute — handles streaming, protocol translation, and provider orchestration",
   "type": "module",
   "main": "index.js",
diff --git a/open-sse/services/accountFallback.ts b/open-sse/services/accountFallback.ts
index e62698f904..696fdab687 100644
--- a/open-sse/services/accountFallback.ts
+++ b/open-sse/services/accountFallback.ts
@@ -251,6 +251,20 @@ const MALFORMED_REQUEST_PATTERNS = [
   /tool_call.*name.*(?:blank|empty|missing)/i,
 ];
 
+// Rate-limit text on a 400 — some providers (e.g. MiMoCode) signal throttling with a
+// non-standard 400 status whose body carries rate-limit semantics instead of a 429
+// (#4976). When detected, the request is fallback-worthy at connection-cooldown scope
+// (NOT a whole-provider breaker) so combo routing can fail over to another free target.
+// Bounded, non-overlapping patterns only (ReDoS-safe — no nested quantifiers).
+const RATE_LIMIT_TEXT_PATTERNS = [
+  /high.?frequency/i,
+  /non-compliant/i,
+  /too many requests/i,
+  /rate.?limit/i,
+  /频繁/, // "frequent" (zh) — high-frequency request throttling
+  /频率/, // "frequency" (zh) — request-frequency throttling
+];
+
 // Parameter validation errors — model-specific constraints (different models = different limits)
 const PARAM_VALIDATION_PATTERNS = [
   /max_tokens.*illegal/i,
@@ -1582,6 +1596,16 @@ export function checkFallbackError(
       };
     }
 
+    // Some providers (e.g. MiMoCode) signal throttling with a non-standard 400 whose
+    // body carries rate-limit semantics ("Detected high-frequency non-compliant
+    // requests from you.") instead of a 429. Detected here (AFTER malformed/overflow
+    // detection above, so a genuinely malformed 400 still wins and keeps its #2101
+    // zero-cooldown MODEL_CAPACITY classification), it is fallback-worthy at
+    // connection-cooldown scope so combo can fail over to another target (#4976).
+    if (RATE_LIMIT_TEXT_PATTERNS.some((p) => p.test(errorStr))) {
+      return buildRetryableFallback(RateLimitReason.RATE_LIMIT_EXCEEDED);
+    }
+
     // Generic 400 is not account-fallback-worthy. Combo routing may still try a
     // different provider/model because combo fallback is target-level orchestration.
     return { shouldFallback: false, cooldownMs: 0, reason: RateLimitReason.UNKNOWN };
diff --git a/open-sse/services/antigravity429Engine.ts b/open-sse/services/antigravity429Engine.ts
index 36364a9e6c..909ed8adff 100644
--- a/open-sse/services/antigravity429Engine.ts
+++ b/open-sse/services/antigravity429Engine.ts
@@ -53,7 +53,6 @@ const CREDITS_EXHAUSTED_KEYWORDS = [
   "minimumcreditamountforusage",
   "minimum credit amount for usage",
   "minimum credit",
-  "resource has been exhausted",
 ];
 
 const SHORT_COOLDOWN_MS = 5 * 60 * 1000; // 5 minutes
diff --git a/open-sse/services/ccBridgeTransforms.ts b/open-sse/services/ccBridgeTransforms.ts
index eb9a5f79a5..d45c980dd3 100644
--- a/open-sse/services/ccBridgeTransforms.ts
+++ b/open-sse/services/ccBridgeTransforms.ts
@@ -114,7 +114,7 @@ export const CCH_SALT = "59cf53e54c78";
 /** Character positions sampled from the first user message text. */
 export const CCH_POSITIONS = [4, 7, 20] as const;
 /** Default `cc_version=` value embedded in the billing header. */
-export const DEFAULT_CLAUDE_CODE_VERSION = "2.1.158";
+export const DEFAULT_CLAUDE_CODE_VERSION = "2.1.187";
 /** Identity sentinel prepended for Claude Agent SDK callers. */
 export const CLAUDE_AGENT_SDK_IDENTITY =
   "You are a Claude agent, built on Anthropic's Claude Agent SDK.";
diff --git a/open-sse/services/claudeCodeCompatible.ts b/open-sse/services/claudeCodeCompatible.ts
index 60b22d2188..c8f0788861 100644
--- a/open-sse/services/claudeCodeCompatible.ts
+++ b/open-sse/services/claudeCodeCompatible.ts
@@ -40,8 +40,8 @@ export {
   CLAUDE_CODE_COMPATIBLE_REDACT_THINKING_BETA,
   resolveClaudeCodeCompatibleAnthropicBeta,
 } from "./claudeCodeCompatibleBeta.ts";
-export const CLAUDE_CODE_COMPATIBLE_VERSION = "2.1.158";
-export const CLAUDE_CODE_COMPATIBLE_USER_AGENT = "claude-cli/2.1.158 (external, sdk-cli)";
+export const CLAUDE_CODE_COMPATIBLE_VERSION = "2.1.187";
+export const CLAUDE_CODE_COMPATIBLE_USER_AGENT = "claude-cli/2.1.187 (external, sdk-cli)";
 export const CLAUDE_CODE_COMPATIBLE_STAINLESS_PACKAGE_VERSION = "0.94.0";
 export const CLAUDE_CODE_COMPATIBLE_STAINLESS_RUNTIME_VERSION = "v24.3.0";
 export const CONTEXT_1M_BETA_HEADER = "context-1m-2025-08-07";
diff --git a/open-sse/services/claudeCodeToolRemapper.ts b/open-sse/services/claudeCodeToolRemapper.ts
index 16c97a7b3b..754ecc978a 100644
--- a/open-sse/services/claudeCodeToolRemapper.ts
+++ b/open-sse/services/claudeCodeToolRemapper.ts
@@ -194,9 +194,37 @@ function toPascalCaseToolName(name: string): string {
 export function needsThirdPartyCloak(name: string): boolean {
   if (!name) return false;
   if (CLAUDE_BUILTIN_TOOL_NAMES.has(name)) return false;
+  // `mcp__<server>__<tool>` names are genuine Claude Code MCP tool names that
+  // Anthropic accepts natively. Cloaking them to PascalCase is unnecessary and,
+  // via round-trip asymmetry (a history tool_use keeping the original name while
+  // tools[] is cloaked), produces "Tool reference 'mcp__…' not found in available
+  // tools" 400s on the native claude OAuth path. Leave the MCP namespace alone.
+  if (name.startsWith("mcp__")) return false;
   return /[a-z]/.test(name.charAt(0)) || name.includes("_") || name.includes("-");
 }
 
+/**
+ * Anthropic server-side tool types whose `name` is a reserved literal that the
+ * Messages API validates exactly (e.g. type `web_search_20250305` REQUIRES
+ * `name: "web_search"`). These look like third-party harness tools to the name
+ * cloak (`web_search` has a `_`, fails the PascalCase test) so without this
+ * guard the cloak rewrites the name to `WebSearch` and Anthropic 400s with
+ * `tools.N.web_search_20250305.name: Input should be 'web_search'`.
+ *
+ * Detection mirrors the codebase's existing convention: a versioned built-in
+ * tool type carries an 8-digit date suffix (`web_search_20250305`,
+ * `code_execution_20250522`, `bash_20250124`, …) — see
+ * `stripVersionedToolModelPrefix` in executors/base.ts. The non-versioned
+ * aliases (`web_search`, `web_search_preview`) are covered explicitly.
+ */
+const VERSIONED_SERVER_TOOL_TYPE = /^[a-z][a-z0-9_]*_\d{8}$/;
+const NON_VERSIONED_SERVER_TOOL_TYPES = new Set(["web_search", "web_search_preview"]);
+
+export function isAnthropicServerToolType(type: unknown): boolean {
+  if (typeof type !== "string" || type.length === 0) return false;
+  return VERSIONED_SERVER_TOOL_TYPE.test(type) || NON_VERSIONED_SERVER_TOOL_TYPES.has(type);
+}
+
 export interface CloakOptions {
   /**
    * Names matching this predicate are left untouched, so a caller that owns a
@@ -265,6 +293,11 @@ export function cloakThirdPartyToolNames(
   // not corrupt an input body that may be logged or replayed on fallback).
   if (Array.isArray(tools)) {
     body.tools = tools.map((tool) => {
+      // Never rewrite the reserved name of an Anthropic server-side tool — its
+      // `type` (web_search_20250305, …) binds the API to an exact `name`.
+      if (tool && isAnthropicServerToolType(tool.type)) {
+        return tool;
+      }
       if (tool && typeof tool.name === "string" && shouldCloak(tool.name)) {
         return { ...tool, name: aliasFor(tool.name) };
       }
diff --git a/open-sse/services/claudeHaikuConstraints.ts b/open-sse/services/claudeHaikuConstraints.ts
new file mode 100644
index 0000000000..23c6f912da
--- /dev/null
+++ b/open-sse/services/claudeHaikuConstraints.ts
@@ -0,0 +1,88 @@
+type JsonRecord = Record<string, unknown>;
+
+// Models that reject `thinking.type:"adaptive"` and `output_config.effort` —
+// today, all Claude Haiku-tier models (4.5 / 3.5 / dated and aliased). Adaptive
+// thinking + the effort knob landed on Sonnet 4.6 / Opus 4.5+ only; sending
+// either on Haiku is a hard 400 from the Messages API.
+const HAIKU_CONSTRAINT_PATTERN = /haiku/i;
+
+// Default budget when collapsing `thinking.type:"adaptive"` to a manual shape
+// on Haiku. Mirrors the upstream 9router decision (`claude.js`, commit
+// 401d93bd5) — a conservative ~10K budget keeps reasoning enabled without
+// hitting Haiku's output-token cap.
+const HAIKU_FALLBACK_THINKING_BUDGET = 10000;
+
+function asRecord(value: unknown): JsonRecord | null {
+  return value && typeof value === "object" && !Array.isArray(value) ? (value as JsonRecord) : null;
+}
+
+function modelRejectsAdaptiveAndEffort(modelId: string | null | undefined): boolean {
+  if (typeof modelId !== "string" || modelId.length === 0) return false;
+  return HAIKU_CONSTRAINT_PATTERN.test(modelId);
+}
+
+/**
+ * Strip Claude-API params that Haiku-tier models reject.
+ *
+ * Anthropic restricts two extended-reasoning knobs to Sonnet 4.6 / Opus 4.5+:
+ *   1. `thinking.type:"adaptive"` — Haiku only accepts manual `"enabled"` (with a
+ *      `budget_tokens`) or `"disabled"`.
+ *   2. `output_config.effort` — only the larger models steer reasoning via effort.
+ * Sending either of these to Haiku is a hard `400` from the Messages API.
+ *
+ * Multiple OmniRoute paths can still emit those shapes on a Haiku target:
+ *   - native Claude passthrough from newer Claude Code / Cowork clients;
+ *   - the OpenAI→Claude translator when `reasoning_effort` is `max`/`xhigh`
+ *     (see `request/openai-to-claude.ts`) — Haiku isn't `adaptiveThinkingOnly`,
+ *     so it falls into the branch that emits `{type:"adaptive"}` + `effort`;
+ *   - per-model thinking defaults from the request flow / combo routing.
+ *
+ * This normalizer is the final, provider-agnostic guard keyed on the resolved
+ * upstream model. It runs after model substitution in `chatCore.ts`, so it
+ * covers every routing mode (single-model, combo, fallback).
+ *
+ * Returns a NEW object only when it changes the body. No-op for non-Haiku
+ * models, when the body carries no thinking/output_config, or when neither
+ * `thinking.type:"adaptive"` nor `output_config.effort` is present — so the
+ * existing Sonnet/Opus paths and Haiku bodies without these fields are
+ * unaffected.
+ *
+ * Mirrors upstream 9router commit 401d93bd5 (`open-sse/translator/formats/claude.js`).
+ */
+export function normalizeClaudeHaikuConstraints<T extends Record<string, unknown>>(
+  body: T,
+  model: string | null | undefined
+): T {
+  if (!modelRejectsAdaptiveAndEffort(model)) return body;
+  const record = asRecord(body);
+  if (!record) return body;
+
+  const thinking = asRecord(record.thinking);
+  const outputConfig = asRecord(record.output_config);
+
+  const needsThinkingRewrite = thinking?.type === "adaptive";
+  const needsEffortStrip = outputConfig != null && outputConfig.effort != null;
+  if (!needsThinkingRewrite && !needsEffortStrip) return body;
+
+  const next: JsonRecord = { ...record };
+
+  if (needsThinkingRewrite && thinking) {
+    next.thinking = {
+      ...thinking,
+      type: "enabled",
+      budget_tokens: HAIKU_FALLBACK_THINKING_BUDGET,
+    };
+  }
+
+  if (needsEffortStrip && outputConfig) {
+    const nextOutputConfig: JsonRecord = { ...outputConfig };
+    delete nextOutputConfig.effort;
+    if (Object.keys(nextOutputConfig).length === 0) {
+      delete next.output_config;
+    } else {
+      next.output_config = nextOutputConfig;
+    }
+  }
+
+  return next as T;
+}
diff --git a/open-sse/services/claudeUsageCooldown.ts b/open-sse/services/claudeUsageCooldown.ts
new file mode 100644
index 0000000000..01de93dec9
--- /dev/null
+++ b/open-sse/services/claudeUsageCooldown.ts
@@ -0,0 +1,51 @@
+/**
+ * Per-token cooldown for the Claude OAuth usage endpoint
+ * (`https://api.anthropic.com/api/oauth/usage`).
+ *
+ * Anthropic rate-limits this quota endpoint independently of `/v1/messages`.
+ * When polled from multiple connections at once (dashboard auto-refresh + the
+ * combo health-scheduler), it spams `429` and that surfaces as noisy provider
+ * errors plus increased upstream load. Chat with the same token still works.
+ *
+ * We track a per-access-token "skip until" timestamp. When we see a `429`,
+ * we suppress further OAuth-usage polls for that token until the cooldown
+ * expires and the caller falls back to the legacy settings/org endpoint
+ * (which is what `getClaudeUsage` does on every non-OK response).
+ *
+ * Pure helpers (no fetch, no timers) keep this TDD-friendly.
+ *
+ * Inspired-by upstream 9router commit `79df34ca`.
+ */
+
+export const OAUTH_USAGE_429_COOLDOWN_MS = 180_000; // 3 minutes
+
+const oauthCooldown = new Map<string, number>();
+
+/** Returns true while `accessToken` is still inside its 429 cooldown window. */
+export function isClaudeOauthUsageCoolingDown(
+  accessToken: string | undefined,
+  now: number = Date.now()
+): boolean {
+  if (!accessToken) return false;
+  const until = oauthCooldown.get(accessToken);
+  if (until === undefined) return false;
+  if (until > now) return true;
+  // Lazy GC of expired entries — keeps the Map bounded by active tokens.
+  oauthCooldown.delete(accessToken);
+  return false;
+}
+
+/** Record a 429 from the OAuth usage endpoint for `accessToken`. */
+export function markClaudeOauthUsage429(
+  accessToken: string | undefined,
+  now: number = Date.now(),
+  cooldownMs: number = OAUTH_USAGE_429_COOLDOWN_MS
+): void {
+  if (!accessToken) return;
+  oauthCooldown.set(accessToken, now + cooldownMs);
+}
+
+/** Test-only: clear all entries. */
+export function _resetClaudeOauthUsageCooldown(): void {
+  oauthCooldown.clear();
+}
diff --git a/open-sse/services/combo.ts b/open-sse/services/combo.ts
index 69d2932804..8aea1e03d0 100644
--- a/open-sse/services/combo.ts
+++ b/open-sse/services/combo.ts
@@ -2,7 +2,7 @@
  * Shared combo (model combo) handling with fallback support
  * Supports: priority, weighted, round-robin, random, least-used, cost-optimized,
  * reset-aware, reset-window, strict-random, auto, fill-first, p2c, lkgp,
- * context-optimized, and context-relay strategies
+ * context-optimized, context-relay, and fusion strategies
  */
 
 import {
@@ -10,6 +10,7 @@ import {
   classifyLockoutReason,
   decayModelFailureCount,
   formatRetryAfter,
+  getModelLockoutInfo,
   getRuntimeProviderProfile,
   isModelLocked,
   recordModelLockoutFailure,
@@ -73,6 +74,14 @@ import {
 import { supportsToolCalling } from "./modelCapabilities.ts";
 import { estimateTokens } from "./contextManager.ts";
 import { getSessionConnection } from "./sessionManager.ts";
+import { applySessionStickiness, recordStickyBinding } from "./combo/sessionStickiness.ts";
+import { selectQuotaShareTarget } from "./combo/quotaShareStrategy.ts";
+import {
+  resolveMaxConcurrentByConnection,
+  makeConnectionConcurrencyResolver,
+  lookupPositiveCap,
+} from "./combo/concurrencyCaps.ts";
+import { acquireQuotaShareConcurrencySlot } from "./combo/quotaShareConcurrency.ts";
 import { orderTargetsByEvalScores } from "./evalRouting.ts";
 import { generateRoutingHints } from "./manifestAdapter";
 import type { RoutingHint } from "./manifestAdapter";
@@ -118,6 +127,12 @@ import {
   recordStickyWeightedSuccess,
 } from "./combo/rrState.ts";
 import { validateResponseQuality, toRetryAfterDisplayValue } from "./combo/validateQuality.ts";
+import { resolveComboCooldownWaitDecision } from "./combo/comboCooldownRetry.ts";
+import {
+  computeClosestRetryAfter,
+  waitForCooldownAwareRetry,
+} from "../../src/sse/services/cooldownAwareRetry.ts";
+import { handleFusionChat, type FusionTuning } from "./fusion.ts";
 import {
   TRANSIENT_FOR_SEMAPHORE,
   MAX_FALLBACK_WAIT_MS,
@@ -178,8 +193,15 @@ import {
   preScreenTargets,
   orderTargetsByResetAwareQuota,
   orderTargetsByResetWindow,
+  orderTargetsByHeadroom,
   type PreScreenResult,
 } from "./combo/quotaStrategies.ts";
+import {
+  classifyTask,
+  getConversationCacheKey,
+  isTaskRoutingStrategy,
+  reorderByTaskWeight,
+} from "./taskAwareRouting.ts";
 
 // Backward-compatible re-exports — these were public from combo.ts before the
 // types extraction (Quality Gate v2 / Fase 9). Keep the external surface stable.
@@ -508,13 +530,24 @@ export async function buildAutoCandidates(
       // testStatus must still fall through to normal connection-cooldown / model-lockout
       // handling instead of being hard-blocked here (which would surface a misleading
       // "below quota cutoff" 429 when every candidate is transiently unavailable).
-      const statusCutoffReason = quotaCutoffEnabled
-        ? getConnectionStatusQuotaCutoffReason(connection)
-        : undefined;
+      // The connection's terminal/transient status (credits_exhausted / rate_limited /
+      // banned / expired / future-dated unavailable) is classified unconditionally.
+      const connectionStatusReason = getConnectionStatusQuotaCutoffReason(connection);
+      const statusCutoffReason = quotaCutoffEnabled ? connectionStatusReason : undefined;
+      // #4540: when the HARD cutoff is OFF (default), a status-flagged connection is NOT
+      // hard-blocked (that would surface a misleading "below quota cutoff" 429), but it
+      // also must not score identically to a healthy provider. A no-fetcher exhausted
+      // connection keeps quotaRemaining=100, so we tag a SOFT penalty applied at scoring
+      // time (scoreAutoTargets → STATUS_SOFT_DEPRIORITIZE_FACTOR) instead.
+      let statusPenalty = false;
+      let statusPenaltyReason: string | undefined;
       if (statusCutoffReason) {
         quotaCutoffBlocked = true;
         quotaCutoffReason = statusCutoffReason;
         quotaRemaining = 0;
+      } else if (connectionStatusReason) {
+        statusPenalty = true;
+        statusPenaltyReason = connectionStatusReason;
       }
       if (fetcher && target.connectionId) {
         const quotaKey = `${provider}:${target.connectionId}`;
@@ -568,6 +601,8 @@ export async function buildAutoCandidates(
         resetWindowAffinity,
         quotaCutoffBlocked,
         quotaCutoffReason,
+        statusPenalty,
+        statusPenaltyReason,
         connectionPoolSize: connectionPoolCounts.get(provider) ?? 1,
         connectionId: target.connectionId ?? undefined,
       };
@@ -581,6 +616,72 @@ export async function buildAutoCandidates(
   });
 }
 
+const TERMINAL_PIN_STATUSES = new Set(["credits_exhausted", "banned", "expired"]);
+
+/**
+ * Pure decision: should a context-cache pin be DROPPED because its provider has
+ * DURABLY fallen? A ccp pin keeps the prompt cache warm by bypassing the combo
+ * strategy — but if the pinned provider is dead (credits exhausted / banned /
+ * expired, circuit-open, repeated failures, or a long rate-limit) honoring the
+ * pin pounds a dead account forever with no failover (laila throttle + credits
+ * incidents, 2026-06-22). A brief transient cooldown is tolerated (pin kept) so
+ * an unstable provider does not churn the pin every turn. Connection-level
+ * `backoffLevel` already resets on success, so `backoffLevel >= K` ≈ K
+ * consecutive failures — no per-session counter needed.
+ *
+ * Returns true ⇒ drop the pin and use the strategy. Pure + unit-testable.
+ */
+export function pinIsDurablyUnhealthy(
+  circuitState: string | undefined,
+  connections: Array<{
+    testStatus?: string | null;
+    backoffLevel?: number | null;
+    rateLimitedUntil?: string | null;
+  }>,
+  now: number,
+  opts: { backoffLevel?: number; graceMs?: number } = {}
+): boolean {
+  if (circuitState === "OPEN") return true;
+  if (!Array.isArray(connections) || connections.length === 0) return true;
+  const backoffThreshold = opts.backoffLevel ?? Number(process.env.PIN_DROP_BACKOFF_LEVEL || "2");
+  const graceMs = opts.graceMs ?? Number(process.env.PIN_DROP_GRACE_MS || "20000");
+  // The pin survives as long as AT LEAST ONE connection is healthy or only
+  // briefly cooling down — failover only when every connection is durably down.
+  const anyUsable = connections.some((c) => {
+    const status = typeof c.testStatus === "string" ? c.testStatus : "";
+    if (TERMINAL_PIN_STATUSES.has(status)) return false;
+    if (Number(c.backoffLevel ?? 0) >= backoffThreshold) return false;
+    const rl = c.rateLimitedUntil ? new Date(String(c.rateLimitedUntil)).getTime() : 0;
+    if (Number.isFinite(rl) && rl - now > graceMs) return false;
+    return true;
+  });
+  return !anyUsable;
+}
+
+/**
+ * Async wrapper: resolve the pinned model's provider, read its circuit state and
+ * active connections, and decide via {@link pinIsDurablyUnhealthy}. Fail-open
+ * (return false) on any error so a lookup bug never drops a healthy pin.
+ */
+async function isPinnedModelDurablyUnhealthy(pinnedModel: string): Promise<boolean> {
+  try {
+    const provider = parseModel(pinnedModel).provider;
+    if (!provider) return false;
+    const circuitState = getCircuitBreaker(provider)?.getStatus?.()?.state;
+    const connections = (await getProviderConnections({
+      provider,
+      isActive: true,
+    })) as Array<{
+      testStatus?: string | null;
+      backoffLevel?: number | null;
+      rateLimitedUntil?: string | null;
+    }>;
+    return pinIsDurablyUnhealthy(circuitState, connections || [], Date.now());
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Handle combo chat with fallback.
  * @param {Object} options
@@ -730,13 +831,76 @@ export async function handleComboChat({
 
   // Route to pinned model if context caching specifies one (Fix #679)
   if (pinnedModel) {
-    log.info(
+    // The pin is read from session_model_history (a PRIOR turn) and may name a
+    // model that has since been removed from this combo, or a provider whose
+    // credentials are gone. Without this guard a stale pin bypasses the strategy
+    // and routes to a dead model forever — incident 2026-06-21: cli-claude-heavy
+    // pinned to a deepseek connection with no active credentials → instant fail,
+    // never falling through to the live targets; and combos re-pointed Opus→Sonnet
+    // kept serving the old model. Validate the pin is still reachable in THIS
+    // combo's resolved targets (refs flattened) before honoring it. Only validate
+    // when allCombos is authoritative (non-empty) so we can resolve combo-refs;
+    // the auto-combo redirect path passes an empty list and keeps prior behavior.
+    const haveFullCombos = Array.isArray(allCombos) ? allCombos.length > 0 : !!allCombos;
+    const pinInCombo =
+      !haveFullCombos ||
+      resolveComboTargets(combo, allCombos, clampComboDepth(config.maxComboDepth)).some(
+        (t) => t.modelStr === pinnedModel
+      );
+    // Honor the pin only if it is still a combo target AND its provider is not
+    // DURABLY down. Without the health gate a pin keeps routing a session to a
+    // dead/credits-exhausted/throttled account forever (strategy bypassed, no
+    // failover) — incident 2026-06-22: laila stuck on a throttled claude account
+    // and credits_exhausted accounts never failing over. A transient cooldown is
+    // tolerated (pin kept) so an unstable provider does not churn the pin.
+    const pinDurablyDown = pinInCombo ? await isPinnedModelDurablyUnhealthy(pinnedModel) : false;
+    if (pinInCombo && !pinDurablyDown) {
+      log.info(
+        "COMBO",
+        `Bypassing strategy — routing directly to pinned context model: ${pinnedModel}`
+      );
+      return handleSingleModelWithTimeout(body, pinnedModel);
+    }
+    log.warn(
       "COMBO",
-      `Bypassing strategy — routing directly to pinned context model: ${pinnedModel}`
+      pinInCombo
+        ? `Context-cache pin "${pinnedModel}" provider durably unhealthy — dropping pin, using strategy`
+        : `Stale context-cache pin "${pinnedModel}" not in combo "${combo.name}" targets — dropping pin, using strategy`
     );
     return handleSingleModelWithTimeout(body, pinnedModel);
   }
 
+  // Fusion strategy: parallel panel + judge synthesis. Handled in a separate module
+  // because it neither iterates targets in order nor needs the failover/retry/credential
+  // gate machinery that follows — it fans out, then synthesizes once.
+  if (strategy === "fusion") {
+    const fusionModels = (combo.models || [])
+      .map((m) => {
+        if (typeof m === "string") return m;
+        if (m && typeof m === "object") {
+          const obj = m as Record<string, unknown>;
+          if (typeof obj.model === "string") return obj.model;
+        }
+        return null;
+      })
+      .filter((m): m is string => Boolean(m));
+    const cfg = config as Record<string, unknown>;
+    const judgeModel = typeof cfg.judgeModel === "string" ? cfg.judgeModel : undefined;
+    const tuning =
+      cfg.fusionTuning && typeof cfg.fusionTuning === "object"
+        ? (cfg.fusionTuning as FusionTuning)
+        : undefined;
+    return handleFusionChat({
+      body,
+      models: fusionModels,
+      handleSingleModel: handleSingleModelWithTimeout,
+      log,
+      comboName: combo.name,
+      judgeModel,
+      tuning,
+    });
+  }
+
   const nestingContext = nesting || {
     depth: 0,
     maxDepth: clampComboDepth(config.maxComboDepth),
@@ -885,7 +1049,8 @@ export async function handleComboChat({
 
   const isTargetSelectableForWeighted = async (target: ResolvedComboTarget): Promise<boolean> => {
     const rawModel = parseModel(target.modelStr).model || target.modelStr;
-    if (target.provider && getCircuitBreaker(target.provider).getStatus().state === "OPEN") return false;
+    if (target.provider && getCircuitBreaker(target.provider).getStatus().state === "OPEN")
+      return false;
     if (
       resilienceSettings.providerCooldown.enabled &&
       Boolean(target.provider && target.provider !== "unknown") &&
@@ -963,16 +1128,21 @@ export async function handleComboChat({
       : null;
   const getWeightedStepKeyForTarget = (target: ResolvedComboTarget): string | null => {
     if (!weightedResolution?.orderedSteps) return null;
-    const step = weightedResolution.orderedSteps.find((entry) =>
-      target.executionKey === entry.executionKey ||
-      target.executionKey.startsWith(entry.executionKey + ">")
+    const step = weightedResolution.orderedSteps.find(
+      (entry) =>
+        target.executionKey === entry.executionKey ||
+        target.executionKey.startsWith(entry.executionKey + ">")
     );
     return step?.executionKey || null;
   };
   let orderedTargets =
     strategy === "weighted"
       ? weightedResolution?.orderedTargets || []
-      : resolveComboTargets(expandedCombo, expandedAllCombos, clampComboDepth(config.maxComboDepth));
+      : resolveComboTargets(
+          expandedCombo,
+          expandedAllCombos,
+          clampComboDepth(config.maxComboDepth)
+        );
 
   orderedTargets = await applyRequestTagRouting(orderedTargets, body, log);
 
@@ -1028,6 +1198,11 @@ export async function handleComboChat({
     }
   }
 
+  // #4945 regression guard: when an "auto" combo uses an EXPLICIT router
+  // (routingStrategy lkgp/cost/etc, not the default "rules" scorer), that router
+  // pins orderedTargets[0]. The task-aware reordering below must then refine only
+  // the fallback order, never override the router's primary choice.
+  let autoUsedExplicitRouter = false;
   if (strategy === "auto") {
     const requestHasTools = Array.isArray(body?.tools) && body.tools.length > 0;
     let eligibleTargets = [...orderedTargets];
@@ -1177,6 +1352,7 @@ export async function handleComboChat({
           selectedProvider = decision.provider;
           selectedModel = decision.model;
           selectionReason = decision.reason;
+          autoUsedExplicitRouter = true;
         } catch (err) {
           log.warn(
             "COMBO",
@@ -1410,11 +1586,67 @@ export async function handleComboChat({
   } else if (strategy === "context-optimized") {
     orderedTargets = sortTargetsByContextSize(orderedTargets);
     log.info("COMBO", `Context-optimized ordering: largest first (${orderedTargets[0]?.modelStr})`);
+  } else if (strategy === "headroom") {
+    orderedTargets = await orderTargetsByHeadroom(
+      orderedTargets,
+      combo.name,
+      log,
+      apiKeyAllowedConnections
+    );
+    log.info(
+      "COMBO",
+      `Headroom ordering: ${orderedTargets[0]?.modelStr}${orderedTargets[0]?.connectionId ? ` (${orderedTargets[0].connectionId})` : ""} has most free capacity`
+    );
+  } else if (strategy === "quota-share") {
+    // Internal quota-share combos (qtSd/): delegate to the dedicated module (DRR +
+    // P2C in-flight + per-model bucket gating + per-connection concurrency gating).
+    const qsModel =
+      typeof body?.model === "string" ? body.model : (orderedTargets[0]?.modelStr ?? "");
+    const qsMaxConcurrent = await resolveMaxConcurrentByConnection(orderedTargets);
+    orderedTargets = selectQuotaShareTarget(orderedTargets, combo.name, qsModel, Date.now(), {
+      maxConcurrentByConnection: qsMaxConcurrent,
+    }).orderedTargets;
+    log.info(
+      "COMBO",
+      `Quota-share ordering: ${orderedTargets[0]?.modelStr}${orderedTargets[0]?.connectionId ? ` (${orderedTargets[0].connectionId})` : ""} selected (DRR+P2C)`
+    );
   }
-
+  const _sticky = await applySessionStickiness(
+    orderedTargets,
+    body.messages as Array<{ role?: string; content?: unknown }>
+  );
+  orderedTargets = _sticky.targets;
   orderedTargets = orderTargetsByEvalScores(orderedTargets, config.evalRouting, log);
   orderedTargets = filterTargetsByRequestCompatibility(orderedTargets, body, log);
 
+  // Task-aware reordering: only active for strategies ["smart","task","task-aware","task_aware","auto"].
+  // Additive — does not affect any of the other 15 strategies.
+  if (isTaskRoutingStrategy(strategy)) {
+    const task = classifyTask(body);
+    const conversationCacheKey = getConversationCacheKey(body);
+    const taskReordered = reorderByTaskWeight(orderedTargets, task);
+    // #4945 regression guard: when an explicit auto router (lkgp/cost/…) pinned
+    // orderedTargets[0], keep that primary choice and let task-aware refine only
+    // the fallback tail — otherwise task weighting silently defeats the operator's
+    // chosen LKGP/cost selection. reorderByTaskWeight returns the same target
+    // objects (no clone), so identity filtering is safe.
+    const pinnedFirst = autoUsedExplicitRouter ? orderedTargets[0] : undefined;
+    const nextOrder = pinnedFirst
+      ? [pinnedFirst, ...taskReordered.filter((t) => t !== pinnedFirst)]
+      : taskReordered;
+    if (nextOrder[0]?.modelStr !== orderedTargets[0]?.modelStr) {
+      const reasons =
+        Array.isArray(task.reasons) && task.reasons.length > 0
+          ? ` (${task.reasons.join(",")})`
+          : "";
+      log.info(
+        "COMBO",
+        `task-route task=${task.level}${reasons} cacheKey=${conversationCacheKey ?? "none"} → ${nextOrder[0]?.modelStr}`
+      );
+    }
+    orderedTargets = nextOrder;
+  }
+
   // Parallel pre-screen: check provider profiles and model availability for all targets
   // Only runs for priority strategy where sequential checking causes latency
   const preScreenMap =
@@ -1445,7 +1677,37 @@ export async function handleComboChat({
 
   let globalAttempts = 0;
 
-  try {
+  // Quota-share cooldown-aware retry (Variante A). Only quota-share (qtSd/)
+  // combos opt in: when the set loop would crystallize a 429 model_cooldown
+  // because the target hit a SHORT transient cooldown, we wait it out and
+  // re-run the whole set loop instead of propagating the 429. `globalAttempts`
+  // persists across these waits so MAX_GLOBAL_ATTEMPTS still bounds total work.
+  // The wait happens at the crystallization point. The only semaphore slot the
+  // quota-share path may hold is the FASE 2.1 per-connection concurrency slot
+  // (acquired once around dispatchWithCooldownRetry below); it is intentionally
+  // kept across the wait so the account stays "busy", and is released by the
+  // outer finally — not here.
+  //
+  // The set loop is wrapped in a small recursive closure rather than an extra
+  // labelled `while (true)` so the loop body keeps its original indentation; a
+  // wait+redispatch is a tail `return dispatchWithCooldownRetry()`, which
+  // re-runs ONLY the set loop (selection / shadow routing / setup above stay
+  // untouched), preserving the pre-existing `continue`-to-top-of-set-loop
+  // semantics exactly.
+  const comboCooldownWaitEnabled =
+    strategy === "quota-share" && resilienceSettings.comboCooldownWait.enabled;
+  let comboCooldownAttempt = 0;
+  let comboCooldownBudgetLeftMs = resilienceSettings.comboCooldownWait.budgetMs;
+
+  // FASE 2.1: per-connection concurrency limit for quota-share. The gating in
+  // selectQuotaShareTarget is fail-open and cannot hard-limit a single-connection
+  // pool, so we serialize concurrent requests to the selected account through a
+  // per-connection semaphore. Enabled only for quota-share combos (the cap is the
+  // account's) and gated by the kill-switch; the slot wraps the whole dispatch.
+  const quotaShareConcurrencyEnabled =
+    strategy === "quota-share" && resilienceSettings.quotaShareConcurrencyLimit.enabled;
+
+  const dispatchWithCooldownRetry = async (): Promise<Response> => {
     for (let setTry = 0; setTry <= maxSetRetries; setTry++) {
       // #1731: Per-set-iteration set of providers whose quota is fully exhausted.
       // Reset each retry so providers excluded in a previous attempt get another chance.
@@ -1946,8 +2208,8 @@ export async function handleComboChat({
                 }
               }
             }
-
-            // Record last known good provider (LKGP) for this combo/model (#919)
+            if (_sticky.messageHash && target.connectionId)
+              recordStickyBinding(_sticky.messageHash, target.connectionId); // LKGP (#919):
             if (provider) {
               const connId = effectiveConnectionId || undefined;
               void (async () => {
@@ -2369,6 +2631,43 @@ export async function handleComboChat({
       const msg = lastError || "All combo models unavailable";
 
       if (earliestRetryAfter) {
+        // Quota-share cooldown-aware retry: instead of crystallizing the 429,
+        // wait out a SHORT transient cooldown and re-run the whole set loop.
+        // Guarded by the helper (quota_exhausted/auth/not-found excluded,
+        // ceiling, attempts, budget). MAX_GLOBAL_ATTEMPTS still bounds total
+        // dispatches.
+        if (comboCooldownWaitEnabled && status === 429) {
+          const decision = resolveComboCooldownWaitDecision({
+            targets: orderedTargets,
+            earliestRetryAfter,
+            attempt: comboCooldownAttempt,
+            budgetLeftMs: comboCooldownBudgetLeftMs,
+            settings: resilienceSettings.comboCooldownWait,
+            lookupLock: (provider, connectionId) => {
+              const rawModel = parseModel(orderedTargets[0]?.modelStr ?? "").model || "";
+              return getModelLockoutInfo(provider, connectionId, rawModel);
+            },
+            computeWaitMs: (retryAfter) => computeClosestRetryAfter(retryAfter).waitMs,
+          });
+          if (decision.wait) {
+            log.info(
+              "COMBO",
+              `Quota-share cooldown wait: ${msg} — waiting ${Math.ceil(
+                decision.waitMs / 1000
+              )}s (reason=${decision.reason ?? "?"}) then retrying (attempt ${
+                comboCooldownAttempt + 1
+              }/${resilienceSettings.comboCooldownWait.maxAttempts})`
+            );
+            const completed = await waitForCooldownAwareRetry(decision.waitMs, signal);
+            if (!completed) {
+              log.info("COMBO", "Quota-share cooldown wait aborted by client disconnect");
+              return errorResponse(499, "Request aborted");
+            }
+            comboCooldownAttempt += 1;
+            comboCooldownBudgetLeftMs = Math.max(0, comboCooldownBudgetLeftMs - decision.waitMs);
+            return dispatchWithCooldownRetry();
+          }
+        }
         const retryHuman = formatRetryAfter(toRetryAfterDisplayValue(earliestRetryAfter));
         log.warn("COMBO", `All models failed | ${msg} (${retryHuman})`);
         return unavailableResponse(status, msg, earliestRetryAfter, retryHuman);
@@ -2382,7 +2681,33 @@ export async function handleComboChat({
     }
 
     return errorResponse(503, "Combo routing completed without an upstream response");
+  };
+
+  // FASE 2.1: acquire the per-connection concurrency slot for the selected
+  // quota-share target once, around the whole dispatch (including any
+  // cooldown-aware re-dispatch), so concurrent requests to one subscription
+  // account are serialized through the connection's max_concurrent ceiling. The
+  // cap is read fresh from the selected connection; a null cap (no limit) or a
+  // saturated queue is a no-op (fail-open). Released in the finally below.
+  let quotaShareConcurrencyRelease: (() => void) | null = null;
+  const qsConnectionId = orderedTargets[0]?.connectionId;
+  if (quotaShareConcurrencyEnabled && qsConnectionId) {
+    const qsCap = await lookupPositiveCap(qsConnectionId);
+    quotaShareConcurrencyRelease = await acquireQuotaShareConcurrencySlot(
+      orderedTargets[0],
+      qsCap,
+      {
+        queueTimeoutMs: config.queueTimeoutMs ?? 30000,
+        maxQueueSize: resolveComboQueueDepth(config),
+      },
+      log
+    );
+  }
+
+  try {
+    return await dispatchWithCooldownRetry();
   } finally {
+    quotaShareConcurrencyRelease?.();
     // G2: Clean up candidate registry to prevent unbounded memory growth.
     _unregisterExecutionCandidates(_registeredExecutionKeys);
   }
@@ -2413,6 +2738,10 @@ async function handleRoundRobinCombo({
     ? resolveComboConfig(combo, settings)
     : { ...getDefaultComboConfig(), ...(combo.config || {}) };
   const concurrency = config.concurrencyPerModel ?? 3;
+  // Honor each target connection's own maxConcurrent ceiling (cached per dispatch)
+  // so a low-concurrency subscription account is not flooded; falls back to the
+  // combo-level concurrency when the connection has no positive cap.
+  const resolveTargetConcurrency = makeConnectionConcurrencyResolver(concurrency);
   const queueTimeout = config.queueTimeoutMs ?? 30000;
   // #3872: pre-cascade queue depth — lower values fail over to the next combo member
   // sooner under concurrency saturation (0 = never queue). Default 20 (backward-compat).
@@ -2494,7 +2823,8 @@ async function handleRoundRobinCombo({
       if (stickyTarget) {
         const rawModel = parseModel(stickyTarget.modelStr).model || stickyTarget.modelStr;
         const stickyAvailable =
-          (!stickyTarget.provider || getCircuitBreaker(stickyTarget.provider).getStatus().state !== "OPEN") &&
+          (!stickyTarget.provider ||
+            getCircuitBreaker(stickyTarget.provider).getStatus().state !== "OPEN") &&
           !(
             resilienceSettings.providerCooldown.enabled &&
             Boolean(stickyTarget.provider && stickyTarget.provider !== "unknown") &&
@@ -2611,11 +2941,13 @@ async function handleRoundRobinCombo({
       continue;
     }
 
-    // Acquire semaphore slot (may wait in queue)
+    // Acquire semaphore slot (may wait in queue). Honor the connection's own
+    // maxConcurrent cap when set; else fall back to the combo-level concurrency.
+    const targetConcurrency = await resolveTargetConcurrency(target.connectionId);
     let release: () => void;
     try {
       release = await semaphore.acquire(semaphoreKey, {
-        maxConcurrency: concurrency,
+        maxConcurrency: targetConcurrency,
         timeoutMs: queueTimeout,
         maxQueueSize: queueDepth,
       });
diff --git a/open-sse/services/combo/autoStrategy.ts b/open-sse/services/combo/autoStrategy.ts
index 16263cb92f..6e0bbaaed7 100644
--- a/open-sse/services/combo/autoStrategy.ts
+++ b/open-sse/services/combo/autoStrategy.ts
@@ -49,6 +49,17 @@ export const QUOTA_SOFT_DEPRIORITIZE_FACTOR = Number(
   process.env.QUOTA_SOFT_DEPRIORITIZE_FACTOR ?? "0.7"
 );
 
+// #4540: Status soft-deprioritization factor.
+// When the quota-preflight HARD cutoff is OFF (default), a candidate whose connection
+// is in a terminal/transient unavailable status (credits_exhausted / rate_limited /
+// banned / expired / future-dated unavailable) is NOT hard-blocked — instead its
+// auto-combo score is multiplied by this factor so an exhausted provider ranks strictly
+// below an otherwise-identical healthy one, without surfacing a misleading 429.
+// Override via STATUS_SOFT_DEPRIORITIZE_FACTOR env var (range 0..1, default 0.5).
+export const STATUS_SOFT_DEPRIORITIZE_FACTOR = Number(
+  process.env.STATUS_SOFT_DEPRIORITIZE_FACTOR ?? "0.5"
+);
+
 // G2: Module-level registry of active combo execution candidates.
 // Maps executionKey → Map<stepId, candidate mutable ref>.
 // Populated by buildAutoCandidates registrations; cleaned up after each execution.
@@ -364,6 +375,12 @@ export function scoreAutoTargets(
       if ("quotaSoftPenalty" in candidate && candidate.quotaSoftPenalty === true) {
         score *= QUOTA_SOFT_DEPRIORITIZE_FACTOR;
       }
+      // #4540: terminal/transient connection status soft penalty (no hard block).
+      // A no-fetcher exhausted provider keeps quotaRemaining=100, so without this its
+      // score would tie a healthy provider's. The penalty pushes it strictly below.
+      if ("statusPenalty" in candidate && candidate.statusPenalty === true) {
+        score *= STATUS_SOFT_DEPRIORITIZE_FACTOR;
+      }
       return {
         target,
         score,
diff --git a/open-sse/services/combo/comboCooldownRetry.ts b/open-sse/services/combo/comboCooldownRetry.ts
new file mode 100644
index 0000000000..775bae62ca
--- /dev/null
+++ b/open-sse/services/combo/comboCooldownRetry.ts
@@ -0,0 +1,237 @@
+/**
+ * comboCooldownRetry.ts — pure decision helper for the quota-share combo
+ * cooldown-aware retry (Variante A).
+ *
+ * Problem it solves
+ * -----------------
+ * In a single-connection quota-share combo (`qtSd/…`), when the upstream
+ * returns a SHORT transient 429 (reset in a few seconds), the combo loop
+ * treats the only target as locked-by-resilience, skips it, and crystallizes a
+ * 429 `model_cooldown` to the client immediately — even though waiting a couple
+ * of seconds would let the same connection succeed. This helper decides whether
+ * `handleComboChat` should WAIT for that short cooldown and re-dispatch instead
+ * of propagating the 429.
+ *
+ * Why a pure helper
+ * -----------------
+ * The actual wait (`waitForCooldownAwareRetry`) and the lock lookup
+ * (`getModelLockoutInfo`) live in `handleComboChat`; only the *gating policy*
+ * lives here. Keeping the policy pure (no I/O, no clock) means every branch is
+ * unit-testable deterministically and the orchestration in combo.ts stays thin.
+ *
+ * SECURITY — `quota_exhausted` must be excluded
+ * ---------------------------------------------
+ * `isRetryableModelLockoutReason` (src/sse/services/auth.ts:533) considers
+ * `quota_exhausted` RETRYABLE — its NON_RETRYABLE set only holds
+ * `not_found`/`not_found_local`. But `recordModelLockoutFailure`
+ * (accountFallback.ts) locks a quota-exhausted model UNTIL MIDNIGHT. If this
+ * helper trusted that classifier, a combo would wait until midnight. So this
+ * helper uses its OWN allow-list semantics: a reason qualifies for a wait only
+ * when it is a known short/transient reason AND is not in the explicit
+ * non-retryable set below. The small `maxWaitMs` ceiling is the second barrier.
+ */
+
+/**
+ * Reasons that must NEVER trigger a wait, regardless of the upstream-provided
+ * retry hint. `quota_exhausted` is the critical one (locked until midnight);
+ * the auth/not-found reasons can never be cured by waiting a few seconds.
+ */
+export const COMBO_COOLDOWN_NON_RETRYABLE_REASONS: ReadonlySet<string> = new Set([
+  "quota_exhausted",
+  "auth_error",
+  "not_found",
+  "not_found_local",
+]);
+
+/**
+ * Reasons recognised as short/transient and therefore eligible for a wait. We
+ * use an allow-list (rather than "anything not in the deny-list") so an unknown
+ * or empty reason fails closed — only an explicit transient reason qualifies.
+ * These match the model-lockout reasons produced by classifyLockoutReason /
+ * recordModelLockoutFailure for rate-limit-class failures.
+ */
+export const COMBO_COOLDOWN_RETRYABLE_REASONS: ReadonlySet<string> = new Set([
+  "rate_limit",
+  "rate_limited",
+  "transient",
+  "overloaded",
+  "server_error",
+]);
+
+export interface ComboCooldownWaitSettings {
+  /** Master switch — when false the helper always returns wait=false. */
+  enabled: boolean;
+  /** Hard ceiling (ms) on a single wait. Inclusive upper bound. */
+  maxWaitMs: number;
+  /** Maximum number of wait+redispatch attempts for one request. */
+  maxAttempts: number;
+  /** Total wait budget (ms) for the request — combo.ts decrements it. */
+  budgetMs: number;
+}
+
+export interface ShouldWaitForComboCooldownInput {
+  /** Lock reason from getModelLockoutInfo (may be null/unknown). */
+  reason: unknown;
+  /** Computed wait derived from the upstream retry-after hint (ms). */
+  waitMs: unknown;
+  /** Zero-based count of waits already performed for this request. */
+  attempt: number;
+  /** Remaining wait budget (ms) for this request. */
+  budgetLeftMs: number;
+  settings: ComboCooldownWaitSettings;
+}
+
+export interface ShouldWaitForComboCooldownResult {
+  wait: boolean;
+  /**
+   * The wait duration the caller should pass to waitForCooldownAwareRetry. It
+   * is surfaced even when `wait` is false (clamped to a finite >= 0 value) so
+   * the caller can log "would have waited Xms" without re-deriving it.
+   */
+  waitMs: number;
+}
+
+function toFiniteWaitMs(value: unknown): number {
+  if (typeof value === "number" && Number.isFinite(value) && value > 0) {
+    return value;
+  }
+  return 0;
+}
+
+function isRetryableComboCooldownReason(reason: unknown): boolean {
+  if (typeof reason !== "string" || reason.length === 0) return false;
+  if (COMBO_COOLDOWN_NON_RETRYABLE_REASONS.has(reason)) return false;
+  return COMBO_COOLDOWN_RETRYABLE_REASONS.has(reason);
+}
+
+/**
+ * Decide whether a quota-share combo should wait for a short cooldown and
+ * re-dispatch. Pure — no I/O, no clock. All inputs are explicit.
+ *
+ * Returns wait=true only when ALL hold:
+ *   - settings.enabled
+ *   - reason is a recognised transient reason AND not in the non-retryable set
+ *     (quota_exhausted / auth_error / not_found / not_found_local)
+ *   - waitMs is finite and 0 < waitMs <= settings.maxWaitMs
+ *   - attempt < settings.maxAttempts
+ *   - budgetLeftMs >= waitMs
+ */
+export function shouldWaitForComboCooldown(
+  input: ShouldWaitForComboCooldownInput
+): ShouldWaitForComboCooldownResult {
+  const { reason, attempt, budgetLeftMs, settings } = input;
+  const waitMs = toFiniteWaitMs(input.waitMs);
+
+  const wait =
+    settings.enabled === true &&
+    isRetryableComboCooldownReason(reason) &&
+    waitMs > 0 &&
+    waitMs <= settings.maxWaitMs &&
+    attempt < settings.maxAttempts &&
+    budgetLeftMs >= waitMs;
+
+  return { wait, waitMs };
+}
+
+/** Minimal lock shape resolved from getModelLockoutInfo. */
+export interface ComboCooldownLockInfo {
+  reason: unknown;
+  remainingMs: number;
+}
+
+export interface ResolveComboCooldownDecisionInput {
+  /** Combo targets to inspect for an active short lock. */
+  targets: ReadonlyArray<{ provider?: string | null; connectionId?: string | null }>;
+  /** Earliest retry-after the loop crystallized (string | number | Date | null). */
+  earliestRetryAfter: unknown;
+  attempt: number;
+  budgetLeftMs: number;
+  settings: ComboCooldownWaitSettings;
+  /** Per-target lock lookup (getModelLockoutInfo bound to the request model). */
+  lookupLock: (provider: string, connectionId: string) => ComboCooldownLockInfo | null;
+  /** Derives the wait (ms) from the retry-after hint (computeClosestRetryAfter). */
+  computeWaitMs: (retryAfter: unknown) => number | null;
+}
+
+export interface ResolveComboCooldownDecisionResult extends ShouldWaitForComboCooldownResult {
+  /** Reason that drove the decision (for logging); null when none resolved. */
+  reason: string | null;
+}
+
+/**
+ * Small safety margin (ms) added on top of the wait so the model lock is
+ * reliably EXPIRED when the loop re-checks `isModelLocked` after the wait (real
+ * clocks drift a few ms between locking and re-evaluation; under-waiting would
+ * make the 2nd pass skip the target again and crystallize a 503/429).
+ */
+export const COMBO_COOLDOWN_WAIT_MARGIN_MS = 50;
+
+/**
+ * Resolve, from the combo targets and the crystallized retry-after, whether the
+ * quota-share combo should wait and re-dispatch. Picks the locked target with
+ * the SMALLEST positive remaining cooldown (the soonest to recover) and uses its
+ * reason. The wait must last long enough to actually clear that lock, so it is
+ * `max(lock remainingMs, upstream retry-after hint) + margin` — the lock's own
+ * remaining time is authoritative (it already folds in a longer upstream hint
+ * via selectLockoutCooldownMs), and we honor an even longer hint if present. The
+ * ceiling check in shouldWaitForComboCooldown then gates on that real duration,
+ * so only genuinely SHORT cooldowns are waited. Pure given the injected
+ * `lookupLock`/`computeWaitMs` — no I/O, no clock — so it is unit-testable.
+ */
+export function resolveComboCooldownWaitDecision(
+  input: ResolveComboCooldownDecisionInput
+): ResolveComboCooldownDecisionResult {
+  const {
+    targets,
+    earliestRetryAfter,
+    attempt,
+    budgetLeftMs,
+    settings,
+    lookupLock,
+    computeWaitMs,
+  } = input;
+
+  // Short-circuit before any lookup when the feature is off.
+  if (!settings.enabled) return { wait: false, waitMs: 0, reason: null };
+
+  let best: { reason: unknown; remainingMs: number } | null = null;
+  for (const target of targets) {
+    const provider = typeof target.provider === "string" ? target.provider : "";
+    if (!provider) continue;
+    const connectionId = typeof target.connectionId === "string" ? target.connectionId : "";
+    const info = lookupLock(provider, connectionId);
+    if (!info) continue;
+    const remainingMs =
+      typeof info.remainingMs === "number" && Number.isFinite(info.remainingMs)
+        ? info.remainingMs
+        : 0;
+    if (remainingMs <= 0) continue;
+    if (!best || remainingMs < best.remainingMs) {
+      best = { reason: info.reason, remainingMs };
+    }
+  }
+
+  if (!best) return { wait: false, waitMs: 0, reason: null };
+
+  // Wait long enough to actually clear the lock: the larger of the lock's own
+  // remaining time and the upstream retry-after hint, plus a small margin.
+  const rawHintWaitMs = computeWaitMs(earliestRetryAfter);
+  const hintWaitMs =
+    typeof rawHintWaitMs === "number" && Number.isFinite(rawHintWaitMs) && rawHintWaitMs > 0
+      ? rawHintWaitMs
+      : 0;
+  const waitMs = Math.max(best.remainingMs, hintWaitMs) + COMBO_COOLDOWN_WAIT_MARGIN_MS;
+
+  const decision = shouldWaitForComboCooldown({
+    reason: best.reason,
+    waitMs,
+    attempt,
+    budgetLeftMs,
+    settings,
+  });
+
+  return {
+    ...decision,
+    reason: typeof best.reason === "string" ? best.reason : null,
+  };
+}
diff --git a/open-sse/services/combo/comboPredicates.ts b/open-sse/services/combo/comboPredicates.ts
index 66b8ba704c..f41c31c559 100644
--- a/open-sse/services/combo/comboPredicates.ts
+++ b/open-sse/services/combo/comboPredicates.ts
@@ -151,6 +151,23 @@ export function resolveDelayMs(value: unknown, fallback: number): number {
   return numericValue;
 }
 
+/**
+ * Resolve the effective semaphore `maxConcurrency` for a round-robin combo
+ * target from its connection's per-account concurrency cap.
+ *
+ * `cap` is the connection's `maxConcurrent` (provider_connections.max_concurrent).
+ * A positive cap is honored (floored to a whole slot count); null / undefined /
+ * <= 0 / non-finite all mean "no per-connection limit" and fall back to the
+ * combo-level concurrency. This keeps subscription accounts with a tiny
+ * concurrency ceiling (e.g. GLM/MiniMax ≈ 1) from being flooded.
+ */
+export function effectiveMaxConcurrency(cap: number | null | undefined, fallback: number): number {
+  if (typeof cap === "number" && Number.isFinite(cap) && cap > 0) {
+    return Math.floor(cap);
+  }
+  return fallback;
+}
+
 export function comboModelNotFoundResponse(message: string) {
   return errorResponse(404, message);
 }
diff --git a/open-sse/services/combo/concurrencyCaps.ts b/open-sse/services/combo/concurrencyCaps.ts
new file mode 100644
index 0000000000..329df99069
--- /dev/null
+++ b/open-sse/services/combo/concurrencyCaps.ts
@@ -0,0 +1,76 @@
+/**
+ * concurrencyCaps.ts — Per-connection concurrency-cap resolution for combos.
+ *
+ * A provider connection (OAuth account / API key) can declare a `maxConcurrent`
+ * ceiling (provider_connections.max_concurrent). Subscription accounts often
+ * allow only ~1–3 concurrent requests; exceeding that triggers 429s and
+ * cooldowns. These helpers resolve that ceiling from the DB so the routing layer
+ * can honor it:
+ *
+ *   - resolveMaxConcurrentByConnection: batch-resolves a Map<connectionId, cap>
+ *     for a set of targets (used by the quota-share strategy gating).
+ *   - makeConnectionConcurrencyResolver: a cached per-target resolver returning
+ *     the effective semaphore maxConcurrency (used by the round-robin loop).
+ *
+ * Both deduplicate DB reads per connectionId (the same connection can repeat
+ * across combo steps) so at most one lookup happens per distinct connection, and
+ * both fail open: a null/<=0 cap or a lookup error means "no per-connection
+ * limit" and never blocks routing. Extracted from combo.ts to keep that god-file
+ * shrinking (Quality Gate / #3501).
+ */
+
+import { getProviderConnectionById } from "../../../src/lib/db/providers";
+import { effectiveMaxConcurrency } from "./comboPredicates.ts";
+import type { ResolvedComboTarget } from "./types.ts";
+
+/** Read a connection's positive `maxConcurrent`, or null when unset / <= 0 / on error. */
+export async function lookupPositiveCap(connectionId: string): Promise<number | null> {
+  try {
+    const conn = await getProviderConnectionById(connectionId);
+    const raw = (conn as { maxConcurrent?: number | null } | null)?.maxConcurrent;
+    return typeof raw === "number" && Number.isFinite(raw) && raw > 0 ? raw : null;
+  } catch {
+    return null; // fail-open: never block routing on a lookup error
+  }
+}
+
+/**
+ * Resolve each distinct target connection's `maxConcurrent` into a Map keyed by
+ * connectionId. null entries mean "no limit". DB reads are deduplicated per
+ * connectionId, so this adds at most one lookup per distinct connection.
+ */
+export async function resolveMaxConcurrentByConnection(
+  targets: ResolvedComboTarget[]
+): Promise<Map<string, number | null>> {
+  const caps = new Map<string, number | null>();
+  const distinctIds = new Set<string>();
+  for (const target of targets) {
+    const connId = target.connectionId ?? "";
+    if (connId) distinctIds.add(connId);
+  }
+  for (const connId of distinctIds) {
+    caps.set(connId, await lookupPositiveCap(connId));
+  }
+  return caps;
+}
+
+/**
+ * Build a cached resolver that maps a target's connectionId to the effective
+ * semaphore `maxConcurrency`: the connection's own positive `maxConcurrent` when
+ * set, else `fallbackConcurrency`. The cache lives for the resolver's lifetime
+ * (one combo dispatch) so a repeated connection costs a single DB read.
+ */
+export function makeConnectionConcurrencyResolver(
+  fallbackConcurrency: number
+): (connectionId: string | null) => Promise<number> {
+  const cache = new Map<string, number | null>();
+  return async (connectionId: string | null): Promise<number> => {
+    if (!connectionId) return fallbackConcurrency;
+    let cap = cache.get(connectionId);
+    if (cap === undefined) {
+      cap = await lookupPositiveCap(connectionId);
+      cache.set(connectionId, cap);
+    }
+    return effectiveMaxConcurrency(cap, fallbackConcurrency);
+  };
+}
diff --git a/open-sse/services/combo/headroomRanking.ts b/open-sse/services/combo/headroomRanking.ts
new file mode 100644
index 0000000000..13e5baffe4
--- /dev/null
+++ b/open-sse/services/combo/headroomRanking.ts
@@ -0,0 +1,91 @@
+/**
+ * Pure headroom ranking for combo / pool connection selection.
+ *
+ * Technique borrowed from the `dario` project: when choosing among the
+ * connections of a pool/combo, prefer the one with the MOST free capacity
+ * (highest headroom) instead of reactively filling one connection until it
+ * 429s. This spreads load across accounts proactively.
+ *
+ *   headroom = 1 − max(util_5h, util_7d)
+ *
+ * where util_5h / util_7d are the 0..1 saturation signals from
+ * `src/lib/quota/saturationSignals.ts::getSaturation` for the 5h plan window
+ * and the weekly (7-day) plan window respectively. The binding (worst)
+ * dimension drives the score, so a connection that is fine on 5h but nearly
+ * exhausted on the weekly window is correctly deprioritized.
+ *
+ * This module is a PURE leaf: saturation is INJECTED by the caller (a Map),
+ * never fetched here — no DB, no network — so the ranking is fully
+ * deterministic and unit-testable. The stateful/async orderer that gathers the
+ * saturation signals lives in ./quotaStrategies.ts and feeds these helpers.
+ *
+ * Fail-open: any missing / non-finite utilization is treated as 0 (full
+ * headroom), so an unknown saturation signal never penalizes a connection —
+ * matching getSaturation's own fail-open contract.
+ *
+ * No barrel import — pure leaf (consistent with the other combo/* helpers).
+ *
+ * Part of: Group B — Quota Sharing Engine (headroom-aware connection selection).
+ */
+
+/**
+ * The two plan-window utilization signals (0..1) for one connection.
+ * Either may be absent / non-finite; both are clamped + defaulted to 0.
+ */
+export interface HeadroomSaturation {
+  /** 5h plan-window utilization (0..1). */
+  util5h?: number;
+  /** weekly (7-day) plan-window utilization (0..1). */
+  util7d?: number;
+}
+
+/** Clamp an arbitrary number into [0,1]; non-finite → 0 (generous default). */
+function clampUtil(value: number | undefined): number {
+  if (typeof value !== "number" || !Number.isFinite(value)) return 0;
+  if (value <= 0) return 0;
+  if (value >= 1) return 1;
+  return value;
+}
+
+/**
+ * headroom = 1 − max(util_5h, util_7d), clamped to [0,1].
+ * Higher = more free capacity. Pure.
+ */
+export function computeHeadroom(sat: HeadroomSaturation | undefined): number {
+  const u5 = clampUtil(sat?.util5h);
+  const u7 = clampUtil(sat?.util7d);
+  return 1 - Math.max(u5, u7);
+}
+
+/**
+ * Order `candidates` by descending headroom (most free capacity first).
+ *
+ * @param candidates  the connections / targets to rank (NOT mutated).
+ * @param satByKey    saturation signal per candidate, keyed by `keyOf`.
+ *                    A missing entry → full headroom (fail-open, ranks first).
+ * @param keyOf       extracts the stable string key used to look up `satByKey`.
+ * @returns a NEW array; ties preserve the original input order (stable sort).
+ */
+export function rankByHeadroom<T>(
+  candidates: T[],
+  satByKey: Map<string, HeadroomSaturation>,
+  keyOf: (candidate: T) => string
+): T[] {
+  if (candidates.length <= 1) return candidates;
+
+  // Decorate with original index so equal-headroom candidates keep input order
+  // (Array.prototype.sort is not guaranteed stable across all engines for the
+  // comparator we need; the explicit index tie-break makes it deterministic).
+  const decorated = candidates.map((candidate, index) => ({
+    candidate,
+    index,
+    headroom: computeHeadroom(satByKey.get(keyOf(candidate))),
+  }));
+
+  decorated.sort((a, b) => {
+    if (b.headroom !== a.headroom) return b.headroom - a.headroom;
+    return a.index - b.index;
+  });
+
+  return decorated.map((entry) => entry.candidate);
+}
diff --git a/open-sse/services/combo/quotaShareConcurrency.ts b/open-sse/services/combo/quotaShareConcurrency.ts
new file mode 100644
index 0000000000..7cc5ba5995
--- /dev/null
+++ b/open-sse/services/combo/quotaShareConcurrency.ts
@@ -0,0 +1,74 @@
+/**
+ * quotaShareConcurrency.ts — Per-connection concurrency limit for quota-share combos (FASE 2.1).
+ *
+ * The quota-share gating in selectQuotaShareTarget (combo/quotaShareStrategy.ts)
+ * is FAIL-OPEN: an at-cap connection is only deprioritized, never hard-blocked,
+ * so with a single-connection pool (the common case for a subscription account)
+ * concurrent requests to that account are all dispatched at once and flood it
+ * (→ 429 + cooldown). The quota-share dispatch path also never calls
+ * `semaphore.acquire` — that lived only in handleRoundRobinCombo.
+ *
+ * This helper closes that gap WITHOUT touching the fail-open selection logic:
+ * when the selected connection declares a positive `max_concurrent` ceiling, the
+ * dispatch acquires a per-CONNECTION semaphore slot keyed by connectionId (the
+ * cap belongs to the account, not the combo), so concurrent requests to one
+ * account WAIT in the queue instead of flooding it. It stays fail-open at the
+ * edges: no connection / no positive cap → no limit; a saturated queue / timeout
+ * → proceed without a slot rather than ever worsening availability.
+ *
+ * The key is connectionId-scoped (not combo-scoped like the round-robin key) so
+ * every quota-share request that lands on the same account shares one gate.
+ */
+
+import * as semaphore from "../rateLimitSemaphore.ts";
+import type { ResolvedComboTarget } from "./types.ts";
+
+/** Stable, connection-scoped semaphore key for the quota-share concurrency gate. */
+export function quotaShareConcurrencyKey(connectionId: string): string {
+  return `qsconn:${connectionId}`;
+}
+
+export interface QuotaShareSlotOptions {
+  /** Max time a request waits in the queue before failing open (ms). */
+  queueTimeoutMs: number;
+  /** Max queued waiters before the gate fails open instead of queueing more. */
+  maxQueueSize: number;
+}
+
+interface SlotLogger {
+  warn: (tag: string, message: string) => void;
+}
+
+/**
+ * Acquire a per-connection concurrency slot for the selected quota-share target.
+ *
+ * Returns a release callback to invoke once the request finishes, or `null` when
+ * no limit applies (missing connection, `cap === null`, `cap <= 0`) or the gate
+ * is saturated. Fail-open is deliberate: this layer must never make a quota-share
+ * request fail that would otherwise have been dispatched — it only paces the ones
+ * it can, so a full queue / timeout proceeds WITHOUT a slot.
+ */
+export async function acquireQuotaShareConcurrencySlot(
+  target: ResolvedComboTarget | undefined,
+  cap: number | null,
+  opts: QuotaShareSlotOptions,
+  log: SlotLogger
+): Promise<(() => void) | null> {
+  const connectionId = target?.connectionId ?? "";
+  if (!connectionId || cap === null || cap <= 0) return null;
+  try {
+    return await semaphore.acquire(quotaShareConcurrencyKey(connectionId), {
+      maxConcurrency: cap,
+      timeoutMs: opts.queueTimeoutMs,
+      maxQueueSize: opts.maxQueueSize,
+    });
+  } catch {
+    // Fail-open: a saturated queue / timeout must never worsen availability —
+    // proceed without a slot rather than reject a dispatchable request.
+    log.warn(
+      "COMBO",
+      `Quota-share concurrency: connection ${connectionId} gate saturated (cap=${cap}) — proceeding without a slot`
+    );
+    return null;
+  }
+}
diff --git a/open-sse/services/combo/quotaShareInflight.ts b/open-sse/services/combo/quotaShareInflight.ts
new file mode 100644
index 0000000000..eaeee06a9d
--- /dev/null
+++ b/open-sse/services/combo/quotaShareInflight.ts
@@ -0,0 +1,133 @@
+/**
+ * quotaShareInflight.ts — In-flight request counter for the quota-share strategy.
+ *
+ * Tracks how many requests are currently in-flight per connectionId so the
+ * quota-share P2C tie-break can prefer the least-loaded connection in real time.
+ *
+ * Decrement-on-abort safety (TTL/lease):
+ *   The generic combo dispatch path is intentionally NOT instrumented (so this
+ *   feature cannot regress existing strategies). Instead, each in-flight slot
+ *   carries an expiry: incrementInflight() stamps `nowMs + leaseMs`. The normal
+ *   path calls decrementInflight() (returned to the caller as a callback) once
+ *   the request settles, which clears the slot immediately. If a request is
+ *   aborted or crashes before that callback runs, the slot still auto-expires
+ *   after DEFAULT_LEASE_MS — so the counter can never leak forever, even without
+ *   touching the generic dispatch.
+ *
+ * Fail-open: getInflight() returns 0 for an unknown / empty connectionId.
+ * All time input is injectable (the `nowMs` param) so unit tests drive the
+ * clock deterministically — the tested path never calls Date.now() implicitly.
+ *
+ * Part of: Quota Sharing Engine — Phase 3 (#9 dedicated quota-share strategy).
+ */
+
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+
+/**
+ * Default lease duration (ms). A slot that is never explicitly decremented
+ * (aborted / crashed request) auto-expires after this, bounding the counter.
+ */
+export const DEFAULT_LEASE_MS = 120_000;
+
+// ---------------------------------------------------------------------------
+// Types
+// ---------------------------------------------------------------------------
+
+interface InflightSlot {
+  count: number;
+  expiresAtMs: number;
+}
+
+// ---------------------------------------------------------------------------
+// In-process store. Key: connectionId.
+// ---------------------------------------------------------------------------
+
+const _inflightMap = new Map<string, InflightSlot>();
+
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+
+/**
+ * Increment the in-flight counter for a connection and return the new count.
+ * Sets / refreshes the slot's expiry lease.
+ *
+ * @param connectionId  Opaque connection identifier (empty → no-op, returns 0).
+ * @param leaseMs       Lease before the slot auto-expires if never decremented.
+ * @param nowMs         Current epoch ms; defaults to Date.now() (off-path only).
+ */
+export function incrementInflight(
+  connectionId: string,
+  leaseMs: number = DEFAULT_LEASE_MS,
+  nowMs: number = Date.now()
+): number {
+  if (!connectionId) return 0;
+  pruneExpired(nowMs);
+  const slot = _inflightMap.get(connectionId);
+  const base = slot && slot.expiresAtMs > nowMs ? slot.count : 0;
+  const newCount = base + 1;
+  _inflightMap.set(connectionId, { count: newCount, expiresAtMs: nowMs + leaseMs });
+  return newCount;
+}
+
+/**
+ * Decrement the in-flight counter for a connection, flooring at 0. The entry is
+ * removed once the count reaches 0 (or if the slot already expired).
+ *
+ * @param connectionId  Opaque connection identifier (empty → no-op).
+ * @param nowMs         Current epoch ms; defaults to Date.now() (off-path only).
+ */
+export function decrementInflight(connectionId: string, nowMs: number = Date.now()): void {
+  if (!connectionId) return;
+  const slot = _inflightMap.get(connectionId);
+  if (!slot || slot.expiresAtMs <= nowMs) {
+    _inflightMap.delete(connectionId);
+    return;
+  }
+  const newCount = Math.max(0, slot.count - 1);
+  if (newCount === 0) {
+    _inflightMap.delete(connectionId);
+  } else {
+    _inflightMap.set(connectionId, { count: newCount, expiresAtMs: slot.expiresAtMs });
+  }
+}
+
+/**
+ * Current in-flight count for a connection (0 if unknown / empty / expired).
+ *
+ * @param connectionId  Opaque connection identifier.
+ * @param nowMs         Current epoch ms; defaults to Date.now() (off-path only).
+ */
+export function getInflight(connectionId: string, nowMs: number = Date.now()): number {
+  if (!connectionId) return 0;
+  const slot = _inflightMap.get(connectionId);
+  if (!slot || slot.expiresAtMs <= nowMs) return 0;
+  return slot.count;
+}
+
+// ---------------------------------------------------------------------------
+// Internal helpers
+// ---------------------------------------------------------------------------
+
+/** Drop all expired slots so the map cannot grow unbounded with stale leases. */
+function pruneExpired(nowMs: number): void {
+  for (const [key, slot] of _inflightMap) {
+    if (slot.expiresAtMs <= nowMs) _inflightMap.delete(key);
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Test helpers (never call in production code)
+// ---------------------------------------------------------------------------
+
+/** Clear all in-flight state. Tests only — keeps state isolation between cases. */
+export function _clearInflightForTest(): void {
+  _inflightMap.clear();
+}
+
+/** Return the current slot count. Tests only — black-box size assertion. */
+export function _inflightSizeForTest(): number {
+  return _inflightMap.size;
+}
diff --git a/open-sse/services/combo/quotaShareStrategy.ts b/open-sse/services/combo/quotaShareStrategy.ts
new file mode 100644
index 0000000000..e9e4293543
--- /dev/null
+++ b/open-sse/services/combo/quotaShareStrategy.ts
@@ -0,0 +1,349 @@
+/**
+ * quotaShareStrategy.ts — Dedicated selection strategy for quota-share combos.
+ *
+ * Activated ONLY for the internal "quota-share" strategy (the auto-minted qtSd/
+ * combos). It is never imported by generic combo routing paths, so tuning this
+ * module can never regress the existing strategies (fill-first, p2c, headroom…).
+ *
+ * Three mechanisms are applied in sequence:
+ *
+ *   1. Per-model bucket gating (accountBuckets.isBucketSaturated):
+ *      A connection whose 5h, 7d, or per-model 7d:<model> window is saturated
+ *      for the requested model is moved to a DEPRIORITIZED tail rather than
+ *      dropped. If EVERY connection is saturated, all are eligible again
+ *      (fail-open: a quota-share combo is never hard-blocked here).
+ *
+ *   2. DRR (Deficit Round Robin):
+ *      Among the eligible connections, each round adds a quantum proportional to
+ *      the target weight to that target's deficit, then selects the target with
+ *      the largest accumulated deficit and zeroes it. Over many requests this
+ *      distributes load proportionally to weight, deterministically.
+ *
+ *   3. P2C (Power of Two Choices) over real in-flight load:
+ *      Between the top two DRR candidates, the one with fewer active in-flight
+ *      requests (quotaShareInflight) wins; ties keep the DRR order. The winner's
+ *      in-flight counter is incremented immediately and a decrement callback is
+ *      returned for the caller's finally/abort handler.
+ *
+ * All state is in-process; no DB or network calls. The clock is injectable
+ * (the `nowMs` param) so unit tests are fully deterministic.
+ *
+ * Part of: Quota Sharing Engine — Phase 3 (#9 dedicated quota-share strategy).
+ */
+
+import { isBucketSaturated } from "../../../src/lib/quota/accountBuckets.ts";
+import { incrementInflight, decrementInflight, getInflight } from "./quotaShareInflight.ts";
+import type { ResolvedComboTarget } from "./types.ts";
+
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+
+/** Maximum number of per-combo DRR states retained before oldest-entry eviction. */
+const MAX_DRR_COMBOS = 200;
+
+// ---------------------------------------------------------------------------
+// DRR state
+// ---------------------------------------------------------------------------
+
+/**
+ * Outer key: comboName. Inner key: target.executionKey. Value: accumulated
+ * deficit (higher = this target is "owed" more service). Single instance —
+ * never duplicate this Map (state cohesion).
+ */
+const _drrState = new Map<string, Map<string, number>>();
+
+function getDrrDeficits(comboName: string): Map<string, number> {
+  let deficits = _drrState.get(comboName);
+  if (!deficits) {
+    if (_drrState.size >= MAX_DRR_COMBOS) {
+      // Evict the oldest entry (Map iterates in insertion order).
+      const oldestKey = _drrState.keys().next().value;
+      if (oldestKey !== undefined) _drrState.delete(oldestKey);
+    }
+    deficits = new Map();
+    _drrState.set(comboName, deficits);
+  }
+  return deficits;
+}
+
+// ---------------------------------------------------------------------------
+// Mechanism 1 — per-model bucket gating
+// ---------------------------------------------------------------------------
+
+/** Extract the bare model name from "<provider>/<model>" (or pass through). */
+function bareModelName(modelStr: string): string {
+  const slash = modelStr.indexOf("/");
+  return slash >= 0 ? modelStr.slice(slash + 1) : modelStr;
+}
+
+/**
+ * Return the eligible (non-saturated) targets. Fail-open: when every target is
+ * saturated, the original list is returned so the combo is never hard-blocked.
+ */
+function filterEligibleBySaturation(
+  targets: ResolvedComboTarget[],
+  modelStr: string,
+  nowMs: number
+): ResolvedComboTarget[] {
+  const modelName = bareModelName(modelStr);
+
+  const eligible = targets.filter((target) => {
+    const connId = target.connectionId ?? "";
+    if (connId === "") return true; // no connection → cannot be saturation-scored
+    const saturated =
+      isBucketSaturated(connId, "5h", nowMs) ||
+      isBucketSaturated(connId, "7d", nowMs) ||
+      (modelName !== "" && isBucketSaturated(connId, `7d:${modelName}`, nowMs));
+    return !saturated;
+  });
+
+  return eligible.length > 0 ? eligible : targets;
+}
+
+// ---------------------------------------------------------------------------
+// Mechanism 1b — per-connection concurrency gating (maxConcurrent)
+// ---------------------------------------------------------------------------
+
+/**
+ * Resolve the configured concurrency cap for a connection. Treats null, <= 0,
+ * non-finite, and a missing entry all as "no limit" (returns null → never gates).
+ * The cap is the connection's `maxConcurrent` (provider_connections.max_concurrent),
+ * supplied by the caller as a pre-resolved Map so this module stays pure/sync.
+ */
+function resolveConnectionCap(
+  connectionId: string,
+  caps: Map<string, number | null> | undefined
+): number | null {
+  if (!connectionId || !caps) return null;
+  const cap = caps.get(connectionId);
+  if (typeof cap !== "number" || !Number.isFinite(cap) || cap <= 0) return null;
+  return cap;
+}
+
+/**
+ * Partition `targets` into those with concurrency headroom and those currently
+ * AT (or over) their per-connection `maxConcurrent`. A connection is "at cap"
+ * when its live in-flight count (quotaShareInflight) is >= its configured cap.
+ *
+ * Fail-open, mirroring filterEligibleBySaturation: when EVERY target is at cap
+ * (or no caps apply), all targets are returned as `withRoom` and `atCap` is
+ * empty — the combo is never hard-blocked by this gate. Targets without a
+ * positive cap are always treated as having room.
+ */
+function partitionByConcurrencyCap(
+  targets: ResolvedComboTarget[],
+  caps: Map<string, number | null> | undefined,
+  nowMs: number
+): { withRoom: ResolvedComboTarget[]; atCap: ResolvedComboTarget[] } {
+  if (!caps || caps.size === 0) return { withRoom: targets, atCap: [] };
+
+  const withRoom: ResolvedComboTarget[] = [];
+  const atCap: ResolvedComboTarget[] = [];
+
+  for (const target of targets) {
+    const connId = target.connectionId ?? "";
+    const cap = resolveConnectionCap(connId, caps);
+    if (cap === null) {
+      withRoom.push(target); // no limit → always has room
+      continue;
+    }
+    if (getInflight(connId, nowMs) >= cap) {
+      atCap.push(target);
+    } else {
+      withRoom.push(target);
+    }
+  }
+
+  // Fail-open: never demote the entire eligible set — if nothing has room,
+  // keep all targets dispatchable rather than hard-blocking the combo.
+  if (withRoom.length === 0) return { withRoom: targets, atCap: [] };
+  return { withRoom, atCap };
+}
+
+// ---------------------------------------------------------------------------
+// Mechanism 2 — DRR ordering
+// ---------------------------------------------------------------------------
+
+/**
+ * Reorder `targets` by deficit round-robin (quantum proportional to weight).
+ * Returns a NEW array with the highest-deficit target first; mutates the shared
+ * DRR state for `comboName`.
+ *
+ * Classic DRR: every round each target gains a quantum equal to its normalized
+ * weight share; the target with the largest deficit is selected and pays a fixed
+ * cost of 1. Subtracting a constant (rather than zeroing) keeps the accumulated
+ * fractional credit, so long-run selection frequency converges EXACTLY to the
+ * weight ratio and the choice stays deterministic (no fragile float ties).
+ */
+function applyDrr(targets: ResolvedComboTarget[], comboName: string): ResolvedComboTarget[] {
+  if (targets.length <= 1) return targets.slice();
+
+  const deficits = getDrrDeficits(comboName);
+  const totalWeight = targets.reduce((sum, t) => sum + normalizeWeight(t.weight), 0);
+
+  // Add each target's quantum (weight share) to its deficit.
+  for (const target of targets) {
+    const quantum = normalizeWeight(target.weight) / totalWeight;
+    deficits.set(target.executionKey, (deficits.get(target.executionKey) ?? 0) + quantum);
+  }
+
+  // Select the target with the largest deficit (ties keep input order).
+  let winner = targets[0];
+  let bestDeficit = deficits.get(winner.executionKey) ?? 0;
+  for (let i = 1; i < targets.length; i++) {
+    const d = deficits.get(targets[i].executionKey) ?? 0;
+    if (d > bestDeficit) {
+      bestDeficit = d;
+      winner = targets[i];
+    }
+  }
+
+  // Winner pays a unit cost; the leftover credit carries into the next round.
+  deficits.set(winner.executionKey, bestDeficit - 1);
+
+  const rest = targets.filter((t) => t.executionKey !== winner.executionKey);
+  return [winner, ...rest];
+}
+
+/** Weights default to 1 and are floored at 1 to keep quantum math well-defined. */
+function normalizeWeight(weight: number | undefined): number {
+  return Number.isFinite(weight) && (weight as number) > 0 ? (weight as number) : 1;
+}
+
+// ---------------------------------------------------------------------------
+// Mechanism 3 — P2C over in-flight load
+// ---------------------------------------------------------------------------
+
+/**
+ * Pick the less-loaded of the first two candidates. Returns 0 to keep the DRR
+ * winner, or 1 to prefer the runner-up. Ties favor the DRR winner (index 0).
+ */
+function pickByInflightP2C(
+  first: ResolvedComboTarget,
+  second: ResolvedComboTarget,
+  nowMs: number
+): 0 | 1 {
+  const loadFirst = getInflight(first.connectionId ?? "", nowMs);
+  const loadSecond = getInflight(second.connectionId ?? "", nowMs);
+  return loadSecond < loadFirst ? 1 : 0;
+}
+
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+
+export interface QuotaShareResult {
+  /** The selected target, or null when `targets` was empty. */
+  target: ResolvedComboTarget | null;
+  /**
+   * Full ordered dispatch list: winner first, then the remaining eligible
+   * targets, then any deprioritized (saturated) targets as last-resort fallbacks.
+   */
+  orderedTargets: ResolvedComboTarget[];
+  /**
+   * Release the winner's in-flight slot. Call this in a finally/abort handler.
+   * Idempotent — safe to call more than once. If never called, the slot still
+   * auto-expires (see quotaShareInflight DEFAULT_LEASE_MS).
+   */
+  decrementInflight: () => void;
+}
+
+/**
+ * Options for {@link selectQuotaShareTarget}. Kept as a separate object so the
+ * function stays SYNCHRONOUS and PURE (no DB/network) and so the injected clock
+ * (`nowMs`) and testability are preserved — the caller pre-resolves any data.
+ */
+export interface QuotaShareOptions {
+  /**
+   * Per-connection concurrency caps: connectionId → `maxConcurrent`
+   * (provider_connections.max_concurrent). A connection whose live in-flight
+   * count is >= its cap is DEPRIORITIZED (moved to the tail), never hard-blocked
+   * (fail-open). null / <= 0 / a missing entry mean "no limit". When omitted, no
+   * concurrency gating is applied (backward compatible).
+   */
+  maxConcurrentByConnection?: Map<string, number | null>;
+}
+
+/**
+ * Select the best target using the dedicated quota-share strategy.
+ *
+ * @param targets    Resolved combo targets (the combo's eligible step entries).
+ * @param comboName  Combo name; used as the DRR state key.
+ * @param modelStr   Requested model string, e.g. "anthropic/claude-opus-4".
+ * @param nowMs      Current epoch ms for bucket/in-flight checks; defaults to Date.now().
+ * @param options    Optional pre-resolved data (per-connection concurrency caps).
+ */
+export function selectQuotaShareTarget(
+  targets: ResolvedComboTarget[],
+  comboName: string,
+  modelStr: string,
+  nowMs: number = Date.now(),
+  options?: QuotaShareOptions
+): QuotaShareResult {
+  const noOp = (): void => {};
+
+  if (targets.length === 0) {
+    return { target: null, orderedTargets: [], decrementInflight: noOp };
+  }
+
+  // 1) Per-model bucket gating.
+  const eligible = filterEligibleBySaturation(targets, modelStr, nowMs);
+  const saturatedDeprioritized = targets.filter((t) => !eligible.includes(t));
+
+  // 1b) Per-connection concurrency gating: connections already at their
+  // maxConcurrent are demoted behind those with headroom (fail-open).
+  const { withRoom, atCap } = partitionByConcurrencyCap(
+    eligible,
+    options?.maxConcurrentByConnection,
+    nowMs
+  );
+
+  // 2) DRR ordering over the set that still has concurrency headroom.
+  const ordered = applyDrr(withRoom, comboName);
+
+  // 3) P2C over in-flight between the top two.
+  let winner: ResolvedComboTarget;
+  let rest: ResolvedComboTarget[];
+  if (ordered.length >= 2 && pickByInflightP2C(ordered[0], ordered[1], nowMs) === 1) {
+    winner = ordered[1];
+    rest = [ordered[0], ...ordered.slice(2)];
+  } else {
+    winner = ordered[0];
+    rest = ordered.slice(1);
+  }
+
+  // Reserve the winner's in-flight slot immediately.
+  const winnerConnectionId = winner.connectionId ?? "";
+  if (winnerConnectionId) incrementInflight(winnerConnectionId, undefined, nowMs);
+
+  // Fallback order: winner → remaining-with-room → at-cap → saturated. Both
+  // deprioritized tiers stay dispatchable so the combo is never hard-blocked.
+  const orderedTargets = [winner, ...rest, ...atCap, ...saturatedDeprioritized];
+
+  // Idempotent decrement callback for the caller's finally/abort path. Uses the
+  // selection-time clock so the slot (stamped nowMs + lease) is never treated as
+  // expired here — it decrements the live count deterministically.
+  let released = false;
+  const release = (): void => {
+    if (released) return;
+    released = true;
+    if (winnerConnectionId) decrementInflight(winnerConnectionId, nowMs);
+  };
+
+  return { target: winner, orderedTargets, decrementInflight: release };
+}
+
+// ---------------------------------------------------------------------------
+// Test helpers (never call in production code)
+// ---------------------------------------------------------------------------
+
+/** Clear all DRR state. Tests only — keeps state isolation between cases. */
+export function _clearDrrStateForTest(): void {
+  _drrState.clear();
+}
+
+/** Return the DRR deficit for a (comboName, executionKey). Tests only. */
+export function _getDrrDeficitForTest(comboName: string, executionKey: string): number {
+  return _drrState.get(comboName)?.get(executionKey) ?? 0;
+}
diff --git a/open-sse/services/combo/quotaStrategies.ts b/open-sse/services/combo/quotaStrategies.ts
index 48d466a162..1f5ca8d7b7 100644
--- a/open-sse/services/combo/quotaStrategies.ts
+++ b/open-sse/services/combo/quotaStrategies.ts
@@ -36,9 +36,11 @@ import {
   getResetWindowTimestampMs,
   type QuotaFetchCacheConfig,
 } from "./quotaScoring.ts";
+import { rankByHeadroom, type HeadroomSaturation } from "./headroomRanking.ts";
 
 const RESET_AWARE_CONNECTION_CACHE_TTL_MS = 30_000;
 const RESET_AWARE_QUOTA_FETCH_CONCURRENCY = 5;
+const HEADROOM_SATURATION_FETCH_CONCURRENCY = 5;
 
 const MAX_RESET_AWARE_CACHE = 200;
 
@@ -566,3 +568,145 @@ export async function orderTargetsByResetWindow(
     ...scoredTargets.filter((entry) => !tiedExecutionKeys.has(entry.target.executionKey)),
   ].map((entry) => entry.target);
 }
+
+/**
+ * Lazily resolve getSaturation from the cross-workspace quota module. Kept as a
+ * dynamic import (matching chatCore's `@/lib/quota/saturationSignals` import) so
+ * this open-sse leaf has no static edge into `src/lib/quota`, and so the seam
+ * stays injectable for tests via __setHeadroomSaturationFetcherForTests.
+ */
+type SaturationFetcher = (
+  connectionId: string,
+  provider: string,
+  dim: { unit: "percent"; window: "5h" | "weekly" }
+) => Promise<number>;
+
+let _headroomSaturationFetcherOverride: SaturationFetcher | null = null;
+
+/** Test-only: inject the getSaturation fetcher; pass null to restore default. */
+export function __setHeadroomSaturationFetcherForTests(fetcher: SaturationFetcher | null): void {
+  _headroomSaturationFetcherOverride = fetcher;
+}
+
+async function resolveHeadroomSaturationFetcher(): Promise<SaturationFetcher> {
+  if (_headroomSaturationFetcherOverride) return _headroomSaturationFetcherOverride;
+  const mod = await import("../../../src/lib/quota/saturationSignals");
+  return mod.getSaturation as SaturationFetcher;
+}
+
+/**
+ * Headroom-aware ordering: prefer the connection with the MOST free capacity,
+ * where headroom = 1 − max(util_5h, util_7d). The per-connection 5h / weekly
+ * saturation comes from getSaturation (src/lib/quota/saturationSignals.ts); the
+ * pure ranking is delegated to rankByHeadroom (./headroomRanking.ts).
+ *
+ * Targets are first expanded across their candidate connections (same machinery
+ * as reset-aware / reset-window), saturation is fetched once per unique
+ * connection with bounded concurrency, and the resulting order puts the freest
+ * connection first. Fail-open throughout: getSaturation already returns 0 on
+ * error (full headroom), and any unexpected failure leaves the target order
+ * unchanged. Ties preserve priority order (stable).
+ */
+export async function orderTargetsByHeadroom(
+  targets: ResolvedComboTarget[],
+  comboName: string,
+  log: { warn?: (...args: unknown[]) => void },
+  apiKeyAllowedConnectionIds?: string[] | null
+): Promise<ResolvedComboTarget[]> {
+  if (targets.length <= 1) return targets;
+
+  try {
+    const connectionCache = new Map<string, Array<Record<string, unknown>>>();
+    const connectionLoadPromises = new Map<string, Promise<Array<Record<string, unknown>>>>();
+    const expandedTargets: ResolvedComboTarget[] = [];
+
+    const targetsWithConnections = await Promise.all(
+      targets.map(async (target) => ({
+        connections: await getQuotaAwareConnectionsForTarget(
+          target,
+          connectionCache,
+          connectionLoadPromises,
+          comboName,
+          log
+        ),
+        target,
+      }))
+    );
+
+    for (const { target, connections } of targetsWithConnections) {
+      const unrestrictedConnectionIds = getTargetConnectionIds(target, connections);
+      const connectionIds = filterAllowedConnectionIds(
+        unrestrictedConnectionIds,
+        apiKeyAllowedConnectionIds
+      );
+      if (connectionIds.length === 0) {
+        if (
+          unrestrictedConnectionIds.length > 0 &&
+          normalizeConnectionIds(apiKeyAllowedConnectionIds)
+        ) {
+          continue;
+        }
+        // No specific connection — keep the target with full headroom (it cannot
+        // be saturation-scored, so it should not be penalized).
+        expandedTargets.push(target);
+        continue;
+      }
+
+      for (const connectionId of connectionIds) {
+        expandedTargets.push({
+          ...target,
+          connectionId,
+          executionKey:
+            target.connectionId === connectionId
+              ? target.executionKey
+              : `${target.executionKey}@${connectionId}`,
+        });
+      }
+    }
+
+    if (expandedTargets.length <= 1) return expandedTargets;
+
+    const getSaturation = await resolveHeadroomSaturationFetcher();
+
+    // Fetch saturation once per unique provider:connection (5h + weekly).
+    const satByConnection = new Map<string, Promise<HeadroomSaturation>>();
+    const connKey = (target: ResolvedComboTarget) => `${target.provider}:${target.connectionId}`;
+
+    await mapWithConcurrency(expandedTargets, HEADROOM_SATURATION_FETCH_CONCURRENCY, async (target) => {
+      if (!target.connectionId) return;
+      const key = connKey(target);
+      if (satByConnection.has(key)) return;
+      satByConnection.set(
+        key,
+        (async () => {
+          const [util5h, util7d] = await Promise.all([
+            getSaturation(target.connectionId as string, target.provider, {
+              unit: "percent",
+              window: "5h",
+            }),
+            getSaturation(target.connectionId as string, target.provider, {
+              unit: "percent",
+              window: "weekly",
+            }),
+          ]);
+          return { util5h, util7d } satisfies HeadroomSaturation;
+        })()
+      );
+      await satByConnection.get(key);
+    });
+
+    // Resolve the per-connection saturation, keyed by the per-target executionKey
+    // for the pure ranker. Targets without a connection get full headroom.
+    const satByExecutionKey = new Map<string, HeadroomSaturation>();
+    for (const target of expandedTargets) {
+      if (!target.connectionId) continue;
+      const sat = await satByConnection.get(connKey(target));
+      if (sat) satByExecutionKey.set(target.executionKey, sat);
+    }
+
+    return rankByHeadroom(expandedTargets, satByExecutionKey, (target) => target.executionKey);
+  } catch (err) {
+    log.warn?.({ err: (err as Error)?.message, comboName }, "headroom ordering failed — keeping target order");
+    return targets;
+  }
+}
diff --git a/open-sse/services/combo/sessionStickiness.ts b/open-sse/services/combo/sessionStickiness.ts
new file mode 100644
index 0000000000..1b81548106
--- /dev/null
+++ b/open-sse/services/combo/sessionStickiness.ts
@@ -0,0 +1,281 @@
+/**
+ * Session stickiness for prompt-cache integrity — Fase 3 #5
+ *
+ * Problem: multi-turn conversations routed to different connections on each
+ * request lose the provider's prompt-cache, inflating token cost 5-10× (known
+ * effect in dario/clewdr). This module pins a session to the same connection
+ * while that connection remains healthy (headroom > STICKINESS_HEADROOM_THRESHOLD).
+ *
+ * Design
+ * ──────
+ * • Hash key: SHA-256 of the FIRST user message → first 16 hex chars.
+ *   Using only the first message gives a stable key that does not change as
+ *   the conversation grows, yet still identifies the conversation reliably.
+ * • Headroom gate: before reusing the sticky connection we re-check that its
+ *   headroom (= 1 − max(util_5h, util_7d)) is above STICKINESS_HEADROOM_THRESHOLD
+ *   (0.15). Below this threshold the connection is considered saturated and the
+ *   session is rebound to whatever the normal ordering picks.
+ *   Rationale for 0.15: empirically a connection at >85 % utilisation is within
+ *   one burst of hitting rate limits, so the cache benefit no longer outweighs
+ *   the cost of sticking to a degraded connection. The value matches the soft-
+ *   penalty zone used elsewhere in the quota-share engine.
+ * • Fail-open: any error (no body, no messages, hash failure, saturation fetch
+ *   failure) falls back to the normal target ordering without throwing.
+ * • Storage: in-memory Map with a TTL (15 min, aligned with sessionManager.ts).
+ *   Max 500 entries; oldest entry evicted when the cap is exceeded.
+ * • Saturation: resolved via the same dynamic-import seam as
+ *   orderTargetsByHeadroom (quotaStrategies.ts), so the open-sse leaf has no
+ *   static edge into src/lib/quota. For tests the fetcher is injected via
+ *   __setStickinessHeadroomFetcherForTests.
+ *
+ * No barrel import — consistent with the other combo/* helpers.
+ *
+ * Part of: Group B — Quota Sharing Engine (Fase 3, point #5).
+ */
+
+import { createHash } from "node:crypto";
+import { computeHeadroom, type HeadroomSaturation } from "./headroomRanking.ts";
+import type { ResolvedComboTarget } from "./types.ts";
+
+// ─── Constants ────────────────────────────────────────────────────────────────
+
+/**
+ * Minimum headroom for a sticky connection to be reused.
+ * A connection at >85 % utilisation is within one burst of rate-limiting;
+ * the cache benefit no longer justifies staying on a degraded connection.
+ * Matches the soft-penalty zone used in the broader quota-share engine.
+ */
+export const STICKINESS_HEADROOM_THRESHOLD = 0.15;
+
+/** TTL aligned with sessionManager.ts SESSION_TTL_MS (15 min). */
+const TTL_MS = 15 * 60 * 1000;
+
+/** Cap to prevent unbounded memory growth. */
+const MAX_ENTRIES = 500;
+
+// ─── Types ────────────────────────────────────────────────────────────────────
+
+interface StickyEntry {
+  connectionId: string;
+  createdAt: number;
+  lastUsedAt: number;
+}
+
+/**
+ * Injectable saturation fetcher seam (for unit tests).
+ * Returns HeadroomSaturation or undefined when unknown.
+ */
+export type SaturationFetcher = (
+  connectionId: string
+) => Promise<HeadroomSaturation | undefined>;
+
+// ─── Saturation fetcher seam ─────────────────────────────────────────────────
+
+/** Overrides the default fetcher for tests; null = use production fetcher. */
+let _fetcherOverride: SaturationFetcher | null = null;
+
+/** Test-only: inject the saturation fetcher; pass null to restore default. */
+export function __setStickinessHeadroomFetcherForTests(fetcher: SaturationFetcher | null): void {
+  _fetcherOverride = fetcher;
+}
+
+/**
+ * Resolve the HeadroomSaturation for a connection by fetching both the 5h and
+ * weekly utilisation signals. Uses the same dynamic-import pattern as
+ * orderTargetsByHeadroom so this leaf has no static dependency on src/lib/quota.
+ */
+async function resolveSaturation(
+  connectionId: string,
+  provider: string
+): Promise<HeadroomSaturation | undefined> {
+  if (_fetcherOverride) return _fetcherOverride(connectionId);
+
+  try {
+    const mod = await import("../../../src/lib/quota/saturationSignals");
+    const getSaturation = mod.getSaturation as (
+      connectionId: string,
+      provider: string,
+      dim: { unit: "percent"; window: "5h" | "weekly" }
+    ) => Promise<number>;
+
+    const [util5h, util7d] = await Promise.all([
+      getSaturation(connectionId, provider, { unit: "percent", window: "5h" }),
+      getSaturation(connectionId, provider, { unit: "percent", window: "weekly" }),
+    ]);
+    return { util5h, util7d };
+  } catch {
+    return undefined;
+  }
+}
+
+// ─── In-memory store ─────────────────────────────────────────────────────────
+
+/** messageHash → sticky entry */
+const stickyMap = new Map<string, StickyEntry>();
+
+// ─── Helpers ─────────────────────────────────────────────────────────────────
+
+/**
+ * Derive a stable 16-hex-char session key from the first user message content.
+ * Returns null when the message cannot be extracted (fail-open).
+ */
+export function deriveMessageHash(
+  messages: Array<{ role?: string; content?: unknown }> | null | undefined
+): string | null {
+  if (!Array.isArray(messages) || messages.length === 0) return null;
+  const first = messages.find((m) => m?.role === "user");
+  if (!first) return null;
+
+  let text: string;
+  if (typeof first.content === "string") {
+    text = first.content;
+  } else if (Array.isArray(first.content)) {
+    // Multi-part content: collect all text parts
+    text = first.content
+      .filter((p): p is { type: string; text: string } => p != null && typeof p === "object")
+      .map((p) => (typeof p.text === "string" ? p.text : ""))
+      .join("");
+  } else {
+    return null;
+  }
+
+  if (!text) return null;
+
+  return createHash("sha256").update(text).digest("hex").slice(0, 16);
+}
+
+/** Evict expired entries and enforce the hard cap. */
+function evict(): void {
+  const now = Date.now();
+  for (const [key, entry] of stickyMap) {
+    if (now - entry.lastUsedAt > TTL_MS) stickyMap.delete(key);
+  }
+  // Hard cap: remove oldest by lastUsedAt
+  while (stickyMap.size > MAX_ENTRIES) {
+    let oldestKey: string | null = null;
+    let oldestTime = Infinity;
+    for (const [key, entry] of stickyMap) {
+      if (entry.lastUsedAt < oldestTime) {
+        oldestTime = entry.lastUsedAt;
+        oldestKey = key;
+      }
+    }
+    if (oldestKey === null) break;
+    stickyMap.delete(oldestKey);
+  }
+}
+
+/** Record (or refresh) a sticky binding after a successful request. */
+export function recordStickyBinding(messageHash: string, connectionId: string): void {
+  const existing = stickyMap.get(messageHash);
+  if (existing) {
+    existing.connectionId = connectionId;
+    existing.lastUsedAt = Date.now();
+  } else {
+    evict();
+    stickyMap.set(messageHash, {
+      connectionId,
+      createdAt: Date.now(),
+      lastUsedAt: Date.now(),
+    });
+  }
+}
+
+/** Remove a binding (e.g. after the connection is confirmed unhealthy). */
+export function clearStickyBinding(messageHash: string): void {
+  stickyMap.delete(messageHash);
+}
+
+/** Reset the entire store (for testing). */
+export function clearAllStickyBindings(): void {
+  stickyMap.clear();
+}
+
+// ─── Core: apply stickiness to an ordered target list ────────────────────────
+
+export interface ApplyStickinessResult {
+  /** Reordered targets (sticky first when applicable). */
+  targets: ResolvedComboTarget[];
+  /** The message hash derived from the request (null = no stickiness possible). */
+  messageHash: string | null;
+  /** Whether a sticky connection was successfully applied. */
+  stuck: boolean;
+}
+
+/**
+ * Attempt to promote the sticky connection to the front of `orderedTargets`.
+ *
+ * Algorithm:
+ * 1. Derive the message hash from the first user message.
+ * 2. Look up the sticky binding for that hash.
+ * 3. If found, fetch saturation for that connection.
+ * 4. If headroom > threshold → move the matching target to index 0.
+ *    Otherwise → clear the binding (rebind on next success).
+ * 5. On any error → fall through unchanged (fail-open).
+ *
+ * In production the saturation fetcher is resolved via dynamic import of
+ * src/lib/quota/saturationSignals (same pattern as orderTargetsByHeadroom).
+ * In tests, inject via __setStickinessHeadroomFetcherForTests.
+ *
+ * @param orderedTargets  Targets already ordered by the combo strategy.
+ * @param messages        Request body.messages.
+ * @returns               Result with (possibly reordered) targets.
+ */
+export async function applySessionStickiness(
+  orderedTargets: ResolvedComboTarget[],
+  messages: Array<{ role?: string; content?: unknown }> | null | undefined
+): Promise<ApplyStickinessResult> {
+  const noOp: ApplyStickinessResult = { targets: orderedTargets, messageHash: null, stuck: false };
+
+  try {
+    if (orderedTargets.length <= 1) return noOp;
+
+    const messageHash = deriveMessageHash(messages);
+    if (!messageHash) return noOp;
+
+    const existing = stickyMap.get(messageHash);
+    if (!existing) return { targets: orderedTargets, messageHash, stuck: false };
+
+    // Check TTL
+    if (Date.now() - existing.lastUsedAt > TTL_MS) {
+      stickyMap.delete(messageHash);
+      return { targets: orderedTargets, messageHash, stuck: false };
+    }
+
+    const { connectionId } = existing;
+
+    // Find the target that matches the sticky connection
+    const stickyIdx = orderedTargets.findIndex((t) => t.connectionId === connectionId);
+    if (stickyIdx === -1) {
+      // Connection gone from pool — clear binding, fall through
+      clearStickyBinding(messageHash);
+      return { targets: orderedTargets, messageHash, stuck: false };
+    }
+
+    // Gate: headroom must be above threshold
+    const stickyTarget = orderedTargets[stickyIdx];
+    const sat = await resolveSaturation(connectionId, stickyTarget.provider);
+    const headroom = computeHeadroom(sat);
+
+    if (headroom <= STICKINESS_HEADROOM_THRESHOLD) {
+      // Connection saturated — rebind on next success
+      clearStickyBinding(messageHash);
+      return { targets: orderedTargets, messageHash, stuck: false };
+    }
+
+    // Promote the sticky target to position 0
+    const reordered = [
+      orderedTargets[stickyIdx],
+      ...orderedTargets.slice(0, stickyIdx),
+      ...orderedTargets.slice(stickyIdx + 1),
+    ];
+
+    // Refresh lastUsedAt
+    existing.lastUsedAt = Date.now();
+
+    return { targets: reordered, messageHash, stuck: true };
+  } catch {
+    // Completely unexpected error — fail-open
+    return noOp;
+  }
+}
diff --git a/open-sse/services/combo/types.ts b/open-sse/services/combo/types.ts
index 651eaa7061..df42aef4a3 100644
--- a/open-sse/services/combo/types.ts
+++ b/open-sse/services/combo/types.ts
@@ -117,6 +117,18 @@ export type AutoProviderCandidate = ProviderCandidate & {
   quotaCutoffBlocked?: boolean;
   /** Diagnostic reason for quotaCutoffBlocked. */
   quotaCutoffReason?: string;
+  /**
+   * #4540: True when this candidate's connection is in a terminal/transient
+   * unavailable status (credits_exhausted / rate_limited / banned / expired /
+   * future-dated unavailable) but the quota-preflight HARD cutoff is OFF (default).
+   * In that case the candidate is NOT hard-blocked — instead its auto-combo score
+   * is multiplied by STATUS_SOFT_DEPRIORITIZE_FACTOR so an exhausted provider ranks
+   * strictly below an otherwise-identical healthy one, without emitting a misleading
+   * "below quota cutoff" 429. Set by buildAutoCandidates from the connection testStatus.
+   */
+  statusPenalty?: boolean;
+  /** Diagnostic reason for statusPenalty (the connection testStatus that triggered it). */
+  statusPenaltyReason?: string;
 };
 
 export type ResolvedComboTarget = {
diff --git a/open-sse/services/compression/bodyAdapter.ts b/open-sse/services/compression/bodyAdapter.ts
index 2a65c21a94..9c42fbdd6f 100644
--- a/open-sse/services/compression/bodyAdapter.ts
+++ b/open-sse/services/compression/bodyAdapter.ts
@@ -2,6 +2,7 @@ type MessageLike = {
   role?: unknown;
   content?: unknown;
   [COMPRESSION_INPUT_INDEX]?: number;
+  [KIRO_TOOL_RESULT_PATH]?: KiroToolResultPath;
   [key: string]: unknown;
 };
 
@@ -16,6 +17,23 @@ type ResponsesItem = {
 const RESPONSES_MESSAGE_TYPES = new Set(["message", "function_call_output"]);
 const COMPRESSION_INPUT_INDEX = Symbol("compressionInputIndex");
 
+// Kiro envelope path back to the original tool-result text inside
+// `conversationState.{history|currentMessage}[].userInputMessage.userInputMessageContext.toolResults[N].content[M].text`.
+// Stored on the synthesized role:"tool" message so we can restore the rewritten text
+// to the exact source slot after any compression engine runs.
+//
+// This lifts Kiro support from RTK-only (upstream decolua/9router#1194) to the shared
+// adapter layer, so every compression engine (RTK, lite, aggressive…) automatically
+// covers Kiro/CodeWhisperer payloads, not just RTK.
+const KIRO_TOOL_RESULT_PATH = Symbol("kiroToolResultPath");
+
+type KiroToolResultPath = {
+  scope: "currentMessage" | "history";
+  historyIndex: number; // ignored when scope === "currentMessage"
+  toolResultIndex: number;
+  contentIndex: number;
+};
+
 function isRecord(value: unknown): value is Record<string, unknown> {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
@@ -47,9 +65,19 @@ function responsesItemToMessage(item: ResponsesItem): MessageLike | null {
   if (!RESPONSES_MESSAGE_TYPES.has(type)) return null;
 
   if (type === "function_call_output") {
+    const rawOutput = item.output ?? item.content;
+    // OpenAI Responses shape (Codex): body.input holds Responses items. When
+    // output is a JSON object (not a string or content array), serialise it so
+    // compression engines can process the text. On restore the serialised string
+    // is kept as output — the Responses API accepts string output. (#1998)
+    const isObjectOutput =
+      rawOutput !== null &&
+      rawOutput !== undefined &&
+      typeof rawOutput === "object" &&
+      !Array.isArray(rawOutput);
     return {
       role: "tool",
-      content: toChatContent(item.output ?? item.content),
+      content: isObjectOutput ? JSON.stringify(rawOutput) : toChatContent(rawOutput),
     };
   }
 
@@ -97,6 +125,14 @@ export function adaptBodyForCompression(body: Record<string, unknown>): Compress
     };
   }
 
+  // Kiro / AWS CodeWhisperer envelope: tool results live deep inside
+  // conversationState.{currentMessage|history[]}.userInputMessage.userInputMessageContext.toolResults.
+  // Flatten the tool-result text into synthesized role:"tool" messages so every engine
+  // can compress them, then restore the rewritten text back into the exact source slot.
+  if (isRecord(body.conversationState)) {
+    return adaptKiroBodyForCompression(body);
+  }
+
   if (!Array.isArray(body.input) && typeof body.input !== "string") {
     return {
       body,
@@ -158,3 +194,161 @@ export function adaptBodyForCompression(body: Record<string, unknown>): Compress
     },
   };
 }
+
+/**
+ * Flatten a Kiro / AWS CodeWhisperer body so compression engines can rewrite the
+ * tool-result text, then restore the rewritten text back into the original envelope
+ * shape. Mirrors the OpenAI tool-role contract:
+ *
+ * - Each surviving tool-result content block becomes one role:"tool" message whose
+ *   `content` is its inner text (engines see a familiar shape).
+ * - Error tool results (`status === "error"`) are intentionally left out of the
+ *   synthesized messages so engines cannot rewrite them — preserves diagnostics
+ *   byte-for-byte (matches upstream decolua/9router#1194 behavior).
+ * - Non-string text parts are skipped.
+ * - On restore, only string `content` (or an array whose first text part is a string)
+ *   is written back to `toolResults[N].content[M].text`.
+ */
+function adaptKiroBodyForCompression(body: Record<string, unknown>): CompressionBodyAdapter {
+  const state = body.conversationState as Record<string, unknown>;
+  const history = Array.isArray(state.history) ? (state.history as Array<unknown>) : [];
+  const currentMessage = isRecord(state.currentMessage) ? state.currentMessage : null;
+
+  const messages: MessageLike[] = [];
+
+  const collectFrom = (
+    container: Record<string, unknown>,
+    scope: "currentMessage" | "history",
+    historyIndex: number
+  ): void => {
+    const uim = container.userInputMessage;
+    if (!isRecord(uim)) return;
+    const ctx = uim.userInputMessageContext;
+    if (!isRecord(ctx)) return;
+    const toolResults = ctx.toolResults;
+    if (!Array.isArray(toolResults)) return;
+    toolResults.forEach((tr, trIdx) => {
+      if (!isRecord(tr)) return;
+      if (tr.status === "error") return; // preserve error traces — never compress
+      const content = tr.content;
+      if (!Array.isArray(content)) return;
+      content.forEach((part, partIdx) => {
+        if (!isRecord(part)) return;
+        if (typeof part.text !== "string" || part.text.length === 0) return;
+        messages.push({
+          role: "tool",
+          content: part.text,
+          [KIRO_TOOL_RESULT_PATH]: {
+            scope,
+            historyIndex,
+            toolResultIndex: trIdx,
+            contentIndex: partIdx,
+          },
+        });
+      });
+    });
+  };
+
+  history.forEach((entry, idx) => {
+    if (!isRecord(entry)) return;
+    collectFrom(entry, "history", idx);
+  });
+  if (currentMessage) collectFrom(currentMessage, "currentMessage", -1);
+
+  if (messages.length === 0) {
+    return {
+      body,
+      adapted: false,
+      restore: (compressedBody) => compressedBody,
+    };
+  }
+
+  return {
+    body: { ...body, messages },
+    adapted: true,
+    restore(compressedBody) {
+      // Build a path → rewritten text map from the synthesized tool messages.
+      const rewrites = new Map<string, string>();
+      if (Array.isArray(compressedBody.messages)) {
+        for (const message of compressedBody.messages as MessageLike[]) {
+          const path = message[KIRO_TOOL_RESULT_PATH];
+          if (!path) continue;
+          let nextText: string | null = null;
+          if (typeof message.content === "string") {
+            nextText = message.content;
+          } else if (Array.isArray(message.content)) {
+            const firstText = message.content.find(
+              (part): part is { text: string } =>
+                isRecord(part) && typeof (part as { text?: unknown }).text === "string"
+            );
+            if (firstText) nextText = firstText.text;
+          }
+          if (nextText === null) continue;
+          rewrites.set(kiroPathKey(path), nextText);
+        }
+      }
+
+      const nextState: Record<string, unknown> = { ...state };
+      // Rebuild history with any rewritten tool-result text.
+      if (history.length > 0) {
+        nextState.history = history.map((entry, idx) => {
+          if (!isRecord(entry)) return entry;
+          return rewriteKiroEntry(entry, "history", idx, rewrites);
+        });
+      }
+      if (currentMessage) {
+        nextState.currentMessage = rewriteKiroEntry(currentMessage, "currentMessage", -1, rewrites);
+      }
+
+      const rest = { ...compressedBody };
+      delete rest.messages;
+      return { ...rest, conversationState: nextState };
+    },
+  };
+}
+
+function kiroPathKey(path: KiroToolResultPath): string {
+  return `${path.scope}|${path.historyIndex}|${path.toolResultIndex}|${path.contentIndex}`;
+}
+
+function rewriteKiroEntry(
+  entry: Record<string, unknown>,
+  scope: "currentMessage" | "history",
+  historyIndex: number,
+  rewrites: Map<string, string>
+): Record<string, unknown> {
+  const uim = entry.userInputMessage;
+  if (!isRecord(uim)) return entry;
+  const ctx = uim.userInputMessageContext;
+  if (!isRecord(ctx)) return entry;
+  const toolResults = ctx.toolResults;
+  if (!Array.isArray(toolResults)) return entry;
+
+  let entryChanged = false;
+  const nextToolResults = toolResults.map((tr, trIdx) => {
+    if (!isRecord(tr)) return tr;
+    const content = tr.content;
+    if (!Array.isArray(content)) return tr;
+    let trChanged = false;
+    const nextContent = content.map((part, partIdx) => {
+      if (!isRecord(part) || typeof part.text !== "string") return part;
+      const key = kiroPathKey({ scope, historyIndex, toolResultIndex: trIdx, contentIndex: partIdx });
+      const rewritten = rewrites.get(key);
+      if (rewritten === undefined || rewritten === part.text) return part;
+      trChanged = true;
+      return { ...part, text: rewritten };
+    });
+    if (!trChanged) return tr;
+    entryChanged = true;
+    return { ...tr, content: nextContent };
+  });
+
+  if (!entryChanged) return entry;
+  return {
+    ...entry,
+    userInputMessage: {
+      ...uim,
+      userInputMessageContext: { ...ctx, toolResults: nextToolResults },
+    },
+  };
+}
diff --git a/open-sse/services/compression/engines/rtk/index.ts b/open-sse/services/compression/engines/rtk/index.ts
index 53e0522c33..2912ce2ce4 100644
--- a/open-sse/services/compression/engines/rtk/index.ts
+++ b/open-sse/services/compression/engines/rtk/index.ts
@@ -331,8 +331,21 @@ export function processRtkText(
   let result = text;
 
   const detection = detectCommandType(text, options.command);
+  // #4559: A document/file read (e.g. a Read tool returning a ~147-line code/prose
+  // file) is NOT repetitive command output, but the generic-output *fallback* filter
+  // and the final line/char hard-cap (designed for npm/make/docker logs) silently drop
+  // its middle. Treat content as a document read when RTK recognized no command,
+  // classified it "unknown", and it carries none of the generic error markers the
+  // generic-output filter keys on — then skip the truncating fallbacks. Genuine logs
+  // detect as a known command type (or carry a command / error markers), so RTK's
+  // value on those is preserved.
+  const hasGenericErrorMarkers = /Error:|Exception:|Traceback \(most recent call last\):/.test(
+    text
+  );
+  const isDocumentLikeRead =
+    detection.type === "unknown" && !detection.command && !hasGenericErrorMarkers;
   let matchedFilterPatterns: string[] = [];
-  if (!options.skipFilters) {
+  if (!options.skipFilters && !isDocumentLikeRead) {
     const filter = matchRtkFilter(text, detection.command, {
       customFiltersEnabled: config.customFiltersEnabled,
       trustProjectFilters: config.trustProjectFilters,
@@ -403,13 +416,17 @@ export function processRtkText(
       return [];
     }
   });
-  const truncated = smartTruncate(result, {
-    maxLines: effectiveMaxLines(config.maxLinesPerResult, config.intensity),
-    maxChars: config.maxCharsPerResult,
-    preserveHead: config.intensity === "aggressive" ? 16 : 24,
-    preserveTail: config.intensity === "aggressive" ? 16 : 24,
-    priorityPatterns: [...defaultPriorityPatterns, ...filterPriorityPatterns],
-  });
+  // #4559: skip the generic line/char hard-cap for document/file reads (see
+  // isDocumentLikeRead above) so the middle of a code/prose read is not dropped.
+  const truncated = isDocumentLikeRead
+    ? { text: result, truncated: false, droppedLines: 0 }
+    : smartTruncate(result, {
+        maxLines: effectiveMaxLines(config.maxLinesPerResult, config.intensity),
+        maxChars: config.maxCharsPerResult,
+        preserveHead: config.intensity === "aggressive" ? 16 : 24,
+        preserveTail: config.intensity === "aggressive" ? 16 : 24,
+        priorityPatterns: [...defaultPriorityPatterns, ...filterPriorityPatterns],
+      });
   if (truncated.truncated) {
     result = truncated.text;
     techniquesUsed.push("rtk-truncate");
diff --git a/open-sse/services/compression/preservation.ts b/open-sse/services/compression/preservation.ts
index dcd382b92a..0f499a2ee5 100644
--- a/open-sse/services/compression/preservation.ts
+++ b/open-sse/services/compression/preservation.ts
@@ -92,7 +92,14 @@ export function extractPreservedBlocks(
   const builtIns: CompiledPattern[] = [
     { pattern: /\$\$[\s\S]*?\$\$/g, kind: "math_block" },
     { pattern: /\\\[[\s\S]*?\\\]/g, kind: "math_block" },
-    { pattern: /(?<!\$)\$(?![\s$\d])(?:\\.|[^$\n]){1,160}?(?<!\s)\$(?!\$)/g, kind: "math_inline" },
+    // #4795: exclude `\` from the catch-all branch so a backslash is only ever
+    // consumed by the escape branch `\\.`. The previous `[^$\n]` overlapped with
+    // `\\.`, making a run of consecutive backslashes (e.g. unmatched `$` + a
+    // Windows path) exponentially ambiguous → catastrophic backtracking (ReDoS).
+    {
+      pattern: /(?<!\$)\$(?![\s$\d])(?:\\.|[^$\n\\]){1,160}?(?<!\s)\$(?!\$)/g,
+      kind: "math_inline",
+    },
     { pattern: /\\begin\{[A-Za-z*]+\}[\s\S]*?\\end\{[A-Za-z*]+\}/g, kind: "latex_block" },
     { pattern: /^#{1,6}\s+.+$/gm, kind: "markdown_heading" },
     { pattern: /^\s*\|.*\|\s*$/gm, kind: "markdown_table" },
diff --git a/open-sse/services/fusion.ts b/open-sse/services/fusion.ts
new file mode 100644
index 0000000000..2ebde14a3a
--- /dev/null
+++ b/open-sse/services/fusion.ts
@@ -0,0 +1,327 @@
+/**
+ * Fusion combo strategy — parallel panel + judge synthesis.
+ *
+ * A fusion combo fans the prompt out to every panel model in parallel, then a
+ * configurable judge model synthesizes one final answer from all panel responses.
+ *
+ *   - quorum-grace collection caps the straggler penalty (the slowest model
+ *     otherwise dominates wall time);
+ *   - anonymized sources prevent judge brand-bias ("Source N" rather than model name);
+ *   - degrades to a direct answer on a single survivor, 503 on total failure.
+ *
+ * Per OpenRouter's Fusion design, the judge does NOT merge — it analyzes
+ * (consensus / contradictions / partial coverage / unique insights / blind spots)
+ * then writes one answer grounded in that analysis. Most of fusion's quality lift
+ * comes from this synthesis step.
+ *
+ * Ported from upstream decolua/9router (Daniil Schovkunov), adapted JS → TS and
+ * wired through OmniRoute's existing combo schema (combo.config.judgeModel /
+ * combo.config.fusionTuning).
+ */
+import { errorResponse, sanitizeErrorMessage } from "../utils/error.ts";
+import { extractTextContent } from "../translator/helpers/geminiHelper.ts";
+import type { ComboLogger, HandleSingleModel } from "./combo/types.ts";
+
+// Fusion tuning. Overridable per-combo via combo.config.fusionTuning.
+export const FUSION_DEFAULTS = {
+  minPanel: 2, // answers needed before stragglers get a grace window
+  stragglerGraceMs: 8000, // wait this long for laggards once quorum is reached
+  panelHardTimeoutMs: 90000, // absolute cap so one hung model can't stall forever
+} as const;
+
+export type FusionTuning = {
+  minPanel?: number;
+  stragglerGraceMs?: number;
+  panelHardTimeoutMs?: number;
+};
+
+type Body = Record<string, unknown>;
+
+/**
+ * Extract assistant text from a non-stream completion across formats
+ * (OpenAI chat, Claude messages, Gemini, OpenAI Responses). Returns "" if none.
+ * Panel responses are already translated to the client format by chatCore, so the
+ * leaf content → string step reuses the translator's own extractTextContent.
+ */
+export function extractPanelText(json: unknown): string {
+  if (!json || typeof json !== "object") return "";
+  const j = json as Record<string, unknown>;
+
+  // OpenAI chat completion
+  const choices = j.choices as Array<Record<string, unknown>> | undefined;
+  const choice = choices?.[0];
+  if (choice) {
+    const msg = (choice.message ?? choice.delta ?? {}) as Record<string, unknown>;
+    const t = extractTextContent(msg.content);
+    if (t.trim()) return t;
+    if (typeof choice.text === "string" && choice.text.trim()) return choice.text;
+  }
+
+  // Claude messages (text blocks share OpenAI's {type:"text"} shape)
+  const claudeText = extractTextContent(j.content);
+  if (claudeText.trim()) return claudeText;
+
+  // Gemini (parts carry .text without a type discriminator)
+  const candidates = j.candidates as Array<Record<string, unknown>> | undefined;
+  const parts = (candidates?.[0]?.content as Record<string, unknown> | undefined)?.parts as
+    | Array<{ text?: unknown }>
+    | undefined;
+  if (Array.isArray(parts)) {
+    const t = parts.map((p) => (typeof p?.text === "string" ? p.text : "")).join("");
+    if (t.trim()) return t;
+  }
+
+  // OpenAI Responses API
+  const output = j.output as Array<Record<string, unknown>> | undefined;
+  if (Array.isArray(output)) {
+    const t = output
+      .flatMap((o) =>
+        Array.isArray(o.content)
+          ? (o.content as Array<{ text?: unknown }>).map((c) =>
+              typeof c?.text === "string" ? c.text : ""
+            )
+          : []
+      )
+      .join("");
+    if (t.trim()) return t;
+  }
+
+  return "";
+}
+
+/**
+ * Append a synthesized user turn to whichever message array the request format uses.
+ * Preserves the original conversation + system prompt so the judge has full context.
+ */
+export function appendUserTurn(body: Body, text: string): Body {
+  const next: Body = { ...body };
+  if (Array.isArray(body.messages)) {
+    next.messages = [...(body.messages as unknown[]), { role: "user", content: text }];
+  } else if (Array.isArray(body.input)) {
+    next.input = [...(body.input as unknown[]), { role: "user", content: text }];
+  } else if (Array.isArray(body.contents)) {
+    next.contents = [
+      ...(body.contents as unknown[]),
+      { role: "user", parts: [{ text }] },
+    ];
+  } else {
+    next.messages = [{ role: "user", content: text }];
+  }
+  return next;
+}
+
+/**
+ * Build the judge directive. Sources are anonymized ("Source N") so the judge
+ * weighs substance, not the reputation of a model brand.
+ */
+export function buildJudgePrompt(answers: Array<{ text: string }>): string {
+  const panel = answers.map((a, i) => `[Source ${i + 1}]\n${a.text}`).join("\n\n");
+
+  return [
+    `You are the JUDGE in a model-fusion panel. ${answers.length} expert models independently answered the user's most recent request. Their responses are below, anonymized by source.`,
+    "",
+    "Do NOT mention that multiple models were used, and do NOT refer to the sources. Produce ONE authoritative final answer addressed directly to the user.",
+    "",
+    "First, internally analyze the panel along these dimensions: consensus (points most sources agree on — treat as higher-confidence), contradictions (where they disagree — resolve with your own judgment), partial coverage, unique insights only one source surfaced, and blind spots every source missed. Then write the best possible final answer grounded in that analysis — more complete and correct than any single response, with no filler.",
+    "",
+    "=== PANEL RESPONSES ===",
+    panel,
+    "=== END PANEL RESPONSES ===",
+    "",
+    "Now write the final answer to the user's original request.",
+  ].join("\n");
+}
+
+type Sentinel = { __timeout?: true; __error?: unknown };
+
+// Resolve a Response (or sentinel) within ms; the loser keeps running but is ignored.
+function withTimeout(
+  promise: Promise<Response>,
+  ms: number
+): Promise<Response | Sentinel> {
+  return new Promise((resolve) => {
+    const t = setTimeout(() => resolve({ __timeout: true }), ms);
+    Promise.resolve(promise)
+      .then((v) => {
+        clearTimeout(t);
+        resolve(v);
+      })
+      .catch((e) => {
+        clearTimeout(t);
+        resolve({ __error: e });
+      });
+  });
+}
+
+/**
+ * Collect panel responses with quorum-grace: as soon as `minPanel` calls succeed,
+ * start a short grace timer for the rest, then proceed with whatever arrived. This
+ * caps the straggler penalty while still preferring a full panel when everyone is
+ * fast. Bounded by a hard timeout.
+ *
+ * Returns a sparse array aligned to `calls` (undefined = not yet / dropped).
+ */
+export function collectPanel(
+  calls: Array<Promise<Response | Sentinel>>,
+  cfg: { minPanel: number; stragglerGraceMs: number; panelHardTimeoutMs: number }
+): Promise<Array<Response | Sentinel | undefined>> {
+  return new Promise((resolve) => {
+    const out: Array<Response | Sentinel | undefined> = new Array(calls.length);
+    let settled = 0;
+    let ok = 0;
+    let finished = false;
+    let graceTimer: ReturnType<typeof setTimeout> | null = null;
+    const finish = () => {
+      if (finished) return;
+      finished = true;
+      clearTimeout(hardTimer);
+      if (graceTimer) clearTimeout(graceTimer);
+      resolve(out);
+    };
+    const hardTimer = setTimeout(finish, cfg.panelHardTimeoutMs);
+    calls.forEach((p, i) => {
+      Promise.resolve(p)
+        .then((v) => {
+          out[i] = v;
+        })
+        .catch((e) => {
+          out[i] = { __error: e };
+        })
+        .finally(() => {
+          settled++;
+          const slot = out[i] as Response | undefined;
+          if (slot && (slot as Response).ok) ok++;
+          if (settled === calls.length) return finish();
+          if (ok >= cfg.minPanel && !graceTimer) {
+            graceTimer = setTimeout(finish, cfg.stragglerGraceMs);
+          }
+        });
+    });
+  });
+}
+
+export type HandleFusionChatOptions = {
+  body: Body;
+  models: string[];
+  handleSingleModel: HandleSingleModel;
+  log: ComboLogger;
+  comboName?: string;
+  judgeModel?: string | null;
+  tuning?: FusionTuning | null;
+};
+
+/**
+ * Handle a fusion combo: fan the prompt out to every panel model in parallel,
+ * then a judge model synthesizes one final answer from all panel responses.
+ *
+ * Panel calls are forced non-streaming with tools stripped (the judge needs
+ * complete prose to synthesize). The judge call keeps the client's original
+ * stream flag + tools, so streaming and downstream tool use still work.
+ *
+ * Speed: quorum-grace collection caps the straggler penalty. Quality: the judge
+ * runs the consensus/contradiction/blind-spot analysis before writing.
+ *
+ * Degrades gracefully: 0 panel answers → 503, exactly 1 → return it directly.
+ */
+export async function handleFusionChat({
+  body,
+  models,
+  handleSingleModel,
+  log,
+  comboName,
+  judgeModel,
+  tuning,
+}: HandleFusionChatOptions): Promise<Response> {
+  const panel = Array.isArray(models) ? models.filter(Boolean) : [];
+  if (panel.length === 0) {
+    return errorResponse(400, "Fusion combo has no models");
+  }
+
+  // A single-model fusion has nothing to fuse — just answer directly.
+  if (panel.length === 1) {
+    return handleSingleModel(body, panel[0]);
+  }
+
+  const cfg = {
+    minPanel: tuning?.minPanel ?? FUSION_DEFAULTS.minPanel,
+    stragglerGraceMs: tuning?.stragglerGraceMs ?? FUSION_DEFAULTS.stragglerGraceMs,
+    panelHardTimeoutMs: tuning?.panelHardTimeoutMs ?? FUSION_DEFAULTS.panelHardTimeoutMs,
+  };
+  const minPanel = Math.min(Math.max(2, cfg.minPanel), panel.length);
+  const judge = judgeModel && judgeModel.trim() ? judgeModel.trim() : panel[0];
+  log.info(
+    "FUSION",
+    `Combo "${comboName ?? ""}" | panel=${panel.length} [${panel.join(", ")}] | judge=${judge} | quorum=${minPanel}`
+  );
+
+  // 1. Fan out to the panel in parallel: non-streaming, tools stripped (we want prose).
+  const { tools: _tools, tool_choice: _tc, ...rest } = body;
+  void _tools;
+  void _tc;
+  const panelBody: Body = { ...rest, stream: false };
+  const t0 = Date.now();
+  const calls = panel.map((m) =>
+    withTimeout(handleSingleModel(panelBody, m), cfg.panelHardTimeoutMs)
+  );
+  const settled = await collectPanel(calls, { ...cfg, minPanel });
+  log.info("FUSION", `fan-out collected in ${Date.now() - t0}ms`);
+
+  // 2. Collect successful answers.
+  const answers: Array<{ model: string; text: string }> = [];
+  for (let i = 0; i < settled.length; i++) {
+    const res = settled[i];
+    const model = panel[i];
+    if (!res) {
+      log.warn("FUSION", `Panel ${model} dropped (straggler/timeout)`);
+      continue;
+    }
+    const sentinel = res as Sentinel;
+    if (sentinel.__timeout) {
+      log.warn("FUSION", `Panel ${model} timed out`);
+      continue;
+    }
+    if (sentinel.__error) {
+      log.warn("FUSION", `Panel ${model} threw`, {
+        error: sanitizeErrorMessage(sentinel.__error as Error),
+      });
+      continue;
+    }
+    const resp = res as Response;
+    if (!resp.ok) {
+      log.warn("FUSION", `Panel ${model} failed`, { status: resp.status });
+      continue;
+    }
+    try {
+      const json = await resp.clone().json();
+      const text = extractPanelText(json);
+      if (text) {
+        answers.push({ model, text });
+        log.info("FUSION", `Panel ${model} ok (${text.length} chars)`);
+      } else {
+        log.warn("FUSION", `Panel ${model} returned empty content`);
+      }
+    } catch (e) {
+      log.warn("FUSION", `Panel ${model} unparseable`, {
+        error: sanitizeErrorMessage(e as Error),
+      });
+    }
+  }
+
+  // 3. Degrade gracefully when the panel is too thin to fuse.
+  if (answers.length === 0) {
+    log.warn("FUSION", "All panel models failed");
+    return errorResponse(503, "All fusion panel models failed");
+  }
+  if (answers.length === 1) {
+    log.info(
+      "FUSION",
+      `Only ${answers[0].model} succeeded — answering directly (no fusion)`
+    );
+    return handleSingleModel(body, answers[0].model);
+  }
+
+  // 4. Judge analyzes + writes one final answer (streams to client if requested).
+  const judgeBody = appendUserTurn(body, buildJudgePrompt(answers));
+  log.info("FUSION", `Judging ${answers.length} answers with ${judge}`);
+  return handleSingleModel(judgeBody, judge);
+}
diff --git a/open-sse/services/qoderCli.ts b/open-sse/services/qoderCli.ts
index f2481cac38..507e92af8c 100644
--- a/open-sse/services/qoderCli.ts
+++ b/open-sse/services/qoderCli.ts
@@ -393,6 +393,109 @@ export function buildCosyHeadersForValidation(bodyStr: string, token: string) {
   };
 }
 
+// #4683: Qoder PATs (`pt-*`) cannot be used directly as the Cosy
+// `security_oauth_token`. The official qodercli performs a two-step flow: it first
+// exchanges the PAT for a short-lived job token (`jt-*`) at
+// `openapi.qoder.sh/api/v1/jobToken/exchange`, then carries that `jt-*` in the Cosy
+// envelope for chat. Passing the raw `pt-*` makes Cosy return a generic 500, which
+// OmniRoute mis-surfaced as "PAT may not be valid for the chat API". We mirror the
+// exchange here and cache the `jt-*` for its lifetime.
+const QODER_JOB_TOKEN_EXCHANGE_URL = "https://openapi.qoder.sh/api/v1/jobToken/exchange";
+// Refresh a little before the ~24h expiry to avoid using a just-expired token.
+const QODER_JOB_TOKEN_DEFAULT_TTL_MS = 23 * 60 * 60 * 1000;
+const QODER_JOB_TOKEN_MIN_TTL_MS = 60 * 1000;
+
+type QoderJobTokenCacheEntry = { jobToken: string; expiresAt: number };
+const qoderJobTokenCache = new Map<string, QoderJobTokenCacheEntry>();
+
+type FetchLike = (input: string, init?: Record<string, unknown>) => Promise<Response>;
+
+/** A Qoder Personal Access Token is the only credential that needs the exchange. */
+export function isQoderPatToken(token: string): boolean {
+  return typeof token === "string" && token.trim().startsWith("pt-");
+}
+
+/** Pull a `jt-*` job token out of the (loosely-specified) exchange response. */
+export function parseQoderJobTokenResponse(json: unknown): {
+  jobToken: string;
+  expiresInMs: number;
+} | null {
+  const root = asRecord(json);
+  const data = asRecord(root.data);
+  const candidates = [
+    root.job_token,
+    root.jobToken,
+    root.jt,
+    root.token,
+    data.job_token,
+    data.jobToken,
+    data.jt,
+    data.token,
+  ];
+  const jobToken = candidates.map(getString).find((v) => v.trim().startsWith("jt-")) || "";
+  if (!jobToken) return null;
+
+  const expiresRaw = [root.expires_in, root.expiresIn, data.expires_in, data.expiresIn].find(
+    (v) => typeof v === "number" && Number.isFinite(v) && (v as number) > 0
+  ) as number | undefined;
+  // Qoder reports expiry in seconds; fall back to the default ~24h window.
+  const expiresInMs = expiresRaw ? expiresRaw * 1000 : QODER_JOB_TOKEN_DEFAULT_TTL_MS;
+  return { jobToken, expiresInMs: Math.max(expiresInMs, QODER_JOB_TOKEN_MIN_TTL_MS) };
+}
+
+/** Exchange a `pt-*` PAT for a short-lived `jt-*` job token (no caching). */
+export async function exchangeQoderJobToken(
+  pat: string,
+  options: { fetchImpl?: FetchLike; signal?: AbortSignal | null } = {}
+): Promise<{ jobToken: string; expiresInMs: number } | null> {
+  const fetchImpl = options.fetchImpl || (fetch as unknown as FetchLike);
+  const res = await fetchImpl(QODER_JOB_TOKEN_EXCHANGE_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ personal_token: pat }),
+    signal: options.signal || AbortSignal.timeout(15000),
+  });
+  if (!res || !res.ok) return null;
+  let json: unknown = null;
+  try {
+    json = await res.json();
+  } catch {
+    return null;
+  }
+  return parseQoderJobTokenResponse(json);
+}
+
+/**
+ * Resolve the token to carry in the Cosy envelope. For a `pt-*` PAT this returns a
+ * cached/freshly-exchanged `jt-*` job token; any other token (already a `jt-*`, or a
+ * non-PAT credential) is returned unchanged. Exchange failures fall back to the
+ * original token so behavior is no worse than before the fix.
+ */
+export async function resolveQoderJobToken(
+  token: string,
+  options: { fetchImpl?: FetchLike; signal?: AbortSignal | null; now?: number } = {}
+): Promise<string> {
+  const trimmed = (token || "").trim();
+  if (!isQoderPatToken(trimmed)) return trimmed;
+
+  const now = options.now ?? Date.now();
+  const cached = qoderJobTokenCache.get(trimmed);
+  if (cached && cached.expiresAt > now) return cached.jobToken;
+
+  const exchanged = await exchangeQoderJobToken(trimmed, options);
+  if (!exchanged) return trimmed; // graceful fallback — keep prior behavior
+  qoderJobTokenCache.set(trimmed, {
+    jobToken: exchanged.jobToken,
+    expiresAt: now + exchanged.expiresInMs,
+  });
+  return exchanged.jobToken;
+}
+
+/** Test-only: clear the job-token cache so unit tests don't leak state. */
+export function __clearQoderJobTokenCache(): void {
+  qoderJobTokenCache.clear();
+}
+
 export async function validateQoderCliPat({
   apiKey,
   providerSpecificData = {},
@@ -461,8 +564,10 @@ export async function validateQoderCliPat({
     };
   }
 
-  // Step 2: Auth validation — send a minimal request with the PAT
-  const headers = buildCosyHeadersForValidation(bodyStr, resolvedToken);
+  // Step 2: Auth validation — exchange the PAT for a job token (#4683), then send a
+  // minimal request with the `jt-*` (Cosy rejects a raw `pt-*` with a generic 500).
+  const cosyToken = await resolveQoderJobToken(resolvedToken);
+  const headers = buildCosyHeadersForValidation(bodyStr, cosyToken);
   const endpoint =
     "https://api1.qoder.sh/algo/api/v2/service/pro/sse/agent_chat_generation?AgentId=agent_common";
 
diff --git a/open-sse/services/systemPrompt.ts b/open-sse/services/systemPrompt.ts
index 2eb7a85f9d..d728b885e2 100644
--- a/open-sse/services/systemPrompt.ts
+++ b/open-sse/services/systemPrompt.ts
@@ -132,3 +132,56 @@ export function injectSystemPrompt(body) {
 
   return result;
 }
+
+/**
+ * Inject a per-request custom system prompt into the request body.
+ *
+ * Unlike injectSystemPrompt (which reads from globalThis config), this
+ * function takes an explicit prompt string and appends it as a suffix
+ * after any existing system content — mirroring the caveman/ponytail
+ * injection pattern but driven by per-endpoint settings.
+ *
+ * @param body  - Translated request body (OpenAI/Claude/Gemini format)
+ * @param prompt - The custom system prompt text to inject
+ * @returns Modified body with prompt appended to the system message
+ */
+export function injectCustomSystemPrompt(body: Record<string, unknown>, prompt: string) {
+  if (!prompt || typeof prompt !== "string") return body;
+  if (!body || typeof body !== "object") return body;
+  if (body._skipSystemPrompt) return body;
+
+  const result = { ...body };
+
+  // OpenAI/Claude messages[] format
+  if (result.messages && Array.isArray(result.messages)) {
+    const sysIdx = (result.messages as Array<{ role: string; content: unknown }>).findIndex(
+      (m) => m.role === "system" || m.role === "developer"
+    );
+    result.messages = [...(result.messages as Array<{ role: string; content: unknown }>)];
+    if (sysIdx >= 0) {
+      const msg = { ...(result.messages as Array<{ role: string; content: unknown }>)[sysIdx] };
+      if (Array.isArray(msg.content)) {
+        msg.content = [...(msg.content as unknown[]), { type: "text", text: prompt }];
+      } else {
+        msg.content = (msg.content ? msg.content + "\n\n" : "") + prompt;
+      }
+      (result.messages as Array<{ role: string; content: unknown }>)[sysIdx] = msg;
+    } else {
+      result.messages = [
+        { role: "system", content: prompt },
+        ...(result.messages as Array<{ role: string; content: unknown }>),
+      ];
+    }
+  }
+
+  // Claude direct system field
+  if (result.system !== undefined) {
+    if (typeof result.system === "string") {
+      result.system = result.system ? result.system + "\n\n" + prompt : prompt;
+    } else if (Array.isArray(result.system)) {
+      result.system = [...(result.system as unknown[]), { type: "text", text: prompt }];
+    }
+  }
+
+  return result;
+}
diff --git a/open-sse/services/taskAwareRouting.ts b/open-sse/services/taskAwareRouting.ts
new file mode 100644
index 0000000000..3cc2da730c
--- /dev/null
+++ b/open-sse/services/taskAwareRouting.ts
@@ -0,0 +1,553 @@
+/**
+ * Task-aware routing layer for combo routing.
+ *
+ * Derives request difficulty (light / standard / heavy / critical) from cheap,
+ * local structural signals — no LLM call. Routes heavier tasks toward higher-power
+ * models using a continuous `modelPowerScore`. Also provides conversation-affinity
+ * sticky round-robin for prompt-cache efficiency.
+ *
+ * Ported from upstream PR #2045 (decolua/9router) by @nguyenxvotanminh3.
+ * Adaptation: operates on ResolvedComboTarget[] (TS target objects) rather than
+ * plain string arrays, uses getResolvedModelCapabilities (OmniRoute TS API) instead
+ * of getCapabilitiesForModel, and is wired additively — only applies when
+ * isTaskRoutingStrategy() returns true. All other strategies are unaffected.
+ *
+ * ReDoS safety: all regexes use word-boundary anchors with alternation of fixed
+ * literals, no variable-length quantifiers on overlapping groups. Safe per
+ * CLAUDE.md PII/Regex learnings.
+ */
+
+import { createHash } from "node:crypto";
+import { getResolvedModelCapabilities } from "./modelCapabilities.ts";
+import type { ResolvedComboTarget } from "./combo/types.ts";
+
+// ── Task level constants ──────────────────────────────────────────────────────
+
+export const TASK_LEVEL_WEIGHT = {
+  light: 1,
+  standard: 2,
+  heavy: 3,
+  critical: 4,
+} as const;
+
+export type TaskLevel = keyof typeof TASK_LEVEL_WEIGHT;
+
+export const TASK_TARGET_POWER: Record<TaskLevel, number> = {
+  light: 35,
+  standard: 65,
+  heavy: 95,
+  critical: 120,
+};
+
+// ReDoS-safe: all alternations are fixed-length word literals under \b anchors.
+// No overlapping or nested quantifiers.
+export const LIGHT_TASK_RE =
+  /\b(hi|hello|thanks|thank you|ping|format|rewrite|grammar|translate|summari[sz]e|short|quick|one[- ]?liner|explain briefly)\b/i;
+
+export const HEAVY_TASK_RE =
+  /\b(debug|root cause|architecture|architectural|refactor|migrate|implementation|implement|design|analy[sz]e|investigate|compare|benchmark|whitebox|codebase|end[- ]?to[- ]?end|e2e)\b/i;
+
+export const CRITICAL_TASK_RE =
+  /\b(critical|security|vulnerability|exploit|rce|remote code execution|supply chain|account takeover|auth bypass|privilege escalation|tenant|cross[- ]tenant|sandbox escape|ssrf|deserialization|prod incident|data exfiltration|bug bounty)\b/i;
+
+// ── Conversation affinity state ───────────────────────────────────────────────
+
+/** @internal exported only for testing */
+export const comboConversationAffinity = new Map<string, { index: number; lastUsed: number }>();
+const CONVERSATION_AFFINITY_TTL_MS = 60 * 60 * 1000; // 1 hour
+const MAX_CONVERSATION_AFFINITY_ENTRIES = 1000;
+
+// ── Strategy gate ─────────────────────────────────────────────────────────────
+
+/**
+ * Returns true when the combo strategy is one of the task-aware strategies.
+ * Task routing is additive: other strategies are wholly unaffected.
+ */
+export function isTaskRoutingStrategy(strategy: unknown): boolean {
+  return ["smart", "task", "task-aware", "task_aware", "auto"].includes(
+    String(strategy ?? "").toLowerCase()
+  );
+}
+
+// ── Internal helpers ──────────────────────────────────────────────────────────
+
+function taskWeight(level: TaskLevel): number {
+  return TASK_LEVEL_WEIGHT[level];
+}
+
+function collectText(value: unknown, out: string[] = []): string[] {
+  if (value == null) return out;
+  if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+    out.push(String(value));
+    return out;
+  }
+  if (Array.isArray(value)) {
+    for (const item of value) collectText(item, out);
+    return out;
+  }
+  if (typeof value !== "object") return out;
+
+  const rec = value as Record<string, unknown>;
+  if (typeof rec["text"] === "string") out.push(rec["text"]);
+  if (typeof rec["input_text"] === "string") out.push(rec["input_text"]);
+  if (typeof rec["output_text"] === "string") out.push(rec["output_text"]);
+  if (typeof rec["content"] === "string") out.push(rec["content"]);
+  else if (Array.isArray(rec["content"])) collectText(rec["content"], out);
+  if (Array.isArray(rec["parts"])) collectText(rec["parts"], out);
+  if (typeof rec["query"] === "string") out.push(rec["query"]);
+  if (typeof rec["url"] === "string") out.push(rec["url"]);
+
+  return out;
+}
+
+function estimatePromptChars(body: Record<string, unknown>): number {
+  const contents =
+    (body["contents"] as unknown) ??
+    ((body["request"] as Record<string, unknown> | undefined)?.["contents"] as unknown);
+  const parts = [
+    body["system"],
+    body["instructions"],
+    body["messages"],
+    body["input"],
+    contents,
+    body["query"],
+    body["url"],
+  ];
+  return collectText(parts).join("\n").length;
+}
+
+function countMessages(body: Record<string, unknown>): number {
+  const contents =
+    (body["contents"] as unknown[]) ??
+    ((body["request"] as Record<string, unknown> | undefined)?.["contents"] as unknown[]);
+  return (
+    (Array.isArray(body["messages"]) ? body["messages"].length : 0) +
+    (Array.isArray(body["input"]) ? body["input"].length : 0) +
+    (Array.isArray(body["contents"]) ? (body["contents"] as unknown[]).length : 0) +
+    (Array.isArray(contents) ? contents.length : 0)
+  );
+}
+
+function maxRequestedOutput(body: Record<string, unknown>): number {
+  const genConf = body["generationConfig"] as Record<string, unknown> | undefined;
+  const candidates = [
+    body["max_tokens"],
+    body["max_output_tokens"],
+    body["max_completion_tokens"],
+    genConf?.["maxOutputTokens"],
+  ]
+    .map((v) => Number.parseInt(String(v ?? ""), 10))
+    .filter((v) => Number.isFinite(v));
+  return candidates.length > 0 ? Math.max(...candidates) : 0;
+}
+
+function getTaskText(body: Record<string, unknown>): string {
+  const contents =
+    (body?.["contents"] as unknown) ??
+    ((body?.["request"] as Record<string, unknown> | undefined)?.["contents"] as unknown);
+  return collectText([
+    body?.["system"],
+    body?.["instructions"],
+    body?.["messages"],
+    body?.["input"],
+    contents,
+    body?.["query"],
+    body?.["url"],
+  ]).join("\n");
+}
+
+function normalizeEffort(body: Record<string, unknown>): string {
+  const reasoning = body?.["reasoning"] as Record<string, unknown> | undefined;
+  return String(body?.["reasoning_effort"] ?? reasoning?.["effort"] ?? "").toLowerCase();
+}
+
+// ── Task signals ──────────────────────────────────────────────────────────────
+
+export interface TaskSignals {
+  promptChars: number;
+  messageCount: number;
+  toolCount: number;
+  outputTokens: number;
+  effort: string;
+  hasExplicitReasoning: boolean;
+  lightKeyword: boolean;
+  heavyKeyword: boolean;
+  criticalKeyword: boolean;
+}
+
+export function getTaskSignals(body: Record<string, unknown>): TaskSignals {
+  const promptChars = estimatePromptChars(body);
+  const messageCount = countMessages(body);
+  const toolCount = Array.isArray(body?.["tools"]) ? (body["tools"] as unknown[]).length : 0;
+  const outputTokens = maxRequestedOutput(body);
+  const effort = normalizeEffort(body);
+  const text = getTaskText(body);
+
+  return {
+    promptChars,
+    messageCount,
+    toolCount,
+    outputTokens,
+    effort,
+    hasExplicitReasoning: Boolean(
+      effort && effort !== "none" && effort !== "off" && effort !== "disabled"
+    ),
+    lightKeyword: LIGHT_TASK_RE.test(text),
+    heavyKeyword: HEAVY_TASK_RE.test(text),
+    criticalKeyword: CRITICAL_TASK_RE.test(text),
+  };
+}
+
+// ── Task classification ───────────────────────────────────────────────────────
+
+export interface TaskClassification extends TaskSignals {
+  level: TaskLevel;
+  weight: number;
+  reasons: string[];
+}
+
+/**
+ * Classify request difficulty for smart combo routing.
+ *
+ * Deliberately uses cheap, local signals only — no LLM call. It is a routing
+ * hint: light requests stay on fast/cheap models while large, tool-heavy,
+ * security-sensitive, or reasoning-heavy requests try stronger models first.
+ * Fallback still tries every model.
+ */
+export function classifyTask(body: Record<string, unknown>): TaskClassification {
+  const s = getTaskSignals(body ?? {});
+  const reasons: string[] = [];
+  const add = (condition: boolean, reason: string): boolean => {
+    if (condition) reasons.push(reason);
+    return condition;
+  };
+
+  const effortIsHigh = /^(high|xhigh|max|maximum|hard|deep)$/.test(s.effort);
+  const effortIsLight =
+    !s.hasExplicitReasoning || /^(low|minimal|none|off|disabled)$/.test(s.effort);
+
+  const critical =
+    add(s.promptChars >= 100000, "huge-context") ||
+    add(s.outputTokens >= 32768, "huge-output") ||
+    add(s.toolCount >= 8 && s.promptChars >= 16000, "many-tools-large-context") ||
+    add(
+      s.criticalKeyword && (effortIsHigh || s.toolCount >= 3 || s.promptChars >= 8000),
+      "critical-domain"
+    );
+
+  if (critical) {
+    return { level: "critical", weight: taskWeight("critical"), ...s, reasons };
+  }
+
+  const heavySignalCount = [
+    add(s.promptChars >= 50000, "large-context"),
+    add(s.promptChars >= 24000, "medium-large-context"),
+    add(s.messageCount >= 16, "long-conversation"),
+    add(s.toolCount >= 4, "many-tools"),
+    add(s.outputTokens >= 8192, "large-output"),
+    add(effortIsHigh, "high-reasoning-effort"),
+    add(s.criticalKeyword, "security-sensitive"),
+    add(s.heavyKeyword && s.promptChars >= 4000, "complex-task"),
+  ].filter(Boolean).length;
+
+  if (heavySignalCount >= 2 || s.promptChars >= 50000 || effortIsHigh) {
+    return { level: "heavy", weight: taskWeight("heavy"), ...s, reasons };
+  }
+
+  const light =
+    s.promptChars <= 2000 &&
+    s.messageCount <= 3 &&
+    s.toolCount === 0 &&
+    s.outputTokens <= 1500 &&
+    effortIsLight &&
+    !s.criticalKeyword &&
+    !s.heavyKeyword;
+
+  if (
+    light ||
+    (s.lightKeyword &&
+      s.promptChars <= 4000 &&
+      s.toolCount === 0 &&
+      effortIsLight &&
+      !s.criticalKeyword)
+  ) {
+    return {
+      level: "light",
+      weight: taskWeight("light"),
+      ...s,
+      reasons: reasons.length > 0 ? reasons : ["small-simple-request"],
+    };
+  }
+
+  return {
+    level: "standard",
+    weight: taskWeight("standard"),
+    ...s,
+    reasons: reasons.length > 0 ? reasons : ["default"],
+  };
+}
+
+// ── Model power scoring ───────────────────────────────────────────────────────
+
+/**
+ * Estimate how capable a model is on a continuous 0–150 scale, using both
+ * registry-derived capabilities and heuristic name matching.
+ */
+export function modelPowerScore(modelStr: string): number {
+  const id = `${modelStr ?? ""}`.toLowerCase();
+  const caps = getResolvedModelCapabilities(modelStr);
+
+  let score = 35;
+  if (caps.reasoning) score += 18;
+  if (caps.supportsVision === true) score += 3;
+  if (caps.toolCalling) score += 3;
+
+  const ctx = caps.contextWindow ?? 0;
+  if (ctx >= 1_000_000) score += 22;
+  else if (ctx >= 400_000) score += 15;
+  else if (ctx >= 200_000) score += 9;
+  else if (ctx > 0 && ctx <= 32_000) score -= 10;
+
+  const maxOut = caps.maxOutputTokens ?? 0;
+  if (maxOut >= 128_000) score += 12;
+  else if (maxOut >= 64_000) score += 8;
+  else if (maxOut > 0 && maxOut <= 8_192) score -= 8;
+
+  if (
+    /\b(opus|mythos|gpt-5|o3|o4|pro|max|ultra|deepseek-v4-pro|sonnet-4|glm-5|kimi-k2\.7|minimax-m3|reasoner)\b/i.test(
+      id
+    )
+  )
+    score += 28;
+  if (/\b(coder|code|coding)\b/i.test(id)) score += 8;
+  if (/\b(haiku|flash|mini|lite|small|nano|instant|fast|turbo|3\.5|8b|7b)\b/i.test(id)) score -= 24;
+
+  return Math.max(0, Math.min(150, score));
+}
+
+// Hard capabilities: missing one drops request data (images, PDFs). Maps TS
+// ResolvedModelCapabilities fields that correspond to hard-cap modalities.
+const HARD_CAP_CHECKS = new Set(["vision"]);
+
+/**
+ * Score a single model for a given task + capability requirements.
+ * Higher score = better fit. Negative score = capability hard-miss.
+ */
+export function scoreModelForTask(
+  modelStr: string,
+  task: TaskClassification = classifyTask({}),
+  required: Set<string> = new Set()
+): number {
+  const caps = getResolvedModelCapabilities(modelStr);
+  const target = TASK_TARGET_POWER[task.level];
+  const power = modelPowerScore(modelStr);
+  let score = 100 - Math.abs(power - target);
+
+  // Hard capability misses: drop score heavily so the model sorts to the back
+  // but stays in the list (fallback still tries every model).
+  for (const cap of required) {
+    if (!HARD_CAP_CHECKS.has(cap)) continue;
+    if (cap === "vision" && caps.supportsVision !== true) score -= 10000;
+  }
+
+  if ((required.has("reasoning") || task.weight >= TASK_LEVEL_WEIGHT.heavy) && !caps.reasoning)
+    score -= 120;
+  if (required.has("search") && !caps.toolCalling) score -= 30;
+
+  const estimatedPromptTokens = Math.ceil((task.promptChars ?? 0) / 4);
+  const ctxLimit = caps.contextWindow ?? 0;
+  if (ctxLimit > 0 && estimatedPromptTokens > ctxLimit * 0.85) score -= 200;
+
+  const maxOut = caps.maxOutputTokens ?? 0;
+  if (maxOut > 0 && task.outputTokens > 0 && task.outputTokens > maxOut) score -= 80;
+
+  if (task.level === "light" && power > 95) score -= 35;
+  if (task.level === "standard" && power > 125) score -= 10;
+  if (task.level === "heavy" && power < 65) score -= 60;
+  if (task.level === "critical" && power < 85) score -= 100;
+
+  return score;
+}
+
+/**
+ * Reorder ResolvedComboTarget[] so the best-fit model for the task comes first.
+ * Stable: ties keep original order. Identity-returns when no reordering needed
+ * (avoids allocations on the common path). Never removes targets.
+ */
+export function reorderByTaskWeight(
+  targets: ResolvedComboTarget[],
+  task: TaskClassification = classifyTask({}),
+  required: Set<string> = new Set()
+): ResolvedComboTarget[] {
+  if (!Array.isArray(targets) || targets.length <= 1) return targets;
+
+  const reordered = targets
+    .map((t, i) => ({ t, i, score: scoreModelForTask(t.modelStr, task, required) }))
+    .sort((a, b) => b.score - a.score || a.i - b.i)
+    .map((x) => x.t);
+
+  return reordered.every((t, i) => t === targets[i]) ? targets : reordered;
+}
+
+// ── Conversation affinity (cache-key derivation) ──────────────────────────────
+
+function normalizeFingerprintText(value: unknown): string {
+  return String(value ?? "")
+    .replace(/\s+/g, " ")
+    .trim()
+    .slice(0, 12000);
+}
+
+function firstRoleText(
+  items: unknown[],
+  roles: Set<string>,
+  contentKey: "content" | "parts" = "content"
+): string {
+  if (!Array.isArray(items)) return "";
+  for (const item of items) {
+    if (!item || typeof item !== "object") continue;
+    const rec = item as Record<string, unknown>;
+    if (!roles.has(String(rec["role"] ?? ""))) continue;
+    const raw = contentKey === "parts" ? rec["parts"] : rec["content"];
+    const text = normalizeFingerprintText(collectText(raw).join("\n"));
+    if (text) return text;
+  }
+  return "";
+}
+
+function allRoleText(
+  items: unknown[],
+  roles: Set<string>,
+  contentKey: "content" | "parts" = "content"
+): string {
+  if (!Array.isArray(items)) return "";
+  return normalizeFingerprintText(
+    items
+      .filter(
+        (item): item is Record<string, unknown> =>
+          !!item &&
+          typeof item === "object" &&
+          roles.has(String((item as Record<string, unknown>)["role"] ?? ""))
+      )
+      .map((item) =>
+        collectText(contentKey === "parts" ? item["parts"] : item["content"]).join("\n")
+      )
+      .filter(Boolean)
+      .join("\n")
+  );
+}
+
+function hashConversationSeed(seed: string): string | null {
+  const normalized = normalizeFingerprintText(seed);
+  if (!normalized) return null;
+  return createHash("sha1").update(normalized).digest("hex").slice(0, 24);
+}
+
+/**
+ * Derive a stable cache-affinity key from explicit thread metadata when present,
+ * otherwise from the immutable start of the prompt (system + first user turn).
+ * Appended turns should not move an existing conversation to another model.
+ */
+export function getConversationCacheKey(body: Record<string, unknown>): string | null {
+  if (!body || typeof body !== "object") return null;
+
+  const meta = body["metadata"] as Record<string, unknown> | undefined;
+  const explicitCandidates = [
+    body["conversation_id"],
+    body["conversationId"],
+    body["thread_id"],
+    body["threadId"],
+    body["session_id"],
+    body["sessionId"],
+    meta?.["conversation_id"],
+    meta?.["conversationId"],
+    meta?.["thread_id"],
+    meta?.["threadId"],
+    meta?.["session_id"],
+    meta?.["sessionId"],
+  ];
+  const explicit = explicitCandidates.find((v) => v != null && String(v).trim());
+  if (explicit != null) return hashConversationSeed(`explicit:${String(explicit).trim()}`);
+
+  const systemRoles = new Set(["system", "developer"]);
+  const userRoles = new Set(["user"]);
+  const contents =
+    (body["contents"] as unknown[]) ??
+    ((body["request"] as Record<string, unknown> | undefined)?.["contents"] as unknown[]);
+
+  const seedParts = [
+    collectText(body["system"]).join("\n"),
+    collectText(body["instructions"]).join("\n"),
+    allRoleText((body["messages"] as unknown[]) ?? [], systemRoles),
+    allRoleText((body["input"] as unknown[]) ?? [], systemRoles),
+    allRoleText(contents ?? [], systemRoles, "parts"),
+    firstRoleText((body["messages"] as unknown[]) ?? [], userRoles),
+    typeof body["input"] === "string"
+      ? body["input"]
+      : firstRoleText((body["input"] as unknown[]) ?? [], userRoles),
+    firstRoleText(contents ?? [], userRoles, "parts"),
+    body["query"],
+    body["url"],
+  ].filter(Boolean);
+
+  return hashConversationSeed(seedParts.join("\n"));
+}
+
+// ── Affinity management (for round-robin integration) ────────────────────────
+
+/** @internal exported for testing */
+export function pruneConversationAffinity(now = Date.now()): void {
+  for (const [key, value] of comboConversationAffinity) {
+    if (!value || now - value.lastUsed > CONVERSATION_AFFINITY_TTL_MS) {
+      comboConversationAffinity.delete(key);
+    }
+  }
+  while (comboConversationAffinity.size > MAX_CONVERSATION_AFFINITY_ENTRIES) {
+    const oldestKey = comboConversationAffinity.keys().next().value;
+    if (oldestKey === undefined) break;
+    comboConversationAffinity.delete(oldestKey);
+  }
+}
+
+/**
+ * Returns the pinned target index for a conversation, or null if none.
+ * Creates and stores an affinity entry on first call for a new conversation.
+ *
+ * Used by getRotatedModels (round-robin) when stickyLimit > 1.
+ */
+export function getOrSetConversationAffinityIndex(
+  rotationKey: string,
+  conversationCacheKey: string,
+  currentIndex: number
+): number {
+  const now = Date.now();
+  pruneConversationAffinity(now);
+
+  const affinityKey = `${rotationKey}:${conversationCacheKey}`;
+  const existing = comboConversationAffinity.get(affinityKey);
+  if (existing) {
+    const pinnedIndex = existing.index;
+    // Refresh TTL (move to end of Map iteration order)
+    comboConversationAffinity.delete(affinityKey);
+    comboConversationAffinity.set(affinityKey, { index: pinnedIndex, lastUsed: now });
+    return pinnedIndex;
+  }
+
+  comboConversationAffinity.set(affinityKey, { index: currentIndex, lastUsed: now });
+  return currentIndex;
+}
+
+/**
+ * Clear affinity entries for a specific combo (or all if no name given).
+ * Called by resetComboRotation.
+ */
+export function clearConversationAffinity(comboName?: string): void {
+  if (comboName) {
+    const prefix = `${comboName}:`;
+    for (const key of comboConversationAffinity.keys()) {
+      if (key.startsWith(prefix)) comboConversationAffinity.delete(key);
+    }
+  } else {
+    comboConversationAffinity.clear();
+  }
+}
diff --git a/open-sse/services/tokenRefresh.ts b/open-sse/services/tokenRefresh.ts
index 0581a77bf6..34eac23a74 100755
--- a/open-sse/services/tokenRefresh.ts
+++ b/open-sse/services/tokenRefresh.ts
@@ -463,6 +463,75 @@ export async function refreshWindsurfToken(
   }
 }
 
+/**
+ * CodeBuddy CN (Tencent) token refresh — POST /v2/plugin/auth/token/refresh with
+ * the refresh token carried in the X-Refresh-Token header (not a form body),
+ * matching the official CodeBuddy CLI. Response: { code: 0, data: <token> }.
+ */
+export async function refreshCodebuddyCnToken(
+  refreshToken: string,
+  log: RefreshLogger,
+  proxyConfig: unknown = null
+) {
+  if (!refreshToken) return null;
+  const { CODEBUDDY_CN_CONFIG } = await import("@/lib/oauth/constants/oauth");
+  const oauth = CODEBUDDY_CN_CONFIG;
+  try {
+    const response = await runWithProxyContext(proxyConfig, () =>
+      fetch(oauth.refreshUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Accept: "application/json",
+          "User-Agent": oauth.userAgent,
+          "X-Requested-With": "XMLHttpRequest",
+          "X-Domain": "copilot.tencent.com",
+          "X-Refresh-Token": refreshToken,
+          "X-Auth-Refresh-Source": "plugin",
+          "X-Product": "SaaS",
+        },
+        body: "{}",
+      })
+    );
+
+    if (!response.ok) {
+      const errorText = await response.text();
+      log?.error?.("TOKEN_REFRESH", "Failed to refresh CodeBuddy CN token", {
+        status: response.status,
+        error: errorText,
+      });
+      return null;
+    }
+
+    const data = await response.json();
+    if (data?.code !== 0 || !data?.data?.accessToken) {
+      log?.error?.("TOKEN_REFRESH", "CodeBuddy CN token refresh returned no token", {
+        code: data?.code,
+        msg: data?.msg,
+      });
+      return null;
+    }
+
+    log?.info?.("TOKEN_REFRESH", "Successfully refreshed CodeBuddy CN token", {
+      hasNewAccessToken: !!data.data.accessToken,
+      hasNewRefreshToken: !!data.data.refreshToken,
+      expiresIn: data.data.expiresIn,
+    });
+
+    return {
+      accessToken: data.data.accessToken,
+      refreshToken: data.data.refreshToken || refreshToken,
+      expiresIn: data.data.expiresIn,
+    };
+  } catch (error) {
+    log?.error?.(
+      "TOKEN_REFRESH",
+      `Network error refreshing CodeBuddy CN token: ${error?.message}`
+    );
+    return null;
+  }
+}
+
 export async function refreshClineToken(refreshToken, log, proxyConfig: unknown = null) {
   const endpoint = PROVIDERS.cline?.refreshUrl;
   if (!endpoint) {
@@ -1457,6 +1526,9 @@ async function _getAccessTokenInternal(provider, credentials, log, proxyConfig:
         proxyConfig
       );
 
+    case "codebuddy-cn":
+      return await refreshCodebuddyCnToken(credentials.refreshToken, log, proxyConfig);
+
     default:
       // Fallback to generic OAuth refresh for unknown providers
       return refreshAccessToken(provider, credentials.refreshToken, credentials, log, proxyConfig);
@@ -1484,6 +1556,7 @@ export function supportsTokenRefresh(provider) {
     "windsurf",
     "devin-cli",
     "gitlab-duo",
+    "codebuddy-cn",
   ]);
   if (explicitlySupported.has(provider)) return true;
   const config = PROVIDERS[provider];
diff --git a/open-sse/services/usage.ts b/open-sse/services/usage.ts
index edd14b8a09..76ac708a50 100644
--- a/open-sse/services/usage.ts
+++ b/open-sse/services/usage.ts
@@ -2,16 +2,6 @@
  * Usage Fetcher - Get usage data from provider APIs
  */
 
-import { PROVIDERS } from "../config/constants.ts";
-import {
-  getAntigravityFetchAvailableModelsUrls,
-  ANTIGRAVITY_BASE_URLS,
-} from "../config/antigravityUpstream.ts";
-import {
-  isUserCallableAntigravityModelId,
-  toClientAntigravityQuotaModelId,
-} from "../config/antigravityModelAliases.ts";
-import { isUserCallableAgyModelId } from "../config/agyModels.ts";
 import { buildCodexUsageQuotas } from "./codexUsageQuotas.ts";
 import { getGlmQuotaUrl } from "../config/glmProvider.ts";
 import { getGitHubCopilotInternalUserHeaders } from "../config/providerHeaderProfiles.ts";
@@ -21,28 +11,50 @@ import { fetchBailianQuota, type BailianTripleWindowQuota } from "./bailianQuota
 import { fetchDeepseekQuota, type DeepseekQuota } from "./deepseekQuotaFetcher.ts";
 import { fetchOpencodeQuota, type OpencodeTripleWindowQuota } from "./opencodeQuotaFetcher.ts";
 import { getOllamaCloudUsage, getOpenCodeGoUsage } from "./opencodeOllamaUsage.ts";
-import {
-  applyAntigravityClientProfileHeaders,
-  getAntigravityBootstrapHeaders,
-  getAntigravityClientProfile,
-} from "./antigravityClientProfile.ts";
-import {
-  antigravityUserAgent,
-  getAntigravityHeaders,
-  getAntigravityLoadCodeAssistMetadata,
-} from "./antigravityHeaders.ts";
-import {
-  getAntigravityRemainingCredits,
-  updateAntigravityRemainingCredits,
-} from "../executors/antigravity.ts";
-import { getCreditsMode } from "./antigravityCredits.ts";
+import { getCodeBuddyCnUsage } from "./usage/codebuddy-cn.ts";
 import { CLAUDE_CODE_VERSION, fetchClaudeBootstrap } from "../executors/claudeIdentity.ts";
-import { generateAntigravityRequestId, getAntigravitySessionId } from "./antigravityIdentity.ts";
+import { isClaudeOauthUsageCoolingDown, markClaudeOauthUsage429 } from "./claudeUsageCooldown.ts";
 import {
   extractCodeAssistOnboardTierId,
   extractCodeAssistSubscriptionTier,
 } from "./codeAssistSubscription.ts";
 import { sanitizeErrorMessage } from "../utils/error.ts";
+import {
+  toRecord,
+  toNumber,
+  toPercentage,
+  toTitleCase,
+  getFieldValue,
+  clampPercentage,
+  roundCurrency,
+  toDisplayLabel,
+  pickFirstNonEmptyString,
+} from "./usage/scalars.ts";
+import { type UsageQuota, parseResetTime, createQuotaFromUsage } from "./usage/quota.ts";
+import {
+  getMiniMaxUsage,
+  getMiniMaxPlanLabel,
+  getMiniMaxSessionTotal,
+  inferMiniMaxPlanLabelFromTotals,
+  getMiniMaxQuotaResetAt,
+  isMiniMaxTextQuotaModel,
+  getMiniMaxWeeklyTotal,
+  createMiniMaxQuotaFromCount,
+  createMiniMaxQuotaFromPercent,
+  getMiniMaxRemainingPercent,
+  getMiniMaxAuthErrorMessage,
+  getMiniMaxErrorSummary,
+} from "./usage/minimax.ts";
+import { getGlmUsage } from "./usage/glm.ts";
+// Re-exported para o teste glm-coding-plan-monthly (importa de services/usage).
+export { glmMonthlyRemainingPercentage } from "./usage/glm.ts";
+import {
+  getAntigravityUsage,
+  getAntigravityPlanLabel,
+  mapCodeAssistSubscriptionToPlanLabel,
+  mapCodeAssistTierIdToLabel,
+  mapSubscriptionTierStringToPlanLabel,
+} from "./usage/antigravity.ts";
 
 // Quota / usage upstream URLs (overridable for testing or relays).
 const CROF_USAGE_URL = process.env.OMNIROUTE_CROF_USAGE_URL ?? "https://crof.ai/usage_api/";
@@ -52,22 +64,6 @@ const GEMINI_CLI_USAGE_URL =
 const CODEWHISPERER_BASE_URL =
   process.env.OMNIROUTE_CODEWHISPERER_BASE_URL ?? "https://codewhisperer.us-east-1.amazonaws.com";
 
-// Antigravity API config (credentials from PROVIDERS via credential loader)
-const ANTIGRAVITY_CONFIG = {
-  quotaApiUrls: getAntigravityFetchAvailableModelsUrls(),
-  loadProjectApiUrl: "https://daily-cloudcode-pa.sandbox.googleapis.com/v1internal:loadCodeAssist",
-  tokenUrl: "https://oauth2.googleapis.com/token",
-  get clientId() {
-    return PROVIDERS.antigravity.clientId;
-  },
-  get clientSecret() {
-    return PROVIDERS.antigravity.clientSecret;
-  },
-  get userAgent() {
-    return antigravityUserAgent();
-  },
-};
-
 // Codex (OpenAI) API config
 const CODEX_CONFIG = {
   usageUrl: "https://chatgpt.com/backend-api/wham/usage",
@@ -104,45 +100,7 @@ const CURSOR_USAGE_CONFIG = {
     "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
 };
 
-const MINIMAX_USAGE_CONFIG = {
-  minimax: {
-    usageUrls: [
-      "https://www.minimax.io/v1/token_plan/remains",
-      "https://api.minimax.io/v1/api/openplatform/coding_plan/remains",
-    ],
-  },
-  "minimax-cn": {
-    usageUrls: [
-      "https://www.minimaxi.com/v1/api/openplatform/coding_plan/remains",
-      "https://api.minimaxi.com/v1/api/openplatform/coding_plan/remains",
-    ],
-  },
-} as const;
-
 type JsonRecord = Record<string, unknown>;
-type UsageQuota = {
-  used: number;
-  total: number;
-  remaining?: number;
-  remainingPercentage?: number;
-  resetAt: string | null;
-  unlimited: boolean;
-  /**
-   * True when the upstream provider reported the remaining fraction. False
-   * means the API didn't include the field and the 0 value here is a sentinel,
-   * NOT a confirmed-exhausted state. Antigravity-specific.
-   */
-  fractionReported?: boolean;
-  quotaSource?: "retrieveUserQuota" | "fetchAvailableModels" | "localUsageHistory";
-  displayName?: string;
-  details?: Array<{
-    name: string;
-    used: number;
-  }>;
-  currency?: string;
-  grantedBalance?: number;
-  toppedUpBalance?: number;
-};
 type UsageProviderConnection = JsonRecord & {
   id?: string;
   provider?: string;
@@ -157,79 +115,6 @@ type SubscriptionCacheEntry = {
   fetchedAt: number;
 };
 
-function toRecord(value: unknown): JsonRecord {
-  return value && typeof value === "object" && !Array.isArray(value) ? (value as JsonRecord) : {};
-}
-
-function toNumber(value: unknown, fallback = 0): number {
-  const parsed =
-    typeof value === "number"
-      ? value
-      : typeof value === "string" && value.trim().length > 0
-        ? Number(value)
-        : Number.NaN;
-  return Number.isFinite(parsed) ? parsed : fallback;
-}
-
-function toPercentage(value: unknown): number {
-  return Math.max(0, Math.min(100, toNumber(value, 0)));
-}
-
-function toTitleCase(value: string): string {
-  return value
-    .trim()
-    .split(/[\s_-]+/)
-    .filter(Boolean)
-    .map((part) => part.charAt(0).toUpperCase() + part.slice(1).toLowerCase())
-    .join(" ");
-}
-
-function getGlmTokenQuotaName(
-  limit: JsonRecord,
-  existingQuotas: Record<string, UsageQuota>
-): string {
-  const unit = toNumber(limit.unit, 0);
-  const number = toNumber(limit.number, 0);
-
-  if (unit === 3 && number === 5) return "session";
-  if ((unit === 4 && number === 7) || (unit === 3 && number >= 24 * 7)) return "weekly";
-
-  return existingQuotas.session ? "weekly" : "session";
-}
-
-function getGlmQuotaDisplayName(quotaName: string): string {
-  if (quotaName === "session") return "5 Hours Quota";
-  if (quotaName === "weekly") return "Weekly Quota";
-  return quotaName;
-}
-function getFieldValue(source: unknown, snakeKey: string, camelKey: string): unknown {
-  const obj = toRecord(source);
-  return obj[snakeKey] ?? obj[camelKey] ?? null;
-}
-
-function clampPercentage(value: number): number {
-  return Math.max(0, Math.min(100, value));
-}
-
-function roundCurrency(value: number): number {
-  return Math.round(value * 100) / 100;
-}
-
-function toDisplayLabel(value: string): string {
-  return value
-    .replace(/^copilot[_\s-]*/i, "")
-    .split(/[\s_-]+/)
-    .filter(Boolean)
-    .map((part) => {
-      if (/^pro\+$/i.test(part)) return "Pro+";
-      if (/^[a-z]{2,}$/.test(part))
-        return part.charAt(0).toUpperCase() + part.slice(1).toLowerCase();
-      return part;
-    })
-    .join(" ")
-    .trim();
-}
-
 function shouldDisplayGitHubQuota(quota: UsageQuota | null): quota is UsageQuota {
   if (!quota) return false;
   if (quota.unlimited && quota.total <= 0) return false;
@@ -271,47 +156,6 @@ function buildKiroQuota(
   };
 }
 
-function pickFirstNonEmptyString(...values: unknown[]): string | undefined {
-  for (const value of values) {
-    if (typeof value !== "string") continue;
-    const trimmed = value.trim();
-    if (trimmed) return trimmed;
-  }
-  return undefined;
-}
-
-function inferMiniMaxPlanLabelFromTotals(models: JsonRecord[]): string | null {
-  const maxSessionTotal = models.reduce(
-    (maxTotal, model) => Math.max(maxTotal, getMiniMaxSessionTotal(model)),
-    0
-  );
-
-  if (maxSessionTotal >= 15_000) return "Max";
-  if (maxSessionTotal >= 4_500) return "Plus";
-  if (maxSessionTotal >= 1_500) return "Starter";
-  return null;
-}
-
-function getMiniMaxPlanLabel(payload: JsonRecord, models: JsonRecord[] = []): string {
-  const raw = pickFirstNonEmptyString(
-    getFieldValue(payload, "current_subscribe_title", "currentSubscribeTitle"),
-    getFieldValue(payload, "plan_name", "planName"),
-    getFieldValue(payload, "plan", "plan"),
-    getFieldValue(payload, "current_plan_title", "currentPlanTitle"),
-    getFieldValue(payload, "combo_title", "comboTitle")
-  );
-
-  if (!raw) return inferMiniMaxPlanLabelFromTotals(models) || "Coding Plan";
-
-  const cleaned = raw
-    .replace(/^minimax\s+/i, "")
-    .replace(/\bcoding\s+plan\b/gi, "")
-    .replace(/\s{2,}/g, " ")
-    .trim();
-
-  return cleaned || inferMiniMaxPlanLabelFromTotals(models) || "Coding Plan";
-}
-
 function getClaudePlanLabel(...candidates: Array<string | null | undefined>): string | null {
   for (const candidate of candidates) {
     if (typeof candidate !== "string") continue;
@@ -328,309 +172,6 @@ function getClaudePlanLabel(...candidates: Array<string | null | undefined>): st
   return null;
 }
 
-function createQuotaFromUsage(
-  usedValue: unknown,
-  totalValue: unknown,
-  resetValue: unknown
-): UsageQuota {
-  const total = Math.max(0, toNumber(totalValue, 0));
-  const used = total > 0 ? Math.min(Math.max(0, toNumber(usedValue, 0)), total) : 0;
-  const remaining = total > 0 ? Math.max(total - used, 0) : 0;
-
-  return {
-    used,
-    total,
-    remaining,
-    remainingPercentage: total > 0 ? clampPercentage((remaining / total) * 100) : 0,
-    resetAt: parseResetTime(resetValue),
-    unlimited: false,
-  };
-}
-
-function getMiniMaxQuotaResetAt(
-  model: JsonRecord,
-  capturedAtMs: number,
-  remainsTimeSnakeKey: string,
-  remainsTimeCamelKey: string,
-  endTimeSnakeKey: string,
-  endTimeCamelKey: string
-): string | null {
-  const remainsMs = toNumber(getFieldValue(model, remainsTimeSnakeKey, remainsTimeCamelKey), 0);
-  if (remainsMs > 0) {
-    return new Date(capturedAtMs + remainsMs).toISOString();
-  }
-
-  return parseResetTime(getFieldValue(model, endTimeSnakeKey, endTimeCamelKey));
-}
-
-function isMiniMaxTextQuotaModel(modelName: string): boolean {
-  const normalized = modelName.trim().toLowerCase();
-  return (
-    normalized.startsWith("minimax-m") ||
-    normalized.startsWith("coding-plan") ||
-    // MiniMax Coding Plan surfaces the text/coding quota under model "general"
-    // (media buckets like "video"/"image"/"music" are excluded).
-    normalized === "general"
-  );
-}
-
-function getMiniMaxSessionTotal(model: JsonRecord): number {
-  return Math.max(
-    0,
-    toNumber(getFieldValue(model, "current_interval_total_count", "currentIntervalTotalCount"), 0)
-  );
-}
-
-function getMiniMaxWeeklyTotal(model: JsonRecord): number {
-  return Math.max(
-    0,
-    toNumber(getFieldValue(model, "current_weekly_total_count", "currentWeeklyTotalCount"), 0)
-  );
-}
-
-function pickMiniMaxRepresentativeModel(
-  models: JsonRecord[],
-  getTotal: (model: JsonRecord) => number
-): JsonRecord | null {
-  const withQuota = models.filter((model) => getTotal(model) > 0);
-  const pool = withQuota.length > 0 ? withQuota : models;
-  if (pool.length === 0) return null;
-
-  return pool.reduce((best, current) => (getTotal(current) > getTotal(best) ? current : best));
-}
-
-function createMiniMaxQuotaFromCount(
-  total: number,
-  count: number,
-  resetAt: string | null,
-  countMeansRemaining: boolean
-): UsageQuota {
-  const used = countMeansRemaining ? Math.max(total - count, 0) : count;
-  return createQuotaFromUsage(used, total, resetAt);
-}
-
-/**
- * MiniMax Coding Plan exposes per-window remaining as a 0–100 percent
- * (`current_interval_remaining_percent` / `current_weekly_remaining_percent`)
- * with zero request counts. Read it defensively (string-encoded numbers ok).
- */
-function getMiniMaxRemainingPercent(
-  model: JsonRecord,
-  snakeKey: string,
-  camelKey: string
-): number | null {
-  const raw = getFieldValue(model, snakeKey, camelKey);
-  if (raw === null || raw === undefined || raw === "") return null;
-  const parsed = toNumber(raw, NaN);
-  return Number.isFinite(parsed) ? Math.max(0, Math.min(100, parsed)) : null;
-}
-
-/** Build a 0–100 percent-based window quota (used = 100 − remaining). */
-function createMiniMaxQuotaFromPercent(
-  remainingPercent: number,
-  resetAt: string | null
-): UsageQuota {
-  const clamped = Math.max(0, Math.min(100, remainingPercent));
-  return createQuotaFromUsage(100 - clamped, 100, resetAt);
-}
-
-/**
- * Build one MiniMax usage window (session or weekly) from the representative
- * model. Token Plan keys report request counts (`*_total_count`); Coding Plan
- * keys report zero counts and a `*_remaining_percent` instead — fall back to
- * that so the Coding Plan still surfaces a quota. The percent signal is keyed
- * off "counts == 0 + percent present", NOT the endpoint URL, because the
- * `token_plan/remains` and `coding_plan/remains` endpoints return identical
- * Coding-Plan payloads for a Coding Plan key.
- */
-function buildMiniMaxWindow(
-  models: JsonRecord[],
-  getTotal: (model: JsonRecord) => number,
-  usageCountKeys: [string, string],
-  percentKeys: [string, string],
-  resetKeys: [string, string, string, string],
-  capturedAtMs: number,
-  countMeansRemaining: boolean
-): UsageQuota | null {
-  const model = pickMiniMaxRepresentativeModel(models, getTotal);
-  if (!model) return null;
-
-  const resetAt = getMiniMaxQuotaResetAt(model, capturedAtMs, ...resetKeys);
-  const total = getTotal(model);
-
-  if (total > 0) {
-    const count = Math.max(0, toNumber(getFieldValue(model, ...usageCountKeys), 0));
-    return createMiniMaxQuotaFromCount(total, count, resetAt, countMeansRemaining);
-  }
-
-  const remainingPercent = getMiniMaxRemainingPercent(model, ...percentKeys);
-  return remainingPercent !== null
-    ? createMiniMaxQuotaFromPercent(remainingPercent, resetAt)
-    : null;
-}
-
-function getMiniMaxAuthErrorMessage(message: string): string {
-  const normalized = message.toLowerCase();
-  if (
-    normalized.includes("token plan") ||
-    normalized.includes("coding plan") ||
-    normalized.includes("active period") ||
-    normalized.includes("invalid api key") ||
-    normalized.includes("invalid key") ||
-    normalized.includes("subscription")
-  ) {
-    return "MiniMax Token Plan API key invalid or inactive. Use an active Token Plan key.";
-  }
-
-  return "MiniMax access denied. Confirm the key is an active Token Plan API key.";
-}
-
-function getMiniMaxErrorSummary(status: number, message: string): string {
-  const compact = message.replace(/\s+/g, " ").trim();
-  if (!compact) {
-    return `MiniMax usage endpoint error (${status}).`;
-  }
-  if (compact.length <= 160) {
-    return `MiniMax usage endpoint error (${status}): ${compact}`;
-  }
-  return `MiniMax usage endpoint error (${status}): ${compact.slice(0, 157)}...`;
-}
-
-async function getMiniMaxUsage(apiKey: string, provider: "minimax" | "minimax-cn") {
-  if (!apiKey) {
-    return { message: "MiniMax API key not available. Add a Token Plan API key." };
-  }
-
-  const usageUrls = MINIMAX_USAGE_CONFIG[provider].usageUrls;
-  let lastErrorMessage = "";
-
-  for (let index = 0; index < usageUrls.length; index += 1) {
-    const usageUrl = usageUrls[index];
-    const canFallback = index < usageUrls.length - 1;
-
-    try {
-      const response = await fetch(usageUrl, {
-        method: "GET",
-        headers: {
-          Authorization: `Bearer ${apiKey}`,
-          Accept: "application/json",
-          "Content-Type": "application/json",
-        },
-      });
-
-      const rawText = await response.text();
-      let payload: JsonRecord = {};
-      if (rawText) {
-        try {
-          payload = toRecord(JSON.parse(rawText));
-        } catch {
-          payload = {};
-        }
-      }
-
-      const baseResp = toRecord(getFieldValue(payload, "base_resp", "baseResp"));
-      const apiStatusCode = toNumber(getFieldValue(baseResp, "status_code", "statusCode"), 0);
-      const apiStatusMessage = String(
-        getFieldValue(baseResp, "status_msg", "statusMsg") ?? ""
-      ).trim();
-      const combinedMessage = `${apiStatusMessage} ${rawText}`.trim();
-      const authLikeStatusMessage =
-        /token plan|coding plan|invalid api key|invalid key|unauthorized|inactive/i;
-
-      if (
-        response.status === 401 ||
-        response.status === 403 ||
-        apiStatusCode === 1004 ||
-        authLikeStatusMessage.test(apiStatusMessage)
-      ) {
-        return { message: getMiniMaxAuthErrorMessage(apiStatusMessage || combinedMessage) };
-      }
-
-      if (!response.ok) {
-        lastErrorMessage = getMiniMaxErrorSummary(response.status, combinedMessage);
-        if (
-          (response.status === 404 || response.status === 405 || response.status >= 500) &&
-          canFallback
-        ) {
-          continue;
-        }
-        return { message: `MiniMax connected. ${lastErrorMessage}` };
-      }
-
-      if (rawText && Object.keys(payload).length === 0) {
-        return { message: "MiniMax connected. Unable to parse usage response." };
-      }
-
-      if (apiStatusCode !== 0) {
-        if (apiStatusMessage) {
-          return { message: `MiniMax connected. ${apiStatusMessage}` };
-        }
-        return { message: "MiniMax connected. Upstream quota API returned an error." };
-      }
-
-      const capturedAtMs = Date.now();
-      const modelRemains = getFieldValue(payload, "model_remains", "modelRemains");
-      const allModels = Array.isArray(modelRemains)
-        ? modelRemains.map((item) => toRecord(item))
-        : [];
-      const textModels = allModels.filter((model) => {
-        const modelName = String(getFieldValue(model, "model_name", "modelName") ?? "");
-        return isMiniMaxTextQuotaModel(modelName);
-      });
-
-      if (textModels.length === 0) {
-        return { message: "MiniMax connected. No text quota data was returned." };
-      }
-
-      const countMeansRemaining = usageUrl.includes("/coding_plan/remains");
-      const quotas: Record<string, UsageQuota> = {};
-
-      const sessionQuota = buildMiniMaxWindow(
-        textModels,
-        getMiniMaxSessionTotal,
-        ["current_interval_usage_count", "currentIntervalUsageCount"],
-        ["current_interval_remaining_percent", "currentIntervalRemainingPercent"],
-        ["remains_time", "remainsTime", "end_time", "endTime"],
-        capturedAtMs,
-        countMeansRemaining
-      );
-      if (sessionQuota) {
-        quotas["session (5h)"] = sessionQuota;
-      }
-
-      const weeklyQuota = buildMiniMaxWindow(
-        textModels,
-        getMiniMaxWeeklyTotal,
-        ["current_weekly_usage_count", "currentWeeklyUsageCount"],
-        ["current_weekly_remaining_percent", "currentWeeklyRemainingPercent"],
-        ["weekly_remains_time", "weeklyRemainsTime", "weekly_end_time", "weeklyEndTime"],
-        capturedAtMs,
-        countMeansRemaining
-      );
-      if (weeklyQuota) {
-        quotas["weekly (7d)"] = weeklyQuota;
-      }
-
-      if (Object.keys(quotas).length === 0) {
-        return { message: "MiniMax connected. Unable to extract text quota usage." };
-      }
-
-      return { plan: getMiniMaxPlanLabel(payload, textModels), quotas };
-    } catch (error) {
-      lastErrorMessage = (error as Error).message;
-      if (!canFallback) {
-        break;
-      }
-    }
-  }
-
-  return {
-    message: lastErrorMessage
-      ? `MiniMax connected. Unable to fetch usage: ${lastErrorMessage}`
-      : "MiniMax connected. Unable to fetch usage.",
-  };
-}
-
 // CrofAI surfaces a tiny endpoint with two signals:
 //   GET https://crof.ai/usage_api/  →  { usable_requests: number|null, credits: number }
 // `usable_requests` is the daily request bucket on a subscription plan; `null`
@@ -736,153 +277,6 @@ async function getCrofUsage(apiKey: string) {
   return { quotas };
 }
 
-const GLM_QUOTA_ORDER = ["5 Hours Quota", "Weekly Quota", "Monthly Tools", "Tokens", "Time Limit"];
-
-function getGlmQuotaLabel(type: unknown, unit: unknown): string | null {
-  const normalized = typeof type === "string" ? type.trim().toUpperCase() : "";
-  const unitValue = toNumber(unit, -1);
-
-  switch (normalized) {
-    case "TOKENS_LIMIT":
-    case "TOKEN_LIMIT":
-      if (unitValue === 3) return "5 Hours Quota";
-      if (unitValue === 6) return "Weekly Quota";
-      return "Tokens";
-    case "TIME_LIMIT":
-    case "TIME_USAGE_LIMIT":
-      if (unitValue === 5) return "Monthly Tools";
-      return "Time Limit";
-    default:
-      return null;
-  }
-}
-
-function orderGlmQuotas(quotas: Record<string, UsageQuota>): Record<string, UsageQuota> {
-  const ordered: Record<string, UsageQuota> = {};
-
-  for (const key of GLM_QUOTA_ORDER) {
-    if (quotas[key]) ordered[key] = quotas[key];
-  }
-
-  for (const [key, quota] of Object.entries(quotas)) {
-    if (!ordered[key]) ordered[key] = quota;
-  }
-
-  return ordered;
-}
-
-/**
- * Remaining-percentage for a GLM/z.ai TIME_LIMIT ("Monthly") quota. With an absolute
- * monthly cap (`total > 0`) it is `remaining / total`. Coding plans that have no
- * monthly cap (only 5-hour windows) report `total = 0`; in that case fall back to the
- * percentage-derived remaining so "no monthly cap" renders as full/100% instead of a
- * misleading 0% (#3580).
- */
-export function glmMonthlyRemainingPercentage(total: number, remaining: number): number {
-  if (total > 0) {
-    return Math.max(0, Math.min(100, Math.round((remaining / total) * 100)));
-  }
-  return Math.max(0, Math.min(100, Math.round(remaining)));
-}
-
-async function getGlmUsage(apiKey: string, providerSpecificData?: Record<string, unknown>) {
-  if (!apiKey) {
-    return { message: "API key not available. Add a coding plan API key to view usage." };
-  }
-
-  const quotaUrl = getGlmQuotaUrl(providerSpecificData);
-
-  const res = await fetch(quotaUrl, {
-    headers: {
-      Authorization: `Bearer ${apiKey}`,
-      Accept: "application/json",
-    },
-  });
-
-  if (!res.ok) {
-    if (res.status === 401) throw new Error("Invalid API key");
-    throw new Error(`GLM quota API error (${res.status})`);
-  }
-
-  const json = await res.json();
-  if (toNumber(json.code, 200) === 401 || json.success === false) {
-    throw new Error("Invalid API key");
-  }
-
-  const data = toRecord(json.data);
-  const limits: unknown[] = Array.isArray(data.limits) ? data.limits : [];
-  const quotas: Record<string, UsageQuota> = {};
-
-  for (const limit of limits) {
-    const src = toRecord(limit);
-    const type = String(src.type || "").toUpperCase();
-    const resetMs = toNumber(src.nextResetTime, 0);
-    const resetAt = resetMs > 0 ? new Date(resetMs).toISOString() : null;
-
-    if (type === "TOKENS_LIMIT") {
-      const quotaName = getGlmTokenQuotaName(src, quotas);
-      const usedPercent = toPercentage(src.percentage);
-      const remaining = Math.max(0, 100 - usedPercent);
-
-      quotas[quotaName] = {
-        used: usedPercent,
-        total: 100,
-        remaining,
-        remainingPercentage: remaining,
-        resetAt,
-        displayName: getGlmQuotaDisplayName(quotaName),
-        details: Array.isArray(src.models)
-          ? (src.models as unknown[]).map((m) => {
-              const modelInfo = toRecord(m);
-              return {
-                name: String(modelInfo.model || ""),
-                used: toNumber(modelInfo.percentage, 0),
-              };
-            })
-          : [],
-        unlimited: false,
-      };
-      continue;
-    }
-
-    if (type === "TIME_LIMIT") {
-      const total = toNumber(src.usage, toNumber(src.total, 0));
-      const remaining = toNumber(src.remaining, Math.max(0, 100 - toPercentage(src.percentage)));
-      const used = toNumber(src.currentValue, Math.max(0, total - remaining));
-      const remainingPercentage = glmMonthlyRemainingPercentage(total, remaining);
-
-      quotas["mcp_monthly"] = {
-        used,
-        total,
-        remaining,
-        remainingPercentage,
-        resetAt,
-        unlimited: false,
-        displayName: "Monthly",
-        details: Array.isArray(src.usageDetails)
-          ? src.usageDetails.map((item) => {
-              const detail = toRecord(item);
-              return {
-                name: String(detail.modelCode || detail.name || "usage"),
-                used: toNumber(detail.usage, 0),
-              };
-            })
-          : undefined,
-      };
-    }
-  }
-
-  const levelRaw =
-    typeof data.planName === "string"
-      ? data.planName
-      : typeof data.level === "string"
-        ? data.level
-        : "";
-  const plan = levelRaw ? toTitleCase(levelRaw.replace(/\s*plan$/i, "")) : null;
-
-  return { plan, quotas: orderGlmQuotas(quotas) };
-}
-
 /**
  * Bailian (Alibaba Coding Plan) Usage
  * Fetches triple-window quota (5h, weekly, monthly) and returns worst-case.
@@ -1332,6 +726,7 @@ export const USAGE_FETCHER_PROVIDERS = [
   "xiaomi-mimo",
   "vertex",
   "vertex-partner",
+  "codebuddy-cn",
 ] as const;
 
 export type UsageFetcherProvider = (typeof USAGE_FETCHER_PROVIDERS)[number];
@@ -1410,6 +805,8 @@ export async function getUsageForProvider(
       return await getOpencodeUsage(id || "", apiKey || "");
     case "xiaomi-mimo":
       return await getXiaomiMimoUsage(id || "");
+    case "codebuddy-cn":
+      return await getCodeBuddyCnUsage(accessToken, apiKey, providerSpecificData);
     default:
       return { message: `Usage API not implemented for ${provider}` };
   }
@@ -1419,37 +816,6 @@ export async function getUsageForProvider(
  * Parse reset date/time to ISO string
  * Handles multiple formats: Unix timestamp (ms), ISO date string, etc.
  */
-function parseResetTime(resetValue: unknown): string | null {
-  if (!resetValue) return null;
-
-  try {
-    let date: Date;
-    if (resetValue instanceof Date) {
-      date = resetValue;
-    } else if (typeof resetValue === "number") {
-      date = new Date(resetValue < 1e12 ? resetValue * 1000 : resetValue);
-    } else if (typeof resetValue === "string") {
-      // Numeric strings are Unix timestamps too (seconds or milliseconds).
-      // `new Date("1700000000")` otherwise returns Invalid Date.
-      if (/^\d+$/.test(resetValue)) {
-        const ts = Number(resetValue);
-        date = new Date(ts < 1e12 ? ts * 1000 : ts);
-      } else {
-        date = new Date(resetValue);
-      }
-    } else {
-      return null;
-    }
-
-    // Epoch-zero (1970-01-01) means no scheduled reset — treat as null
-    if (date.getTime() <= 0) return null;
-
-    return date.toISOString();
-  } catch (error) {
-    return null;
-  }
-}
-
 /**
  * GitHub Copilot Usage
  * Uses GitHub accessToken (not copilotToken) to call copilot_internal/user API
@@ -1820,739 +1186,21 @@ function getGeminiCliPlanLabel(subscriptionInfo: unknown): string {
 }
 
 // ── Antigravity subscription info cache ──────────────────────────────────────
-// Prevents duplicate loadCodeAssist calls within the same quota cycle.
-// Key: truncated accessToken → { data, fetchedAt }
-const _antigravitySubCache = new Map<string, SubscriptionCacheEntry>();
-const ANTIGRAVITY_CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes
-const ANTIGRAVITY_MODELS_CACHE_TTL_MS = 60 * 1000;
-const ANTIGRAVITY_CREDIT_PROBE_TTL_MS = 5 * 60 * 1000;
-const _antigravityAvailableModelsCache = new Map<string, { data: unknown; fetchedAt: number }>();
-const _antigravityAvailableModelsInflight = new Map<string, Promise<unknown>>();
-const _antigravityUserQuotaCache = new Map<string, { data: unknown; fetchedAt: number }>();
-const _antigravityUserQuotaInflight = new Map<string, Promise<unknown>>();
-const _antigravityCreditProbeCache = new Map<string, { data: number | null; fetchedAt: number }>();
-const _antigravityCreditProbeInflight = new Map<string, Promise<number | null>>();
-
-// ── Proactive TTL purging for module-level caches ──────────────────────────
-// All 4 data caches only evict on read (passive TTL). This interval proactively
-// purges stale entries so keys accessed once and never again don't leak memory.
-// The 2 inflight Maps (availableModelsInflight, creditProbeInflight) self-clean
-// when the Promise resolves/rejects, so they are NOT touched here.
-const _usageCacheCleanupTimer = setInterval(
+// ── Proactive TTL purging for the Gemini CLI subscription cache ────────────
+// Passive TTL evicts on read; this interval proactively purges stale entries so
+// keys accessed once and never again don't leak memory. The Antigravity caches
+// + their own purge timer were split out into ./usage/antigravity.ts (god-file
+// decomposition), so each module now owns its caches and their cleanup.
+const _geminiCacheCleanupTimer = setInterval(
   () => {
     const now = Date.now();
     for (const [key, entry] of _geminiCliSubCache) {
       if (now - entry.fetchedAt > GEMINI_CLI_CACHE_TTL_MS) _geminiCliSubCache.delete(key);
     }
-    for (const [key, entry] of _antigravitySubCache) {
-      if (now - entry.fetchedAt > ANTIGRAVITY_CACHE_TTL_MS) _antigravitySubCache.delete(key);
-    }
-    for (const [key, entry] of _antigravityAvailableModelsCache) {
-      if (now - entry.fetchedAt > ANTIGRAVITY_MODELS_CACHE_TTL_MS)
-        _antigravityAvailableModelsCache.delete(key);
-    }
-    for (const [key, entry] of _antigravityUserQuotaCache) {
-      if (now - entry.fetchedAt > ANTIGRAVITY_MODELS_CACHE_TTL_MS)
-        _antigravityUserQuotaCache.delete(key);
-    }
-    for (const [key, entry] of _antigravityCreditProbeCache) {
-      if (now - entry.fetchedAt > ANTIGRAVITY_CREDIT_PROBE_TTL_MS)
-        _antigravityCreditProbeCache.delete(key);
-    }
   },
   5 * 60 * 1000
 ); // every 5 minutes
-_usageCacheCleanupTimer.unref?.(); // Don't prevent process exit
-
-interface AntigravityUsageOptions {
-  forceRefresh?: boolean;
-}
-
-const ANTIGRAVITY_LOCAL_USAGE_WINDOW_MS = 5 * 60 * 60 * 1000;
-const ANTIGRAVITY_LOCAL_USAGE_TOKENS_PER_UNIT = 1000;
-
-// `toClientAntigravityQuotaModelId` was an inline if-ladder here; it is now the single
-// source of truth in open-sse/config/antigravityModelAliases.ts (imported above), shared
-// with the provider-limits cache sanitizer. (#3821-review LEDGER-5)
-
-function getAntigravityLocalUsageUnits(
-  provider: "antigravity" | "agy",
-  connectionId: string | undefined,
-  modelId: string,
-  resetAt: string | null
-): number {
-  if (!connectionId || !modelId || !resetAt) return 0;
-
-  const resetMs = Date.parse(resetAt);
-  if (!Number.isFinite(resetMs)) return 0;
-
-  const windowStart = new Date(resetMs - ANTIGRAVITY_LOCAL_USAGE_WINDOW_MS).toISOString();
-  const windowEnd = new Date(resetMs).toISOString();
-
-  try {
-    const db = getDbInstance() as unknown as {
-      prepare: (sql: string) => { get: (...params: unknown[]) => unknown };
-    };
-    const row = db
-      .prepare(
-        `SELECT COALESCE(SUM(
-           COALESCE(tokens_input, 0) + COALESCE(tokens_output, 0) + COALESCE(tokens_reasoning, 0)
-         ), 0) AS tokens
-         FROM usage_history
-         WHERE provider = ?
-           AND connection_id = ?
-           AND model = ?
-           AND success = 1
-           AND timestamp >= ?
-           AND timestamp < ?`
-      )
-      .get(provider, connectionId, modelId, windowStart, windowEnd) as
-      | { tokens?: unknown }
-      | undefined;
-
-    const tokens = Number(row?.tokens || 0);
-    if (!Number.isFinite(tokens) || tokens <= 0) return 0;
-    return Math.max(1, Math.ceil(tokens / ANTIGRAVITY_LOCAL_USAGE_TOKENS_PER_UNIT));
-  } catch {
-    return 0;
-  }
-}
-
-function applyLocalUsageFallback(
-  quota: UsageQuota,
-  provider: "antigravity" | "agy",
-  connectionId: string | undefined,
-  modelId: string
-): UsageQuota {
-  if (quota.quotaSource !== "fetchAvailableModels" || quota.used > 0 || quota.unlimited) {
-    return quota;
-  }
-
-  const localUsed = getAntigravityLocalUsageUnits(provider, connectionId, modelId, quota.resetAt);
-  if (localUsed <= 0 || quota.total <= 0) return quota;
-
-  const used = Math.min(quota.total, localUsed);
-  return {
-    ...quota,
-    used,
-    remainingPercentage: Math.max(0, ((quota.total - used) / quota.total) * 100),
-    quotaSource: "localUsageHistory",
-  };
-}
-
-function buildAntigravityUsageCacheKey(accessToken: string, projectId?: string | null): string {
-  return `${accessToken.substring(0, 16)}:${projectId || "default"}`;
-}
-
-async function fetchAntigravityAvailableModelsCached(
-  accessToken: string,
-  projectId?: string | null,
-  options: AntigravityUsageOptions = {}
-): Promise<unknown> {
-  if (!accessToken) throw new Error("Access token is required");
-
-  const cacheKey = buildAntigravityUsageCacheKey(accessToken, projectId);
-  const cached = _antigravityAvailableModelsCache.get(cacheKey);
-  if (
-    !options.forceRefresh &&
-    cached &&
-    Date.now() - cached.fetchedAt < ANTIGRAVITY_MODELS_CACHE_TTL_MS
-  ) {
-    return cached.data;
-  }
-
-  const inflight = _antigravityAvailableModelsInflight.get(cacheKey);
-  if (inflight) return inflight;
-
-  const promise = (async () => {
-    let response: Response | null = null;
-    let lastError: Error | null = null;
-
-    for (const quotaApiUrl of ANTIGRAVITY_CONFIG.quotaApiUrls) {
-      try {
-        response = await fetch(quotaApiUrl, {
-          method: "POST",
-          headers: getAntigravityHeaders("fetchAvailableModels", accessToken),
-          body: JSON.stringify(projectId ? { project: projectId } : {}),
-          signal: AbortSignal.timeout(10000),
-        });
-
-        if (response.ok || response.status === 401 || response.status === 403) {
-          break;
-        }
-      } catch (error) {
-        lastError = error as Error;
-      }
-    }
-
-    if (!response) {
-      throw lastError || new Error("Antigravity API unavailable");
-    }
-
-    if (response.status === 403) {
-      return { __antigravityForbidden: true };
-    }
-
-    if (!response.ok) {
-      throw new Error(`Antigravity API error: ${response.status}`);
-    }
-
-    const data = await response.json();
-    _antigravityAvailableModelsCache.set(cacheKey, { data, fetchedAt: Date.now() });
-    return data;
-  })().finally(() => {
-    _antigravityAvailableModelsInflight.delete(cacheKey);
-  });
-
-  _antigravityAvailableModelsInflight.set(cacheKey, promise);
-  return promise;
-}
-
-async function fetchAntigravityUserQuotaCached(
-  accessToken: string,
-  projectId?: string | null,
-  options: AntigravityUsageOptions = {}
-): Promise<unknown | null> {
-  if (!accessToken || !projectId) return null;
-
-  const cacheKey = buildAntigravityUsageCacheKey(accessToken, projectId);
-  const cached = _antigravityUserQuotaCache.get(cacheKey);
-  if (
-    !options.forceRefresh &&
-    cached &&
-    Date.now() - cached.fetchedAt < ANTIGRAVITY_MODELS_CACHE_TTL_MS
-  ) {
-    return cached.data;
-  }
-
-  const inflight = _antigravityUserQuotaInflight.get(cacheKey);
-  if (inflight) return inflight;
-
-  const promise = (async () => {
-    try {
-      const response = await fetch(
-        "https://cloudcode-pa.googleapis.com/v1internal:retrieveUserQuota",
-        {
-          method: "POST",
-          headers: {
-            Authorization: `Bearer ${accessToken}`,
-            "Content-Type": "application/json",
-          },
-          body: JSON.stringify({ project: projectId }),
-          signal: AbortSignal.timeout(10000),
-        }
-      );
-
-      if (!response.ok) return null;
-
-      const data = await response.json();
-      _antigravityUserQuotaCache.set(cacheKey, { data, fetchedAt: Date.now() });
-      return data;
-    } catch {
-      return null;
-    }
-  })().finally(() => {
-    _antigravityUserQuotaInflight.delete(cacheKey);
-  });
-
-  _antigravityUserQuotaInflight.set(cacheKey, promise);
-  return promise;
-}
-
-function extractCodeAssistTierId(subscription: JsonRecord): string {
-  const tierId = extractCodeAssistOnboardTierId(subscription);
-  if (tierId === "legacy-tier") return "";
-  const upper = tierId.toUpperCase();
-  return mapCodeAssistTierIdToLabel(upper) ? upper : "";
-}
-
-function mapCodeAssistTierIdToLabel(tierId: string): string | null {
-  const upper = tierId.toUpperCase();
-  if (upper.includes("ULTRA")) return "Ultra";
-  if (
-    upper.includes("PRO") ||
-    upper.includes("PREMIUM") ||
-    upper.includes("GOOGLE_ONE") ||
-    upper.includes("ONE_AI")
-  )
-    return "Pro";
-  if (upper.includes("ENTERPRISE")) return "Enterprise";
-  if (upper.includes("BUSINESS") || upper.includes("STANDARD")) return "Business";
-  if (upper.includes("PLUS")) return "Plus";
-  if (upper.includes("LITE") || upper.includes("LIGHT")) return "Lite";
-  if (upper.includes("FREE") || upper.includes("INDIVIDUAL") || upper.includes("LEGACY"))
-    return "Free";
-  return null;
-}
-
-function mapSubscriptionTierStringToPlanLabel(tierText: string): string | null {
-  const upper = tierText.toUpperCase();
-  if (upper.includes("ULTRA")) return "Ultra";
-  if (upper.includes("PRO") || upper.includes("PREMIUM") || upper.includes("GOOGLE ONE"))
-    return "Pro";
-  if (upper.includes("ENTERPRISE")) return "Enterprise";
-  if (upper.includes("STANDARD") || upper.includes("BUSINESS")) return "Business";
-  if (upper.includes("PLUS")) return "Plus";
-  if (upper.includes("LITE")) return "Lite";
-  if (upper.includes("INDIVIDUAL") || upper.includes("FREE")) return "Free";
-  // Strip a trailing "(RESTRICTED)" marker. Match the fixed literal anywhere then
-  // trim, instead of /\s*\(RESTRICTED\)\s*$/ whose overlapping \s* runs backtrack
-  // polynomially on whitespace-heavy upstream input (js/polynomial-redos).
-  const normalizedId = upper.replace(/\(RESTRICTED\)/i, "").trim();
-  if (normalizedId) {
-    const mapped = mapCodeAssistTierIdToLabel(normalizedId);
-    if (mapped) return mapped;
-  }
-  return null;
-}
-
-function mapCodeAssistSubscriptionToPlanLabel(subscriptionInfo: unknown): string {
-  const subscription = toRecord(subscriptionInfo);
-  if (Object.keys(subscription).length === 0) return "Free";
-
-  const subscriptionTier = extractCodeAssistSubscriptionTier(subscriptionInfo);
-  if (subscriptionTier) {
-    const mapped = mapSubscriptionTierStringToPlanLabel(subscriptionTier);
-    if (mapped) return mapped;
-    if (subscriptionTier.toLowerCase() !== "free") {
-      return subscriptionTier.charAt(0).toUpperCase() + subscriptionTier.slice(1).toLowerCase();
-    }
-  }
-
-  const currentTier = toRecord(subscription.currentTier);
-  const tierName = String(
-    getFieldValue(currentTier, "name", "displayName") ||
-      subscription.subscriptionType ||
-      subscription.tier ||
-      ""
-  );
-  const mappedName = tierName ? mapSubscriptionTierStringToPlanLabel(tierName) : null;
-  if (mappedName) return mappedName;
-
-  const tierId = extractCodeAssistTierId(subscription);
-  if (tierId) {
-    const mapped = mapCodeAssistTierIdToLabel(tierId);
-    if (mapped) return mapped;
-  }
-  if (currentTier.upgradeSubscriptionType) return "Free";
-  if (tierName) return tierName.charAt(0).toUpperCase() + tierName.slice(1).toLowerCase();
-  return "Free";
-}
-
-const KNOWN_ANTIGRAVITY_PLAN_LABELS = new Set([
-  "Ultra",
-  "Pro",
-  "Enterprise",
-  "Business",
-  "Plus",
-  "Lite",
-]);
-
-/**
- * Map raw loadCodeAssist tier data to short display labels (Antigravity Manager parity).
- */
-function getAntigravityPlanLabel(subscriptionInfo: unknown, fallbackInfo?: unknown): string {
-  const livePlan = mapCodeAssistSubscriptionToPlanLabel(subscriptionInfo);
-  const fallbackPlan = mapCodeAssistSubscriptionToPlanLabel(fallbackInfo);
-
-  if (KNOWN_ANTIGRAVITY_PLAN_LABELS.has(livePlan)) return livePlan;
-  if (KNOWN_ANTIGRAVITY_PLAN_LABELS.has(fallbackPlan)) return fallbackPlan;
-  if (livePlan !== "Free") return livePlan;
-  return fallbackPlan !== "Free" ? fallbackPlan : livePlan;
-}
-
-/**
- * Proactive credit balance probe for Antigravity.
- *
- * Fires a minimal streamGenerateContent request with GOOGLE_ONE_AI credits enabled
- * and maxOutputTokens=1 to extract the `remainingCredits` field from the SSE stream.
- * This uses ~1 credit but lets us show the balance on the dashboard without waiting
- * for a real user request.
- *
- * Returns the credit balance, or null if the probe failed.
- */
-async function probeAntigravityCreditBalance(
-  accessToken: string,
-  accountId: string,
-  projectId?: string | null,
-  options: AntigravityUsageOptions = {},
-  providerSpecificData: JsonRecord = {}
-): Promise<number | null> {
-  if (!accessToken) return null;
-
-  const cacheKey = buildAntigravityUsageCacheKey(accessToken, projectId || accountId);
-  const cached = _antigravityCreditProbeCache.get(cacheKey);
-  if (
-    !options.forceRefresh &&
-    cached &&
-    Date.now() - cached.fetchedAt < ANTIGRAVITY_CREDIT_PROBE_TTL_MS
-  ) {
-    return cached.data;
-  }
-
-  const inflight = _antigravityCreditProbeInflight.get(cacheKey);
-  if (inflight) return inflight;
-
-  const promise = probeAntigravityCreditBalanceUncached(
-    accessToken,
-    accountId,
-    projectId,
-    providerSpecificData
-  )
-    .then(
-      (data) => {
-        _antigravityCreditProbeCache.set(cacheKey, { data, fetchedAt: Date.now() });
-        return data;
-      },
-      (error) => {
-        _antigravityCreditProbeCache.set(cacheKey, { data: null, fetchedAt: Date.now() });
-        throw error;
-      }
-    )
-    .finally(() => {
-      _antigravityCreditProbeInflight.delete(cacheKey);
-    });
-
-  _antigravityCreditProbeInflight.set(cacheKey, promise);
-  return promise;
-}
-
-async function probeAntigravityCreditBalanceUncached(
-  accessToken: string,
-  accountId: string,
-  projectId?: string | null,
-  providerSpecificData: JsonRecord = {}
-): Promise<number | null> {
-  try {
-    if (!projectId) return null;
-
-    // Try all base URLs (some accounts only work with specific endpoints)
-    for (const baseUrl of ANTIGRAVITY_BASE_URLS) {
-      const url = `${baseUrl}/v1internal:streamGenerateContent?alt=sse`;
-
-      const sessionId = getAntigravitySessionId({ connectionId: accountId, projectId });
-      const body = {
-        project: projectId,
-        model: "gemini-2-flash",
-        userAgent: "antigravity",
-        requestType: "agent",
-        requestId: generateAntigravityRequestId(),
-        enabledCreditTypes: ["GOOGLE_ONE_AI"],
-        request: {
-          model: "gemini-2-flash",
-          contents: [{ role: "user", parts: [{ text: "hi" }] }],
-          generationConfig: { maxOutputTokens: 1 },
-          sessionId,
-        },
-      };
-
-      const headers: Record<string, string> = {
-        "Content-Type": "application/json",
-        Authorization: `Bearer ${accessToken}`,
-        Accept: "text/event-stream",
-      };
-      applyAntigravityClientProfileHeaders(
-        headers,
-        { connectionId: accountId, projectId, providerSpecificData },
-        body
-      );
-
-      try {
-        const res = await fetch(url, {
-          method: "POST",
-          headers,
-          body: JSON.stringify(body),
-          signal: AbortSignal.timeout(10_000),
-        });
-
-        if (!res.ok) continue;
-
-        // Read the full SSE response and scan for remainingCredits
-        const rawSSE = await res.text();
-        const lines = rawSSE.split("\n");
-
-        for (const line of lines) {
-          const trimmed = line.trim();
-          if (!trimmed.startsWith("data:")) continue;
-          const payload = trimmed.slice(5).trim();
-          if (payload === "[DONE]") break;
-          try {
-            const parsed = JSON.parse(payload);
-            if (Array.isArray(parsed?.remainingCredits)) {
-              const googleCredit = parsed.remainingCredits.find(
-                (c: { creditType?: string }) => c?.creditType === "GOOGLE_ONE_AI"
-              );
-              if (googleCredit) {
-                const balance = parseInt(googleCredit.creditAmount, 10);
-                if (!isNaN(balance)) {
-                  updateAntigravityRemainingCredits(accountId, balance);
-                  return balance;
-                }
-              }
-            }
-          } catch {
-            // Skip malformed SSE lines
-          }
-        }
-      } catch {
-        // Individual endpoint failure; try next
-      }
-    }
-
-    return null;
-  } catch {
-    // Probe is best-effort — don't let it break the usage fetch
-    return null;
-  }
-}
-
-/**
- * Antigravity Usage - Fetch quota from Google Cloud Code API.
- * fetchAvailableModels is catalog/eligibility data and may keep reporting full buckets
- * after real usage. retrieveUserQuota is the consumption signal for Gemini-family
- * buckets, so prefer it when present and fall back to fetchAvailableModels only for
- * models that have no retrieveUserQuota entry (for example Claude/GPT OSS buckets).
- */
-async function getAntigravityUsage(
-  provider: "antigravity" | "agy",
-  accessToken?: string,
-  providerSpecificData?: JsonRecord,
-  connectionProjectId?: string,
-  connectionId?: string,
-  options: AntigravityUsageOptions = {}
-) {
-  if (!accessToken) {
-    return { plan: "Free", message: "Antigravity access token not available." };
-  }
-
-  let subscriptionInfo: unknown = null;
-  try {
-    subscriptionInfo = await getAntigravitySubscriptionInfoCached(
-      accessToken,
-      providerSpecificData,
-      options
-    );
-    const savedProjectId =
-      typeof providerSpecificData?.projectId === "string" && providerSpecificData.projectId.trim()
-        ? providerSpecificData.projectId.trim()
-        : null;
-    const subscriptionProject = toRecord(subscriptionInfo).cloudaicompanionProject;
-    const projectId =
-      savedProjectId ||
-      connectionProjectId ||
-      (typeof subscriptionProject === "string"
-        ? subscriptionProject
-        : typeof toRecord(subscriptionProject).id === "string"
-          ? (toRecord(subscriptionProject).id as string)
-          : null);
-
-    // Derive accountId for credit balance cache.
-    // Must match executor key: credentials.connectionId
-    const accountId: string = connectionId || "unknown";
-
-    // Read cached credit balance (hydrated from DB on first access)
-    let creditBalance = getAntigravityRemainingCredits(accountId);
-
-    // If no cached balance and credits mode is enabled, fire a minimal probe
-    const creditsMode = getCreditsMode();
-    if ((options.forceRefresh || creditBalance === null) && creditsMode !== "off") {
-      creditBalance = await probeAntigravityCreditBalance(
-        accessToken,
-        accountId,
-        projectId,
-        options,
-        providerSpecificData || {}
-      );
-    }
-
-    const [data, userQuotaData] = await Promise.all([
-      fetchAntigravityAvailableModelsCached(accessToken, projectId, options),
-      fetchAntigravityUserQuotaCached(accessToken, projectId, options),
-    ]);
-    const dataObj = toRecord(data);
-    if (dataObj.__antigravityForbidden === true) {
-      return { message: "Antigravity access forbidden. Check subscription." };
-    }
-    const modelEntries = toRecord(dataObj.models);
-    const userQuotaEntries = new Map<string, JsonRecord>();
-    const userQuotaObj = toRecord(userQuotaData);
-    if (Array.isArray(userQuotaObj.buckets)) {
-      for (const bucketValue of userQuotaObj.buckets) {
-        const bucket = toRecord(bucketValue);
-        const modelId = toClientAntigravityQuotaModelId(String(bucket.modelId || "").trim());
-        if (!modelId) continue;
-        userQuotaEntries.set(modelId, bucket);
-      }
-    }
-    const quotas: Record<string, UsageQuota> = {};
-
-    // Parse per-model quota info from fetchAvailableModels response.
-    for (const [rawModelKey, infoValue] of Object.entries(modelEntries)) {
-      const info = toRecord(infoValue);
-      const quotaInfo = toRecord(info.quotaInfo);
-      const modelKey = toClientAntigravityQuotaModelId(rawModelKey);
-
-      // Skip internal, excluded, and models without quota info
-      if (
-        !modelKey ||
-        info.isInternal === true ||
-        !(provider === "agy"
-          ? isUserCallableAgyModelId(modelKey)
-          : isUserCallableAntigravityModelId(modelKey)) ||
-        Object.keys(quotaInfo).length === 0
-      ) {
-        continue;
-      }
-
-      const liveQuota = userQuotaEntries.get(modelKey);
-      const quotaSource = liveQuota || quotaInfo;
-      const rawFraction = toNumber(quotaSource.remainingFraction, -1);
-      const resetAt = parseResetTime(quotaSource.resetTime);
-      // Distinguish "upstream did not report remainingFraction" from "remaining is 0%".
-      // fetchAvailableModels is a catalog view and can be stale/full; retrieveUserQuota is
-      // the source of truth for actual Gemini consumption when it includes the model.
-      const fractionReported = rawFraction >= 0;
-      if (!fractionReported) {
-        console.warn(
-          `[Antigravity] model ${modelKey} returned no remainingFraction — quota unknown`
-        );
-      }
-      const remainingFraction = fractionReported ? Math.max(0, Math.min(1, rawFraction)) : 0;
-      // Models with no resetTime AND a reported full fraction are unlimited
-      // (e.g. tab-completion models). Unreported fraction is NEVER unlimited.
-      const isUnlimited = fractionReported && !resetAt && remainingFraction >= 1;
-      const remainingPercentage = remainingFraction * 100;
-      const QUOTA_NORMALIZED_BASE = 1000;
-      const total = QUOTA_NORMALIZED_BASE;
-      const remaining = Math.round(total * remainingFraction);
-      const used = isUnlimited ? 0 : Math.max(0, total - remaining);
-
-      quotas[modelKey] = applyLocalUsageFallback(
-        {
-          used,
-          total: isUnlimited ? 0 : total,
-          resetAt,
-          remainingPercentage: isUnlimited ? 100 : remainingPercentage,
-          unlimited: isUnlimited,
-          fractionReported,
-          quotaSource: liveQuota ? "retrieveUserQuota" : "fetchAvailableModels",
-        },
-        provider,
-        connectionId,
-        modelKey
-      );
-    }
-
-    // Include retrieveUserQuota buckets not listed in the static/public Antigravity catalog yet.
-    // This keeps Provider Limits honest when Google adds a new Gemini tier before our catalog is
-    // updated. Hidden/internal catalog entries above are still filtered by the public pass.
-    for (const [modelKey, bucket] of userQuotaEntries) {
-      if (
-        quotas[modelKey] ||
-        !(provider === "agy"
-          ? isUserCallableAgyModelId(modelKey)
-          : isUserCallableAntigravityModelId(modelKey))
-      ) {
-        continue;
-      }
-      const rawFraction = toNumber(bucket.remainingFraction, -1);
-      if (rawFraction < 0) continue;
-      const remainingFraction = Math.max(0, Math.min(1, rawFraction));
-      const resetAt = parseResetTime(bucket.resetTime);
-      const isUnlimited = !resetAt && remainingFraction >= 1;
-      const QUOTA_NORMALIZED_BASE = 1000;
-      const total = QUOTA_NORMALIZED_BASE;
-      const remaining = Math.round(total * remainingFraction);
-      quotas[modelKey] = {
-        used: isUnlimited ? 0 : Math.max(0, total - remaining),
-        total: isUnlimited ? 0 : total,
-        resetAt,
-        remainingPercentage: isUnlimited ? 100 : remainingFraction * 100,
-        unlimited: isUnlimited,
-        fractionReported: true,
-        quotaSource: "retrieveUserQuota",
-      };
-    }
-
-    return {
-      plan: getAntigravityPlanLabel(subscriptionInfo, providerSpecificData),
-      quotas: {
-        ...quotas,
-        ...(creditBalance !== null && {
-          credits: {
-            used: 0,
-            total: 0,
-            remaining: creditBalance,
-            unlimited: false,
-            resetAt: null,
-          },
-        }),
-      },
-      subscriptionInfo,
-    };
-  } catch (error) {
-    return {
-      plan: getAntigravityPlanLabel(subscriptionInfo, providerSpecificData),
-      subscriptionInfo,
-      message: `Antigravity error: ${(error as Error).message}`,
-    };
-  }
-}
-
-/**
- * Get Antigravity subscription info (cached, 5 min TTL)
- * Prevents duplicate loadCodeAssist calls within the same quota cycle.
- */
-async function getAntigravitySubscriptionInfoCached(
-  accessToken: string,
-  providerSpecificData?: JsonRecord,
-  options: AntigravityUsageOptions = {}
-): Promise<unknown> {
-  const profile = getAntigravityClientProfile({ providerSpecificData });
-  const cacheKey = `${accessToken.substring(0, 16)}:${profile}`;
-
-  if (options.forceRefresh) {
-    _antigravitySubCache.delete(cacheKey);
-  } else {
-    const cached = _antigravitySubCache.get(cacheKey);
-    if (cached && Date.now() - cached.fetchedAt < ANTIGRAVITY_CACHE_TTL_MS) {
-      return cached.data;
-    }
-  }
-
-  const data = await getAntigravitySubscriptionInfo(accessToken, providerSpecificData);
-  if (data != null) {
-    _antigravitySubCache.set(cacheKey, { data, fetchedAt: Date.now() });
-  }
-  return data;
-}
-
-/**
- * Get Antigravity subscription info using correct Antigravity headers.
- * Must match the headers used in providers.js postExchange (not CLI headers).
- */
-async function getAntigravitySubscriptionInfo(
-  accessToken: string,
-  providerSpecificData?: JsonRecord
-): Promise<unknown | null> {
-  try {
-    const profile = getAntigravityClientProfile({ providerSpecificData });
-    const response = await fetch(ANTIGRAVITY_CONFIG.loadProjectApiUrl, {
-      method: "POST",
-      headers:
-        profile === "harness"
-          ? getAntigravityBootstrapHeaders(profile, accessToken)
-          : getAntigravityHeaders("loadCodeAssist", accessToken),
-      body: JSON.stringify({ metadata: getAntigravityLoadCodeAssistMetadata() }),
-    });
-
-    if (!response.ok) return null;
-
-    return await response.json();
-  } catch {
-    return null;
-  }
-}
+_geminiCacheCleanupTimer.unref?.(); // Don't prevent process exit
 
 /**
  * Claude Usage - Try to fetch from Anthropic API
@@ -2564,6 +1212,12 @@ async function getClaudeUsage(accessToken?: string) {
 
   // Refresh bootstrap in parallel; best-effort, failure non-fatal.
   const bootstrapPromise = fetchClaudeBootstrap(accessToken).catch(() => null);
+  // Skip OAuth usage call while this token is cooling down from a recent 429
+  // (chat with the same token still works — only the quota endpoint is throttled).
+  if (isClaudeOauthUsageCoolingDown(accessToken)) {
+    const legacy = await getClaudeUsageLegacy(accessToken);
+    return { ...legacy, bootstrap: await bootstrapPromise };
+  }
   try {
     // Real CLI uses axios here, not Stainless — UA is `claude-code/<version>`
     // (not `claude-cli/...`) and the shape is simpler than /v1/messages.
@@ -2649,6 +1303,11 @@ async function getClaudeUsage(accessToken?: string) {
       };
     }
 
+    // Cool down OAuth usage polling after a 429 (quota endpoint only — chat is unaffected).
+    if (oauthResponse.status === 429) {
+      markClaudeOauthUsage429(accessToken);
+    }
+
     // Fallback: OAuth endpoint returned non-OK, try legacy settings/org endpoint
     console.warn(
       `[Claude Usage] OAuth endpoint returned ${oauthResponse.status}, falling back to legacy`
diff --git a/open-sse/services/usage/antigravity.ts b/open-sse/services/usage/antigravity.ts
new file mode 100644
index 0000000000..02f98b010d
--- /dev/null
+++ b/open-sse/services/usage/antigravity.ts
@@ -0,0 +1,794 @@
+/**
+ * usage/antigravity.ts — Antigravity (Gemini Code Assist) usage fetcher + quota helpers.
+ *
+ * Extracted from services/usage.ts (god-file decomposition): the full Antigravity family —
+ * local-usage fallback, code-assist tier/plan mapping, credit-balance probing, the user-quota
+ * + available-models fetchers (with their module-level caches), and getAntigravityUsage. The
+ * 4 data caches + their proactive TTL-purge setInterval move here as a self-contained unit
+ * (previously the purge timer was shared with the Gemini CLI cache in usage.ts; that timer was
+ * split so each module owns its own caches + cleanup). usage.ts imports getAntigravityUsage
+ * (dispatcher) + getAntigravityPlanLabel/mapCodeAssist* (__testing). Behavior-preserving move.
+ */
+
+import { PROVIDERS } from "../../config/constants.ts";
+import {
+  getAntigravityFetchAvailableModelsUrls,
+  ANTIGRAVITY_BASE_URLS,
+} from "../../config/antigravityUpstream.ts";
+import {
+  isUserCallableAntigravityModelId,
+  toClientAntigravityQuotaModelId,
+} from "../../config/antigravityModelAliases.ts";
+import { isUserCallableAgyModelId } from "../../config/agyModels.ts";
+import { getDbInstance } from "@/lib/db/core";
+import {
+  applyAntigravityClientProfileHeaders,
+  getAntigravityBootstrapHeaders,
+  getAntigravityClientProfile,
+} from "../antigravityClientProfile.ts";
+import {
+  antigravityUserAgent,
+  getAntigravityHeaders,
+  getAntigravityLoadCodeAssistMetadata,
+} from "../antigravityHeaders.ts";
+import {
+  getAntigravityRemainingCredits,
+  updateAntigravityRemainingCredits,
+} from "../../executors/antigravity.ts";
+import { getCreditsMode } from "../antigravityCredits.ts";
+import { generateAntigravityRequestId, getAntigravitySessionId } from "../antigravityIdentity.ts";
+import {
+  extractCodeAssistOnboardTierId,
+  extractCodeAssistSubscriptionTier,
+} from "../codeAssistSubscription.ts";
+import { toRecord, toNumber, getFieldValue } from "./scalars.ts";
+import { type UsageQuota, parseResetTime } from "./quota.ts";
+
+type JsonRecord = Record<string, unknown>;
+type SubscriptionCacheEntry = {
+  data: unknown;
+  fetchedAt: number;
+};
+
+const ANTIGRAVITY_CONFIG = {
+  quotaApiUrls: getAntigravityFetchAvailableModelsUrls(),
+  loadProjectApiUrl: "https://daily-cloudcode-pa.sandbox.googleapis.com/v1internal:loadCodeAssist",
+  tokenUrl: "https://oauth2.googleapis.com/token",
+  get clientId() {
+    return PROVIDERS.antigravity.clientId;
+  },
+  get clientSecret() {
+    return PROVIDERS.antigravity.clientSecret;
+  },
+  get userAgent() {
+    return antigravityUserAgent();
+  },
+};
+
+const _antigravitySubCache = new Map<string, SubscriptionCacheEntry>();
+const ANTIGRAVITY_CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes
+const ANTIGRAVITY_MODELS_CACHE_TTL_MS = 60 * 1000;
+const ANTIGRAVITY_CREDIT_PROBE_TTL_MS = 5 * 60 * 1000;
+const _antigravityAvailableModelsCache = new Map<string, { data: unknown; fetchedAt: number }>();
+const _antigravityAvailableModelsInflight = new Map<string, Promise<unknown>>();
+const _antigravityUserQuotaCache = new Map<string, { data: unknown; fetchedAt: number }>();
+const _antigravityUserQuotaInflight = new Map<string, Promise<unknown>>();
+const _antigravityCreditProbeCache = new Map<string, { data: number | null; fetchedAt: number }>();
+const _antigravityCreditProbeInflight = new Map<string, Promise<number | null>>();
+
+// ── Proactive TTL purging for the Antigravity module-level caches ──────────
+// Split out of the shared usage.ts cleanup timer (god-file decomposition): this
+// leaf owns its 4 data caches, so it owns their purge too. The 2 inflight Maps
+// self-clean when their Promise settles, so they are NOT swept here.
+const _antigravityCacheCleanupTimer = setInterval(
+  () => {
+    const now = Date.now();
+    for (const [key, entry] of _antigravitySubCache) {
+      if (now - entry.fetchedAt > ANTIGRAVITY_CACHE_TTL_MS) _antigravitySubCache.delete(key);
+    }
+    for (const [key, entry] of _antigravityAvailableModelsCache) {
+      if (now - entry.fetchedAt > ANTIGRAVITY_MODELS_CACHE_TTL_MS)
+        _antigravityAvailableModelsCache.delete(key);
+    }
+    for (const [key, entry] of _antigravityUserQuotaCache) {
+      if (now - entry.fetchedAt > ANTIGRAVITY_MODELS_CACHE_TTL_MS)
+        _antigravityUserQuotaCache.delete(key);
+    }
+    for (const [key, entry] of _antigravityCreditProbeCache) {
+      if (now - entry.fetchedAt > ANTIGRAVITY_CREDIT_PROBE_TTL_MS)
+        _antigravityCreditProbeCache.delete(key);
+    }
+  },
+  5 * 60 * 1000
+); // every 5 minutes
+_antigravityCacheCleanupTimer.unref?.(); // Don't prevent process exit
+
+interface AntigravityUsageOptions {
+  forceRefresh?: boolean;
+}
+
+const ANTIGRAVITY_LOCAL_USAGE_WINDOW_MS = 5 * 60 * 60 * 1000;
+const ANTIGRAVITY_LOCAL_USAGE_TOKENS_PER_UNIT = 1000;
+
+// `toClientAntigravityQuotaModelId` was an inline if-ladder here; it is now the single
+// source of truth in open-sse/config/antigravityModelAliases.ts (imported above), shared
+// with the provider-limits cache sanitizer. (#3821-review LEDGER-5)
+
+function getAntigravityLocalUsageUnits(
+  provider: "antigravity" | "agy",
+  connectionId: string | undefined,
+  modelId: string,
+  resetAt: string | null
+): number {
+  if (!connectionId || !modelId || !resetAt) return 0;
+
+  const resetMs = Date.parse(resetAt);
+  if (!Number.isFinite(resetMs)) return 0;
+
+  const windowStart = new Date(resetMs - ANTIGRAVITY_LOCAL_USAGE_WINDOW_MS).toISOString();
+  const windowEnd = new Date(resetMs).toISOString();
+
+  try {
+    const db = getDbInstance() as unknown as {
+      prepare: (sql: string) => { get: (...params: unknown[]) => unknown };
+    };
+    const row = db
+      .prepare(
+        `SELECT COALESCE(SUM(
+           COALESCE(tokens_input, 0) + COALESCE(tokens_output, 0) + COALESCE(tokens_reasoning, 0)
+         ), 0) AS tokens
+         FROM usage_history
+         WHERE provider = ?
+           AND connection_id = ?
+           AND model = ?
+           AND success = 1
+           AND timestamp >= ?
+           AND timestamp < ?`
+      )
+      .get(provider, connectionId, modelId, windowStart, windowEnd) as
+      | { tokens?: unknown }
+      | undefined;
+
+    const tokens = Number(row?.tokens || 0);
+    if (!Number.isFinite(tokens) || tokens <= 0) return 0;
+    return Math.max(1, Math.ceil(tokens / ANTIGRAVITY_LOCAL_USAGE_TOKENS_PER_UNIT));
+  } catch {
+    return 0;
+  }
+}
+
+function applyLocalUsageFallback(
+  quota: UsageQuota,
+  provider: "antigravity" | "agy",
+  connectionId: string | undefined,
+  modelId: string
+): UsageQuota {
+  if (quota.quotaSource !== "fetchAvailableModels" || quota.used > 0 || quota.unlimited) {
+    return quota;
+  }
+
+  const localUsed = getAntigravityLocalUsageUnits(provider, connectionId, modelId, quota.resetAt);
+  if (localUsed <= 0 || quota.total <= 0) return quota;
+
+  const used = Math.min(quota.total, localUsed);
+  return {
+    ...quota,
+    used,
+    remainingPercentage: Math.max(0, ((quota.total - used) / quota.total) * 100),
+    quotaSource: "localUsageHistory",
+  };
+}
+
+function buildAntigravityUsageCacheKey(accessToken: string, projectId?: string | null): string {
+  return `${accessToken.substring(0, 16)}:${projectId || "default"}`;
+}
+
+async function fetchAntigravityAvailableModelsCached(
+  accessToken: string,
+  projectId?: string | null,
+  options: AntigravityUsageOptions = {}
+): Promise<unknown> {
+  if (!accessToken) throw new Error("Access token is required");
+
+  const cacheKey = buildAntigravityUsageCacheKey(accessToken, projectId);
+  const cached = _antigravityAvailableModelsCache.get(cacheKey);
+  if (
+    !options.forceRefresh &&
+    cached &&
+    Date.now() - cached.fetchedAt < ANTIGRAVITY_MODELS_CACHE_TTL_MS
+  ) {
+    return cached.data;
+  }
+
+  const inflight = _antigravityAvailableModelsInflight.get(cacheKey);
+  if (inflight) return inflight;
+
+  const promise = (async () => {
+    let response: Response | null = null;
+    let lastError: Error | null = null;
+
+    for (const quotaApiUrl of ANTIGRAVITY_CONFIG.quotaApiUrls) {
+      try {
+        response = await fetch(quotaApiUrl, {
+          method: "POST",
+          headers: getAntigravityHeaders("fetchAvailableModels", accessToken),
+          body: JSON.stringify(projectId ? { project: projectId } : {}),
+          signal: AbortSignal.timeout(10000),
+        });
+
+        if (response.ok || response.status === 401 || response.status === 403) {
+          break;
+        }
+      } catch (error) {
+        lastError = error as Error;
+      }
+    }
+
+    if (!response) {
+      throw lastError || new Error("Antigravity API unavailable");
+    }
+
+    if (response.status === 403) {
+      return { __antigravityForbidden: true };
+    }
+
+    if (!response.ok) {
+      throw new Error(`Antigravity API error: ${response.status}`);
+    }
+
+    const data = await response.json();
+    _antigravityAvailableModelsCache.set(cacheKey, { data, fetchedAt: Date.now() });
+    return data;
+  })().finally(() => {
+    _antigravityAvailableModelsInflight.delete(cacheKey);
+  });
+
+  _antigravityAvailableModelsInflight.set(cacheKey, promise);
+  return promise;
+}
+
+async function fetchAntigravityUserQuotaCached(
+  accessToken: string,
+  projectId?: string | null,
+  options: AntigravityUsageOptions = {}
+): Promise<unknown | null> {
+  if (!accessToken || !projectId) return null;
+
+  const cacheKey = buildAntigravityUsageCacheKey(accessToken, projectId);
+  const cached = _antigravityUserQuotaCache.get(cacheKey);
+  if (
+    !options.forceRefresh &&
+    cached &&
+    Date.now() - cached.fetchedAt < ANTIGRAVITY_MODELS_CACHE_TTL_MS
+  ) {
+    return cached.data;
+  }
+
+  const inflight = _antigravityUserQuotaInflight.get(cacheKey);
+  if (inflight) return inflight;
+
+  const promise = (async () => {
+    try {
+      const response = await fetch(
+        "https://cloudcode-pa.googleapis.com/v1internal:retrieveUserQuota",
+        {
+          method: "POST",
+          headers: {
+            Authorization: `Bearer ${accessToken}`,
+            "Content-Type": "application/json",
+          },
+          body: JSON.stringify({ project: projectId }),
+          signal: AbortSignal.timeout(10000),
+        }
+      );
+
+      if (!response.ok) return null;
+
+      const data = await response.json();
+      _antigravityUserQuotaCache.set(cacheKey, { data, fetchedAt: Date.now() });
+      return data;
+    } catch {
+      return null;
+    }
+  })().finally(() => {
+    _antigravityUserQuotaInflight.delete(cacheKey);
+  });
+
+  _antigravityUserQuotaInflight.set(cacheKey, promise);
+  return promise;
+}
+
+function extractCodeAssistTierId(subscription: JsonRecord): string {
+  const tierId = extractCodeAssistOnboardTierId(subscription);
+  if (tierId === "legacy-tier") return "";
+  const upper = tierId.toUpperCase();
+  return mapCodeAssistTierIdToLabel(upper) ? upper : "";
+}
+
+export function mapCodeAssistTierIdToLabel(tierId: string): string | null {
+  const upper = tierId.toUpperCase();
+  if (upper.includes("ULTRA")) return "Ultra";
+  if (
+    upper.includes("PRO") ||
+    upper.includes("PREMIUM") ||
+    upper.includes("GOOGLE_ONE") ||
+    upper.includes("ONE_AI")
+  )
+    return "Pro";
+  if (upper.includes("ENTERPRISE")) return "Enterprise";
+  if (upper.includes("BUSINESS") || upper.includes("STANDARD")) return "Business";
+  if (upper.includes("PLUS")) return "Plus";
+  if (upper.includes("LITE") || upper.includes("LIGHT")) return "Lite";
+  if (upper.includes("FREE") || upper.includes("INDIVIDUAL") || upper.includes("LEGACY"))
+    return "Free";
+  return null;
+}
+
+export function mapSubscriptionTierStringToPlanLabel(tierText: string): string | null {
+  const upper = tierText.toUpperCase();
+  if (upper.includes("ULTRA")) return "Ultra";
+  if (upper.includes("PRO") || upper.includes("PREMIUM") || upper.includes("GOOGLE ONE"))
+    return "Pro";
+  if (upper.includes("ENTERPRISE")) return "Enterprise";
+  if (upper.includes("STANDARD") || upper.includes("BUSINESS")) return "Business";
+  if (upper.includes("PLUS")) return "Plus";
+  if (upper.includes("LITE")) return "Lite";
+  if (upper.includes("INDIVIDUAL") || upper.includes("FREE")) return "Free";
+  // Strip a trailing "(RESTRICTED)" marker. Match the fixed literal anywhere then
+  // trim, instead of /\s*\(RESTRICTED\)\s*$/ whose overlapping \s* runs backtrack
+  // polynomially on whitespace-heavy upstream input (js/polynomial-redos).
+  const normalizedId = upper.replace(/\(RESTRICTED\)/i, "").trim();
+  if (normalizedId) {
+    const mapped = mapCodeAssistTierIdToLabel(normalizedId);
+    if (mapped) return mapped;
+  }
+  return null;
+}
+
+export function mapCodeAssistSubscriptionToPlanLabel(subscriptionInfo: unknown): string {
+  const subscription = toRecord(subscriptionInfo);
+  if (Object.keys(subscription).length === 0) return "Free";
+
+  const subscriptionTier = extractCodeAssistSubscriptionTier(subscriptionInfo);
+  if (subscriptionTier) {
+    const mapped = mapSubscriptionTierStringToPlanLabel(subscriptionTier);
+    if (mapped) return mapped;
+    if (subscriptionTier.toLowerCase() !== "free") {
+      return subscriptionTier.charAt(0).toUpperCase() + subscriptionTier.slice(1).toLowerCase();
+    }
+  }
+
+  const currentTier = toRecord(subscription.currentTier);
+  const tierName = String(
+    getFieldValue(currentTier, "name", "displayName") ||
+      subscription.subscriptionType ||
+      subscription.tier ||
+      ""
+  );
+  const mappedName = tierName ? mapSubscriptionTierStringToPlanLabel(tierName) : null;
+  if (mappedName) return mappedName;
+
+  const tierId = extractCodeAssistTierId(subscription);
+  if (tierId) {
+    const mapped = mapCodeAssistTierIdToLabel(tierId);
+    if (mapped) return mapped;
+  }
+  if (currentTier.upgradeSubscriptionType) return "Free";
+  if (tierName) return tierName.charAt(0).toUpperCase() + tierName.slice(1).toLowerCase();
+  return "Free";
+}
+
+const KNOWN_ANTIGRAVITY_PLAN_LABELS = new Set([
+  "Ultra",
+  "Pro",
+  "Enterprise",
+  "Business",
+  "Plus",
+  "Lite",
+]);
+
+/**
+ * Map raw loadCodeAssist tier data to short display labels (Antigravity Manager parity).
+ */
+export function getAntigravityPlanLabel(subscriptionInfo: unknown, fallbackInfo?: unknown): string {
+  const livePlan = mapCodeAssistSubscriptionToPlanLabel(subscriptionInfo);
+  const fallbackPlan = mapCodeAssistSubscriptionToPlanLabel(fallbackInfo);
+
+  if (KNOWN_ANTIGRAVITY_PLAN_LABELS.has(livePlan)) return livePlan;
+  if (KNOWN_ANTIGRAVITY_PLAN_LABELS.has(fallbackPlan)) return fallbackPlan;
+  if (livePlan !== "Free") return livePlan;
+  return fallbackPlan !== "Free" ? fallbackPlan : livePlan;
+}
+
+/**
+ * Proactive credit balance probe for Antigravity.
+ *
+ * Fires a minimal streamGenerateContent request with GOOGLE_ONE_AI credits enabled
+ * and maxOutputTokens=1 to extract the `remainingCredits` field from the SSE stream.
+ * This uses ~1 credit but lets us show the balance on the dashboard without waiting
+ * for a real user request.
+ *
+ * Returns the credit balance, or null if the probe failed.
+ */
+async function probeAntigravityCreditBalance(
+  accessToken: string,
+  accountId: string,
+  projectId?: string | null,
+  options: AntigravityUsageOptions = {},
+  providerSpecificData: JsonRecord = {}
+): Promise<number | null> {
+  if (!accessToken) return null;
+
+  const cacheKey = buildAntigravityUsageCacheKey(accessToken, projectId || accountId);
+  const cached = _antigravityCreditProbeCache.get(cacheKey);
+  if (
+    !options.forceRefresh &&
+    cached &&
+    Date.now() - cached.fetchedAt < ANTIGRAVITY_CREDIT_PROBE_TTL_MS
+  ) {
+    return cached.data;
+  }
+
+  const inflight = _antigravityCreditProbeInflight.get(cacheKey);
+  if (inflight) return inflight;
+
+  const promise = probeAntigravityCreditBalanceUncached(
+    accessToken,
+    accountId,
+    projectId,
+    providerSpecificData
+  )
+    .then(
+      (data) => {
+        _antigravityCreditProbeCache.set(cacheKey, { data, fetchedAt: Date.now() });
+        return data;
+      },
+      (error) => {
+        _antigravityCreditProbeCache.set(cacheKey, { data: null, fetchedAt: Date.now() });
+        throw error;
+      }
+    )
+    .finally(() => {
+      _antigravityCreditProbeInflight.delete(cacheKey);
+    });
+
+  _antigravityCreditProbeInflight.set(cacheKey, promise);
+  return promise;
+}
+
+async function probeAntigravityCreditBalanceUncached(
+  accessToken: string,
+  accountId: string,
+  projectId?: string | null,
+  providerSpecificData: JsonRecord = {}
+): Promise<number | null> {
+  try {
+    if (!projectId) return null;
+
+    // Try all base URLs (some accounts only work with specific endpoints)
+    for (const baseUrl of ANTIGRAVITY_BASE_URLS) {
+      const url = `${baseUrl}/v1internal:streamGenerateContent?alt=sse`;
+
+      const sessionId = getAntigravitySessionId({ connectionId: accountId, projectId });
+      const body = {
+        project: projectId,
+        model: "gemini-2-flash",
+        userAgent: "antigravity",
+        requestType: "agent",
+        requestId: generateAntigravityRequestId(),
+        enabledCreditTypes: ["GOOGLE_ONE_AI"],
+        request: {
+          model: "gemini-2-flash",
+          contents: [{ role: "user", parts: [{ text: "hi" }] }],
+          generationConfig: { maxOutputTokens: 1 },
+          sessionId,
+        },
+      };
+
+      const headers: Record<string, string> = {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${accessToken}`,
+        Accept: "text/event-stream",
+      };
+      applyAntigravityClientProfileHeaders(
+        headers,
+        { connectionId: accountId, projectId, providerSpecificData },
+        body
+      );
+
+      try {
+        const res = await fetch(url, {
+          method: "POST",
+          headers,
+          body: JSON.stringify(body),
+          signal: AbortSignal.timeout(10_000),
+        });
+
+        if (!res.ok) continue;
+
+        // Read the full SSE response and scan for remainingCredits
+        const rawSSE = await res.text();
+        const lines = rawSSE.split("\n");
+
+        for (const line of lines) {
+          const trimmed = line.trim();
+          if (!trimmed.startsWith("data:")) continue;
+          const payload = trimmed.slice(5).trim();
+          if (payload === "[DONE]") break;
+          try {
+            const parsed = JSON.parse(payload);
+            if (Array.isArray(parsed?.remainingCredits)) {
+              const googleCredit = parsed.remainingCredits.find(
+                (c: { creditType?: string }) => c?.creditType === "GOOGLE_ONE_AI"
+              );
+              if (googleCredit) {
+                const balance = parseInt(googleCredit.creditAmount, 10);
+                if (!isNaN(balance)) {
+                  updateAntigravityRemainingCredits(accountId, balance);
+                  return balance;
+                }
+              }
+            }
+          } catch {
+            // Skip malformed SSE lines
+          }
+        }
+      } catch {
+        // Individual endpoint failure; try next
+      }
+    }
+
+    return null;
+  } catch {
+    // Probe is best-effort — don't let it break the usage fetch
+    return null;
+  }
+}
+
+/**
+ * Antigravity Usage - Fetch quota from Google Cloud Code API.
+ * fetchAvailableModels is catalog/eligibility data and may keep reporting full buckets
+ * after real usage. retrieveUserQuota is the consumption signal for Gemini-family
+ * buckets, so prefer it when present and fall back to fetchAvailableModels only for
+ * models that have no retrieveUserQuota entry (for example Claude/GPT OSS buckets).
+ */
+export async function getAntigravityUsage(
+  provider: "antigravity" | "agy",
+  accessToken?: string,
+  providerSpecificData?: JsonRecord,
+  connectionProjectId?: string,
+  connectionId?: string,
+  options: AntigravityUsageOptions = {}
+) {
+  if (!accessToken) {
+    return { plan: "Free", message: "Antigravity access token not available." };
+  }
+
+  let subscriptionInfo: unknown = null;
+  try {
+    subscriptionInfo = await getAntigravitySubscriptionInfoCached(
+      accessToken,
+      providerSpecificData,
+      options
+    );
+    const savedProjectId =
+      typeof providerSpecificData?.projectId === "string" && providerSpecificData.projectId.trim()
+        ? providerSpecificData.projectId.trim()
+        : null;
+    const subscriptionProject = toRecord(subscriptionInfo).cloudaicompanionProject;
+    const projectId =
+      savedProjectId ||
+      connectionProjectId ||
+      (typeof subscriptionProject === "string"
+        ? subscriptionProject
+        : typeof toRecord(subscriptionProject).id === "string"
+          ? (toRecord(subscriptionProject).id as string)
+          : null);
+
+    // Derive accountId for credit balance cache.
+    // Must match executor key: credentials.connectionId
+    const accountId: string = connectionId || "unknown";
+
+    // Read cached credit balance (hydrated from DB on first access)
+    let creditBalance = getAntigravityRemainingCredits(accountId);
+
+    // If no cached balance and credits mode is enabled, fire a minimal probe
+    const creditsMode = getCreditsMode();
+    if ((options.forceRefresh || creditBalance === null) && creditsMode !== "off") {
+      creditBalance = await probeAntigravityCreditBalance(
+        accessToken,
+        accountId,
+        projectId,
+        options,
+        providerSpecificData || {}
+      );
+    }
+
+    const [data, userQuotaData] = await Promise.all([
+      fetchAntigravityAvailableModelsCached(accessToken, projectId, options),
+      fetchAntigravityUserQuotaCached(accessToken, projectId, options),
+    ]);
+    const dataObj = toRecord(data);
+    if (dataObj.__antigravityForbidden === true) {
+      return { message: "Antigravity access forbidden. Check subscription." };
+    }
+    const modelEntries = toRecord(dataObj.models);
+    const userQuotaEntries = new Map<string, JsonRecord>();
+    const userQuotaObj = toRecord(userQuotaData);
+    if (Array.isArray(userQuotaObj.buckets)) {
+      for (const bucketValue of userQuotaObj.buckets) {
+        const bucket = toRecord(bucketValue);
+        const modelId = toClientAntigravityQuotaModelId(String(bucket.modelId || "").trim());
+        if (!modelId) continue;
+        userQuotaEntries.set(modelId, bucket);
+      }
+    }
+    const quotas: Record<string, UsageQuota> = {};
+
+    // Parse per-model quota info from fetchAvailableModels response.
+    for (const [rawModelKey, infoValue] of Object.entries(modelEntries)) {
+      const info = toRecord(infoValue);
+      const quotaInfo = toRecord(info.quotaInfo);
+      const modelKey = toClientAntigravityQuotaModelId(rawModelKey);
+
+      // Skip internal, excluded, and models without quota info
+      if (
+        !modelKey ||
+        info.isInternal === true ||
+        !(provider === "agy"
+          ? isUserCallableAgyModelId(modelKey)
+          : isUserCallableAntigravityModelId(modelKey)) ||
+        Object.keys(quotaInfo).length === 0
+      ) {
+        continue;
+      }
+
+      const liveQuota = userQuotaEntries.get(modelKey);
+      const quotaSource = liveQuota || quotaInfo;
+      const rawFraction = toNumber(quotaSource.remainingFraction, -1);
+      const resetAt = parseResetTime(quotaSource.resetTime);
+      // Distinguish "upstream did not report remainingFraction" from "remaining is 0%".
+      // fetchAvailableModels is a catalog view and can be stale/full; retrieveUserQuota is
+      // the source of truth for actual Gemini consumption when it includes the model.
+      const fractionReported = rawFraction >= 0;
+      if (!fractionReported) {
+        console.warn(
+          `[Antigravity] model ${modelKey} returned no remainingFraction — quota unknown`
+        );
+      }
+      const remainingFraction = fractionReported ? Math.max(0, Math.min(1, rawFraction)) : 0;
+      // Models with no resetTime AND a reported full fraction are unlimited
+      // (e.g. tab-completion models). Unreported fraction is NEVER unlimited.
+      const isUnlimited = fractionReported && !resetAt && remainingFraction >= 1;
+      const remainingPercentage = remainingFraction * 100;
+      const QUOTA_NORMALIZED_BASE = 1000;
+      const total = QUOTA_NORMALIZED_BASE;
+      const remaining = Math.round(total * remainingFraction);
+      const used = isUnlimited ? 0 : Math.max(0, total - remaining);
+
+      quotas[modelKey] = applyLocalUsageFallback(
+        {
+          used,
+          total: isUnlimited ? 0 : total,
+          resetAt,
+          remainingPercentage: isUnlimited ? 100 : remainingPercentage,
+          unlimited: isUnlimited,
+          fractionReported,
+          quotaSource: liveQuota ? "retrieveUserQuota" : "fetchAvailableModels",
+        },
+        provider,
+        connectionId,
+        modelKey
+      );
+    }
+
+    // Include retrieveUserQuota buckets not listed in the static/public Antigravity catalog yet.
+    // This keeps Provider Limits honest when Google adds a new Gemini tier before our catalog is
+    // updated. Hidden/internal catalog entries above are still filtered by the public pass.
+    for (const [modelKey, bucket] of userQuotaEntries) {
+      if (
+        quotas[modelKey] ||
+        !(provider === "agy"
+          ? isUserCallableAgyModelId(modelKey)
+          : isUserCallableAntigravityModelId(modelKey))
+      ) {
+        continue;
+      }
+      const rawFraction = toNumber(bucket.remainingFraction, -1);
+      if (rawFraction < 0) continue;
+      const remainingFraction = Math.max(0, Math.min(1, rawFraction));
+      const resetAt = parseResetTime(bucket.resetTime);
+      const isUnlimited = !resetAt && remainingFraction >= 1;
+      const QUOTA_NORMALIZED_BASE = 1000;
+      const total = QUOTA_NORMALIZED_BASE;
+      const remaining = Math.round(total * remainingFraction);
+      quotas[modelKey] = {
+        used: isUnlimited ? 0 : Math.max(0, total - remaining),
+        total: isUnlimited ? 0 : total,
+        resetAt,
+        remainingPercentage: isUnlimited ? 100 : remainingFraction * 100,
+        unlimited: isUnlimited,
+        fractionReported: true,
+        quotaSource: "retrieveUserQuota",
+      };
+    }
+
+    return {
+      plan: getAntigravityPlanLabel(subscriptionInfo, providerSpecificData),
+      quotas: {
+        ...quotas,
+        ...(creditBalance !== null && {
+          credits: {
+            used: 0,
+            total: 0,
+            remaining: creditBalance,
+            unlimited: false,
+            resetAt: null,
+          },
+        }),
+      },
+      subscriptionInfo,
+    };
+  } catch (error) {
+    return {
+      plan: getAntigravityPlanLabel(subscriptionInfo, providerSpecificData),
+      subscriptionInfo,
+      message: `Antigravity error: ${(error as Error).message}`,
+    };
+  }
+}
+
+/**
+ * Get Antigravity subscription info (cached, 5 min TTL)
+ * Prevents duplicate loadCodeAssist calls within the same quota cycle.
+ */
+async function getAntigravitySubscriptionInfoCached(
+  accessToken: string,
+  providerSpecificData?: JsonRecord,
+  options: AntigravityUsageOptions = {}
+): Promise<unknown> {
+  const profile = getAntigravityClientProfile({ providerSpecificData });
+  const cacheKey = `${accessToken.substring(0, 16)}:${profile}`;
+
+  if (options.forceRefresh) {
+    _antigravitySubCache.delete(cacheKey);
+  } else {
+    const cached = _antigravitySubCache.get(cacheKey);
+    if (cached && Date.now() - cached.fetchedAt < ANTIGRAVITY_CACHE_TTL_MS) {
+      return cached.data;
+    }
+  }
+
+  const data = await getAntigravitySubscriptionInfo(accessToken, providerSpecificData);
+  if (data != null) {
+    _antigravitySubCache.set(cacheKey, { data, fetchedAt: Date.now() });
+  }
+  return data;
+}
+
+/**
+ * Get Antigravity subscription info using correct Antigravity headers.
+ * Must match the headers used in providers.js postExchange (not CLI headers).
+ */
+async function getAntigravitySubscriptionInfo(
+  accessToken: string,
+  providerSpecificData?: JsonRecord
+): Promise<unknown | null> {
+  try {
+    const profile = getAntigravityClientProfile({ providerSpecificData });
+    const response = await fetch(ANTIGRAVITY_CONFIG.loadProjectApiUrl, {
+      method: "POST",
+      headers:
+        profile === "harness"
+          ? getAntigravityBootstrapHeaders(profile, accessToken)
+          : getAntigravityHeaders("loadCodeAssist", accessToken),
+      body: JSON.stringify({ metadata: getAntigravityLoadCodeAssistMetadata() }),
+    });
+
+    if (!response.ok) return null;
+
+    return await response.json();
+  } catch {
+    return null;
+  }
+}
diff --git a/open-sse/services/usage/codebuddy-cn.ts b/open-sse/services/usage/codebuddy-cn.ts
new file mode 100644
index 0000000000..27b1df83fd
--- /dev/null
+++ b/open-sse/services/usage/codebuddy-cn.ts
@@ -0,0 +1,199 @@
+/**
+ * CodeBuddy CN usage handler — scoped to the "codebuddy-cn" provider.
+ *
+ * Quota lives behind a Tencent billing endpoint (POST, payload wrapped twice
+ * under data.Response.Data). It mixes two credit types that must NOT be merged:
+ *
+ *  - Refill / base ("基础体验包"): recurring allowance whose cycle resets long
+ *    before the resource itself expires (CycleEndTime << DeductionEndTime).
+ *    Live numbers in the *Cycle* fields; resetAt = next refresh.
+ *  - Bonus ("活动赠送包"): one-shot credits that run a single cycle and expire
+ *    (CycleEndTime ≈ DeductionEndTime). Numbers in the plain Capacity fields.
+ *
+ * One quota row per package — cadence label (Monthly/Weekly/Daily) for refill
+ * packs, "Bonus Pack N" for bonus packs (soonest-expiring first).
+ */
+
+const USAGE_URL = "https://copilot.tencent.com/v2/billing/meter/get-user-resource";
+
+interface TencentAccount {
+  PackageName?: string;
+  SubProductName?: string;
+  CycleStartTime?: string | number;
+  CycleEndTime?: string | number;
+  DeductionEndTime?: string | number;
+  CycleCapacitySize?: number | string;
+  CycleCapacitySizePrecise?: string | number;
+  CycleCapacityUsed?: number | string;
+  CycleCapacityUsedPrecise?: string | number;
+  CapacitySize?: number | string;
+  CapacitySizePrecise?: string | number;
+  CapacityUsed?: number | string;
+  CapacityUsedPrecise?: string | number;
+}
+
+function parseResetTime(value: unknown): string | null {
+  if (!value) return null;
+  try {
+    if (value instanceof Date) return value.toISOString();
+    if (typeof value === "number") {
+      const ts = value < 1e12 ? value * 1000 : value;
+      const d = new Date(ts);
+      return d.getTime() > 0 ? d.toISOString() : null;
+    }
+    if (typeof value === "string") {
+      if (/^\d+$/.test(value)) {
+        const n = Number(value);
+        const d = new Date(n < 1e12 ? n * 1000 : n);
+        return d.getTime() > 0 ? d.toISOString() : null;
+      }
+      const d = new Date(value);
+      return Number.isNaN(d.getTime()) || d.getTime() <= 0 ? null : d.toISOString();
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+// Prefer the *Precise string fields (exact), fall back to the numeric ones.
+function num(precise: unknown, plain: unknown): number {
+  const n = Number(precise ?? plain);
+  return Number.isFinite(n) ? n : 0;
+}
+
+// Label a refill pack by its cycle length (Monthly is the common CodeBuddy case).
+function refillCadence(acc: TencentAccount): "Monthly" | "Weekly" | "Daily" {
+  const start = parseResetTime(acc.CycleStartTime);
+  const end = parseResetTime(acc.CycleEndTime);
+  if (start && end) {
+    const days = (new Date(end).getTime() - new Date(start).getTime()) / 86400000;
+    if (days <= 1.5) return "Daily";
+    if (days <= 10) return "Weekly";
+  }
+  return "Monthly";
+}
+
+function cycleEndMs(acc: TencentAccount): number {
+  const r = parseResetTime(acc.CycleEndTime);
+  return r ? new Date(r).getTime() : Number.POSITIVE_INFINITY;
+}
+
+function deductionEndMs(acc: TencentAccount): number {
+  const v = acc.DeductionEndTime;
+  if (typeof v === "number") return (v < 1e12 ? v * 1000 : v);
+  if (typeof v === "string" && /^\d+$/.test(v)) {
+    const n = Number(v);
+    return n < 1e12 ? n * 1000 : n;
+  }
+  const r = parseResetTime(v);
+  return r ? new Date(r).getTime() : Number.POSITIVE_INFINITY;
+}
+
+// Refill packs roll into a new cycle before the resource expires; bonus packs
+// end at expiry. >2d gap between cycle end and validity end = refill.
+const REFILL_GAP_MS = 2 * 24 * 60 * 60 * 1000;
+function isRefill(acc: TencentAccount): boolean {
+  const ce = cycleEndMs(acc);
+  const de = deductionEndMs(acc);
+  return Number.isFinite(ce) && Number.isFinite(de) && de - ce > REFILL_GAP_MS;
+}
+
+interface CodeBuddyUsageResult {
+  plan?: string;
+  quotas?: Record<
+    string,
+    {
+      used: number;
+      total: number;
+      resetAt: string | null;
+      unlimited: boolean;
+    }
+  >;
+  message?: string;
+}
+
+export async function getCodeBuddyCnUsage(
+  accessToken?: string,
+  apiKey?: string,
+  _providerSpecificData?: unknown
+): Promise<CodeBuddyUsageResult> {
+  const token = accessToken || apiKey;
+  if (!token) {
+    return { message: "CodeBuddy CN credential not available." };
+  }
+
+  try {
+    const response = await fetch(USAGE_URL, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json",
+        Accept: "application/json",
+        "User-Agent": "CLI/2.108.1 CodeBuddy/2.108.1",
+        "X-Product": "SaaS",
+        "X-IDE-Type": "CLI",
+        "X-IDE-Name": "CLI",
+        "x-requested-with": "XMLHttpRequest",
+        "x-codebuddy-request": "1",
+      },
+      body: "{}",
+    });
+
+    if (response.status === 401 || response.status === 403) {
+      return { message: "CodeBuddy CN credential invalid or expired." };
+    }
+    if (!response.ok) {
+      return { message: `CodeBuddy CN quota API error (${response.status}).` };
+    }
+
+    const json: any = await response.json();
+    if (json?.code !== 0) {
+      return { message: `CodeBuddy CN quota error: ${json?.msg || "unknown"}` };
+    }
+
+    const data = json?.data?.Response?.Data || {};
+    const accountsRaw: TencentAccount[] = Array.isArray(data.Accounts) ? data.Accounts : [];
+    if (accountsRaw.length === 0) {
+      return { message: "CodeBuddy CN connected. No credit package found." };
+    }
+
+    const byExpiry = (a: TencentAccount, b: TencentAccount) => cycleEndMs(a) - cycleEndMs(b);
+    const refills = accountsRaw.filter(isRefill).sort(byExpiry);
+    const bonuses = accountsRaw.filter((a) => !isRefill(a)).sort(byExpiry);
+
+    const quotas: NonNullable<CodeBuddyUsageResult["quotas"]> = {};
+    const seenRefill: Record<string, number> = {};
+    refills.forEach((acc) => {
+      const base = refillCadence(acc);
+      seenRefill[base] = (seenRefill[base] || 0) + 1;
+      const name = seenRefill[base] > 1 ? `${base} ${seenRefill[base]}` : base;
+      quotas[name] = {
+        used: num(acc.CycleCapacityUsedPrecise, acc.CycleCapacityUsed),
+        total: num(acc.CycleCapacitySizePrecise, acc.CycleCapacitySize),
+        resetAt: parseResetTime(acc.CycleEndTime),
+        unlimited: false,
+      };
+    });
+    bonuses.forEach((acc, i) => {
+      quotas[`Bonus Pack ${i + 1}`] = {
+        used: num(acc.CapacityUsedPrecise, acc.CapacityUsed),
+        total: num(acc.CapacitySizePrecise, acc.CapacitySize),
+        resetAt: parseResetTime(acc.CycleEndTime),
+        unlimited: false,
+      };
+    });
+
+    const basePkg = refills[0] || accountsRaw[0] || {};
+    const plan = basePkg.PackageName || basePkg.SubProductName || "CodeBuddy CN";
+
+    return { plan, quotas };
+  } catch (error: any) {
+    // Hard Rule #12: no raw err.message in any HTTP/SSE/executor response. Usage
+    // handler returns a controlled string for the dashboard; do not include the
+    // raw exception text in case it carries a path/stack snippet.
+    return { message: "CodeBuddy CN error: failed to fetch quota." };
+  }
+}
+
+export default getCodeBuddyCnUsage;
diff --git a/open-sse/services/usage/glm.ts b/open-sse/services/usage/glm.ts
new file mode 100644
index 0000000000..27f753281f
--- /dev/null
+++ b/open-sse/services/usage/glm.ts
@@ -0,0 +1,182 @@
+/**
+ * usage/glm.ts — GLM (Zhipu) usage fetcher + quota helpers.
+ *
+ * Extracted from services/usage.ts (god-file decomposition): the GLM family — token/window
+ * quota naming, quota ordering, monthly-remaining math, and the getGlmUsage fetcher that
+ * probes the Zhipu quota endpoint. Depends only on the sibling scalar/quota leaves plus the
+ * GLM quota-URL config — no host coupling — so it lives as a co-located provider leaf.
+ * usage.ts imports getGlmUsage (dispatcher) and re-exports glmMonthlyRemainingPercentage
+ * (used by the glm-coding-plan-monthly test). Behavior-preserving move.
+ */
+
+import { toNumber, toRecord, toTitleCase, toPercentage } from "./scalars.ts";
+import { type UsageQuota } from "./quota.ts";
+import { getGlmQuotaUrl } from "../../config/glmProvider.ts";
+
+type JsonRecord = Record<string, unknown>;
+
+function getGlmTokenQuotaName(
+  limit: JsonRecord,
+  existingQuotas: Record<string, UsageQuota>
+): string {
+  const unit = toNumber(limit.unit, 0);
+  const number = toNumber(limit.number, 0);
+
+  if (unit === 3 && number === 5) return "session";
+  if ((unit === 4 && number === 7) || (unit === 3 && number >= 24 * 7)) return "weekly";
+
+  return existingQuotas.session ? "weekly" : "session";
+}
+
+function getGlmQuotaDisplayName(quotaName: string): string {
+  if (quotaName === "session") return "5 Hours Quota";
+  if (quotaName === "weekly") return "Weekly Quota";
+  return quotaName;
+}
+
+const GLM_QUOTA_ORDER = ["5 Hours Quota", "Weekly Quota", "Monthly Tools", "Tokens", "Time Limit"];
+
+function getGlmQuotaLabel(type: unknown, unit: unknown): string | null {
+  const normalized = typeof type === "string" ? type.trim().toUpperCase() : "";
+  const unitValue = toNumber(unit, -1);
+
+  switch (normalized) {
+    case "TOKENS_LIMIT":
+    case "TOKEN_LIMIT":
+      if (unitValue === 3) return "5 Hours Quota";
+      if (unitValue === 6) return "Weekly Quota";
+      return "Tokens";
+    case "TIME_LIMIT":
+    case "TIME_USAGE_LIMIT":
+      if (unitValue === 5) return "Monthly Tools";
+      return "Time Limit";
+    default:
+      return null;
+  }
+}
+
+function orderGlmQuotas(quotas: Record<string, UsageQuota>): Record<string, UsageQuota> {
+  const ordered: Record<string, UsageQuota> = {};
+
+  for (const key of GLM_QUOTA_ORDER) {
+    if (quotas[key]) ordered[key] = quotas[key];
+  }
+
+  for (const [key, quota] of Object.entries(quotas)) {
+    if (!ordered[key]) ordered[key] = quota;
+  }
+
+  return ordered;
+}
+
+/**
+ * Remaining-percentage for a GLM/z.ai TIME_LIMIT ("Monthly") quota. With an absolute
+ * monthly cap (`total > 0`) it is `remaining / total`. Coding plans that have no
+ * monthly cap (only 5-hour windows) report `total = 0`; in that case fall back to the
+ * percentage-derived remaining so "no monthly cap" renders as full/100% instead of a
+ * misleading 0% (#3580).
+ */
+export function glmMonthlyRemainingPercentage(total: number, remaining: number): number {
+  if (total > 0) {
+    return Math.max(0, Math.min(100, Math.round((remaining / total) * 100)));
+  }
+  return Math.max(0, Math.min(100, Math.round(remaining)));
+}
+
+export async function getGlmUsage(apiKey: string, providerSpecificData?: Record<string, unknown>) {
+  if (!apiKey) {
+    return { message: "API key not available. Add a coding plan API key to view usage." };
+  }
+
+  const quotaUrl = getGlmQuotaUrl(providerSpecificData);
+
+  const res = await fetch(quotaUrl, {
+    headers: {
+      Authorization: `Bearer ${apiKey}`,
+      Accept: "application/json",
+    },
+  });
+
+  if (!res.ok) {
+    if (res.status === 401) throw new Error("Invalid API key");
+    throw new Error(`GLM quota API error (${res.status})`);
+  }
+
+  const json = await res.json();
+  if (toNumber(json.code, 200) === 401 || json.success === false) {
+    throw new Error("Invalid API key");
+  }
+
+  const data = toRecord(json.data);
+  const limits: unknown[] = Array.isArray(data.limits) ? data.limits : [];
+  const quotas: Record<string, UsageQuota> = {};
+
+  for (const limit of limits) {
+    const src = toRecord(limit);
+    const type = String(src.type || "").toUpperCase();
+    const resetMs = toNumber(src.nextResetTime, 0);
+    const resetAt = resetMs > 0 ? new Date(resetMs).toISOString() : null;
+
+    if (type === "TOKENS_LIMIT") {
+      const quotaName = getGlmTokenQuotaName(src, quotas);
+      const usedPercent = toPercentage(src.percentage);
+      const remaining = Math.max(0, 100 - usedPercent);
+
+      quotas[quotaName] = {
+        used: usedPercent,
+        total: 100,
+        remaining,
+        remainingPercentage: remaining,
+        resetAt,
+        displayName: getGlmQuotaDisplayName(quotaName),
+        details: Array.isArray(src.models)
+          ? (src.models as unknown[]).map((m) => {
+              const modelInfo = toRecord(m);
+              return {
+                name: String(modelInfo.model || ""),
+                used: toNumber(modelInfo.percentage, 0),
+              };
+            })
+          : [],
+        unlimited: false,
+      };
+      continue;
+    }
+
+    if (type === "TIME_LIMIT") {
+      const total = toNumber(src.usage, toNumber(src.total, 0));
+      const remaining = toNumber(src.remaining, Math.max(0, 100 - toPercentage(src.percentage)));
+      const used = toNumber(src.currentValue, Math.max(0, total - remaining));
+      const remainingPercentage = glmMonthlyRemainingPercentage(total, remaining);
+
+      quotas["mcp_monthly"] = {
+        used,
+        total,
+        remaining,
+        remainingPercentage,
+        resetAt,
+        unlimited: false,
+        displayName: "Monthly",
+        details: Array.isArray(src.usageDetails)
+          ? src.usageDetails.map((item) => {
+              const detail = toRecord(item);
+              return {
+                name: String(detail.modelCode || detail.name || "usage"),
+                used: toNumber(detail.usage, 0),
+              };
+            })
+          : undefined,
+      };
+    }
+  }
+
+  const levelRaw =
+    typeof data.planName === "string"
+      ? data.planName
+      : typeof data.level === "string"
+        ? data.level
+        : "";
+  const plan = levelRaw ? toTitleCase(levelRaw.replace(/\s*plan$/i, "")) : null;
+
+  return { plan, quotas: orderGlmQuotas(quotas) };
+}
diff --git a/open-sse/services/usage/minimax.ts b/open-sse/services/usage/minimax.ts
new file mode 100644
index 0000000000..db45138371
--- /dev/null
+++ b/open-sse/services/usage/minimax.ts
@@ -0,0 +1,346 @@
+/**
+ * usage/minimax.ts — MiniMax (minimax / minimax-cn) usage fetcher + quota helpers.
+ *
+ * Extracted from services/usage.ts (god-file decomposition): the full MiniMax family —
+ * plan-label inference, per-window quota assembly, and the getMiniMaxUsage fetcher that
+ * probes the coding-plan remains endpoints. Depends only on the sibling scalar/quota
+ * leaves — no host coupling — so it lives as a co-located provider leaf. usage.ts imports
+ * getMiniMaxUsage (dispatcher) + getMiniMaxPlanLabel/getMiniMaxSessionTotal (__testing).
+ * Behavior-preserving move.
+ */
+
+import { toRecord, toNumber, getFieldValue, pickFirstNonEmptyString } from "./scalars.ts";
+import { type UsageQuota, parseResetTime, createQuotaFromUsage } from "./quota.ts";
+
+type JsonRecord = Record<string, unknown>;
+
+const MINIMAX_USAGE_CONFIG = {
+  minimax: {
+    usageUrls: [
+      "https://www.minimax.io/v1/token_plan/remains",
+      "https://api.minimax.io/v1/api/openplatform/coding_plan/remains",
+    ],
+  },
+  "minimax-cn": {
+    usageUrls: [
+      "https://www.minimaxi.com/v1/api/openplatform/coding_plan/remains",
+      "https://api.minimaxi.com/v1/api/openplatform/coding_plan/remains",
+    ],
+  },
+} as const;
+
+export function inferMiniMaxPlanLabelFromTotals(models: JsonRecord[]): string | null {
+  const maxSessionTotal = models.reduce(
+    (maxTotal, model) => Math.max(maxTotal, getMiniMaxSessionTotal(model)),
+    0
+  );
+
+  if (maxSessionTotal >= 15_000) return "Max";
+  if (maxSessionTotal >= 4_500) return "Plus";
+  if (maxSessionTotal >= 1_500) return "Starter";
+  return null;
+}
+
+export function getMiniMaxPlanLabel(payload: JsonRecord, models: JsonRecord[] = []): string {
+  const raw = pickFirstNonEmptyString(
+    getFieldValue(payload, "current_subscribe_title", "currentSubscribeTitle"),
+    getFieldValue(payload, "plan_name", "planName"),
+    getFieldValue(payload, "plan", "plan"),
+    getFieldValue(payload, "current_plan_title", "currentPlanTitle"),
+    getFieldValue(payload, "combo_title", "comboTitle")
+  );
+
+  if (!raw) return inferMiniMaxPlanLabelFromTotals(models) || "Coding Plan";
+
+  const cleaned = raw
+    .replace(/^minimax\s+/i, "")
+    .replace(/\bcoding\s+plan\b/gi, "")
+    .replace(/\s{2,}/g, " ")
+    .trim();
+
+  return cleaned || inferMiniMaxPlanLabelFromTotals(models) || "Coding Plan";
+}
+
+export function getMiniMaxQuotaResetAt(
+  model: JsonRecord,
+  capturedAtMs: number,
+  remainsTimeSnakeKey: string,
+  remainsTimeCamelKey: string,
+  endTimeSnakeKey: string,
+  endTimeCamelKey: string
+): string | null {
+  const remainsMs = toNumber(getFieldValue(model, remainsTimeSnakeKey, remainsTimeCamelKey), 0);
+  if (remainsMs > 0) {
+    return new Date(capturedAtMs + remainsMs).toISOString();
+  }
+
+  return parseResetTime(getFieldValue(model, endTimeSnakeKey, endTimeCamelKey));
+}
+
+export function isMiniMaxTextQuotaModel(modelName: string): boolean {
+  const normalized = modelName.trim().toLowerCase();
+  return (
+    normalized.startsWith("minimax-m") ||
+    normalized.startsWith("coding-plan") ||
+    // MiniMax Coding Plan surfaces the text/coding quota under model "general"
+    // (media buckets like "video"/"image"/"music" are excluded).
+    normalized === "general"
+  );
+}
+
+export function getMiniMaxSessionTotal(model: JsonRecord): number {
+  return Math.max(
+    0,
+    toNumber(getFieldValue(model, "current_interval_total_count", "currentIntervalTotalCount"), 0)
+  );
+}
+
+export function getMiniMaxWeeklyTotal(model: JsonRecord): number {
+  return Math.max(
+    0,
+    toNumber(getFieldValue(model, "current_weekly_total_count", "currentWeeklyTotalCount"), 0)
+  );
+}
+
+function pickMiniMaxRepresentativeModel(
+  models: JsonRecord[],
+  getTotal: (model: JsonRecord) => number
+): JsonRecord | null {
+  const withQuota = models.filter((model) => getTotal(model) > 0);
+  const pool = withQuota.length > 0 ? withQuota : models;
+  if (pool.length === 0) return null;
+
+  return pool.reduce((best, current) => (getTotal(current) > getTotal(best) ? current : best));
+}
+
+export function createMiniMaxQuotaFromCount(
+  total: number,
+  count: number,
+  resetAt: string | null,
+  countMeansRemaining: boolean
+): UsageQuota {
+  const used = countMeansRemaining ? Math.max(total - count, 0) : count;
+  return createQuotaFromUsage(used, total, resetAt);
+}
+
+/**
+ * MiniMax Coding Plan exposes per-window remaining as a 0–100 percent
+ * (`current_interval_remaining_percent` / `current_weekly_remaining_percent`)
+ * with zero request counts. Read it defensively (string-encoded numbers ok).
+ */
+export function getMiniMaxRemainingPercent(
+  model: JsonRecord,
+  snakeKey: string,
+  camelKey: string
+): number | null {
+  const raw = getFieldValue(model, snakeKey, camelKey);
+  if (raw === null || raw === undefined || raw === "") return null;
+  const parsed = toNumber(raw, NaN);
+  return Number.isFinite(parsed) ? Math.max(0, Math.min(100, parsed)) : null;
+}
+
+/** Build a 0–100 percent-based window quota (used = 100 − remaining). */
+export function createMiniMaxQuotaFromPercent(
+  remainingPercent: number,
+  resetAt: string | null
+): UsageQuota {
+  const clamped = Math.max(0, Math.min(100, remainingPercent));
+  return createQuotaFromUsage(100 - clamped, 100, resetAt);
+}
+
+/**
+ * Build one MiniMax usage window (session or weekly) from the representative
+ * model. Token Plan keys report request counts (`*_total_count`); Coding Plan
+ * keys report zero counts and a `*_remaining_percent` instead — fall back to
+ * that so the Coding Plan still surfaces a quota. The percent signal is keyed
+ * off "counts == 0 + percent present", NOT the endpoint URL, because the
+ * `token_plan/remains` and `coding_plan/remains` endpoints return identical
+ * Coding-Plan payloads for a Coding Plan key.
+ */
+function buildMiniMaxWindow(
+  models: JsonRecord[],
+  getTotal: (model: JsonRecord) => number,
+  usageCountKeys: [string, string],
+  percentKeys: [string, string],
+  resetKeys: [string, string, string, string],
+  capturedAtMs: number,
+  countMeansRemaining: boolean
+): UsageQuota | null {
+  const model = pickMiniMaxRepresentativeModel(models, getTotal);
+  if (!model) return null;
+
+  const resetAt = getMiniMaxQuotaResetAt(model, capturedAtMs, ...resetKeys);
+  const total = getTotal(model);
+
+  if (total > 0) {
+    const count = Math.max(0, toNumber(getFieldValue(model, ...usageCountKeys), 0));
+    return createMiniMaxQuotaFromCount(total, count, resetAt, countMeansRemaining);
+  }
+
+  const remainingPercent = getMiniMaxRemainingPercent(model, ...percentKeys);
+  return remainingPercent !== null
+    ? createMiniMaxQuotaFromPercent(remainingPercent, resetAt)
+    : null;
+}
+
+export function getMiniMaxAuthErrorMessage(message: string): string {
+  const normalized = message.toLowerCase();
+  if (
+    normalized.includes("token plan") ||
+    normalized.includes("coding plan") ||
+    normalized.includes("active period") ||
+    normalized.includes("invalid api key") ||
+    normalized.includes("invalid key") ||
+    normalized.includes("subscription")
+  ) {
+    return "MiniMax Token Plan API key invalid or inactive. Use an active Token Plan key.";
+  }
+
+  return "MiniMax access denied. Confirm the key is an active Token Plan API key.";
+}
+
+export function getMiniMaxErrorSummary(status: number, message: string): string {
+  const compact = message.replace(/\s+/g, " ").trim();
+  if (!compact) {
+    return `MiniMax usage endpoint error (${status}).`;
+  }
+  if (compact.length <= 160) {
+    return `MiniMax usage endpoint error (${status}): ${compact}`;
+  }
+  return `MiniMax usage endpoint error (${status}): ${compact.slice(0, 157)}...`;
+}
+
+export async function getMiniMaxUsage(apiKey: string, provider: "minimax" | "minimax-cn") {
+  if (!apiKey) {
+    return { message: "MiniMax API key not available. Add a Token Plan API key." };
+  }
+
+  const usageUrls = MINIMAX_USAGE_CONFIG[provider].usageUrls;
+  let lastErrorMessage = "";
+
+  for (let index = 0; index < usageUrls.length; index += 1) {
+    const usageUrl = usageUrls[index];
+    const canFallback = index < usageUrls.length - 1;
+
+    try {
+      const response = await fetch(usageUrl, {
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${apiKey}`,
+          Accept: "application/json",
+          "Content-Type": "application/json",
+        },
+      });
+
+      const rawText = await response.text();
+      let payload: JsonRecord = {};
+      if (rawText) {
+        try {
+          payload = toRecord(JSON.parse(rawText));
+        } catch {
+          payload = {};
+        }
+      }
+
+      const baseResp = toRecord(getFieldValue(payload, "base_resp", "baseResp"));
+      const apiStatusCode = toNumber(getFieldValue(baseResp, "status_code", "statusCode"), 0);
+      const apiStatusMessage = String(
+        getFieldValue(baseResp, "status_msg", "statusMsg") ?? ""
+      ).trim();
+      const combinedMessage = `${apiStatusMessage} ${rawText}`.trim();
+      const authLikeStatusMessage =
+        /token plan|coding plan|invalid api key|invalid key|unauthorized|inactive/i;
+
+      if (
+        response.status === 401 ||
+        response.status === 403 ||
+        apiStatusCode === 1004 ||
+        authLikeStatusMessage.test(apiStatusMessage)
+      ) {
+        return { message: getMiniMaxAuthErrorMessage(apiStatusMessage || combinedMessage) };
+      }
+
+      if (!response.ok) {
+        lastErrorMessage = getMiniMaxErrorSummary(response.status, combinedMessage);
+        if (
+          (response.status === 404 || response.status === 405 || response.status >= 500) &&
+          canFallback
+        ) {
+          continue;
+        }
+        return { message: `MiniMax connected. ${lastErrorMessage}` };
+      }
+
+      if (rawText && Object.keys(payload).length === 0) {
+        return { message: "MiniMax connected. Unable to parse usage response." };
+      }
+
+      if (apiStatusCode !== 0) {
+        if (apiStatusMessage) {
+          return { message: `MiniMax connected. ${apiStatusMessage}` };
+        }
+        return { message: "MiniMax connected. Upstream quota API returned an error." };
+      }
+
+      const capturedAtMs = Date.now();
+      const modelRemains = getFieldValue(payload, "model_remains", "modelRemains");
+      const allModels = Array.isArray(modelRemains)
+        ? modelRemains.map((item) => toRecord(item))
+        : [];
+      const textModels = allModels.filter((model) => {
+        const modelName = String(getFieldValue(model, "model_name", "modelName") ?? "");
+        return isMiniMaxTextQuotaModel(modelName);
+      });
+
+      if (textModels.length === 0) {
+        return { message: "MiniMax connected. No text quota data was returned." };
+      }
+
+      const countMeansRemaining = usageUrl.includes("/coding_plan/remains");
+      const quotas: Record<string, UsageQuota> = {};
+
+      const sessionQuota = buildMiniMaxWindow(
+        textModels,
+        getMiniMaxSessionTotal,
+        ["current_interval_usage_count", "currentIntervalUsageCount"],
+        ["current_interval_remaining_percent", "currentIntervalRemainingPercent"],
+        ["remains_time", "remainsTime", "end_time", "endTime"],
+        capturedAtMs,
+        countMeansRemaining
+      );
+      if (sessionQuota) {
+        quotas["session (5h)"] = sessionQuota;
+      }
+
+      const weeklyQuota = buildMiniMaxWindow(
+        textModels,
+        getMiniMaxWeeklyTotal,
+        ["current_weekly_usage_count", "currentWeeklyUsageCount"],
+        ["current_weekly_remaining_percent", "currentWeeklyRemainingPercent"],
+        ["weekly_remains_time", "weeklyRemainsTime", "weekly_end_time", "weeklyEndTime"],
+        capturedAtMs,
+        countMeansRemaining
+      );
+      if (weeklyQuota) {
+        quotas["weekly (7d)"] = weeklyQuota;
+      }
+
+      if (Object.keys(quotas).length === 0) {
+        return { message: "MiniMax connected. Unable to extract text quota usage." };
+      }
+
+      return { plan: getMiniMaxPlanLabel(payload, textModels), quotas };
+    } catch (error) {
+      lastErrorMessage = (error as Error).message;
+      if (!canFallback) {
+        break;
+      }
+    }
+  }
+
+  return {
+    message: lastErrorMessage
+      ? `MiniMax connected. Unable to fetch usage: ${lastErrorMessage}`
+      : "MiniMax connected. Unable to fetch usage.",
+  };
+}
diff --git a/open-sse/services/usage/quota.ts b/open-sse/services/usage/quota.ts
new file mode 100644
index 0000000000..ce9642c902
--- /dev/null
+++ b/open-sse/services/usage/quota.ts
@@ -0,0 +1,85 @@
+/**
+ * usage/quota.ts — shared usage-quota shape + builders for the usage fetchers.
+ *
+ * Extracted from services/usage.ts (god-file decomposition): the `UsageQuota` value
+ * type every per-provider fetcher returns, plus the two pure builders that normalize
+ * upstream reset timestamps and assemble a quota from used/total counts. Depends only on
+ * the sibling scalar leaf — no network, no DB, no module state — so usage.ts and the
+ * per-provider fetcher leaves (MiniMax, GLM, …) import it without a cycle.
+ */
+
+import { toNumber, clampPercentage } from "./scalars.ts";
+
+export type UsageQuota = {
+  used: number;
+  total: number;
+  remaining?: number;
+  remainingPercentage?: number;
+  resetAt: string | null;
+  unlimited: boolean;
+  /**
+   * True when the upstream provider reported the remaining fraction. False
+   * means the API didn't include the field and the 0 value here is a sentinel,
+   * NOT a confirmed-exhausted state. Antigravity-specific.
+   */
+  fractionReported?: boolean;
+  quotaSource?: "retrieveUserQuota" | "fetchAvailableModels" | "localUsageHistory";
+  displayName?: string;
+  details?: Array<{
+    name: string;
+    used: number;
+  }>;
+  currency?: string;
+  grantedBalance?: number;
+  toppedUpBalance?: number;
+};
+
+export function parseResetTime(resetValue: unknown): string | null {
+  if (!resetValue) return null;
+
+  try {
+    let date: Date;
+    if (resetValue instanceof Date) {
+      date = resetValue;
+    } else if (typeof resetValue === "number") {
+      date = new Date(resetValue < 1e12 ? resetValue * 1000 : resetValue);
+    } else if (typeof resetValue === "string") {
+      // Numeric strings are Unix timestamps too (seconds or milliseconds).
+      // `new Date("1700000000")` otherwise returns Invalid Date.
+      if (/^\d+$/.test(resetValue)) {
+        const ts = Number(resetValue);
+        date = new Date(ts < 1e12 ? ts * 1000 : ts);
+      } else {
+        date = new Date(resetValue);
+      }
+    } else {
+      return null;
+    }
+
+    // Epoch-zero (1970-01-01) means no scheduled reset — treat as null
+    if (date.getTime() <= 0) return null;
+
+    return date.toISOString();
+  } catch {
+    return null;
+  }
+}
+
+export function createQuotaFromUsage(
+  usedValue: unknown,
+  totalValue: unknown,
+  resetValue: unknown
+): UsageQuota {
+  const total = Math.max(0, toNumber(totalValue, 0));
+  const used = total > 0 ? Math.min(Math.max(0, toNumber(usedValue, 0)), total) : 0;
+  const remaining = total > 0 ? Math.max(total - used, 0) : 0;
+
+  return {
+    used,
+    total,
+    remaining,
+    remainingPercentage: total > 0 ? clampPercentage((remaining / total) * 100) : 0,
+    resetAt: parseResetTime(resetValue),
+    unlimited: false,
+  };
+}
diff --git a/open-sse/services/usage/scalars.ts b/open-sse/services/usage/scalars.ts
new file mode 100644
index 0000000000..24d1db37d9
--- /dev/null
+++ b/open-sse/services/usage/scalars.ts
@@ -0,0 +1,75 @@
+/**
+ * usage/scalars.ts — pure scalar + string coercion helpers for usage fetchers.
+ *
+ * Extracted from services/usage.ts (god-file decomposition): the zero-dependency
+ * primitives that the per-provider usage fetchers lean on to coerce raw upstream JSON
+ * (numbers, percentages, snake/camel field lookups, display labels). Pure — no network,
+ * no DB, no module state — so they live as a neutral leaf that usage.ts (and future
+ * per-provider fetcher leaves) import without a cycle. Behavior-preserving move.
+ */
+
+type JsonRecord = Record<string, unknown>;
+
+export function toRecord(value: unknown): JsonRecord {
+  return value && typeof value === "object" && !Array.isArray(value) ? (value as JsonRecord) : {};
+}
+
+export function toNumber(value: unknown, fallback = 0): number {
+  const parsed =
+    typeof value === "number"
+      ? value
+      : typeof value === "string" && value.trim().length > 0
+        ? Number(value)
+        : Number.NaN;
+  return Number.isFinite(parsed) ? parsed : fallback;
+}
+
+export function toPercentage(value: unknown): number {
+  return Math.max(0, Math.min(100, toNumber(value, 0)));
+}
+
+export function toTitleCase(value: string): string {
+  return value
+    .trim()
+    .split(/[\s_-]+/)
+    .filter(Boolean)
+    .map((part) => part.charAt(0).toUpperCase() + part.slice(1).toLowerCase())
+    .join(" ");
+}
+
+export function getFieldValue(source: unknown, snakeKey: string, camelKey: string): unknown {
+  const obj = toRecord(source);
+  return obj[snakeKey] ?? obj[camelKey] ?? null;
+}
+
+export function clampPercentage(value: number): number {
+  return Math.max(0, Math.min(100, value));
+}
+
+export function roundCurrency(value: number): number {
+  return Math.round(value * 100) / 100;
+}
+
+export function toDisplayLabel(value: string): string {
+  return value
+    .replace(/^copilot[_\s-]*/i, "")
+    .split(/[\s_-]+/)
+    .filter(Boolean)
+    .map((part) => {
+      if (/^pro\+$/i.test(part)) return "Pro+";
+      if (/^[a-z]{2,}$/.test(part))
+        return part.charAt(0).toUpperCase() + part.slice(1).toLowerCase();
+      return part;
+    })
+    .join(" ")
+    .trim();
+}
+
+export function pickFirstNonEmptyString(...values: unknown[]): string | undefined {
+  for (const value of values) {
+    if (typeof value !== "string") continue;
+    const trimmed = value.trim();
+    if (trimmed) return trimmed;
+  }
+  return undefined;
+}
diff --git a/open-sse/translator/helpers/claudeHelper.ts b/open-sse/translator/helpers/claudeHelper.ts
index 43b1a73132..6d8c8edb81 100644
--- a/open-sse/translator/helpers/claudeHelper.ts
+++ b/open-sse/translator/helpers/claudeHelper.ts
@@ -302,6 +302,33 @@ export function prepareClaudeRequest(
       }
     }
 
+    // Tools: for non-Anthropic providers (MiniMax and other Anthropic-compatible
+    // Claude-shape endpoints) strip Anthropic-only built-in tools (e.g.
+    // web_search_20250305) and normalize OpenAI-wire-shape tools to the
+    // Anthropic-native shape — fold `function.{name,description,parameters}`
+    // into top-level `{name, description, input_schema}` and drop the stray
+    // `type` field. Without this MiniMax rejects with code 2013 ("invalid
+    // tool type"). Port of upstream decolua/9router@45240c19.
+    if (body.tools && Array.isArray(body.tools) && provider !== "claude") {
+      body.tools = body.tools
+        .filter((tool) => !tool.type || tool.type === "function")
+        .map((tool) => {
+          const t = tool as ClaudeTool & {
+            function?: { name?: string; description?: string; parameters?: unknown };
+            type?: string;
+          };
+          if (t.function) {
+            return {
+              name: t.function.name,
+              description: t.function.description,
+              input_schema: t.function.parameters,
+            } as ClaudeTool;
+          }
+          const { type: _type, ...rest } = t;
+          return rest as ClaudeTool;
+        });
+    }
+
     // Also filter top-level tool declarations with empty names
     if (body.tools && Array.isArray(body.tools)) {
       body.tools = body.tools.filter((tool) => tool.name && tool.name?.trim());
diff --git a/open-sse/translator/helpers/geminiHelper.ts b/open-sse/translator/helpers/geminiHelper.ts
index cb7c3d8fe8..b5bf0780b8 100644
--- a/open-sse/translator/helpers/geminiHelper.ts
+++ b/open-sse/translator/helpers/geminiHelper.ts
@@ -1,5 +1,7 @@
 // Gemini helper functions for translator
 
+import { safeParseJSON } from "./jsonUtil.ts";
+
 type JsonRecord = Record<string, unknown>;
 
 // Unsupported JSON Schema constraints that should be removed for Antigravity.
@@ -10,7 +12,10 @@ export const GEMINI_UNSUPPORTED_SCHEMA_KEYS = new Set([
   "maxLength",
   "exclusiveMinimum",
   "exclusiveMaximum",
-  "pattern",
+  // NOTE: `pattern` is intentionally NOT in this set. Antigravity (Gemini-derived
+  // surface) accepts `pattern` on string constraints, and glob/grep/file-search
+  // tools depend on it to express their argument regex. Removing it produced
+  // upstream 400s and wrong-tool semantics (decolua/9router#1368).
   "minItems",
   "maxItems",
   "format",
@@ -239,14 +244,9 @@ export function extractTextContent(content: unknown): string {
   return "";
 }
 
-// Try parse JSON safely
+// Try parse JSON safely (null fallback on parse error; re-export keeps legacy API).
 export function tryParseJSON(str: unknown): unknown {
-  if (typeof str !== "string") return str;
-  try {
-    return JSON.parse(str);
-  } catch {
-    return null;
-  }
+  return safeParseJSON(str, null);
 }
 
 // Generate request ID
diff --git a/open-sse/translator/helpers/jsonUtil.ts b/open-sse/translator/helpers/jsonUtil.ts
new file mode 100644
index 0000000000..0643c53336
--- /dev/null
+++ b/open-sse/translator/helpers/jsonUtil.ts
@@ -0,0 +1,18 @@
+// Safe JSON.parse helper shared by the translator layer.
+//
+// Behavior contract (must be preserved by all callers):
+//   - non-string input is returned unchanged (passthrough)
+//   - a valid JSON string is parsed and returned
+//   - on parse error the caller-chosen `fallback` is returned
+//
+// The `fallback` is explicit so the two historical `tryParseJSON` variants
+// can keep their distinct semantics: geminiHelper returns `null` on error,
+// while openai-to-claude returns the raw input string (passthrough).
+export function safeParseJSON<TFallback>(str: unknown, fallback: TFallback): unknown {
+  if (typeof str !== "string") return str;
+  try {
+    return JSON.parse(str);
+  } catch {
+    return fallback;
+  }
+}
diff --git a/open-sse/translator/helpers/openaiHelper.ts b/open-sse/translator/helpers/openaiHelper.ts
index b53bbb64e7..375364c725 100644
--- a/open-sse/translator/helpers/openaiHelper.ts
+++ b/open-sse/translator/helpers/openaiHelper.ts
@@ -35,6 +35,11 @@ export function filterToOpenAIFormat(body) {
   if (!body.messages || !Array.isArray(body.messages)) return body;
 
   body.messages = body.messages.map((msg) => {
+    // Normalize OpenAI Responses-style `developer` role to `system` — many
+    // OpenAI-compatible providers reject `developer` (ported from
+    // decolua/9router#1011).
+    if (msg.role === "developer") msg = { ...msg, role: "system" };
+
     // Keep tool messages as-is (OpenAI format)
     if (msg.role === "tool") return msg;
 
@@ -148,6 +153,9 @@ export function filterToOpenAIFormat(body) {
   // Strip Claude-specific fields that OpenAI-compatible providers reject
   delete body.metadata;
   delete body.anthropic_version;
+  // Codex clients send a top-level `client_metadata` object; OpenAI rejects it
+  // with 400 "Unknown parameter: 'client_metadata'" (9router#1157).
+  delete body.client_metadata;
 
   // Map max_output_tokens (from Vercel AI SDK) to max_tokens logic
   if (body.max_output_tokens !== undefined) {
diff --git a/open-sse/translator/helpers/toolCallHelper.ts b/open-sse/translator/helpers/toolCallHelper.ts
index e9177fa374..01f866fac7 100644
--- a/open-sse/translator/helpers/toolCallHelper.ts
+++ b/open-sse/translator/helpers/toolCallHelper.ts
@@ -2,6 +2,12 @@
 
 const ALPHANUM9 = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
 
+// Fallback streaming tool_call id when a provider response omits one (index optional).
+// `call_<ts>` when no index is given; `call_<index>_<ts>` when an index is supplied.
+export function fallbackToolCallId(index?: number): string {
+  return index === undefined ? `call_${Date.now()}` : `call_${index}_${Date.now()}`;
+}
+
 // Generate unique tool call ID (default long form)
 export function generateToolCallId() {
   return `call_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 9)}`;
diff --git a/open-sse/translator/index.ts b/open-sse/translator/index.ts
index d22ddbb3f8..febb538cb1 100644
--- a/open-sse/translator/index.ts
+++ b/open-sse/translator/index.ts
@@ -103,14 +103,24 @@ function hasNonEmptyReasoningContent(message: Record<string, unknown>): boolean
   return typeof message.reasoning_content === "string" && message.reasoning_content.length > 0;
 }
 
-function isDeepSeekReplayTarget(provider: unknown, model: unknown): boolean {
+function isReasoningOnlyReplayTarget(provider: unknown, model: unknown): boolean {
   const normalizedProvider = String(provider ?? "")
     .trim()
     .toLowerCase();
   const normalizedModel = String(model ?? "")
     .trim()
     .toLowerCase();
-  return normalizedProvider === "deepseek" || /(^|\/)deepseek/i.test(normalizedModel);
+  // DeepSeek V4 and Xiaomi MiMo both enforce "pass reasoning_content back on
+  // subsequent turns" even on PLAIN (non-tool-call) assistant turns. Without
+  // replaying on those turns the upstream 400s with "Param Incorrect: The
+  // reasoning_content in the thinking mode must be passed back to the API."
+  // (deepseek #1682, xiaomi-mimo 9router#1321/#1337).
+  return (
+    normalizedProvider === "deepseek" ||
+    /(^|\/)deepseek/i.test(normalizedModel) ||
+    normalizedProvider === "xiaomi-mimo" ||
+    /(^|\/)mimo/i.test(normalizedModel)
+  );
 }
 
 /** @param options.normalizeToolCallId - When true, use 9-char tool call ids (e.g. Mistral); when false, leave ids as-is */
@@ -319,7 +329,7 @@ export function translateRequest(
     interleavedField: resolvedCapabilities?.interleavedField ?? null,
   });
   if (isReasoner && result.messages && Array.isArray(result.messages)) {
-    const canReplayReasoningOnly = isDeepSeekReplayTarget(normalizedProvider, normalizedModel);
+    const canReplayReasoningOnly = isReasoningOnlyReplayTarget(normalizedProvider, normalizedModel);
 
     for (const [messageIndex, msg] of result.messages.entries()) {
       if (msg.role !== "assistant") continue;
diff --git a/open-sse/translator/paramSupport.ts b/open-sse/translator/paramSupport.ts
new file mode 100644
index 0000000000..142f5528bb
--- /dev/null
+++ b/open-sse/translator/paramSupport.ts
@@ -0,0 +1,60 @@
+// Strip request params a given provider/model rejects upstream (e.g. HTTP 400).
+// Config-driven: add a rule here instead of scattering `delete body.x` across
+// executors. Port from 9router#7ae9fff6 (fixes upstream #1748).
+//
+// Rule semantics:
+//   - `provider` (optional) limits the rule to a single provider id.
+//   - `match` is a RegExp tested against the model id OR a predicate (model -> boolean).
+//   - `drop` is the list of param keys to remove when the rule fires.
+//
+// A param is removed only when it is present (!== undefined). The helper never
+// introduces new keys and never throws on null/undefined bodies — call sites
+// can chain it without extra guards.
+
+type StripRule = {
+  provider?: string;
+  match: RegExp | ((model: string) => boolean);
+  drop: string[];
+};
+
+const STRIP_RULES: StripRule[] = [
+  // claude-opus-4 series: temperature is deprecated (Anthropic returns 400). #1748
+  { match: /claude-opus-4/i, drop: ["temperature"] },
+  // GitHub Copilot gpt-5.4: temperature unsupported.
+  { provider: "github", match: /gpt-5\.4/i, drop: ["temperature"] },
+  // GitHub Copilot Claude (except opus/sonnet 4.6): thinking + reasoning_effort rejected. #713
+  {
+    provider: "github",
+    match: (m: string) =>
+      /claude/i.test(m) && !/claude.*(opus|sonnet).*4\.6/i.test(m),
+    drop: ["thinking", "reasoning_effort"],
+  },
+];
+
+function matches(rule: StripRule, model: string): boolean {
+  return typeof rule.match === "function" ? rule.match(model) : rule.match.test(model);
+}
+
+/**
+ * Remove unsupported params from `body` in place. Returns the same reference
+ * (or `body` unchanged when it is not a plain object / model is empty).
+ */
+export function stripUnsupportedParams<T>(
+  provider: string | null | undefined,
+  model: string | null | undefined,
+  body: T
+): T {
+  if (!model || !body || typeof body !== "object") return body;
+  const rec = body as unknown as Record<string, unknown>;
+  for (const rule of STRIP_RULES) {
+    if (rule.provider && rule.provider !== provider) continue;
+    if (!matches(rule, model)) continue;
+    for (const key of rule.drop) {
+      if (rec[key] !== undefined) delete rec[key];
+    }
+  }
+  return body;
+}
+
+// Exported for unit tests only — do not import from production code.
+export const __STRIP_RULES_FOR_TEST: ReadonlyArray<StripRule> = STRIP_RULES;
diff --git a/open-sse/translator/request/claude-to-openai.ts b/open-sse/translator/request/claude-to-openai.ts
index 013fd77a4d..b6ff556316 100644
--- a/open-sse/translator/request/claude-to-openai.ts
+++ b/open-sse/translator/request/claude-to-openai.ts
@@ -55,7 +55,9 @@ function convertClaudeServerWebSearchTool(tool: JsonRecord): JsonRecord {
   return {
     type: "web_search",
     ...(Object.keys(filters).length > 0 ? { filters } : {}),
-    ...(tool.user_location && typeof tool.user_location === "object" && !Array.isArray(tool.user_location)
+    ...(tool.user_location &&
+    typeof tool.user_location === "object" &&
+    !Array.isArray(tool.user_location)
       ? { user_location: tool.user_location }
       : {}),
   };
@@ -133,32 +135,15 @@ export function claudeToOpenAIRequest(model, body, stream, credentials: unknown
     }
   }
 
-  // Fix missing tool responses - OpenAI requires every tool_call to have a response
-  fixMissingToolResponses(result.messages);
+  // #4714 / #4385: re-group every role:"tool" message immediately after the
+  // assistant turn whose tool_calls issued it (dropping genuine orphans), then
+  // fill placeholders for any tool_call left unanswered.
+  result.messages = regroupToolMessages(result.messages);
 
-  // #4385: drop orphan tool results — a role:"tool" message whose tool_call_id has no
-  // matching assistant.tool_calls (e.g. history truncation / compression removed the
-  // assistant turn that issued the call but kept the tool_result). OpenAI-compatible
-  // upstreams reject these with 502 "Messages with role 'tool' must be a response to a
-  // preceding message with 'tool_calls'". Mirrors the filter already applied on the
-  // Responses->Chat path in openai-responses.ts (#2893). Run after fixMissingToolResponses
-  // so the inserted "[No response received]" placeholders (which DO match a tool_call)
-  // are kept, and only genuinely orphaned results are removed.
-  const assistantToolCallIds = new Set<string>();
-  for (const msg of result.messages) {
-    const calls = (msg as JsonRecord).tool_calls;
-    if (Array.isArray(calls)) {
-      for (const tc of calls as { id?: string }[]) {
-        if (tc.id) assistantToolCallIds.add(String(tc.id));
-      }
-    }
-  }
-  result.messages = result.messages.filter((msg) => {
-    if ((msg as JsonRecord).role === "tool") {
-      return assistantToolCallIds.has(String((msg as JsonRecord).tool_call_id ?? ""));
-    }
-    return true;
-  });
+  // Fix missing tool responses - OpenAI requires every tool_call to have a response.
+  // Runs after regrouping so real results are already adjacent and only a truly
+  // unanswered tool_call receives a "[No response received]" placeholder.
+  fixMissingToolResponses(result.messages);
 
   const useNativeResponsesWebSearch = shouldUseNativeResponsesWebSearch(credentials);
 
@@ -223,6 +208,62 @@ export function claudeToOpenAIRequest(model, body, stream, credentials: unknown
   return result;
 }
 
+// #4714: Re-group tool result messages so every role:"tool" message sits
+// immediately after the assistant message whose tool_calls issued it, in
+// tool_calls order. Claude Code can issue parallel tool_use in one assistant turn
+// but have their tool_result blocks arrive across SEPARATE user turns with
+// interleaved text; the naive conversion then left a role:"tool" stranded after a
+// user message, which OpenAI-compatible upstreams reject with 400 "Messages with
+// role 'tool' must be a response to a preceding message with 'tool_calls'".
+// Tool messages whose tool_call_id matches no assistant.tool_calls are dropped here
+// (supersedes the standalone #4385 orphan filter — same drop behavior, plus ordering).
+function regroupToolMessages(messages: JsonRecord[]): JsonRecord[] {
+  // tool_call_id -> index of the assistant message that issued it (first wins).
+  const callIdToAssistant = new Map<string, number>();
+  messages.forEach((msg, idx) => {
+    if (msg.role === "assistant" && Array.isArray(msg.tool_calls)) {
+      for (const tc of msg.tool_calls as { id?: string }[]) {
+        if (tc.id && !callIdToAssistant.has(String(tc.id))) {
+          callIdToAssistant.set(String(tc.id), idx);
+        }
+      }
+    }
+  });
+
+  // Collect tool messages per assistant index, keyed by tool_call_id (first result wins).
+  const toolsByAssistant = new Map<number, Map<string, JsonRecord>>();
+  for (const msg of messages) {
+    if (msg.role !== "tool") continue;
+    const callId = String(msg.tool_call_id ?? "");
+    const assistantIdx = callIdToAssistant.get(callId);
+    if (assistantIdx === undefined) continue; // orphan -> drop
+    let group = toolsByAssistant.get(assistantIdx);
+    if (!group) {
+      group = new Map();
+      toolsByAssistant.set(assistantIdx, group);
+    }
+    if (!group.has(callId)) group.set(callId, msg);
+  }
+
+  // Rebuild: keep non-tool messages in order; attach each assistant's tool results
+  // immediately after it, ordered by the assistant's own tool_calls sequence.
+  const out: JsonRecord[] = [];
+  messages.forEach((msg, idx) => {
+    if (msg.role === "tool") return; // moved into its assistant's group
+    out.push(msg);
+    if (msg.role === "assistant" && Array.isArray(msg.tool_calls)) {
+      const group = toolsByAssistant.get(idx);
+      if (group) {
+        for (const tc of msg.tool_calls as { id?: string }[]) {
+          const tool = tc.id ? group.get(String(tc.id)) : undefined;
+          if (tool) out.push(tool);
+        }
+      }
+    }
+  });
+  return out;
+}
+
 // Fix missing tool responses - add empty responses for tool_calls without responses
 function fixMissingToolResponses(messages) {
   for (let i = 0; i < messages.length; i++) {
diff --git a/open-sse/translator/request/openai-to-claude.ts b/open-sse/translator/request/openai-to-claude.ts
index 55a1f28433..6e8d9b0058 100644
--- a/open-sse/translator/request/openai-to-claude.ts
+++ b/open-sse/translator/request/openai-to-claude.ts
@@ -4,6 +4,7 @@ import { FORMATS } from "../formats.ts";
 import { supportsClaudeMaxEffort, supportsXHighEffort } from "../../config/providerModels.ts";
 import { adjustMaxTokens } from "../helpers/maxTokensHelper.ts";
 import { sanitizeToolId } from "../helpers/schemaCoercion.ts";
+import { safeParseJSON } from "../helpers/jsonUtil.ts";
 import { DEFAULT_THINKING_CLAUDE_SIGNATURE } from "../../config/defaultThinkingSignature.ts";
 import { capMaxOutputTokens } from "../../../src/lib/modelCapabilities.ts";
 import { isAdaptiveThinkingOnly } from "../../../src/shared/constants/modelSpecs.ts";
@@ -701,14 +702,9 @@ function extractTextContent(content) {
   return "";
 }
 
-// Try parse JSON
-function tryParseJSON(str) {
-  if (typeof str !== "string") return str;
-  try {
-    return JSON.parse(str);
-  } catch {
-    return str;
-  }
+// Try parse JSON (passthrough fallback: return the raw input string on parse error).
+function tryParseJSON(str: unknown): unknown {
+  return safeParseJSON(str, str);
 }
 
 function stripCacheControl(value: unknown): unknown {
diff --git a/open-sse/translator/request/openai-to-gemini.ts b/open-sse/translator/request/openai-to-gemini.ts
index bc9e6651e6..3042ce12e0 100644
--- a/open-sse/translator/request/openai-to-gemini.ts
+++ b/open-sse/translator/request/openai-to-gemini.ts
@@ -282,15 +282,23 @@ function openaiToGeminiBase(
   }
 
   // Thinking / Reasoning support (Google Gemini 2.0+ Thinking models)
-  // 1. OpenAI format: reasoning_effort (low/medium/high)
+  // 1. OpenAI format: reasoning_effort (low/medium/high/auto/max/xhigh)
+  // "auto", "max", and "xhigh" are clamped to the high-tier budget because Gemini
+  // does not accept these strings directly. "auto" signals "use max reasonable effort"
+  // which maps to high. "max"/"xhigh" exceed Gemini's accepted range and are clamped.
+  // Port of decolua/9router#2043 by @nguyenxvotanminh3.
   if (body.reasoning_effort) {
+    const highBudget = capThinkingBudget(model, 32768);
     const budgetMap: Record<string, number> = {
       low: 1024,
       medium: getDefaultThinkingBudget(model) || 8192,
-      high: capThinkingBudget(model, 32768),
+      high: highBudget,
+      auto: highBudget,
+      max: highBudget,
+      xhigh: highBudget,
     };
     const budget =
-      budgetMap[body.reasoning_effort as string] || getDefaultThinkingBudget(model) || 8192;
+      budgetMap[body.reasoning_effort as string] ?? getDefaultThinkingBudget(model) ?? 8192;
     result.generationConfig.thinkingConfig = {
       thinkingBudget: budget,
       includeThoughts: true,
diff --git a/open-sse/translator/response/claude-to-openai.ts b/open-sse/translator/response/claude-to-openai.ts
index 22af8213b6..da553489ae 100644
--- a/open-sse/translator/response/claude-to-openai.ts
+++ b/open-sse/translator/response/claude-to-openai.ts
@@ -102,8 +102,12 @@ export function claudeToOpenAIResponse(chunk, state) {
 
     case "content_block_stop": {
       if (state.inThinkingBlock && chunk.index === state.currentBlockIndex) {
-        // Thinking block closed — no additional content needed;
-        // reasoning_content chunks have already been streamed
+        // Emit explicit close marker so clients that scan content for `</think>`
+        // (Claude Code, Cursor, etc.) know the thinking section ended; without
+        // it the UI stays stuck on the "thinking" indicator after the upstream
+        // stream completes. Ported from decolua/9router#454. `reasoning_content`
+        // consumers are unaffected — they already saw the streamed deltas above.
+        results.push(createChunk(state, { content: "</think>" }));
         state.inThinkingBlock = false;
       }
       state.textBlockStarted = false;
diff --git a/open-sse/translator/response/kiro-to-openai.ts b/open-sse/translator/response/kiro-to-openai.ts
index 5baaf4dc3c..57b70e626b 100644
--- a/open-sse/translator/response/kiro-to-openai.ts
+++ b/open-sse/translator/response/kiro-to-openai.ts
@@ -4,6 +4,7 @@
  */
 import { register } from "../registry.ts";
 import { FORMATS } from "../formats.ts";
+import { fallbackToolCallId } from "../helpers/toolCallHelper.ts";
 
 /**
  * Parse Kiro SSE event and convert to OpenAI format
@@ -116,7 +117,7 @@ export function convertKiroToOpenAI(chunk, state) {
   // Handle tool use events
   if (eventType === "toolUseEvent" || data.toolUseEvent) {
     const toolUse = data.toolUseEvent || data;
-    const toolCallId = toolUse.toolUseId || `call_${Date.now()}`;
+    const toolCallId = toolUse.toolUseId || fallbackToolCallId();
     const toolName = toolUse.name || "";
     const toolInput = toolUse.input || {};
 
diff --git a/open-sse/translator/response/openai-responses.ts b/open-sse/translator/response/openai-responses.ts
index cd3deb5b64..adc4680bb8 100644
--- a/open-sse/translator/response/openai-responses.ts
+++ b/open-sse/translator/response/openai-responses.ts
@@ -5,6 +5,7 @@
 import { register } from "../registry.ts";
 import { FORMATS } from "../formats.ts";
 import { appendToolCallArgumentDelta } from "../../utils/toolCallArguments.ts";
+import { fallbackToolCallId } from "../helpers/toolCallHelper.ts";
 
 function normalizeToolName(value) {
   return typeof value === "string" ? value.trim() : "";
@@ -615,7 +616,7 @@ function openaiResponsesToOpenAIResponseStream(chunk, state) {
   // Function call started
   if (eventType === "response.output_item.added" && data.item?.type === "function_call") {
     const item = data.item;
-    state.currentToolCallId = item.call_id || `call_${Date.now()}`;
+    state.currentToolCallId = item.call_id || fallbackToolCallId();
     state.currentToolCallArgsBuffer = ""; // reset per-call arg buffer
     state.currentToolCallDeferred = false;
 
@@ -694,7 +695,7 @@ function openaiResponsesToOpenAIResponseStream(chunk, state) {
     const item = data.item;
     const buffered = state.currentToolCallArgsBuffer || "";
     const currentIndex = state.toolCallIndex; // capture before increment
-    const callId = item.call_id || state.currentToolCallId || `call_${Date.now()}`;
+    const callId = item.call_id || state.currentToolCallId || fallbackToolCallId();
     const toolName = normalizeToolName(item.name);
 
     if (state.currentToolCallDeferred) {
diff --git a/open-sse/translator/response/openai-to-claude.ts b/open-sse/translator/response/openai-to-claude.ts
index c39020e0b5..edc12816b8 100644
--- a/open-sse/translator/response/openai-to-claude.ts
+++ b/open-sse/translator/response/openai-to-claude.ts
@@ -203,14 +203,17 @@ export function openaiToClaudeResponse(chunk, state) {
             continue;
           }
 
-          // Fix #1852: Strip empty string and array placeholders from streaming tool arguments
-          if (deltaStr.includes('""') || deltaStr.includes("[]") || deltaStr.includes("[ ]")) {
-            deltaStr = deltaStr
-              .replace(/,"[a-zA-Z0-9_]+":""/g, "")
-              .replace(/"[a-zA-Z0-9_]+":"",/g, "")
-              .replace(/,"[a-zA-Z0-9_]+":\s*\[\s*\]/g, "")
-              .replace(/"[a-zA-Z0-9_]+":\s*\[\s*\],?/g, "");
-          }
+          // NOTE: The regex-based "Fix #1852" strip that previously ran here was
+          // removed in #4951. That strip matched patterns like `"key":""` and
+          // `"key":[]` to remove spurious placeholder fields that some models emit
+          // as noise. However, since #3762 the snapshot-dedup logic in
+          // appendToolCallArgumentDelta already collapses repeated/growing snapshots
+          // into a single delta, so noise-only chunks are naturally suppressed.
+          // More critically, the regex unconditionally deleted any field whose value
+          // happened to be "" or [], silently corrupting intentional empty-string or
+          // empty-array arguments (e.g. {"file_path":"","content":"text"} →
+          // {"content":"text"}). Emit deltaStr as-is; the Claude client parses the
+          // assembled partial_json fragments and tolerates unknown extra fields.
 
           results.push({
             type: "content_block_delta",
diff --git a/open-sse/utils/proxyDispatcher.ts b/open-sse/utils/proxyDispatcher.ts
index df120d11a6..18c2f409b6 100644
--- a/open-sse/utils/proxyDispatcher.ts
+++ b/open-sse/utils/proxyDispatcher.ts
@@ -9,6 +9,15 @@ const DISPATCHER_CACHE_KEY = Symbol.for("omniroute.proxyDispatcher.cache");
 const DEFAULT_DISPATCHER_KEY = Symbol.for("omniroute.proxyDispatcher.default");
 const RETRY_DISPATCHER_KEY = Symbol.for("omniroute.proxyDispatcher.retry");
 const SUPPORTED_PROTOCOLS = new Set(["http:", "https:", "socks5:"]);
+// Edge-relay proxy types. These do NOT go through an HTTP/SOCKS dispatcher —
+// the caller wraps the upstream URL with buildRelayHeaders() and fetches the
+// relay endpoint directly. Keep this set as the single source of truth so
+// every dispatch decision stays in sync when a new relay backend lands.
+export const RELAY_TYPES: ReadonlySet<string> = new Set(["vercel", "deno", "cloudflare"]);
+
+export function isRelayType(type: string | undefined | null): boolean {
+  return typeof type === "string" && RELAY_TYPES.has(type);
+}
 const DEFAULT_PROXY_DISPATCHER_CONNECTIONS = 32;
 const MAX_PROXY_DISPATCHER_CONNECTIONS = 256;
 
@@ -34,6 +43,58 @@ type ProxyConfigObject = {
   family?: string;
 };
 
+/**
+ * Direct upstream fan-out dispatcher.
+ *
+ * A single Undici Agent configured with `connections > 1` should be enough in
+ * theory, but real Codex `/backend-api/codex/responses` streams on Node 24 have
+ * still been observed queuing every subsequent same-origin request until the
+ * previous stream emits trailers. Using several one-connection Agents gives
+ * each long SSE stream an independent pool/client and prevents one stream from
+ * monopolizing the effective queue while keeping pipelining disabled.
+ */
+class RoundRobinDispatcher {
+  private readonly dispatchers: Dispatcher[];
+  private nextIndex = 0;
+
+  constructor(dispatchers: Dispatcher[]) {
+    this.dispatchers = dispatchers;
+  }
+
+  dispatch(options: Dispatcher.DispatchOptions, handler: Dispatcher.DispatchHandler): boolean {
+    const dispatcher = this.dispatchers[this.nextIndex % this.dispatchers.length];
+    this.nextIndex = (this.nextIndex + 1) % this.dispatchers.length;
+    return dispatcher.dispatch(options, handler);
+  }
+
+  close(callback?: () => void): Promise<void> | void {
+    const done = Promise.all(this.dispatchers.map((dispatcher) => dispatcher.close())).then(
+      () => undefined
+    );
+    if (callback) {
+      done.then(callback);
+      return;
+    }
+    return done;
+  }
+
+  destroy(
+    errorOrCallback?: Error | null | (() => void),
+    callback?: () => void
+  ): Promise<void> | void {
+    const callbackFn = typeof errorOrCallback === "function" ? errorOrCallback : callback;
+    const error = typeof errorOrCallback === "function" ? null : (errorOrCallback ?? null);
+    const done = Promise.all(this.dispatchers.map((dispatcher) => dispatcher.destroy(error))).then(
+      () => undefined
+    );
+    if (callbackFn) {
+      done.then(callbackFn);
+      return;
+    }
+    return done;
+  }
+}
+
 function getDispatcherCache(): DispatcherCache {
   const globalWithCache = globalThis as GlobalWithDispatcherCache;
   if (!globalWithCache[DISPATCHER_CACHE_KEY]) {
@@ -127,12 +188,11 @@ export function getDefaultDispatcherConnectionLimit(
 
 function getDefaultDispatcherOptions(env: Record<string, string | undefined> = process.env) {
   const options = getDispatcherOptions();
-  // #4580 — On the direct egress path, undici's default pipelining (1) lets a long
-  // SSE stream monopolize the single pooled socket per origin, serializing every
-  // other concurrent request to that same provider. Mirror the proxy fix (#4288):
-  // disable pipelining and keep several connections available. Unlike the proxy
-  // path we KEEP keep-alive — the 1ms TTL there is a cheap-proxy-socket workaround,
-  // not needed (and harmful to perf) for direct connections.
+  // #4580 — On the direct egress path, undici's default pipelining (1) let a long
+  // SSE stream monopolize the single pooled socket per origin. Keep the public
+  // connection-limit option here, but getDefaultDispatcher() fans it out across
+  // independent one-connection Agents; in production traces, one multi-connection
+  // Agent could still queue same-origin Codex streams behind prior trailers.
   return {
     ...options,
     connections: getDefaultDispatcherConnectionLimit(env),
@@ -140,10 +200,23 @@ function getDefaultDispatcherOptions(env: Record<string, string | undefined> = p
   };
 }
 
+function createRoundRobinDirectDispatcher(connectionLimit: number): Dispatcher {
+  const baseOptions = getDispatcherOptions();
+  const perAgentOptions = {
+    ...baseOptions,
+    connections: 1,
+    pipelining: 0,
+  };
+  const dispatchers = Array.from({ length: connectionLimit }, () => new Agent(perAgentOptions));
+  return new RoundRobinDispatcher(dispatchers) as unknown as Dispatcher;
+}
+
 export function getDefaultDispatcher(): Dispatcher {
   const globalWithCache = globalThis as GlobalWithDispatcherCache;
   if (!globalWithCache[DEFAULT_DISPATCHER_KEY]) {
-    globalWithCache[DEFAULT_DISPATCHER_KEY] = new Agent(getDefaultDispatcherOptions());
+    globalWithCache[DEFAULT_DISPATCHER_KEY] = createRoundRobinDirectDispatcher(
+      getDefaultDispatcherConnectionLimit()
+    );
   }
   return globalWithCache[DEFAULT_DISPATCHER_KEY];
 }
@@ -317,6 +390,11 @@ export function buildVercelRelayHeaders(
   };
 }
 
+// Vercel + Deno Deploy share the same x-relay-{target,path,auth} envelope.
+// Use this alias when the call is intentionally backend-agnostic; the named
+// vercel-specific export above stays for direct callers that already use it.
+export const buildRelayHeaders = buildVercelRelayHeaders;
+
 export function proxyConfigToUrl(
   proxyConfig: unknown,
   { allowSocks5 = isSocks5ProxyEnabled() } = {}
@@ -337,9 +415,12 @@ export function proxyConfigToUrl(
   if (!config.host) return null;
   const type = String(config.type || "http").toLowerCase();
 
-  // Vercel Relay entries carry the relay URL in `host` — no dispatcher needed;
-  // callers should use buildVercelRelayHeaders() and fetch directly.
-  if (type === "vercel") {
+  // Edge-relay entries (vercel / deno / cloudflare) carry the relay URL in
+  // `host` — no dispatcher needed; callers should use buildRelayHeaders() and
+  // fetch the relay endpoint directly. All relay types share the exact same
+  // x-relay-target / x-relay-path / x-relay-auth header spec (only the
+  // deployment target differs).
+  if (RELAY_TYPES.has(type)) {
     return config.host ? `https://${config.host}` : null;
   }
 
@@ -400,6 +481,10 @@ export function __getDefaultDispatcherOptionsForTest(
   return getDefaultDispatcherOptions(env);
 }
 
+export function __createRoundRobinDispatcherForTest(dispatchers: Dispatcher[]): Dispatcher {
+  return new RoundRobinDispatcher(dispatchers) as unknown as Dispatcher;
+}
+
 export function createProxyDispatcher(proxyUrl: string): Dispatcher {
   const normalizedUrl = normalizeProxyUrl(proxyUrl, "proxy dispatcher");
   const dispatcherCache = getDispatcherCache();
diff --git a/open-sse/utils/proxyFetch.ts b/open-sse/utils/proxyFetch.ts
index 87d925e745..680377009d 100644
--- a/open-sse/utils/proxyFetch.ts
+++ b/open-sse/utils/proxyFetch.ts
@@ -7,6 +7,7 @@ import {
   createProxyDispatcher,
   getDefaultDispatcher,
   getRetryDispatcher,
+  isRelayType,
   normalizeProxyUrl,
   proxyConfigToUrl,
   proxyUrlForLogs,
@@ -277,9 +278,10 @@ export async function runWithProxyContext(
 
   // T14: Proxy Fast-Fail
   // Perform a short TCP reachability check before issuing upstream requests.
-  // Skip for vercel-relay type: proxyConfigToUrl returns "https://<host>" which is the
-  // relay endpoint itself, not a proxy — the actual routing is handled via relay headers.
-  const isVercelRelay = (effectiveProxyConfig as { type?: string })?.type === "vercel";
+  // Skip for edge-relay types (vercel / deno): proxyConfigToUrl returns
+  // "https://<host>" which is the relay endpoint itself, not an HTTP proxy —
+  // the actual routing is handled via x-relay-* headers below.
+  const isVercelRelay = isRelayType((effectiveProxyConfig as { type?: string })?.type);
   if (resolvedProxyUrl && !isVercelRelay) {
     const reachable = await isProxyReachable(resolvedProxyUrl);
     if (!reachable) {
@@ -506,20 +508,22 @@ async function patchedFetch(
     throw lastDispatcherError;
   }
 
-  // Vercel Relay: instead of routing through an HTTP proxy dispatcher, we send
-  // relay headers to the Vercel edge function which forwards the request upstream.
+  // Edge relay (vercel / deno): instead of routing through an HTTP proxy
+  // dispatcher, we send x-relay-* headers to the edge function which forwards
+  // the request upstream. Both backends share the same envelope shape.
   const contextProxy = proxyContext.getStore();
   if (
     contextProxy &&
     typeof contextProxy === "object" &&
-    (contextProxy as { type?: string }).type === "vercel"
+    isRelayType((contextProxy as { type?: string }).type)
   ) {
-    const vc = contextProxy as { host?: string; relayAuth?: string };
+    const vc = contextProxy as { type?: string; host?: string; relayAuth?: string };
     if (!vc.relayAuth) {
       // Generic message without internal labels — this throw can bubble up to
       // catch blocks that put error.message in response bodies (combo per-model
       // timeout, executor catch-all). Don't leak "[ProxyFetch]" diagnostics.
-      throw new Error("Vercel relay configuration error: missing relayAuth");
+      const label = vc.type === "vercel" ? "Vercel relay" : `${vc.type || "Edge"} relay`;
+      throw new Error(`${label} configuration error: missing relayAuth`);
     }
     const targetUrl = getTargetUrl(input);
     const relayHeaders = buildVercelRelayHeaders(targetUrl, vc.relayAuth);
@@ -529,7 +533,7 @@ async function patchedFetch(
     // to relay routing logs (the rest of this module already follows that rule).
     const hostForLogs = proxyUrlForLogs(vc.host ? `https://${vc.host}` : "");
     if (process.env.OMNIROUTE_PROXY_FETCH_DEBUG === "true") {
-      console.debug(`[ProxyFetch] Routing via Vercel relay: ${hostForLogs}`);
+      console.debug(`[ProxyFetch] Routing via ${vc.type || "edge"} relay: ${hostForLogs}`);
     }
     return await originalFetch(`https://${vc.host}`, {
       ...options,
diff --git a/open-sse/utils/reasoningContentInjector.ts b/open-sse/utils/reasoningContentInjector.ts
new file mode 100644
index 0000000000..8fd9b13bd4
--- /dev/null
+++ b/open-sse/utils/reasoningContentInjector.ts
@@ -0,0 +1,73 @@
+/**
+ * Thinking-mode upstreams (DeepSeek V4 Flash, Kimi, MiniMax, ...) require
+ * `reasoning_content` to be echoed back on every assistant message in the
+ * conversation history. Standard OpenAI clients do not preserve that field
+ * across turns, so we inject a non-empty placeholder before forwarding.
+ *
+ * Without the placeholder these upstreams return:
+ *   400 Bad Request — reasoning_content must be passed back
+ *
+ * Ported from decolua/9router#1099 (issue #1543). Pure helper — no I/O, no
+ * cross-module deps — kept narrow so it can be reused by other meta-providers
+ * that proxy to thinking-mode models.
+ */
+
+const PLACEHOLDER = " ";
+
+type JsonRecord = Record<string, unknown>;
+
+/**
+ * Model-id predicates for thinking-mode families that need the echo.
+ * Matched case-insensitively against the resolved model id (post upstream
+ * routing, e.g. `oc/deepseek-v4-flash-free` for the OpenCode meta-provider).
+ */
+const THINKING_MODEL_PATTERNS: RegExp[] = [
+  /deepseek/i,
+  /\bkimi\b/i,
+  /\bk2\b/i, // moonshot kimi k2 family alias
+  /\bminimax\b/i,
+];
+
+export function isThinkingMessageModel(model: string | undefined | null): boolean {
+  if (!model || typeof model !== "string") return false;
+  return THINKING_MODEL_PATTERNS.some((re) => re.test(model));
+}
+
+function hasNonEmptyReasoningContent(message: JsonRecord): boolean {
+  return (
+    typeof message.reasoning_content === "string" &&
+    (message.reasoning_content as string).trim().length > 0
+  );
+}
+
+function isAssistantMessage(value: unknown): value is JsonRecord {
+  return (
+    !!value &&
+    typeof value === "object" &&
+    !Array.isArray(value) &&
+    (value as JsonRecord).role === "assistant"
+  );
+}
+
+/**
+ * Inject a placeholder `reasoning_content` on every assistant message in
+ * `body.messages` that lacks one. Returns the original object if no mutation
+ * was needed, or a shallow-copied body with a new messages array otherwise.
+ *
+ * No-op when the body shape is unexpected (defensive).
+ */
+export function injectReasoningContentForThinkingModel(body: unknown): unknown {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return body;
+  const record = body as JsonRecord;
+  if (!Array.isArray(record.messages)) return body;
+
+  let modified = false;
+  const messages = record.messages.map((message) => {
+    if (!isAssistantMessage(message)) return message;
+    if (hasNonEmptyReasoningContent(message)) return message;
+    modified = true;
+    return { ...message, reasoning_content: PLACEHOLDER };
+  });
+
+  return modified ? { ...record, messages } : body;
+}
diff --git a/package-lock.json b/package-lock.json
index dd45784f65..7d175ad38b 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "omniroute",
-  "version": "3.8.35",
+  "version": "3.8.36",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "omniroute",
-      "version": "3.8.35",
+      "version": "3.8.36",
       "hasInstallScript": true,
       "license": "MIT",
       "workspaces": [
@@ -17,7 +17,6 @@
         "@dnd-kit/core": "^6.3.1",
         "@dnd-kit/sortable": "^10.0.0",
         "@dnd-kit/utilities": "^3.2.2",
-        "@huggingface/transformers": "3.5.2",
         "@lobehub/icons": "^5.8.0",
         "@modelcontextprotocol/sdk": "^1.29.0",
         "@monaco-editor/react": "^4.7.0",
@@ -140,6 +139,7 @@
       },
       "optionalDependencies": {
         "@atjsh/llmlingua-2": "2.0.3",
+        "@huggingface/transformers": "3.5.2",
         "@tensorflow/tfjs": "4.22.0",
         "better-sqlite3": "^12.10.0",
         "js-tiktoken": "^1.0.20",
@@ -2578,7 +2578,8 @@
       "license": "MIT",
       "engines": {
         "node": ">=18"
-      }
+      },
+      "optional": true
     },
     "node_modules/@huggingface/transformers": {
       "version": "3.5.2",
@@ -2590,7 +2591,8 @@
         "onnxruntime-node": "1.21.0",
         "onnxruntime-web": "1.22.0-dev.20250409-89f8206ba4",
         "sharp": "^0.34.1"
-      }
+      },
+      "optional": true
     },
     "node_modules/@humanfs/core": {
       "version": "0.19.1",
@@ -2668,7 +2670,8 @@
       "license": "MIT",
       "engines": {
         "node": ">=18"
-      }
+      },
+      "optional": true
     },
     "node_modules/@img/sharp-darwin-arm64": {
       "version": "0.34.5",
@@ -3565,7 +3568,8 @@
       },
       "engines": {
         "node": ">=18.0.0"
-      }
+      },
+      "devOptional": true
     },
     "node_modules/@isaacs/string-locale-compare": {
       "version": "1.1.0",
@@ -6244,25 +6248,29 @@
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/@protobufjs/aspromise/-/aspromise-1.1.2.tgz",
       "integrity": "sha512-j+gKExEuLmKwvz3OgROXtrJ2UG2x8Ch2YZUxahh+s1F2HZ+wAceUNLkvy6zKCPVRkU++ZWQrdxsUeQXmcg4uoQ==",
-      "license": "BSD-3-Clause"
+      "license": "BSD-3-Clause",
+      "optional": true
     },
     "node_modules/@protobufjs/base64": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/@protobufjs/base64/-/base64-1.1.2.tgz",
       "integrity": "sha512-AZkcAA5vnN/v4PDqKyMR5lx7hZttPDgClv83E//FMNhR2TMcLUhfRUBHCmSl0oi9zMgDDqRUJkSxO3wm85+XLg==",
-      "license": "BSD-3-Clause"
+      "license": "BSD-3-Clause",
+      "optional": true
     },
     "node_modules/@protobufjs/codegen": {
       "version": "2.0.5",
       "resolved": "https://registry.npmjs.org/@protobufjs/codegen/-/codegen-2.0.5.tgz",
       "integrity": "sha512-zgXFLzW3Ap33e6d0Wlj4MGIm6Ce8O89n/apUaGNB/jx+hw+ruWEp7EwGUshdLKVRCxZW12fp9r40E1mQrf/34g==",
-      "license": "BSD-3-Clause"
+      "license": "BSD-3-Clause",
+      "optional": true
     },
     "node_modules/@protobufjs/eventemitter": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/@protobufjs/eventemitter/-/eventemitter-1.1.1.tgz",
       "integrity": "sha512-vW1GmwMZNnL+gMRaovlh9yZX74kc+TTU3FObkkurpMaRtBfLP3ldjS9KQWlwZgraRE0+dheEEoAxdzcJQ8eXZg==",
-      "license": "BSD-3-Clause"
+      "license": "BSD-3-Clause",
+      "optional": true
     },
     "node_modules/@protobufjs/fetch": {
       "version": "1.1.1",
@@ -6271,31 +6279,36 @@
       "license": "BSD-3-Clause",
       "dependencies": {
         "@protobufjs/aspromise": "^1.1.1"
-      }
+      },
+      "optional": true
     },
     "node_modules/@protobufjs/float": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/@protobufjs/float/-/float-1.0.2.tgz",
       "integrity": "sha512-Ddb+kVXlXst9d+R9PfTIxh1EdNkgoRe5tOX6t01f1lYWOvJnSPDBlG241QLzcyPdoNTsblLUdujGSE4RzrTZGQ==",
-      "license": "BSD-3-Clause"
+      "license": "BSD-3-Clause",
+      "optional": true
     },
     "node_modules/@protobufjs/path": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/@protobufjs/path/-/path-1.1.2.tgz",
       "integrity": "sha512-6JOcJ5Tm08dOHAbdR3GrvP+yUUfkjG5ePsHYczMFLq3ZmMkAD98cDgcT2iA1lJ9NVwFd4tH/iSSoe44YWkltEA==",
-      "license": "BSD-3-Clause"
+      "license": "BSD-3-Clause",
+      "optional": true
     },
     "node_modules/@protobufjs/pool": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/@protobufjs/pool/-/pool-1.1.0.tgz",
       "integrity": "sha512-0kELaGSIDBKvcgS4zkjz1PeddatrjYcmMWOlAuAPwAeccUrPHdUqo/J6LiymHHEiJT5NrF1UVwxY14f+fy4WQw==",
-      "license": "BSD-3-Clause"
+      "license": "BSD-3-Clause",
+      "optional": true
     },
     "node_modules/@protobufjs/utf8": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/@protobufjs/utf8/-/utf8-1.1.1.tgz",
       "integrity": "sha512-oOAWABowe8EAbMyWKM0tYDKi8Yaox52D+HWZhAIJqQXbqe0xI/GV7FhLWqlEKreMkfDjshR5FKgi3mnle0h6Eg==",
-      "license": "BSD-3-Clause"
+      "license": "BSD-3-Clause",
+      "optional": true
     },
     "node_modules/@radix-ui/number": {
       "version": "1.1.2",
@@ -9416,7 +9429,8 @@
       "license": "MIT",
       "dependencies": {
         "undici-types": "~8.3.0"
-      }
+      },
+      "devOptional": true
     },
     "node_modules/@types/node-fetch": {
       "version": "2.6.13",
@@ -11169,7 +11183,8 @@
       "resolved": "https://registry.npmjs.org/boolean/-/boolean-3.2.0.tgz",
       "integrity": "sha512-d0II/GO9uf9lfUHH2BQsjxzRJZBdsjgsBiW4BvhWk/3qoKwQFjIDVN19PfX8F2D/r9PCMTtLWjYVCFrpeYUzsw==",
       "deprecated": "Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.",
-      "license": "MIT"
+      "license": "MIT",
+      "optional": true
     },
     "node_modules/bottleneck": {
       "version": "2.19.5",
@@ -13295,7 +13310,8 @@
       },
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
-      }
+      },
+      "devOptional": true
     },
     "node_modules/define-lazy-prop": {
       "version": "3.0.0",
@@ -13324,7 +13340,8 @@
       },
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
-      }
+      },
+      "devOptional": true
     },
     "node_modules/delaunator": {
       "version": "5.1.0",
@@ -13395,7 +13412,8 @@
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/detect-node/-/detect-node-2.1.0.tgz",
       "integrity": "sha512-T0NIuQpnTvFDATNuHN5roPwSBG83rFsuO+MXXH9/3N1eFbn4wcPjttvjMLEPWJ0RGUYgQE7cGgS3tNxbqCGM7g==",
-      "license": "MIT"
+      "license": "MIT",
+      "optional": true
     },
     "node_modules/detect-node-es": {
       "version": "1.1.0",
@@ -13973,7 +13991,8 @@
       "version": "4.1.1",
       "resolved": "https://registry.npmjs.org/es6-error/-/es6-error-4.1.1.tgz",
       "integrity": "sha512-Um/+FxMr9CISWh0bi5Zv0iOD+4cFh5qLeks1qhAopKVAJw3drgKbKySikp7wGhDL0HPeaja0P5ULZrxLkniUVg==",
-      "license": "MIT"
+      "license": "MIT",
+      "optional": true
     },
     "node_modules/esast-util-from-estree": {
       "version": "2.0.0",
@@ -15306,7 +15325,8 @@
       "version": "25.9.23",
       "resolved": "https://registry.npmjs.org/flatbuffers/-/flatbuffers-25.9.23.tgz",
       "integrity": "sha512-MI1qs7Lo4Syw0EOzUl0xjs2lsoeqFku44KpngfIduHBYvzm8h2+7K8YMQh1JtVVVrUvhLpNwqVi4DERegUJhPQ==",
-      "license": "Apache-2.0"
+      "license": "Apache-2.0",
+      "optional": true
     },
     "node_modules/flatted": {
       "version": "3.4.2",
@@ -16056,7 +16076,8 @@
       },
       "engines": {
         "node": ">=10.0"
-      }
+      },
+      "optional": true
     },
     "node_modules/global-agent/node_modules/semver": {
       "version": "7.8.4",
@@ -16068,7 +16089,8 @@
       },
       "engines": {
         "node": ">=10"
-      }
+      },
+      "optional": true
     },
     "node_modules/global-directory": {
       "version": "4.0.1",
@@ -16121,7 +16143,8 @@
       },
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
-      }
+      },
+      "devOptional": true
     },
     "node_modules/gopd": {
       "version": "1.2.0",
@@ -16145,7 +16168,8 @@
       "version": "1.0.9",
       "resolved": "https://registry.npmjs.org/guid-typescript/-/guid-typescript-1.0.9.tgz",
       "integrity": "sha512-Y8T4vYhEfwJOTbouREvG+3XDsjr8E3kIr7uf+JZ0BYloFsttiHU0WfvANVsR7TxNUJa/WpCnw/Ino/p+DeBhBQ==",
-      "license": "ISC"
+      "license": "ISC",
+      "optional": true
     },
     "node_modules/hachure-fill": {
       "version": "0.5.2",
@@ -16185,7 +16209,8 @@
       },
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
-      }
+      },
+      "devOptional": true
     },
     "node_modules/has-proto": {
       "version": "1.2.0",
@@ -18265,7 +18290,8 @@
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/json-stringify-safe/-/json-stringify-safe-5.0.1.tgz",
       "integrity": "sha512-ZClg6AaYvamvYEE82d3Iyd3vSSIjQ+odgjaTzRuO3s7toCdFKczob2i0zCh7JE8kWn17yvAWhUVxvqGwUalsRA==",
-      "license": "ISC"
+      "license": "ISC",
+      "optional": true
     },
     "node_modules/json5": {
       "version": "2.2.3",
@@ -19788,7 +19814,8 @@
       },
       "engines": {
         "node": ">=10"
-      }
+      },
+      "optional": true
     },
     "node_modules/material-symbols": {
       "version": "0.45.2",
@@ -21037,7 +21064,8 @@
       "license": "BlueOak-1.0.0",
       "engines": {
         "node": ">=16 || 14 >=14.17"
-      }
+      },
+      "devOptional": true
     },
     "node_modules/minipass-collect": {
       "version": "2.0.1",
@@ -21159,7 +21187,8 @@
       },
       "engines": {
         "node": ">= 18"
-      }
+      },
+      "devOptional": true
     },
     "node_modules/mkdirp": {
       "version": "1.0.4",
@@ -22053,7 +22082,8 @@
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
-      }
+      },
+      "devOptional": true
     },
     "node_modules/object.assign": {
       "version": "4.1.7",
@@ -22222,7 +22252,8 @@
       "version": "1.21.0",
       "resolved": "https://registry.npmjs.org/onnxruntime-common/-/onnxruntime-common-1.21.0.tgz",
       "integrity": "sha512-Q632iLLrtCAVOTO65dh2+mNbQir/QNTVBG3h/QdZBpns7mZ0RYbLRBgGABPbpU9351AgYy7SJf1WaeVwMrBFPQ==",
-      "license": "MIT"
+      "license": "MIT",
+      "optional": true
     },
     "node_modules/onnxruntime-node": {
       "version": "1.21.0",
@@ -22239,7 +22270,8 @@
         "global-agent": "^3.0.0",
         "onnxruntime-common": "1.21.0",
         "tar": "^7.0.1"
-      }
+      },
+      "optional": true
     },
     "node_modules/onnxruntime-web": {
       "version": "1.22.0-dev.20250409-89f8206ba4",
@@ -22253,19 +22285,22 @@
         "onnxruntime-common": "1.22.0-dev.20250409-89f8206ba4",
         "platform": "^1.3.6",
         "protobufjs": "^7.2.4"
-      }
+      },
+      "optional": true
     },
     "node_modules/onnxruntime-web/node_modules/long": {
       "version": "5.3.2",
       "resolved": "https://registry.npmjs.org/long/-/long-5.3.2.tgz",
       "integrity": "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==",
-      "license": "Apache-2.0"
+      "license": "Apache-2.0",
+      "optional": true
     },
     "node_modules/onnxruntime-web/node_modules/onnxruntime-common": {
       "version": "1.22.0-dev.20250409-89f8206ba4",
       "resolved": "https://registry.npmjs.org/onnxruntime-common/-/onnxruntime-common-1.22.0-dev.20250409-89f8206ba4.tgz",
       "integrity": "sha512-vDJMkfCfb0b1A836rgHj+ORuZf4B4+cc2bASQtpeoJLueuFc5DuYwjIZUBrSvx/fO5IrLjLz+oTrB3pcGlhovQ==",
-      "license": "MIT"
+      "license": "MIT",
+      "optional": true
     },
     "node_modules/open": {
       "version": "11.0.0",
@@ -22944,7 +22979,8 @@
       "version": "1.3.6",
       "resolved": "https://registry.npmjs.org/platform/-/platform-1.3.6.tgz",
       "integrity": "sha512-fnWVljUchTro6RiCFvCXBbNhJc2NijN7oIQxbwsyL0buWJPG85v81ehlHI9fXrJsMNgTofEoWIQeClKpgxFLrg==",
-      "license": "MIT"
+      "license": "MIT",
+      "optional": true
     },
     "node_modules/playwright": {
       "version": "1.61.0",
@@ -23291,13 +23327,15 @@
       },
       "engines": {
         "node": ">=12.0.0"
-      }
+      },
+      "optional": true
     },
     "node_modules/protobufjs/node_modules/long": {
       "version": "5.3.2",
       "resolved": "https://registry.npmjs.org/long/-/long-5.3.2.tgz",
       "integrity": "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==",
-      "license": "Apache-2.0"
+      "license": "Apache-2.0",
+      "optional": true
     },
     "node_modules/proxy-addr": {
       "version": "2.0.7",
@@ -24427,13 +24465,15 @@
       },
       "engines": {
         "node": ">=8.0"
-      }
+      },
+      "optional": true
     },
     "node_modules/roarr/node_modules/sprintf-js": {
       "version": "1.1.3",
       "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.1.3.tgz",
       "integrity": "sha512-Oo+0REFV59/rz3gfJNKQiBlwfHaSESl1pcGyABQsnnIfWOFt6JNj5gCog2U6MLZ//IGYD+nA8nI+mTShREReaA==",
-      "license": "BSD-3-Clause"
+      "license": "BSD-3-Clause",
+      "optional": true
     },
     "node_modules/robust-predicates": {
       "version": "3.0.3",
@@ -24750,7 +24790,8 @@
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/semver-compare/-/semver-compare-1.0.0.tgz",
       "integrity": "sha512-YM3/ITh2MJ5MtzaM429anh+x2jiLVjqILF4m4oyQB18W7Ggea7BfqdH/wGMK7dDiMghv/6WG7znWMwUDzJiXow==",
-      "license": "MIT"
+      "license": "MIT",
+      "optional": true
     },
     "node_modules/send": {
       "version": "1.2.1",
@@ -24791,7 +24832,8 @@
       },
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"
-      }
+      },
+      "optional": true
     },
     "node_modules/serialize-error/node_modules/type-fest": {
       "version": "0.13.1",
@@ -24803,7 +24845,8 @@
       },
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"
-      }
+      },
+      "optional": true
     },
     "node_modules/serve-static": {
       "version": "2.2.1",
@@ -24921,7 +24964,8 @@
         "@img/sharp-win32-arm64": "0.34.5",
         "@img/sharp-win32-ia32": "0.34.5",
         "@img/sharp-win32-x64": "0.34.5"
-      }
+      },
+      "optional": true
     },
     "node_modules/sharp/node_modules/semver": {
       "version": "7.7.4",
@@ -24933,7 +24977,8 @@
       },
       "engines": {
         "node": ">=10"
-      }
+      },
+      "optional": true
     },
     "node_modules/shebang-command": {
       "version": "2.0.0",
@@ -26174,7 +26219,8 @@
       },
       "engines": {
         "node": ">=18"
-      }
+      },
+      "devOptional": true
     },
     "node_modules/tar-fs": {
       "version": "2.1.4",
@@ -26213,7 +26259,8 @@
       "license": "BlueOak-1.0.0",
       "engines": {
         "node": ">=18"
-      }
+      },
+      "devOptional": true
     },
     "node_modules/tar/node_modules/yallist": {
       "version": "5.0.0",
@@ -26222,7 +26269,8 @@
       "license": "BlueOak-1.0.0",
       "engines": {
         "node": ">=18"
-      }
+      },
+      "devOptional": true
     },
     "node_modules/terminal-size": {
       "version": "4.0.1",
@@ -26987,7 +27035,8 @@
       "version": "8.3.0",
       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.3.0.tgz",
       "integrity": "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==",
-      "license": "MIT"
+      "license": "MIT",
+      "devOptional": true
     },
     "node_modules/unicode-emoji-modifier-base": {
       "version": "1.0.0",
@@ -28502,7 +28551,7 @@
     },
     "open-sse": {
       "name": "@omniroute/open-sse",
-      "version": "3.8.35"
+      "version": "3.8.36"
     }
   }
 }
diff --git a/package.json b/package.json
index 9d7e41682a..916d5184c6 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "omniroute",
-  "version": "3.8.35",
+  "version": "3.8.36",
   "description": "Unified AI router with 160+ providers, RTK+Caveman compression, auto fallback, MCP/A2A, desktop, PWA, and OpenAI-compatible APIs.",
   "type": "module",
   "bin": {
@@ -76,6 +76,7 @@
     "gen:provider-reference": "node --import tsx scripts/docs/gen-provider-reference.ts",
     "bench:compression": "node --import tsx scripts/compression/benchmark.ts",
     "eval:compression": "node --import tsx scripts/compression-eval/index.ts",
+    "release:sync-changelog-i18n": "node scripts/release/sync-changelog-i18n.mjs",
     "build": "node scripts/build/build-next-isolated.mjs",
     "build:secure": "OMNIROUTE_BUILD_PROFILE=minimal node scripts/build/build-next-isolated.mjs",
     "build:cli": "node --import tsx scripts/build/prepublish.ts",
@@ -135,6 +136,7 @@
     "check:duplication": "node scripts/check/check-duplication.mjs",
     "check:tracked-artifacts": "node scripts/check/check-tracked-artifacts.mjs",
     "check:test-masking": "node scripts/check/check-test-masking.mjs",
+    "check:test-runner-api": "node scripts/check/check-test-runner-api.mjs",
     "check:error-helper": "node scripts/check/check-error-helper.mjs",
     "check:migration-numbering": "node scripts/check/check-migration-numbering.mjs",
     "check:public-creds": "node scripts/check/check-public-creds.mjs",
@@ -200,7 +202,6 @@
     "@dnd-kit/core": "^6.3.1",
     "@dnd-kit/sortable": "^10.0.0",
     "@dnd-kit/utilities": "^3.2.2",
-    "@huggingface/transformers": "3.5.2",
     "@lobehub/icons": "^5.8.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@monaco-editor/react": "^4.7.0",
@@ -270,6 +271,7 @@
   },
   "optionalDependencies": {
     "@atjsh/llmlingua-2": "2.0.3",
+    "@huggingface/transformers": "3.5.2",
     "@tensorflow/tfjs": "4.22.0",
     "better-sqlite3": "^12.10.0",
     "js-tiktoken": "^1.0.20",
diff --git a/scripts/check/check-db-rules.mjs b/scripts/check/check-db-rules.mjs
index c310d56c6f..e948bd90e4 100644
--- a/scripts/check/check-db-rules.mjs
+++ b/scripts/check/check-db-rules.mjs
@@ -42,6 +42,7 @@ export const INTENTIONALLY_INTERNAL = new Set([
   "accessTokens", // intentionally-internal: 4 rotas /api/cli/* (connect, whoami, tokens, tokens/[id]) + server/authz/accessTokenAuth.ts via import direto "@/lib/db/accessTokens" (Rule #2)
   "apiKeyColumnFallbacks", // db-internal: importado só por db/apiKeys.ts (API_KEY_COLUMN_FALLBACKS — fallbacks de coluna split do apiKeys.ts)
   "apiKeyUsageLimitFields", // db-internal: importado só por db/apiKeys.ts (helpers de campo de limite de uso split do apiKeys.ts; mig 101)
+  "caseMapping", // db-internal: importado só por db/core.ts (toSnakeCase/toCamelCase/objToSnake — column-mapping snake↔camel split do core.ts, #4947)
   "cleanup", // intentionally-internal: 3 API routes (purge-quota-snapshots, purge-call-logs, purge-detailed-logs)
   "cliToolState", // intentionally-internal: 14+ API routes em /api/cli-tools/*-settings
   "comboForecast", // intentionally-internal: src/lib/usage/comboForecast.ts
@@ -57,11 +58,13 @@ export const INTENTIONALLY_INTERNAL = new Set([
   "migrationRunner", // db-internal: importado por db/core.ts (runMigrations ao inicializar o DB)
   "notion", // intentionally-internal: settings/notion API route + open-sse/mcp-server/tools/notionTools.ts
   "obsidian", // intentionally-internal: src/lib/obsidianSync.ts + settings/obsidian route + MCP obsidianTools.ts
+  "optimizationSettings", // db-internal: imported by db/core.ts for SQLite PRAGMA application helpers that require the live adapter
   "pluginMetrics", // DEAD? (production): write path não foi conectado ainda (documentado no cabeçalho do módulo); testado por tests/unit/plugins-metrics.test.ts
   "prompts", // DEAD? (production): zero callers de produção encontrados; domínio domain/prompts.ts é independente; testado por tests/integration/proxy-pipeline.test.ts
   "providerNodeSelect", // db-internal: importado só por db/providers.ts (selectProviderNodeForConnection — lógica pura de seleção de provider node split do providers.ts, #4421)
   "providerStats", // intentionally-internal: src/app/api/provider-stats/route.ts
   "recovery", // intentionally-internal: bin/cli/runtime.mjs (import() dinâmico) + tests
+  "schemaColumns", // db-internal: importado só por db/core.ts (ensureProviderConnections/UsageHistory/CallLogsColumns + hasColumn/hasTable/getTableColumns — schema-column reconciliation split do core.ts, #4948)
   "secrets", // intentionally-internal: src/instrumentation-node.ts (import() dinâmico na inicialização)
   "serviceModels", // intentionally-internal: 3 callers (services/modelSync, services/bootstrap, /api/services/9router/models)
   "stateReset", // db-internal: 3 callers dentro de src/lib/db/ (core, backup, apiKeys) para coordenação de reset
diff --git a/scripts/check/check-fabricated-docs.mjs b/scripts/check/check-fabricated-docs.mjs
index 12ccfba6b2..3dea3bf5a8 100644
--- a/scripts/check/check-fabricated-docs.mjs
+++ b/scripts/check/check-fabricated-docs.mjs
@@ -85,6 +85,7 @@ const ENV_VAR_ALLOWLIST = new Set([
   "NODE_ENV",
   "NODE_PATH",
   "NODE_OPTIONS",
+  "NODE_EXTRA_CA_CERTS", // Node runtime CA var: read by Node itself + passed to a spawned subprocess (cloudflaredTunnel.ts), not via process.env.X (AGENTBRIDGE.md)
   "DEBUG",
   "VERBOSE",
   "LOG_LEVEL",
diff --git a/scripts/check/check-known-symbols.ts b/scripts/check/check-known-symbols.ts
index 03404a8e0c..b8f49e02c5 100644
--- a/scripts/check/check-known-symbols.ts
+++ b/scripts/check/check-known-symbols.ts
@@ -475,8 +475,14 @@ async function main(): Promise<void> {
   }
 
   // ── (2) Combo strategies ──────────────────────────────────────────────────
+  // Canonical = user-facing ROUTING_STRATEGY_VALUES ∪ INTERNAL_ROUTING_STRATEGY_VALUES
+  // (system-only strategies like "quota-share" are registered but hidden from the UI;
+  // they still must have a real dispatch branch in combo.ts — enforced below).
   const strategiesMod = await import("@/shared/constants/routingStrategies.ts");
-  const canonical = strategiesMod.ROUTING_STRATEGY_VALUES as readonly string[];
+  const canonical = [
+    ...(strategiesMod.ROUTING_STRATEGY_VALUES as readonly string[]),
+    ...(strategiesMod.INTERNAL_ROUTING_STRATEGY_VALUES as readonly string[]),
+  ];
   const comboSource = readFileSync(resolvePath(REPO_ROOT, "open-sse/services/combo.ts"), "utf8");
   const handled = extractHandledStrategies(comboSource);
 
diff --git a/scripts/check/check-public-creds.mjs b/scripts/check/check-public-creds.mjs
index f73c4a296c..74714b3dbc 100644
--- a/scripts/check/check-public-creds.mjs
+++ b/scripts/check/check-public-creds.mjs
@@ -81,15 +81,17 @@ const ENV_KEY_RE = /(clientId|clientSecret|apiKey)Env\s*:/;
 //
 // 6A.8: Expanded scope to open-sse/** + src/lib/oauth/**. Newly discovered FPs:
 //
-//   open-sse/services/usage.ts L499: `getMiniMaxUsage(apiKey: string, provider: "minimax" | "minimax-cn")`
+//   open-sse/services/usage/minimax.ts L213: `getMiniMaxUsage(apiKey: string, provider: "minimax" | "minimax-cn")`
 //   The CRED_KEY_RE matches `apiKey:` in the TypeScript function-parameter type annotation.
 //   "minimax" and "minimax-cn" are provider-name strings in the type annotation, NOT credentials.
 //   This is a false positive (the gate was designed for object-literal assignments, not fn params).
 //   TODO(6A.8): Consider tightening CRED_KEY_RE to exclude function-signature contexts — but
 //   that adds complexity; the FP rate is low (1 file). Frozen by file:line:value key.
+//   The MiniMax family was extracted from services/usage.ts into services/usage/minimax.ts
+//   (god-file decomposition), so the FP moved with the getMiniMaxUsage signature.
 export const KNOWN_LITERAL_CREDS = new Set([
-  "open-sse/services/usage.ts:499:minimax", // TODO(6A.8): pre-existing FP — TS fn-param type, not a credential (moved 582→499 by the OpenCode/Ollama usage extraction)
-  "open-sse/services/usage.ts:499:minimax-cn", // TODO(6A.8): pre-existing FP — TS fn-param type, not a credential (moved 582→499 by the OpenCode/Ollama usage extraction)
+  "open-sse/services/usage/minimax.ts:213:minimax", // TODO(6A.8): pre-existing FP — TS fn-param type, not a credential (getMiniMaxUsage signature)
+  "open-sse/services/usage/minimax.ts:213:minimax-cn", // TODO(6A.8): pre-existing FP — TS fn-param type, not a credential (getMiniMaxUsage signature)
 ]);
 
 /**
diff --git a/scripts/check/check-test-runner-api.mjs b/scripts/check/check-test-runner-api.mjs
new file mode 100644
index 0000000000..f99eda9cc4
--- /dev/null
+++ b/scripts/check/check-test-runner-api.mjs
@@ -0,0 +1,59 @@
+import fs from "node:fs";
+import path from "node:path";
+
+// Dirs collected ONLY by vitest (vitest.mcp.config.ts include globs for .ts tests).
+// Keep in sync with vitest.mcp.config.ts. A test here MUST import from "vitest".
+const VITEST_ONLY_DIRS = [
+  "tests/unit/autoCombo",
+  "open-sse/services/autoCombo",
+  "open-sse/mcp-server",
+];
+
+function walk(dir, root, out = []) {
+  const abs = path.join(root, dir);
+  if (!fs.existsSync(abs)) return out;
+  for (const name of fs.readdirSync(abs)) {
+    const rel = path.join(dir, name);
+    const s = fs.statSync(path.join(root, rel));
+    if (s.isDirectory()) {
+      if (name === "node_modules" || name === ".git") continue;
+      walk(rel, root, out);
+    } else if (/\.test\.(ts|tsx|js|mjs)$/.test(name)) {
+      out.push(rel);
+    }
+  }
+  return out;
+}
+
+function isVitestOnly(relFile) {
+  const norm = relFile.replace(/\\/g, "/");
+  return VITEST_ONLY_DIRS.some(
+    (d) => norm.startsWith(d + "/") && (norm.includes("/__tests__/") || d.startsWith("tests/unit/"))
+  );
+}
+
+export function findRunnerMismatches(root) {
+  const files = VITEST_ONLY_DIRS.flatMap((d) => walk(d, root));
+  const bad = [];
+  for (const f of files) {
+    if (!isVitestOnly(f)) continue;
+    const txt = fs.readFileSync(path.join(root, f), "utf8");
+    const importsNodeTest = /from\s+["']node:test["']/.test(txt);
+    const importsVitest = /from\s+["']vitest["']/.test(txt);
+    if (importsNodeTest && !importsVitest) {
+      bad.push({ file: f, reason: "vitest-only dir but imports node:test (use the vitest API)" });
+    }
+  }
+  return bad;
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  const root = process.cwd();
+  const bad = findRunnerMismatches(root);
+  if (bad.length) {
+    console.error(`[test-runner-api] FAIL — ${bad.length} test(s) use the wrong runner API:`);
+    for (const b of bad) console.error(`  ${b.file}: ${b.reason}`);
+    process.exit(1);
+  }
+  console.log("[test-runner-api] OK — vitest-only dirs use the vitest API.");
+}
diff --git a/scripts/dev/peer-stamp.mjs b/scripts/dev/peer-stamp.mjs
index b4e18d213a..4951abcbdb 100644
--- a/scripts/dev/peer-stamp.mjs
+++ b/scripts/dev/peer-stamp.mjs
@@ -20,6 +20,20 @@ import { randomUUID } from "node:crypto";
  */
 export const PEER_IP_HEADER = "x-omniroute-peer-ip";
 
+/**
+ * Companion header to PEER_IP_HEADER: `<token>|1` when the inbound TCP request
+ * carried forwarding headers (`x-forwarded-for` / `x-real-ip`), `<token>|0`
+ * otherwise. Required so the middleware can tell that a loopback socket is the
+ * reverse-proxy hop (nginx / Caddy / Cloudflare Tunnel) and NOT trust it as
+ * local — without this, a leaked JWT over a public tunnel would reach the
+ * LOCAL_ONLY routes that spawn child processes (Hard Rules #15 + #17;
+ * port of upstream decolua/9router commit da667836).
+ *
+ * Keep VIA_PROXY_HEADER in sync with VIA_PROXY_HEADER in
+ * src/server/authz/headers.ts (the TS side cannot import this .mjs).
+ */
+export const VIA_PROXY_HEADER = "x-omniroute-via-proxy";
+
 /** Generate (once) and return the per-process stamp token, persisting it in env
  *  so the middleware running in the same process reads the identical value. */
 export function ensurePeerStampToken() {
@@ -27,17 +41,26 @@ export function ensurePeerStampToken() {
   return process.env.OMNIROUTE_PEER_STAMP_TOKEN;
 }
 
-/** Strip any client-supplied PEER_IP_HEADER and stamp the real TCP peer IP,
- *  token-prefixed. Never throws — a stamping failure must not block a request
- *  (it degrades to "locality unknown" → fail closed in the middleware). */
+/** Strip any client-supplied PEER_IP_HEADER + VIA_PROXY_HEADER and stamp the
+ *  real TCP peer IP plus a token-protected via-proxy marker. Never throws — a
+ *  stamping failure must not block a request (it degrades to "locality
+ *  unknown" → fail closed in the middleware). */
 export function stampPeerIp(req) {
   try {
     if (!req || !req.headers) return;
     // Node lowercases incoming header names; delete kills any client value.
     delete req.headers[PEER_IP_HEADER];
+    delete req.headers[VIA_PROXY_HEADER];
     const ip = req.socket && req.socket.remoteAddress;
     if (ip) {
-      req.headers[PEER_IP_HEADER] = `${ensurePeerStampToken()}|${ip}`;
+      const token = ensurePeerStampToken();
+      req.headers[PEER_IP_HEADER] = `${token}|${ip}`;
+      // Forwarding headers present = request arrived via a reverse proxy; the
+      // loopback socket is the proxy hop, not the end-user, so it must not be
+      // trusted as local. Token-prefix the marker so a remote caller cannot
+      // forge it (or its absence) on a non-proxied request.
+      const viaProxy = !!(req.headers["x-forwarded-for"] || req.headers["x-real-ip"]);
+      req.headers[VIA_PROXY_HEADER] = `${token}|${viaProxy ? "1" : "0"}`;
     }
   } catch {
     /* never block a request on peer stamping */
diff --git a/scripts/dev/sync-env.mjs b/scripts/dev/sync-env.mjs
index f033319be3..8e0701d20c 100644
--- a/scripts/dev/sync-env.mjs
+++ b/scripts/dev/sync-env.mjs
@@ -19,7 +19,23 @@ import { dirname, join, resolve } from "node:path";
 import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
 
-const require = createRequire(import.meta.url);
+/**
+ * Resolve the repository/package root that holds `.env` / `.env.example`.
+ *
+ * When this module is statically bundled into a Next.js standalone route,
+ * `import.meta.url` is frozen to the build-machine path
+ * (`file:///home/runner/.../sync-env.mjs`) and `fileURLToPath` can throw at
+ * runtime. Callers (e.g. the env-repair route) pass an explicit `rootDir`;
+ * when they don't, fall back to `process.cwd()` instead of crashing. (#5006)
+ */
+function resolveRootDir(rootDir) {
+  if (rootDir) return rootDir;
+  try {
+    return dirname(dirname(fileURLToPath(import.meta.url)));
+  } catch {
+    return process.cwd();
+  }
+}
 
 const CRYPTO_SECRETS = {
   JWT_SECRET: () => randomBytes(64).toString("hex"),
@@ -68,6 +84,11 @@ function hasEncryptedCredentials(dataDir) {
   if (!existsSync(dbPath)) return false;
 
   try {
+    // Resolve `require` lazily here (not at module top-level): when this file is
+    // bundled into a standalone route, a top-level `createRequire(import.meta.url)`
+    // throws during module evaluation and 500s the whole route (#5006). Inside this
+    // guarded block, any failure simply returns false (the safe default below).
+    const require = createRequire(import.meta.url);
     const Database = require("better-sqlite3");
     const db = new Database(dbPath, { readonly: true, fileMustExist: true });
     try {
@@ -170,7 +191,7 @@ function parseExampleEntries(content, scope = "full") {
 }
 
 export function getEnvSyncPlan({ rootDir, scope = "full" } = {}) {
-  const root = rootDir || dirname(dirname(fileURLToPath(import.meta.url)));
+  const root = resolveRootDir(rootDir);
   const envExamplePath = join(root, ".env.example");
   const envPath = join(root, ".env");
 
@@ -237,7 +258,7 @@ function replaceBlankSecret(content, key, value) {
 
 export function syncEnv({ rootDir, quiet = false, scope = "full" } = {}) {
   const log = quiet ? () => {} : (message) => process.stderr.write(`[sync-env] ${message}\n`);
-  const root = rootDir || dirname(dirname(fileURLToPath(import.meta.url)));
+  const root = resolveRootDir(rootDir);
   const envExamplePath = join(root, ".env.example");
   const envPath = join(root, ".env");
 
diff --git a/scripts/ops/prune-stale-worktrees.sh b/scripts/ops/prune-stale-worktrees.sh
new file mode 100755
index 0000000000..8a8a30f716
--- /dev/null
+++ b/scripts/ops/prune-stale-worktrees.sh
@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Lista (ou remove com --apply) worktrees port-* cuja branch já foi merged ao
+# main OU não tem commits à frente do origin/main. NUNCA toca worktrees com
+# trabalho não-commitado. Rodar a partir do checkout principal.
+set -euo pipefail
+APPLY="${1:-}"
+git fetch origin main --quiet || true
+git worktree list --porcelain | awk '/^worktree /{w=$2} /^branch /{print w" "$2}' | \
+while read -r dir ref; do
+  case "$dir" in
+    *"/.claude/worktrees/"*port-*|*"/.worktrees/"*port-*) ;;
+    *) continue ;;
+  esac
+  br="${ref#refs/heads/}"
+  if [ -n "$(git -C "$dir" status --porcelain 2>/dev/null)" ]; then
+    echo "SKIP (dirty): $dir"
+    continue
+  fi
+  ahead=$(git -C "$dir" rev-list --count origin/main.."$br" 2>/dev/null || echo "?")
+  if [ "$ahead" = "0" ]; then
+    if [ "$APPLY" = "--apply" ]; then
+      git worktree remove --force "$dir" && git branch -D "$br" 2>/dev/null || true
+      echo "REMOVED: $dir ($br)"
+    else
+      echo "WOULD REMOVE (0 ahead of main): $dir ($br)"
+    fi
+  else
+    echo "KEEP ($ahead ahead): $dir ($br)"
+  fi
+done
+echo "Done.${APPLY:+ (applied)}"
diff --git a/scripts/release/sync-changelog-i18n.mjs b/scripts/release/sync-changelog-i18n.mjs
new file mode 100644
index 0000000000..9fea0daa79
--- /dev/null
+++ b/scripts/release/sync-changelog-i18n.mjs
@@ -0,0 +1,57 @@
+import fs from "node:fs";
+import path from "node:path";
+
+function sectionRange(text, ver, nextVer) {
+  const lines = text.split("\n");
+  const start = lines.findIndex((l) => l.startsWith(`## [${ver}]`));
+  if (start < 0) return null;
+  let end = lines.findIndex((l, i) => i > start && l.startsWith(`## [${nextVer}]`));
+  if (end < 0) end = lines.length;
+  return { lines, start, end };
+}
+
+// Replace the [ver] section in every docs/i18n/<loc>/CHANGELOG.md with the root one.
+// If a mirror lacks the section, insert it before [nextVer]. Returns count updated.
+export function syncChangelogSection(root, ver, nextVer) {
+  const rootCl = fs.readFileSync(path.join(root, "CHANGELOG.md"), "utf8");
+  const r = sectionRange(rootCl, ver, nextVer);
+  if (!r) throw new Error(`root CHANGELOG missing [${ver}]`);
+  const block = r.lines.slice(r.start, r.end).join("\n");
+  const i18nDir = path.join(root, "docs/i18n");
+  if (!fs.existsSync(i18nDir)) return 0;
+  let n = 0;
+  for (const loc of fs.readdirSync(i18nDir)) {
+    const fp = path.join(i18nDir, loc, "CHANGELOG.md");
+    if (!fs.existsSync(fp)) continue;
+    const txt = fs.readFileSync(fp, "utf8");
+    const m = sectionRange(txt, ver, nextVer);
+    let next;
+    if (m) {
+      next =
+        m.lines.slice(0, m.start).join("\n") +
+        "\n" +
+        block +
+        "\n" +
+        m.lines.slice(m.end).join("\n");
+    } else {
+      const idx = txt.indexOf(`## [${nextVer}]`);
+      if (idx < 0) continue;
+      next = txt.slice(0, idx) + block + "\n\n" + txt.slice(idx);
+    }
+    if (next !== txt) {
+      fs.writeFileSync(fp, next);
+      n++;
+    }
+  }
+  return n;
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  const [ver, nextVer] = process.argv.slice(2);
+  if (!ver || !nextVer) {
+    console.error("usage: sync-changelog-i18n.mjs <ver> <nextVer>");
+    process.exit(2);
+  }
+  const n = syncChangelogSection(process.cwd(), ver, nextVer);
+  console.log(`[sync-changelog-i18n] updated ${n} mirror(s) for [${ver}]`);
+}
diff --git a/src/app/(dashboard)/dashboard/HomePageClient.tsx b/src/app/(dashboard)/dashboard/HomePageClient.tsx
index 37ff007715..b72e8da68c 100644
--- a/src/app/(dashboard)/dashboard/HomePageClient.tsx
+++ b/src/app/(dashboard)/dashboard/HomePageClient.tsx
@@ -14,6 +14,7 @@ import { copyToClipboard } from "@/shared/utils/clipboard";
 import { getProviderDisplayLabel } from "@/shared/utils/providerDisplayLabel";
 import { useIsElectron, useOpenExternal } from "@/shared/hooks/useElectron";
 import { HomeProviderTopologySection } from "./HomeProviderTopologySection";
+import { shouldShowProviderTopologyOnHome } from "./homeAppearance";
 
 const ProviderQuotaWidget = dynamic(() => import("../home/ProviderQuotaWidget"), { ssr: false });
 import type { NewsAnnouncement } from "@/shared/utils/releaseNotes";
@@ -218,9 +219,15 @@ export default function HomePageClient({ machineId }: HomePageClientProps) {
           if (typeof data.showQuickStartOnHome === "boolean") {
             setShowQuickStartOnHome(data.showQuickStartOnHome);
           }
-          if (typeof data.showProviderTopologyOnHome === "boolean") {
-            setShowProviderTopologyOnHome(data.showProviderTopologyOnHome);
-          }
+          // #4596 regression fix: the topology card defaults ON (matches the
+          // AppearanceTab toggle's `!== false`). Honoring only an explicit boolean
+          // left the card hidden whenever the setting was never persisted
+          // (undefined), silently removing it for most installs. The live-WS
+          // connection is still gated by `appearanceSettingsLoaded` in the data
+          // effect, so it is never opened before settings load.
+          setShowProviderTopologyOnHome(
+            shouldShowProviderTopologyOnHome(data.showProviderTopologyOnHome)
+          );
           if (typeof data.autoRefreshProviderQuota === "boolean") {
             setAutoRefreshProviderQuota(data.autoRefreshProviderQuota);
           }
diff --git a/src/app/(dashboard)/dashboard/analytics/ComboHealthTab.tsx b/src/app/(dashboard)/dashboard/analytics/ComboHealthTab.tsx
index dda2143082..62684d51fd 100644
--- a/src/app/(dashboard)/dashboard/analytics/ComboHealthTab.tsx
+++ b/src/app/(dashboard)/dashboard/analytics/ComboHealthTab.tsx
@@ -3,6 +3,7 @@
 import Link from "next/link";
 import { useCallback, useEffect, useMemo, useState } from "react";
 import { useTranslations } from "next-intl";
+import { useProviderNodeMap, resolveProviderName } from "@/lib/display/useProviderNodeMap";
 import Card from "@/shared/components/Card";
 import Badge from "@/shared/components/Badge";
 import { Skeleton, Spinner } from "@/shared/components/Loading";
@@ -156,6 +157,7 @@ function DistributionBar({ label, value, meta }: { label: string; value: number;
 }
 
 function ComboForecastPanel({ forecast }: { forecast: ComboForecastMetrics }) {
+  const nodeMap = useProviderNodeMap();
   const topTargets = useMemo(
     () =>
       [...forecast.targets]
@@ -227,7 +229,8 @@ function ComboForecastPanel({ forecast }: { forecast: ComboForecastMetrics }) {
                     {target.label || target.model}
                   </div>
                   <div className="mt-1 text-xs text-text-muted">
-                    {target.provider} · traffic {formatShare(target.trafficShare)}
+                    {resolveProviderName(target.provider, nodeMap)} · traffic{" "}
+                    {formatShare(target.trafficShare)}
                   </div>
                 </div>
                 <Badge variant={getRiskVariant(target.quota.risk)} size="sm">
@@ -379,6 +382,7 @@ function ComboAutopilotPanel({ report }: { report: ComboAutopilotReport }) {
 }
 
 function ComboScoringInspectorPanel({ inspector }: { inspector: ComboScoringInspectorCombo }) {
+  const nodeMap = useProviderNodeMap();
   const topTargets = inspector.targets.slice(0, 3);
 
   return (
@@ -431,7 +435,8 @@ function ComboScoringInspectorPanel({ inspector }: { inspector: ComboScoringInsp
                       #{target.rank} {target.label || target.model}
                     </div>
                     <div className="mt-1 text-xs text-text-muted">
-                      {target.provider} · score {target.score.toFixed(3)}
+                      {resolveProviderName(target.provider, nodeMap)} · score{" "}
+                      {target.score.toFixed(3)}
                     </div>
                   </div>
                   <Badge variant={target.rank === 1 ? "success" : "default"} size="sm">
@@ -488,6 +493,7 @@ function ComboHealthCard({
   scoringInspector?: ComboScoringInspectorCombo;
 }) {
   const t = useTranslations("analytics");
+  const nodeMap = useProviderNodeMap();
 
   const sortedDistribution = useMemo(
     () =>
@@ -563,7 +569,9 @@ function ComboHealthCard({
                 >
                   <div className="flex flex-wrap items-center justify-between gap-3">
                     <div>
-                      <div className="text-sm font-medium text-text-main">{provider.provider}</div>
+                      <div className="text-sm font-medium text-text-main">
+                        {resolveProviderName(provider.provider, nodeMap)}
+                      </div>
                       <div className="mt-1 text-xs text-text-muted">
                         Remaining quota {formatPercent(provider.remainingPct, 1)}
                       </div>
diff --git a/src/app/(dashboard)/dashboard/analytics/CompressionAnalyticsTab.tsx b/src/app/(dashboard)/dashboard/analytics/CompressionAnalyticsTab.tsx
index d633b38010..fcc47b3862 100644
--- a/src/app/(dashboard)/dashboard/analytics/CompressionAnalyticsTab.tsx
+++ b/src/app/(dashboard)/dashboard/analytics/CompressionAnalyticsTab.tsx
@@ -9,6 +9,7 @@
 
 import { useEffect, useState } from "react";
 import { useTranslations } from "next-intl";
+import { useProviderNodeMap, resolveProviderName } from "@/lib/display/useProviderNodeMap";
 
 interface CompressionAnalyticsSummary {
   totalRequests: number;
@@ -122,6 +123,7 @@ export default function CompressionAnalyticsTab() {
   const [loading, setLoading] = useState(true);
   const [error, setError] = useState<string | null>(null);
   const [since, setSince] = useState<"24h" | "7d" | "30d" | "all">("24h");
+  const nodeMap = useProviderNodeMap();
 
   useEffect(() => {
     fetch(`/api/analytics/compression?since=${since}`)
@@ -303,7 +305,7 @@ export default function CompressionAnalyticsTab() {
             {providers.map(([prov, data]) => (
               <ProviderBar
                 key={prov}
-                provider={prov}
+                provider={resolveProviderName(prov, nodeMap)}
                 count={data.count}
                 total={stats.totalRequests}
                 tokensSaved={data.tokensSaved}
diff --git a/src/app/(dashboard)/dashboard/analytics/ProviderUtilizationTab.tsx b/src/app/(dashboard)/dashboard/analytics/ProviderUtilizationTab.tsx
index 58f42ee8ac..0edba1eaef 100644
--- a/src/app/(dashboard)/dashboard/analytics/ProviderUtilizationTab.tsx
+++ b/src/app/(dashboard)/dashboard/analytics/ProviderUtilizationTab.tsx
@@ -2,6 +2,7 @@
 
 import { useTranslations } from "next-intl";
 import { useCallback, useEffect, useMemo, useState } from "react";
+import { useProviderNodeMap, resolveProviderName } from "@/lib/display/useProviderNodeMap";
 import {
   CartesianGrid,
   Legend,
@@ -91,6 +92,7 @@ function getLatestPoints(points: ProviderUtilizationPoint[]) {
 
 export default function ProviderUtilizationTab() {
   const t = useTranslations("analytics");
+  const nodeMap = useProviderNodeMap();
   const [range, setRange] = useState<UtilizationTimeRange>("24h");
   const [aggregateBy, setAggregateBy] = useState<"provider" | "connection">("provider");
   const [data, setData] = useState<ProviderUtilizationResponse | null>(null);
@@ -350,7 +352,7 @@ export default function ProviderUtilizationTab() {
                       key={provider}
                       type="monotone"
                       dataKey={provider}
-                      name={provider}
+                      name={resolveProviderName(provider, nodeMap)}
                       stroke={providerColors.get(provider) ?? "var(--color-primary)"}
                       strokeWidth={2.5}
                       dot={false}
@@ -374,7 +376,9 @@ export default function ProviderUtilizationTab() {
                           <ProviderIcon providerId={point.provider} size={22} />
                         </div>
                         <div>
-                          <p className="text-sm font-semibold text-text-main">{point.provider}</p>
+                          <p className="text-sm font-semibold text-text-main">
+                            {resolveProviderName(point.provider, nodeMap)}
+                          </p>
                           <p className="text-xs text-text-muted">
                             {t("providerUtilizationLatestSnapshot")}
                           </p>
diff --git a/src/app/(dashboard)/dashboard/analytics/RouteExplainabilityTab.tsx b/src/app/(dashboard)/dashboard/analytics/RouteExplainabilityTab.tsx
index be2257f368..d5ea1b397b 100644
--- a/src/app/(dashboard)/dashboard/analytics/RouteExplainabilityTab.tsx
+++ b/src/app/(dashboard)/dashboard/analytics/RouteExplainabilityTab.tsx
@@ -6,6 +6,7 @@ import Badge from "@/shared/components/Badge";
 import Card from "@/shared/components/Card";
 import { Skeleton } from "@/shared/components/Loading";
 import { cn } from "@/shared/utils/cn";
+import { useProviderNodeMap, resolveProviderName } from "@/lib/display/useProviderNodeMap";
 
 type CallLogOption = {
   id: string;
@@ -247,6 +248,7 @@ function FactorCard({ factor }: { factor: ExplanationFactor }) {
 }
 
 function TargetTimeline({ targets }: { targets: ExplainTarget[] }) {
+  const nodeMap = useProviderNodeMap();
   if (targets.length === 0) {
     return <div className="text-sm text-text-muted">No related target evidence persisted yet.</div>;
   }
@@ -267,7 +269,7 @@ function TargetTimeline({ targets }: { targets: ExplainTarget[] }) {
             <div className="min-w-0">
               <div className="flex flex-wrap items-center gap-2">
                 <span className="truncate text-sm font-medium text-text-main">
-                  {target.provider || "unknown"} / {target.model || "unknown"}
+                  {resolveProviderName(target.provider, nodeMap)} / {target.model || "unknown"}
                 </span>
                 {target.outcome === "selected" ? (
                   <Badge variant="primary" size="sm">
@@ -308,6 +310,7 @@ function replayAlignmentVariant(alignment: NonNullable<DecisionReplay["recompute
 }
 
 function WhyThisTargetCard({ replay }: { replay: DecisionReplay | undefined }) {
+  const nodeMap = useProviderNodeMap();
   if (!replay) return null;
   const recompute = replay.recompute;
   const candidates = recompute?.candidates ?? [];
@@ -324,7 +327,8 @@ function WhyThisTargetCard({ replay }: { replay: DecisionReplay | undefined }) {
             <div className="min-w-0">
               <div className="text-sm font-semibold text-text-main">Exact runtime log</div>
               <div className="mt-1 truncate text-xs text-text-muted">
-                {replay.runtime.provider || "unknown"} / {replay.runtime.model || "unknown"}
+                {resolveProviderName(replay.runtime.provider, nodeMap)} /{" "}
+                {replay.runtime.model || "unknown"}
               </div>
               <div className="mt-1 text-xs text-text-muted">
                 {formatDate(replay.runtime.timestamp)} · {replay.runtime.comboStepId || "no step"}
@@ -400,7 +404,7 @@ function WhyThisTargetCard({ replay }: { replay: DecisionReplay | undefined }) {
                     <div className="flex flex-wrap items-center gap-2 text-sm font-medium text-text-main">
                       <span>#{candidate.rank}</span>
                       <span className="truncate">
-                        {candidate.provider} / {candidate.model}
+                        {resolveProviderName(candidate.provider, nodeMap)} / {candidate.model}
                       </span>
                       {candidate.isRuntimeSelected ? (
                         <Badge variant="primary" size="sm">
@@ -447,6 +451,7 @@ export default function RouteExplainabilityTab({
   initialRequestId?: string;
 }) {
   const t = useTranslations("analytics") as AnalyticsTranslator;
+  const nodeMap = useProviderNodeMap();
   const [logs, setLogs] = useState<CallLogOption[]>([]);
   const [selectedId, setSelectedId] = useState(initialRequestId);
   const [explanation, setExplanation] = useState<RouteExplainabilityResponse | null>(null);
@@ -564,7 +569,7 @@ export default function RouteExplainabilityTab({
             {logs.map((log) => (
               <option key={log.id} value={log.id}>
                 {formatDate(log.timestamp)} · HTTP {log.status} ·{" "}
-                {log.comboName || log.provider || "direct"} ·{" "}
+                {log.comboName || resolveProviderName(log.provider, nodeMap) || "direct"} ·{" "}
                 {log.model || log.requestedModel || log.id}
               </option>
             ))}
@@ -662,7 +667,7 @@ export default function RouteExplainabilityTab({
             <Card title="Selected target" icon="my_location">
               <div className="grid gap-3 text-sm">
                 {[
-                  ["Provider", explanation.selectedTarget.provider || "n/a"],
+                  ["Provider", resolveProviderName(explanation.selectedTarget.provider, nodeMap)],
                   ["Model", explanation.selectedTarget.model || "n/a"],
                   ["Account", explanation.selectedTarget.account || "n/a"],
                   ["Connection", explanation.selectedTarget.connectionId || "n/a"],
diff --git a/src/app/(dashboard)/dashboard/cache/page.tsx b/src/app/(dashboard)/dashboard/cache/page.tsx
index 26cf749841..11ad9c89ba 100644
--- a/src/app/(dashboard)/dashboard/cache/page.tsx
+++ b/src/app/(dashboard)/dashboard/cache/page.tsx
@@ -4,6 +4,7 @@ import { useState, useEffect, useCallback, type ReactNode } from "react";
 import { Card, Button, EmptyState } from "@/shared/components";
 import { useNotificationStore } from "@/store/notificationStore";
 import { useTranslations } from "next-intl";
+import { useProviderNodeMap, resolveProviderName } from "@/lib/display/useProviderNodeMap";
 import CacheEntriesTab from "./components/CacheEntriesTab";
 import ReasoningCacheTab from "./components/ReasoningCacheTab";
 
@@ -351,6 +352,7 @@ export default function CachePage() {
   const tSettings = useTranslations("settings");
   const tRoot = useTranslations();
   const notify = useNotificationStore();
+  const nodeMap = useProviderNodeMap();
 
   const [stats, setStats] = useState<CacheStats | null>(null);
   const [loading, setLoading] = useState(true);
@@ -600,7 +602,9 @@ export default function CachePage() {
                                 className="border-b border-border/15 last:border-b-0"
                               >
                                 <td className="px-4 py-3">
-                                  <div className="font-medium text-text-main">{provider}</div>
+                                  <div className="font-medium text-text-main">
+                                    {resolveProviderName(provider, nodeMap)}
+                                  </div>
                                   <div className="mt-1 text-xs text-text-muted">
                                     {totalRequests.toLocaleString()} {t("requests").toLowerCase()}
                                   </div>
diff --git a/src/app/(dashboard)/dashboard/combos/live/comboFlowModel.ts b/src/app/(dashboard)/dashboard/combos/live/comboFlowModel.ts
index 75230b16b6..9a6c8c7747 100644
--- a/src/app/(dashboard)/dashboard/combos/live/comboFlowModel.ts
+++ b/src/app/(dashboard)/dashboard/combos/live/comboFlowModel.ts
@@ -25,6 +25,7 @@
  *   *into* each target node carries the target's state colour.
  */
 
+import type { CSSProperties } from "react";
 import type { Node, Edge } from "@xyflow/react";
 import { edgeStyle } from "@/shared/components/flow/edgeStyles";
 
@@ -285,7 +286,7 @@ export function comboRunToFlow(run: ComboRunModel): { nodes: Node[]; edges: Edge
 
   // Edge: request → strategy (always active/idle depending on run state)
   const runActive = run.outcome === "running";
-  const reqStratStyle = edgeStyle(runActive, !runActive, false);
+  const reqStratStyle = edgeStyle(runActive, !runActive, false) as unknown as CSSProperties;
   edges.push({
     id: `e-${requestId}-${strategyId}`,
     source: requestId,
@@ -324,7 +325,7 @@ export function comboRunToFlow(run: ComboRunModel): { nodes: Node[]; edges: Edge
     const isError = t.state === "failed";
     const isActive = t.state === "succeeded";
     const isLast = t.state === "attempting";
-    const targetEdgeStyle = edgeStyle(isActive, isLast, isError);
+    const targetEdgeStyle = edgeStyle(isActive, isLast, isError) as unknown as CSSProperties;
 
     edges.push({
       id: `e-${prevId}-${nodeId}`,
@@ -351,7 +352,7 @@ export function comboRunToFlow(run: ComboRunModel): { nodes: Node[]; edges: Edge
 
   // Edge: last target → response — green if succeeded, muted otherwise
   const succeeded = run.outcome === "succeeded";
-  const responseEdgeStyle = edgeStyle(succeeded, false, false);
+  const responseEdgeStyle = edgeStyle(succeeded, false, false) as unknown as CSSProperties;
   edges.push({
     id: `e-${prevId}-${responseId}`,
     source: prevId,
diff --git a/src/app/(dashboard)/dashboard/combos/page.tsx b/src/app/(dashboard)/dashboard/combos/page.tsx
index b64dcbd959..985ad22758 100644
--- a/src/app/(dashboard)/dashboard/combos/page.tsx
+++ b/src/app/(dashboard)/dashboard/combos/page.tsx
@@ -1947,6 +1947,7 @@ function ComboFormModal({ isOpen, combo, onClose, onSave, activeProviders, combo
   const isExpertMode = normalizeComboConfigMode(comboConfigMode) === "expert";
   const createDraftStateRef = useRef<CreateDraftSnapshot>(getEmptyCreateDraftSnapshot());
   const [name, setName] = useState(combo?.name || "");
+  const [description, setDescription] = useState<string>(combo?.description || "");
   const [models, setModels] = useState(() => {
     return (combo?.models || []).map((m) => normalizeModelEntry(m));
   });
@@ -2007,6 +2008,7 @@ function ComboFormModal({ isOpen, combo, onClose, onSave, activeProviders, combo
           );
 
       setName(nextCombo?.name || "");
+      setDescription(nextCombo?.description || "");
       setModels((nextCombo?.models || []).map((m) => normalizeModelEntry(m)));
       setStrategy(nextCombo?.strategy || comboDefaults?.strategy || "priority");
       setConfig(nextConfig);
@@ -2738,6 +2740,14 @@ function ComboFormModal({ isOpen, combo, onClose, onSave, activeProviders, combo
       strategy,
     };
 
+    // Per-combo description (#5005). Free-text, optional, persisted in combo data.
+    if (description.trim()) {
+      saveData.description = description.trim();
+    } else if (isEdit) {
+      // Editing: send null to explicitly clear a previously-set description.
+      saveData.description = null;
+    }
+
     // Include config only if any values are set
     const configToSave = sanitizeComboRuntimeConfig(config);
     // Add round-robin specific fields to config
@@ -2924,6 +2934,25 @@ function ComboFormModal({ isOpen, combo, onClose, onSave, activeProviders, combo
                 )}
               </div>
 
+              {/* Description (#5005) — optional free-text note for this combo */}
+              <div>
+                <label className="text-[11px] font-medium text-text-muted block mb-0.5">
+                  {getI18nOrFallback(t, "comboDescription", "Description")}
+                </label>
+                <textarea
+                  rows={2}
+                  data-testid="combo-description-input"
+                  value={description}
+                  onChange={(e) => setDescription(e.target.value)}
+                  placeholder={getI18nOrFallback(
+                    t,
+                    "comboDescriptionPlaceholder",
+                    "Optional note describing this combo"
+                  )}
+                  className="w-full text-xs py-1.5 px-2 rounded border border-black/10 dark:border-white/10 bg-transparent focus:border-primary focus:outline-none resize-none"
+                />
+              </div>
+
               {!isEdit && !isExpertMode && (
                 <div className="rounded-lg border border-black/8 dark:border-white/8 bg-black/[0.02] dark:bg-white/[0.02] p-3">
                   <div className="mb-2">
diff --git a/src/app/(dashboard)/dashboard/costs/CostOverviewTab.tsx b/src/app/(dashboard)/dashboard/costs/CostOverviewTab.tsx
index 829fb5060f..3915e68a36 100644
--- a/src/app/(dashboard)/dashboard/costs/CostOverviewTab.tsx
+++ b/src/app/(dashboard)/dashboard/costs/CostOverviewTab.tsx
@@ -3,6 +3,7 @@
 import { useEffect, useMemo, useState } from "react";
 import { useSearchParams } from "next/navigation";
 import { useLocale, useTranslations } from "next-intl";
+import { useProviderNodeMap, resolveProviderName } from "@/lib/display/useProviderNodeMap";
 import { Card, EmptyState, SegmentedControl, CardSkeleton } from "@/shared/components";
 import {
   getServiceTierDisplayLabel,
@@ -282,6 +283,7 @@ function downloadFile(content: string, filename: string, mimeType: string) {
 export default function CostOverviewTab() {
   const t = useTranslations("costs");
   const locale = useLocale();
+  const nodeMap = useProviderNodeMap();
   const searchParams = useSearchParams();
   const apiKeyIdsParam = searchParams.get("apiKeyIds");
   const selectedApiKeyIds = useMemo(() => parseApiKeyIds(apiKeyIdsParam), [apiKeyIdsParam]);
@@ -377,7 +379,8 @@ export default function CostOverviewTab() {
 
   const providersByCost = [...(analytics?.byProvider || [])]
     .filter((provider) => (hasCostData ? provider.cost > 0 : provider.requests > 0))
-    .sort((left, right) => (hasCostData ? right.cost - left.cost : right.requests - left.requests));
+    .sort((left, right) => (hasCostData ? right.cost - left.cost : right.requests - left.requests))
+    .map((row) => ({ ...row, provider: resolveProviderName(row.provider, nodeMap) }));
   const modelsByCost = [...(analytics?.byModel || [])]
     .filter((model) => (hasCostData ? model.cost > 0 : model.requests > 0))
     .sort((left, right) => (hasCostData ? right.cost - left.cost : right.requests - left.requests));
diff --git a/src/app/(dashboard)/dashboard/endpoint/EndpointPageClient.tsx b/src/app/(dashboard)/dashboard/endpoint/EndpointPageClient.tsx
index 17c1ae47e5..54e27f4991 100644
--- a/src/app/(dashboard)/dashboard/endpoint/EndpointPageClient.tsx
+++ b/src/app/(dashboard)/dashboard/endpoint/EndpointPageClient.tsx
@@ -3,6 +3,7 @@
 import { useState, useEffect, useMemo, useCallback } from "react";
 import Link from "next/link";
 import { Card, Button, Input, Modal, CardSkeleton, SegmentedControl } from "@/shared/components";
+import Toggle from "@/shared/components/Toggle";
 import { useCopyToClipboard } from "@/shared/hooks/useCopyToClipboard";
 import { useDisplayBaseUrl } from "@/shared/hooks";
 import { AI_PROVIDERS, getProviderByAlias } from "@/shared/constants/providers";
@@ -189,6 +190,8 @@ export default function APIPageClient({ machineId }: Readonly<APIPageClientProps
   const [lanUrls, setLanUrls] = useState<string[]>([]);
   const [tailscaleIpUrl, setTailscaleIpUrl] = useState<string | null>(null);
   const [activeEndpointTab, setActiveEndpointTab] = useState<EndpointTab>("apis");
+  const [customSystemPromptEnabled, setCustomSystemPromptEnabled] = useState(false);
+  const [customSystemPrompt, setCustomSystemPrompt] = useState("");
 
   const { copied, copy } = useCopyToClipboard();
 
@@ -496,6 +499,8 @@ export default function APIPageClient({ machineId }: Readonly<APIPageClientProps
         setShowTailscaleFunnel(tunnelVisibility.showTailscaleFunnel);
         setShowNgrokTunnel(tunnelVisibility.showNgrokTunnel);
         if (data.ngrokAuthToken) setNgrokToken(data.ngrokAuthToken);
+        setCustomSystemPromptEnabled(!!data.customSystemPromptEnabled);
+        setCustomSystemPrompt(data.customSystemPrompt || "");
 
         if (!tunnelVisibility.showCloudflaredTunnel) {
           setCloudflaredStatus(null);
@@ -519,6 +524,24 @@ export default function APIPageClient({ machineId }: Readonly<APIPageClientProps
     return DEFAULT_TUNNEL_VISIBILITY;
   };
 
+  const handleCustomSystemPromptEnabledChange = (value: boolean) => {
+    setCustomSystemPromptEnabled(value);
+    void fetch("/api/settings", {
+      method: "PATCH",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ customSystemPromptEnabled: value }),
+    });
+  };
+
+  const handleCustomSystemPromptChange = (value: string) => {
+    setCustomSystemPrompt(value);
+    void fetch("/api/settings", {
+      method: "PATCH",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ customSystemPrompt: value }),
+    });
+  };
+
   const handleCloudToggle = (checked) => {
     if (checked) {
       if (!cloudConfigured) {
@@ -1749,6 +1772,31 @@ export default function APIPageClient({ machineId }: Readonly<APIPageClientProps
             </div>
           )}
         </div>
+
+        {/* Custom System Prompt */}
+        <div className="flex items-center justify-between pt-4 mt-4 border-t border-border gap-4 flex-wrap">
+          <div className="min-w-0 flex-1">
+            <p className="font-medium text-sm">{t("customSystemPromptTitle")}</p>
+            <p className="text-sm text-text-muted">{t("customSystemPromptDescription")}</p>
+          </div>
+          <div className="flex items-center gap-3 shrink-0">
+            {customSystemPromptEnabled && (
+              <Input
+                type="text"
+                value={customSystemPrompt}
+                onChange={(e) => handleCustomSystemPromptChange(e.target.value)}
+                placeholder={t("customSystemPromptPlaceholder")}
+                className="w-64 text-xs"
+              />
+            )}
+            <Toggle
+              checked={customSystemPromptEnabled}
+              onChange={handleCustomSystemPromptEnabledChange}
+              ariaLabel={t("customSystemPromptTitle")}
+              size="sm"
+            />
+          </div>
+        </div>
       </Card>
 
       <Card>
diff --git a/src/app/(dashboard)/dashboard/health/ProviderHealthAutopilotCard.tsx b/src/app/(dashboard)/dashboard/health/ProviderHealthAutopilotCard.tsx
index 339b12c7d9..15d264b015 100644
--- a/src/app/(dashboard)/dashboard/health/ProviderHealthAutopilotCard.tsx
+++ b/src/app/(dashboard)/dashboard/health/ProviderHealthAutopilotCard.tsx
@@ -3,6 +3,7 @@
 import { useCallback, useEffect, useMemo, useState } from "react";
 import { Card } from "@/shared/components";
 import { getProviderDisplayName } from "@/lib/display/names";
+import { useProviderNodeMap, resolveProviderName } from "@/lib/display/useProviderNodeMap";
 
 type AutopilotAction = {
   type: string;
@@ -99,6 +100,7 @@ function formatConnectionEvidence(issue: AutopilotIssue): string | null {
 }
 
 export default function ProviderHealthAutopilotCard() {
+  const nodeMap = useProviderNodeMap();
   const [report, setReport] = useState<AutopilotReport | null>(null);
   const [loading, setLoading] = useState(true);
   const [error, setError] = useState<string | null>(null);
@@ -241,7 +243,7 @@ export default function ProviderHealthAutopilotCard() {
               <div className="flex flex-col gap-2 md:flex-row md:items-center md:justify-between">
                 <div>
                   <h3 className="font-semibold text-text-main">
-                    {getProviderDisplayName(provider.provider)}
+                    {resolveProviderName(provider.provider, nodeMap)}
                   </h3>
                   <p className="text-xs text-text-muted">
                     score {(provider.score * 100).toFixed(0)}% · active{" "}
diff --git a/src/app/(dashboard)/dashboard/health/page.tsx b/src/app/(dashboard)/dashboard/health/page.tsx
index 12605e5da9..30e2eeb5e0 100644
--- a/src/app/(dashboard)/dashboard/health/page.tsx
+++ b/src/app/(dashboard)/dashboard/health/page.tsx
@@ -16,6 +16,7 @@ import { useState, useEffect, useCallback } from "react";
 import { Card } from "@/shared/components";
 import { AI_PROVIDERS } from "@/shared/constants/providers";
 import { getProviderDisplayName } from "@/lib/display/names";
+import { useProviderNodeMap, resolveProviderName } from "@/lib/display/useProviderNodeMap";
 import { compareTr } from "@/shared/utils/turkishText";
 import { useTranslations } from "next-intl";
 import TelemetryCard from "./TelemetryCard";
@@ -59,6 +60,7 @@ export default function HealthPage() {
   const t = useTranslations("health");
   const tc = useTranslations("common");
   const tp = useTranslations("providers");
+  const nodeMap = useProviderNodeMap();
   const [data, setData] = useState(null);
   const [dbHealth, setDbHealth] = useState(null);
   const [dbHealthError, setDbHealthError] = useState(null);
@@ -763,7 +765,10 @@ export default function HealthPage() {
                     {unhealthy.map(([provider, cb]: [string, any]) => {
                       const style = CB_STYLES[cb.state] || CB_STYLES.OPEN;
                       const providerInfo = AI_PROVIDERS[provider];
-                      const displayName = getProviderDisplayName(provider, providerInfo);
+                      const displayName = getProviderDisplayName(
+                        provider,
+                        nodeMap.get(provider) ?? providerInfo
+                      );
                       return (
                         <div
                           key={provider}
@@ -821,7 +826,10 @@ export default function HealthPage() {
                     <div className="grid grid-cols-2 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-5 gap-2">
                       {healthy.map(([provider]) => {
                         const providerInfo = AI_PROVIDERS[provider];
-                        const displayName = getProviderDisplayName(provider, providerInfo);
+                        const displayName = getProviderDisplayName(
+                          provider,
+                          nodeMap.get(provider) ?? providerInfo
+                        );
                         return (
                           <div
                             key={provider}
@@ -857,25 +865,9 @@ export default function HealthPage() {
             const connectionId = parts[1] || "";
             const model = parts.slice(2).join(":") || null;
 
-            // Resolve friendly name
-            let displayName;
+            // Resolve friendly name — prefer user-given name from provider node map
             let providerInfo = AI_PROVIDERS[providerId];
-
-            if (providerId.startsWith("openai-compatible-")) {
-              const customName = providerId.replace("openai-compatible-", "");
-              displayName = tp("openaiCompatibleName");
-              providerInfo = { color: "#10A37F", textIcon: "OC" };
-              if (customName.length > 12) displayName += ` (${customName.slice(0, 8)}…)`;
-              else if (customName) displayName += ` (${customName})`;
-            } else if (providerId.startsWith("anthropic-compatible-")) {
-              const customName = providerId.replace("anthropic-compatible-", "");
-              displayName = tp("anthropicCompatibleName");
-              providerInfo = { color: "#D97757", textIcon: "AC" };
-              if (customName.length > 12) displayName += ` (${customName.slice(0, 8)}…)`;
-              else if (customName) displayName += ` (${customName})`;
-            } else {
-              displayName = getProviderDisplayName(providerId, providerInfo);
-            }
+            const displayName = resolveProviderName(providerId, nodeMap);
 
             return { providerId, displayName, providerInfo, connectionId, model };
           };
diff --git a/src/app/(dashboard)/dashboard/homeAppearance.ts b/src/app/(dashboard)/dashboard/homeAppearance.ts
new file mode 100644
index 0000000000..db80ad2952
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/homeAppearance.ts
@@ -0,0 +1,18 @@
+// Appearance-flag resolution for the home dashboard.
+//
+// Regression context (#4596 → restored here): the home provider-topology card
+// (the ReactFlow connection map) defaults ON — the AppearanceTab toggle reads it
+// as `settings.showProviderTopologyOnHome !== false`. #4596 made HomePageClient
+// initialize the flag to `false` and only flip it when the API returned an
+// explicit boolean, so any install that never persisted the setting (the common
+// case → the field is `undefined`) kept the card hidden forever, contradicting
+// the AppearanceTab toggle. This helper centralizes the default-ON semantics so
+// both surfaces agree: absent ⇒ show, explicit `false` ⇒ hide, explicit `true` ⇒ show.
+
+/**
+ * Whether the home provider-topology card should render.
+ * Defaults ON; only an explicit `false` hides it (mirrors AppearanceTab).
+ */
+export function shouldShowProviderTopologyOnHome(setting: unknown): boolean {
+  return setting !== false;
+}
diff --git a/src/app/(dashboard)/dashboard/provider-stats/page.tsx b/src/app/(dashboard)/dashboard/provider-stats/page.tsx
index 9be2cb0a5a..da4e218a19 100644
--- a/src/app/(dashboard)/dashboard/provider-stats/page.tsx
+++ b/src/app/(dashboard)/dashboard/provider-stats/page.tsx
@@ -9,6 +9,7 @@
 
 import { useState, useEffect, useCallback, Fragment } from "react";
 import { Card } from "@/shared/components";
+import { useProviderNodeMap, resolveProviderName } from "@/lib/display/useProviderNodeMap";
 
 interface ProviderStat {
   provider: string;
@@ -33,7 +34,14 @@ interface ToolLatencyStat {
   measurementCount: number;
 }
 
-type SortKey = "totalRequests" | "successfulRequests" | "avgLatencyMs" | "totalTokensIn" | "totalTokensOut" | "avgTtftAfterToolMs" | "avgGapAfterToolMs";
+type SortKey =
+  | "totalRequests"
+  | "successfulRequests"
+  | "avgLatencyMs"
+  | "totalTokensIn"
+  | "totalTokensOut"
+  | "avgTtftAfterToolMs"
+  | "avgGapAfterToolMs";
 type SortDir = "asc" | "desc";
 
 function formatNumber(n: number | null): string {
@@ -55,6 +63,7 @@ function successRate(successful: number, total: number): string {
 }
 
 export default function ProviderStatsPage() {
+  const nodeMap = useProviderNodeMap();
   const [data, setData] = useState<{
     providers: ProviderStat[];
     models: ModelStat[];
@@ -99,12 +108,11 @@ export default function ProviderStatsPage() {
   // Compute summary stats
   const totalRequests = data?.providers.reduce((s, p) => s + (p.totalRequests || 0), 0) ?? 0;
   const totalSuccessful = data?.providers.reduce((s, p) => s + (p.successfulRequests || 0), 0) ?? 0;
-  const avgLatency =
-    data?.providers.length
-      ? Math.round(
-          data.providers.reduce((s, p) => s + (p.avgLatencyMs || 0), 0) / data.providers.length
-        )
-      : 0;
+  const avgLatency = data?.providers.length
+    ? Math.round(
+        data.providers.reduce((s, p) => s + (p.avgLatencyMs || 0), 0) / data.providers.length
+      )
+    : 0;
   const activeProviders = data?.providers.length ?? 0;
 
   // Sorted providers
@@ -112,8 +120,8 @@ export default function ProviderStatsPage() {
     if (sortKey === "avgTtftAfterToolMs" || sortKey === "avgGapAfterToolMs") {
       const aLatency = data?.toolLatency?.[a.provider] ?? null;
       const bLatency = data?.toolLatency?.[b.provider] ?? null;
-      const va = aLatency ? (aLatency[sortKey] as number) ?? 0 : 0;
-      const vb = bLatency ? (bLatency[sortKey] as number) ?? 0 : 0;
+      const va = aLatency ? ((aLatency[sortKey] as number) ?? 0) : 0;
+      const vb = bLatency ? ((bLatency[sortKey] as number) ?? 0) : 0;
       return sortDir === "desc" ? vb - va : va - vb;
     }
     const va = (a[sortKey] as number) ?? 0;
@@ -294,17 +302,20 @@ export default function ProviderStatsPage() {
               {sortedProviders.map((p) => {
                 const isExpanded = expandedProvider === p.provider;
                 const models = modelsByProvider.get(p.provider) ?? [];
-                const rate = p.totalRequests > 0 ? (p.successfulRequests / p.totalRequests) * 100 : 0;
+                const rate =
+                  p.totalRequests > 0 ? (p.successfulRequests / p.totalRequests) * 100 : 0;
                 return (
                   <Fragment key={p.provider}>
                     <tr
                       className="border-b border-border/50 hover:bg-surface/50 transition-colors cursor-pointer"
                       onClick={() =>
-                        setExpandedProvider(isExpanded ? null : models.length > 0 ? p.provider : null)
+                        setExpandedProvider(
+                          isExpanded ? null : models.length > 0 ? p.provider : null
+                        )
                       }
                     >
                       <td className="py-2.5 px-3 font-medium text-text-main">
-                        {p.provider}
+                        {resolveProviderName(p.provider, nodeMap)}
                       </td>
                       <td className="py-2.5 px-3 text-right tabular-nums text-text-main">
                         {formatNumber(p.totalRequests)}
@@ -363,7 +374,9 @@ export default function ProviderStatsPage() {
                                   <th className="text-right py-1.5 px-3 font-medium">Requests</th>
                                   <th className="text-right py-1.5 px-3 font-medium">Success</th>
                                   <th className="text-right py-1.5 px-3 font-medium">Rate</th>
-                                  <th className="text-right py-1.5 px-3 font-medium">Avg Latency</th>
+                                  <th className="text-right py-1.5 px-3 font-medium">
+                                    Avg Latency
+                                  </th>
                                   <th className="px-3 w-8" />
                                 </tr>
                               </thead>
@@ -444,7 +457,10 @@ export default function ProviderStatsPage() {
               </thead>
               <tbody>
                 {Object.entries(data.comboMetrics).map(([name, m]: [string, any]) => (
-                  <tr key={name} className="border-b border-border/50 hover:bg-surface/50 transition-colors">
+                  <tr
+                    key={name}
+                    className="border-b border-border/50 hover:bg-surface/50 transition-colors"
+                  >
                     <td className="py-2 px-3 font-medium text-text-main">{name}</td>
                     <td className="py-2 px-3 text-right tabular-nums text-text-main">
                       {formatNumber(m.requestCount ?? m.totalRequests ?? 0)}
@@ -456,7 +472,9 @@ export default function ProviderStatsPage() {
                       {formatLatency(m.avgLatency ?? m.avgTotalMs ?? null)}
                     </td>
                     <td className="py-2 px-3 text-right tabular-nums">
-                      {typeof m.successRate === "number" ? `${(m.successRate * 100).toFixed(1)}%` : "—"}
+                      {typeof m.successRate === "number"
+                        ? `${(m.successRate * 100).toFixed(1)}%`
+                        : "—"}
                     </td>
                   </tr>
                 ))}
@@ -478,10 +496,7 @@ export default function ProviderStatsPage() {
             {Object.entries(data.telemetry).map(([key, val]: [string, any]) => {
               if (val == null || typeof val === "object") return null;
               return (
-                <div
-                  key={key}
-                  className="rounded-lg border border-border/40 bg-surface/30 p-3"
-                >
+                <div key={key} className="rounded-lg border border-border/40 bg-surface/30 p-3">
                   <p className="text-xs text-text-muted uppercase tracking-wide">
                     {key.replace(/([A-Z])/g, " $1").replace(/_/g, " ")}
                   </p>
diff --git a/src/app/(dashboard)/dashboard/providers/[id]/components/modals/EditConnectionModal.tsx b/src/app/(dashboard)/dashboard/providers/[id]/components/modals/EditConnectionModal.tsx
index 0874a9bfcc..e1829f0469 100644
--- a/src/app/(dashboard)/dashboard/providers/[id]/components/modals/EditConnectionModal.tsx
+++ b/src/app/(dashboard)/dashboard/providers/[id]/components/modals/EditConnectionModal.tsx
@@ -750,25 +750,33 @@ export default function EditConnectionModal({
             setFormData({ ...formData, priority: Number.parseInt(e.target.value) || 1 })
           }
         />
-        <Input
-          label={t("accountConcurrencyCapLabel")}
-          type="number"
-          min={0}
-          step={1}
-          value={formData.maxConcurrent}
-          onChange={(e) => {
-            const nextValue = e.target.value;
-            setFormData({ ...formData, maxConcurrent: nextValue });
-            if (saveError && nextValue.trim()) {
-              const numericValue = Number(nextValue);
-              if (Number.isInteger(numericValue) && numericValue >= 0) {
-                setSaveError(null);
+        <div className="flex flex-col gap-2 rounded-lg border border-primary/30 bg-primary/5 p-4">
+          <div className="flex items-center gap-1.5 text-sm font-semibold text-primary">
+            <span className="material-symbols-outlined text-[18px]" aria-hidden="true">
+              dynamic_feed
+            </span>
+            {t("accountConcurrencyCapLabel")}
+          </div>
+          <Input
+            type="number"
+            min={0}
+            step={1}
+            aria-label={t("accountConcurrencyCapLabel")}
+            value={formData.maxConcurrent}
+            onChange={(e) => {
+              const nextValue = e.target.value;
+              setFormData({ ...formData, maxConcurrent: nextValue });
+              if (saveError && nextValue.trim()) {
+                const numericValue = Number(nextValue);
+                if (Number.isInteger(numericValue) && numericValue >= 0) {
+                  setSaveError(null);
+                }
               }
-            }
-          }}
-          placeholder="0"
-          hint={t("accountConcurrencyCapHint")}
-        />
+            }}
+            placeholder="0"
+            hint={t("accountConcurrencyCapHint")}
+          />
+        </div>
         {saveError && (
           <div className="text-sm text-red-500 bg-red-500/10 border border-red-500/20 rounded-lg px-3 py-2">
             {saveError}
diff --git a/src/app/(dashboard)/dashboard/providers/[id]/hooks/useModelVisibilityHandlers.ts b/src/app/(dashboard)/dashboard/providers/[id]/hooks/useModelVisibilityHandlers.ts
index b2ba946b20..e9283d1b77 100644
--- a/src/app/(dashboard)/dashboard/providers/[id]/hooks/useModelVisibilityHandlers.ts
+++ b/src/app/(dashboard)/dashboard/providers/[id]/hooks/useModelVisibilityHandlers.ts
@@ -26,6 +26,7 @@ import {
   providerText,
   testAllResultsText,
   evaluateTestAllEntry,
+  shouldSwitchToVisibleFilter,
   type ProviderMessageTranslator,
   type CompatByProtocolMap,
 } from "../providerPageHelpers";
@@ -391,6 +392,14 @@ export function useModelVisibilityHandlers({
     notify.info(testAllResultsText(t, ok, ok + error));
     if (hiddenCount > 0) {
       notify.info(providerText(t, "testAllFailedHidden", "{count} hidden", { count: hiddenCount }));
+      // Bug #4887: switch to "visible" so the models we just auto-hid disappear
+      // on-screen — parity with PassthroughModelsSection (#3610). Without this,
+      // failed models were hidden in the DB but stayed visible under the "All"
+      // filter, so on GLM (and other OAuth providers using this hook's handleTestAll)
+      // it looked like nothing was hidden.
+      if (shouldSwitchToVisibleFilter({ autoHideFailed, hiddenCount })) {
+        setVisibilityFilter("visible");
+      }
     }
     setTestingAll(false);
     setTestProgress(null);
diff --git a/src/app/(dashboard)/dashboard/runtime/RuntimePageClient.tsx b/src/app/(dashboard)/dashboard/runtime/RuntimePageClient.tsx
index beed568a11..300d93e2e3 100644
--- a/src/app/(dashboard)/dashboard/runtime/RuntimePageClient.tsx
+++ b/src/app/(dashboard)/dashboard/runtime/RuntimePageClient.tsx
@@ -6,6 +6,7 @@ import Link from "next/link";
 import Card from "@/shared/components/Card";
 import ProviderIcon from "@/shared/components/ProviderIcon";
 import ModelCooldownsCard from "./components/ModelCooldownsCard";
+import { useProviderNodeMap, resolveProviderName } from "@/lib/display/useProviderNodeMap";
 
 type KnownBreakerState = "CLOSED" | "OPEN" | "HALF_OPEN" | "DEGRADED";
 type BreakerState = KnownBreakerState | (string & {});
@@ -399,6 +400,7 @@ function diffSnapshots(
 
 export default function RuntimePageClient() {
   const t = useTranslations("runtime");
+  const nodeMap = useProviderNodeMap();
   const [health, setHealth] = useState<HealthPayload | null>(null);
   const [connections, setConnections] = useState<Connection[]>([]);
   const [loading, setLoading] = useState(true);
@@ -673,11 +675,13 @@ export default function RuntimePageClient() {
                       key={b.provider}
                       className="rounded-md border px-2.5 py-2 flex flex-col gap-0.5"
                       style={{ borderColor: tone.ring, background: tone.bg }}
-                      title={`${b.provider} · ${state || "UNKNOWN"} · failures ${b.failureCount}`}
+                      title={`${resolveProviderName(b.provider, nodeMap)} · ${state || "UNKNOWN"} · failures ${b.failureCount}`}
                     >
                       <div className="flex items-center gap-1.5 text-[11px] font-semibold text-text-main">
                         <ProviderIcon providerId={b.provider} size={14} />
-                        <span className="truncate flex-1">{b.provider}</span>
+                        <span className="truncate flex-1">
+                          {resolveProviderName(b.provider, nodeMap)}
+                        </span>
                         <span style={{ color: tone.dot }} className="text-[10px] font-bold">
                           {tone.label}
                         </span>
@@ -721,7 +725,7 @@ export default function RuntimePageClient() {
                         <ProviderIcon providerId={c.provider} size={18} />
                         <div className="min-w-0">
                           <div className="text-[12px] text-text-main truncate font-medium">
-                            {c.provider}/{label}
+                            {resolveProviderName(c.provider, nodeMap)}/{label}
                           </div>
                           {c.lastErrorType && (
                             <div className="text-[10px] text-text-muted truncate">
@@ -1174,7 +1178,7 @@ function QuotaGroup({
             <div className="min-w-0">
               <div className="text-[11px] font-medium text-text-main truncate">
                 {m.accountId ?? "—"}
-                {m.provider ? ` / ${m.provider}` : ""}
+                {m.provider ? ` / ${resolveProviderName(m.provider, nodeMap)}` : ""}
               </div>
               <div className="text-[10px] text-text-muted">{m.window ?? ""}</div>
             </div>
diff --git a/src/app/(dashboard)/dashboard/settings/components/ResilienceTab.tsx b/src/app/(dashboard)/dashboard/settings/components/ResilienceTab.tsx
index fda5ce43bf..206b380f2f 100644
--- a/src/app/(dashboard)/dashboard/settings/components/ResilienceTab.tsx
+++ b/src/app/(dashboard)/dashboard/settings/components/ResilienceTab.tsx
@@ -36,6 +36,17 @@ type WaitForCooldownSettings = {
   maxRetryWaitSec: number;
 };
 
+type ComboCooldownWaitSettings = {
+  enabled: boolean;
+  maxWaitMs: number;
+  maxAttempts: number;
+  budgetMs: number;
+};
+
+type QuotaShareConcurrencyLimitSettings = {
+  enabled: boolean;
+};
+
 type ProviderCooldownSettings = {
   enabled: boolean;
   minRetryCooldownMs: number;
@@ -53,6 +64,8 @@ type ResilienceResponse = {
     apikey: ProviderBreakerProfileSettings;
   };
   waitForCooldown: WaitForCooldownSettings;
+  comboCooldownWait: ComboCooldownWaitSettings;
+  quotaShareConcurrencyLimit: QuotaShareConcurrencyLimitSettings;
   providerCooldown: ProviderCooldownSettings;
 };
 
@@ -722,6 +735,197 @@ function WaitForCooldownCard({
   );
 }
 
+function ComboCooldownWaitCard({
+  value,
+  onSave,
+  saving,
+}: {
+  value: ComboCooldownWaitSettings;
+  onSave: (next: ComboCooldownWaitSettings) => Promise<void>;
+  saving: boolean;
+}) {
+  const t = useTranslations("settings");
+  const [editing, setEditing] = useState(false);
+  const [draft, setDraft] = useState(value);
+
+  useEffect(() => {
+    setDraft(value);
+  }, [value]);
+
+  const title = t("resilienceComboCooldownWaitTitle") || "Quota-share combo cooldown wait";
+  const desc =
+    t("resilienceComboCooldownWaitDesc") ||
+    "For quota-share combos only: wait out a short transient cooldown and re-dispatch instead of returning a 429 immediately. Never waits on quota_exhausted.";
+
+  return (
+    <Card className="p-6">
+      <div className="mb-4 flex items-start justify-between gap-4">
+        <div className="flex items-center gap-2">
+          <span className="material-symbols-outlined text-xl text-primary">timer</span>
+          <h2 className="text-lg font-bold">{title}</h2>
+        </div>
+        <ActionRow
+          editing={editing}
+          saving={saving}
+          onEdit={() => setEditing(true)}
+          onCancel={() => {
+            setDraft(value);
+            setEditing(false);
+          }}
+          onSave={async () => {
+            await onSave(draft);
+            setEditing(false);
+          }}
+        />
+      </div>
+
+      <p className="mb-4 text-sm text-text-muted">{desc}</p>
+
+      <div className="grid grid-cols-1 gap-3 lg:grid-cols-2">
+        {editing ? (
+          <>
+            <BooleanField
+              label={t("resilienceEnableServerWait") || "Enabled"}
+              description={
+                t("resilienceComboCooldownWaitToggleDesc") ||
+                "Quota-share combos only; never waits on quota_exhausted."
+              }
+              checked={draft.enabled}
+              onChange={(enabled) => setDraft((prev) => ({ ...prev, enabled }))}
+            />
+            <NumberField
+              label={t("resilienceComboCooldownMaxWaitMs") || "Max wait per attempt"}
+              value={draft.maxWaitMs}
+              min={0}
+              suffix="ms"
+              onChange={(maxWaitMs) => setDraft((prev) => ({ ...prev, maxWaitMs }))}
+            />
+            <NumberField
+              label={t("resilienceMaxAttempts") || "Max attempts"}
+              value={draft.maxAttempts}
+              min={0}
+              onChange={(maxAttempts) => setDraft((prev) => ({ ...prev, maxAttempts }))}
+            />
+            <NumberField
+              label={t("resilienceComboCooldownBudgetMs") || "Total wait budget"}
+              value={draft.budgetMs}
+              min={0}
+              suffix="ms"
+              onChange={(budgetMs) => setDraft((prev) => ({ ...prev, budgetMs }))}
+            />
+          </>
+        ) : (
+          <>
+            <div className="rounded-xl border border-border bg-bg-subtle p-4">
+              <div className="text-xs text-text-muted">
+                {t("resilienceEnableServerWait") || "Enabled"}
+              </div>
+              <div className="mt-1 text-sm font-semibold text-text-main">
+                {value.enabled ? t("statusEnabled") : t("statusDisabled")}
+              </div>
+            </div>
+            <div className="rounded-xl border border-border bg-bg-subtle p-4">
+              <div className="text-xs text-text-muted">
+                {t("resilienceComboCooldownMaxWaitMs") || "Max wait per attempt"}
+              </div>
+              <div className="mt-1 text-sm font-semibold text-text-main">
+                {formatMs(value.maxWaitMs)}
+              </div>
+            </div>
+            <div className="rounded-xl border border-border bg-bg-subtle p-4">
+              <div className="text-xs text-text-muted">
+                {t("resilienceMaxAttempts") || "Max attempts"}
+              </div>
+              <div className="mt-1 text-sm font-semibold text-text-main">{value.maxAttempts}</div>
+            </div>
+            <div className="rounded-xl border border-border bg-bg-subtle p-4">
+              <div className="text-xs text-text-muted">
+                {t("resilienceComboCooldownBudgetMs") || "Total wait budget"}
+              </div>
+              <div className="mt-1 text-sm font-semibold text-text-main">
+                {formatMs(value.budgetMs)}
+              </div>
+            </div>
+          </>
+        )}
+      </div>
+    </Card>
+  );
+}
+
+function QuotaShareConcurrencyLimitCard({
+  value,
+  onSave,
+  saving,
+}: {
+  value: QuotaShareConcurrencyLimitSettings;
+  onSave: (next: QuotaShareConcurrencyLimitSettings) => Promise<void>;
+  saving: boolean;
+}) {
+  const t = useTranslations("settings");
+  const [editing, setEditing] = useState(false);
+  const [draft, setDraft] = useState(value);
+
+  useEffect(() => {
+    setDraft(value);
+  }, [value]);
+
+  const title =
+    t("resilienceQuotaShareConcurrencyTitle") || "Quota-share per-connection concurrency";
+  const desc =
+    t("resilienceQuotaShareConcurrencyDesc") ||
+    "For quota-share combos only: when a connection sets a Max Concurrent cap, serialize concurrent requests to that subscription account so it is never flooded past its ceiling — excess requests wait in the queue instead of getting a 429. The cap comes from each connection's Max Concurrent field; this switch only enables/disables honoring it.";
+
+  return (
+    <Card className="p-6">
+      <div className="mb-4 flex items-start justify-between gap-4">
+        <div className="flex items-center gap-2">
+          <span className="material-symbols-outlined text-xl text-primary">filter_list</span>
+          <h2 className="text-lg font-bold">{title}</h2>
+        </div>
+        <ActionRow
+          editing={editing}
+          saving={saving}
+          onEdit={() => setEditing(true)}
+          onCancel={() => {
+            setDraft(value);
+            setEditing(false);
+          }}
+          onSave={async () => {
+            await onSave(draft);
+            setEditing(false);
+          }}
+        />
+      </div>
+
+      <p className="mb-4 text-sm text-text-muted">{desc}</p>
+
+      <div className="grid grid-cols-1 gap-3">
+        {editing ? (
+          <BooleanField
+            label={t("resilienceEnableServerWait") || "Enabled"}
+            description={
+              t("resilienceQuotaShareConcurrencyToggleDesc") ||
+              "Quota-share combos only; honors each connection's Max Concurrent cap."
+            }
+            checked={draft.enabled}
+            onChange={(enabled) => setDraft((prev) => ({ ...prev, enabled }))}
+          />
+        ) : (
+          <div className="rounded-xl border border-border bg-bg-subtle p-4">
+            <div className="text-xs text-text-muted">
+              {t("resilienceEnableServerWait") || "Enabled"}
+            </div>
+            <div className="mt-1 text-sm font-semibold text-text-main">
+              {value.enabled ? t("statusEnabled") : t("statusDisabled")}
+            </div>
+          </div>
+        )}
+      </div>
+    </Card>
+  );
+}
+
 function ProviderCooldownCard({
   value,
   onSave,
@@ -955,6 +1159,18 @@ export default function ResilienceTab() {
         saving={savingSection === "waitForCooldown"}
         onSave={(waitForCooldown) => savePatch("waitForCooldown", { waitForCooldown })}
       />
+      <ComboCooldownWaitCard
+        value={data.comboCooldownWait}
+        saving={savingSection === "comboCooldownWait"}
+        onSave={(comboCooldownWait) => savePatch("comboCooldownWait", { comboCooldownWait })}
+      />
+      <QuotaShareConcurrencyLimitCard
+        value={data.quotaShareConcurrencyLimit}
+        saving={savingSection === "quotaShareConcurrencyLimit"}
+        onSave={(quotaShareConcurrencyLimit) =>
+          savePatch("quotaShareConcurrencyLimit", { quotaShareConcurrencyLimit })
+        }
+      />
       <ProviderCooldownCard
         value={data.providerCooldown}
         saving={savingSection === "providerCooldown"}
diff --git a/src/app/(dashboard)/dashboard/settings/components/SystemStorageTab.tsx b/src/app/(dashboard)/dashboard/settings/components/SystemStorageTab.tsx
index 461e08ca8e..f113d140e2 100644
--- a/src/app/(dashboard)/dashboard/settings/components/SystemStorageTab.tsx
+++ b/src/app/(dashboard)/dashboard/settings/components/SystemStorageTab.tsx
@@ -1030,18 +1030,18 @@ export default function SystemStorageTab() {
               />
             </div>
             <div>
-              <label className="block text-xs text-text-muted mb-1">
-                Cache Size (KB, negative = % of RAM)
-              </label>
+              <label className="block text-xs text-text-muted mb-1">Cache Size (KB)</label>
               <input
                 type="number"
+                min="1"
+                step="1024"
                 value={dbSettings.optimization.cacheSize}
                 onChange={(e) =>
                   setDbSettings({
                     ...dbSettings,
                     optimization: {
                       ...dbSettings.optimization,
-                      cacheSize: parseInt(e.target.value) || -2000,
+                      cacheSize: parseInt(e.target.value) || 16384,
                     },
                   })
                 }
diff --git a/src/app/(dashboard)/dashboard/settings/components/proxy/CloudflareRelayModal.tsx b/src/app/(dashboard)/dashboard/settings/components/proxy/CloudflareRelayModal.tsx
new file mode 100644
index 0000000000..e94ef2bdb8
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/settings/components/proxy/CloudflareRelayModal.tsx
@@ -0,0 +1,165 @@
+"use client";
+import { useState } from "react";
+import { useTranslations } from "next-intl";
+import { Button } from "@/shared/components";
+
+interface CloudflareRelayModalProps {
+  isOpen: boolean;
+  onClose: () => void;
+  onDeployed: (poolProxyId: string, relayUrl: string) => void;
+}
+
+// Mirrors VercelRelayModal — shares the same x-relay-target/x-relay-auth
+// header scheme on the wire, only the deployment surface differs.
+export default function CloudflareRelayModal({
+  isOpen,
+  onClose,
+  onDeployed,
+}: CloudflareRelayModalProps) {
+  const t = useTranslations("settings");
+  const [accountId, setAccountId] = useState("");
+  const [apiToken, setApiToken] = useState("");
+  const [projectName, setProjectName] = useState(
+    process.env.NEXT_PUBLIC_CLOUDFLARE_RELAY_DEFAULT_PROJECT || "omniroute-relay"
+  );
+  const [deploying, setDeploying] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  const handleDeploy = async () => {
+    if (!accountId.trim() || !apiToken.trim()) {
+      setError(t("cloudflareRelayCredsRequired"));
+      return;
+    }
+    setDeploying(true);
+    setError(null);
+    try {
+      const res = await fetch("/api/settings/proxy/cloudflare-deploy", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          accountId: accountId.trim(),
+          apiToken: apiToken.trim(),
+          projectName: projectName.trim(),
+        }),
+      });
+      const data = await res.json();
+      if (!res.ok || !data.success) {
+        setError(data.error?.message || t("cloudflareRelayDeployFailed"));
+      } else {
+        setApiToken("");
+        onDeployed(data.poolProxyId as string, data.relayUrl as string);
+        onClose();
+      }
+    } catch (err) {
+      setError(err instanceof Error ? err.message : t("unknownError"));
+    } finally {
+      setDeploying(false);
+    }
+  };
+
+  if (!isOpen) return null;
+
+  return (
+    <div
+      className="fixed inset-0 z-50 flex items-center justify-center bg-black/60"
+      role="dialog"
+      aria-modal="true"
+      aria-labelledby="cloudflare-relay-title"
+    >
+      <div className="bg-surface rounded-lg shadow-xl p-6 w-full max-w-md space-y-4">
+        <div className="flex items-center justify-between">
+          <h2
+            id="cloudflare-relay-title"
+            className="text-lg font-bold flex items-center gap-2"
+          >
+            <span className="material-symbols-outlined text-primary" aria-hidden="true">
+              cloud
+            </span>
+            {t("cloudflareRelayModalTitle")}
+          </h2>
+          <button
+            onClick={onClose}
+            aria-label={t("close")}
+            className="text-text-muted hover:text-text"
+          >
+            <span className="material-symbols-outlined" aria-hidden="true">
+              close
+            </span>
+          </button>
+        </div>
+
+        <div className="bg-orange-500/10 border border-orange-500/30 rounded p-3 text-xs text-orange-300 space-y-1">
+          <p>{t("cloudflareRelayWarning")}</p>
+          <p className="text-text-muted">{t("cloudflareRelayTokenHowto")}</p>
+        </div>
+
+        <div className="space-y-3">
+          <div>
+            <label className="text-sm font-medium mb-1 block" htmlFor="cloudflare-account-id">
+              {t("cloudflareRelayAccountIdLabel")}
+            </label>
+            <input
+              id="cloudflare-account-id"
+              type="text"
+              value={accountId}
+              onChange={(e) => setAccountId(e.target.value)}
+              className="w-full text-sm bg-surface-alt border border-border rounded px-3 py-2 focus:outline-none focus:border-primary"
+              placeholder="your-cloudflare-account-id"
+              autoComplete="off"
+            />
+            <p className="text-xs text-text-muted mt-1">
+              {t("cloudflareRelayAccountIdHint")}
+            </p>
+          </div>
+          <div>
+            <label className="text-sm font-medium mb-1 block" htmlFor="cloudflare-api-token">
+              {t("cloudflareRelayApiTokenLabel")}
+            </label>
+            <input
+              id="cloudflare-api-token"
+              type="password"
+              value={apiToken}
+              onChange={(e) => setApiToken(e.target.value)}
+              className="w-full text-sm bg-surface-alt border border-border rounded px-3 py-2 focus:outline-none focus:border-primary"
+              placeholder="cloudflare-api-token"
+              autoComplete="off"
+            />
+            <p className="text-xs text-text-muted mt-1">
+              {t("cloudflareRelayApiTokenHint")}
+            </p>
+          </div>
+          <div>
+            <label className="text-sm font-medium mb-1 block" htmlFor="cloudflare-project-name">
+              {t("cloudflareRelayProjectNameLabel")}
+            </label>
+            <input
+              id="cloudflare-project-name"
+              type="text"
+              value={projectName}
+              onChange={(e) => setProjectName(e.target.value)}
+              className="w-full text-sm bg-surface-alt border border-border rounded px-3 py-2 focus:outline-none focus:border-primary"
+              placeholder="omniroute-relay"
+            />
+          </div>
+        </div>
+
+        {error && (
+          <div className="text-sm text-red-400 bg-red-500/10 border border-red-500/20 rounded p-2">
+            {error}
+          </div>
+        )}
+
+        <p className="text-xs text-text-muted">{t("cloudflareRelayFreeTierNote")}</p>
+
+        <div className="flex justify-end gap-2 pt-2">
+          <Button variant="secondary" size="sm" onClick={onClose} disabled={deploying}>
+            {t("cancel")}
+          </Button>
+          <Button variant="primary" size="sm" onClick={handleDeploy} disabled={deploying}>
+            {deploying ? t("cloudflareRelayDeploying") : t("cloudflareRelayDeploy")}
+          </Button>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/src/app/(dashboard)/dashboard/settings/components/proxy/DenoRelayModal.tsx b/src/app/(dashboard)/dashboard/settings/components/proxy/DenoRelayModal.tsx
new file mode 100644
index 0000000000..a7f8b39a30
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/settings/components/proxy/DenoRelayModal.tsx
@@ -0,0 +1,154 @@
+"use client";
+import { useState } from "react";
+import { useTranslations } from "next-intl";
+import { Button } from "@/shared/components";
+
+interface DenoRelayModalProps {
+  isOpen: boolean;
+  onClose: () => void;
+  onDeployed: (poolProxyId: string, relayUrl: string) => void;
+}
+
+export default function DenoRelayModal({ isOpen, onClose, onDeployed }: DenoRelayModalProps) {
+  const t = useTranslations("settings");
+  const [denoToken, setDenoToken] = useState("");
+  const [orgDomain, setOrgDomain] = useState("");
+  const [projectName, setProjectName] = useState(
+    process.env.NEXT_PUBLIC_DENO_RELAY_DEFAULT_PROJECT || "omniroute-deno-relay"
+  );
+  const [deploying, setDeploying] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  const handleDeploy = async () => {
+    if (!denoToken.trim()) {
+      setError(t("denoRelayTokenRequired"));
+      return;
+    }
+    if (!orgDomain.trim()) {
+      setError(t("denoRelayOrgDomainRequired"));
+      return;
+    }
+    setDeploying(true);
+    setError(null);
+    try {
+      const res = await fetch("/api/settings/proxy/deno-deploy", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          denoToken: denoToken.trim(),
+          orgDomain: orgDomain.trim(),
+          projectName: projectName.trim(),
+        }),
+      });
+      const data = await res.json();
+      if (!res.ok || !data.success) {
+        setError(data.error?.message || t("denoRelayDeployFailed"));
+      } else {
+        setDenoToken("");
+        onDeployed(data.poolProxyId as string, data.relayUrl as string);
+        onClose();
+      }
+    } catch (err) {
+      setError(err instanceof Error ? err.message : t("unknownError"));
+    } finally {
+      setDeploying(false);
+    }
+  };
+
+  if (!isOpen) return null;
+
+  return (
+    <div
+      className="fixed inset-0 z-50 flex items-center justify-center bg-black/60"
+      role="dialog"
+      aria-modal="true"
+      aria-labelledby="deno-relay-title"
+    >
+      <div className="bg-surface rounded-lg shadow-xl p-6 w-full max-w-md space-y-4">
+        <div className="flex items-center justify-between">
+          <h2 id="deno-relay-title" className="text-lg font-bold flex items-center gap-2">
+            <span className="material-symbols-outlined text-primary" aria-hidden="true">
+              terminal
+            </span>
+            {t("denoRelayModalTitle")}
+          </h2>
+          <button
+            onClick={onClose}
+            aria-label={t("close")}
+            className="text-text-muted hover:text-text"
+          >
+            <span className="material-symbols-outlined" aria-hidden="true">
+              close
+            </span>
+          </button>
+        </div>
+
+        <div className="bg-yellow-500/10 border border-yellow-500/30 rounded p-3 text-xs text-yellow-300">
+          {t("denoRelayWarning")}
+        </div>
+
+        <div className="space-y-3">
+          <div>
+            <label className="text-sm font-medium mb-1 block" htmlFor="deno-token">
+              {t("denoRelayTokenLabel")}
+            </label>
+            <input
+              id="deno-token"
+              type="password"
+              value={denoToken}
+              onChange={(e) => setDenoToken(e.target.value)}
+              className="w-full text-sm bg-surface-alt border border-border rounded px-3 py-2 focus:outline-none focus:border-primary"
+              placeholder="ddo_..."
+              autoComplete="off"
+            />
+            <p className="text-xs text-text-muted mt-1">{t("denoRelayTokenHint")}</p>
+          </div>
+          <div>
+            <label className="text-sm font-medium mb-1 block" htmlFor="deno-org-domain">
+              {t("denoRelayOrgDomainLabel")}
+            </label>
+            <input
+              id="deno-org-domain"
+              type="text"
+              value={orgDomain}
+              onChange={(e) => setOrgDomain(e.target.value)}
+              className="w-full text-sm bg-surface-alt border border-border rounded px-3 py-2 focus:outline-none focus:border-primary"
+              placeholder="your-org.deno.net"
+            />
+            <p className="text-xs text-text-muted mt-1">{t("denoRelayOrgDomainHint")}</p>
+          </div>
+          <div>
+            <label className="text-sm font-medium mb-1 block" htmlFor="deno-project-name">
+              {t("denoRelayProjectNameLabel")}
+            </label>
+            <input
+              id="deno-project-name"
+              type="text"
+              value={projectName}
+              onChange={(e) => setProjectName(e.target.value)}
+              className="w-full text-sm bg-surface-alt border border-border rounded px-3 py-2 focus:outline-none focus:border-primary"
+              placeholder="omniroute-deno-relay"
+            />
+          </div>
+        </div>
+
+        {error && (
+          <div className="text-sm text-red-400 bg-red-500/10 border border-red-500/20 rounded p-2">
+            {error}
+          </div>
+        )}
+
+        <p className="text-xs text-text-muted">{t("denoRelayFreeTierNote")}</p>
+
+        <div className="flex justify-end gap-2 pt-2">
+          <Button variant="secondary" size="sm" onClick={onClose} disabled={deploying}>
+            {t("cancel")}
+          </Button>
+          <Button variant="primary" size="sm" onClick={handleDeploy} disabled={deploying}>
+            {deploying ? t("denoRelayDeploying") : t("denoRelayDeploy")}
+          </Button>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/src/app/(dashboard)/dashboard/settings/components/proxy/FreePoolTab.tsx b/src/app/(dashboard)/dashboard/settings/components/proxy/FreePoolTab.tsx
index 533006f64d..f3f52d590b 100644
--- a/src/app/(dashboard)/dashboard/settings/components/proxy/FreePoolTab.tsx
+++ b/src/app/(dashboard)/dashboard/settings/components/proxy/FreePoolTab.tsx
@@ -102,7 +102,11 @@ export default function FreePoolTab() {
       const res = await fetch(`/api/settings/free-proxies/${id}/add-to-pool`, {
         method: "POST",
       });
-      if (res.ok) {
+      // #4878: gate on the parsed body, not just res.ok. The route used to return
+      // a default 200 with { success:false } on a failed connectivity probe, which
+      // flipped the row to "In Pool" optimistically even though nothing was added.
+      const data = await res.json().catch(() => null);
+      if (res.ok && data?.success) {
         setProxies((prev) => prev.map((p) => (p.id === id ? { ...p, inPool: true } : p)));
       }
     } catch {}
diff --git a/src/app/(dashboard)/dashboard/settings/components/proxy/ProxyPoolTab.tsx b/src/app/(dashboard)/dashboard/settings/components/proxy/ProxyPoolTab.tsx
index aacc5ec1ec..e31b8b1dd3 100644
--- a/src/app/(dashboard)/dashboard/settings/components/proxy/ProxyPoolTab.tsx
+++ b/src/app/(dashboard)/dashboard/settings/components/proxy/ProxyPoolTab.tsx
@@ -1,39 +1,136 @@
 "use client";
-import { useState } from "react";
+import { useEffect, useRef, useState } from "react";
 import { Button } from "@/shared/components";
 import { useTranslations } from "next-intl";
 import ProxyRegistryManager from "../ProxyRegistryManager";
 import VercelRelayModal from "./VercelRelayModal";
+import DenoRelayModal from "./DenoRelayModal";
+import CloudflareRelayModal from "./CloudflareRelayModal";
 
 export default function ProxyPoolTab() {
   const t = useTranslations("settings");
-  const [relayModalOpen, setRelayModalOpen] = useState(false);
+  const [vercelModalOpen, setVercelModalOpen] = useState(false);
+  const [denoModalOpen, setDenoModalOpen] = useState(false);
+  const [cloudflareModalOpen, setCloudflareModalOpen] = useState(false);
+  const [menuOpen, setMenuOpen] = useState(false);
+  const menuRef = useRef<HTMLDivElement | null>(null);
 
   const showVercelRelay = process.env.NEXT_PUBLIC_VERCEL_RELAY_ENABLED !== "false";
+  const showDenoRelay = process.env.NEXT_PUBLIC_DENO_RELAY_ENABLED !== "false";
+  const showCloudflareRelay = process.env.NEXT_PUBLIC_CLOUDFLARE_RELAY_ENABLED !== "false";
+  const showAnyRelay = showVercelRelay || showDenoRelay || showCloudflareRelay;
 
-  const handleDeployed = (_poolProxyId: string, relayUrl: string) => {
+  // Close the dropdown on outside click — mirrors the upstream PR-1437
+  // grouped-button UX so adding more relay backends does not blow up the
+  // toolbar horizontally.
+  useEffect(() => {
+    if (!menuOpen) return;
+    const onMouseDown = (e: MouseEvent) => {
+      if (menuRef.current && !menuRef.current.contains(e.target as Node)) {
+        setMenuOpen(false);
+      }
+    };
+    document.addEventListener("mousedown", onMouseDown);
+    return () => document.removeEventListener("mousedown", onMouseDown);
+  }, [menuOpen]);
+
+  const handleVercelDeployed = (_poolProxyId: string, relayUrl: string) => {
     alert(`${t("vercelRelaySuccess")}: ${relayUrl}`);
   };
 
+  const handleCloudflareDeployed = (_poolProxyId: string, relayUrl: string) => {
+    alert(`${t("cloudflareRelaySuccess")}: ${relayUrl}`);
+  };
+
   return (
     <div className="space-y-4">
-      {showVercelRelay && (
+      {showAnyRelay && (
         <div className="flex justify-end">
-          <Button
-            size="sm"
-            variant="secondary"
-            icon="cloud_upload"
-            onClick={() => setRelayModalOpen(true)}
-          >
-            {t("vercelRelayButton")}
-          </Button>
+          <div className="relative" ref={menuRef}>
+            <Button
+              size="sm"
+              variant="secondary"
+              icon="rocket_launch"
+              onClick={() => setMenuOpen((v) => !v)}
+            >
+              {t("deployRelayButton")}
+            </Button>
+            {menuOpen && (
+              <div className="absolute right-0 top-full z-50 mt-1 w-48 rounded-md border border-border bg-surface p-1 shadow-xl">
+                {showVercelRelay && (
+                  <button
+                    type="button"
+                    onClick={() => {
+                      setVercelModalOpen(true);
+                      setMenuOpen(false);
+                    }}
+                    className="flex w-full items-center gap-2 rounded px-3 py-2 text-sm hover:bg-surface-alt"
+                  >
+                    <span
+                      className="material-symbols-outlined text-[20px] text-primary"
+                      aria-hidden="true"
+                    >
+                      cloud_upload
+                    </span>
+                    {t("vercelRelayButton")}
+                  </button>
+                )}
+                {showDenoRelay && (
+                  <button
+                    type="button"
+                    onClick={() => {
+                      setDenoModalOpen(true);
+                      setMenuOpen(false);
+                    }}
+                    className="flex w-full items-center gap-2 rounded px-3 py-2 text-sm hover:bg-surface-alt"
+                  >
+                    <span
+                      className="material-symbols-outlined text-[20px] text-primary"
+                      aria-hidden="true"
+                    >
+                      terminal
+                    </span>
+                    {t("denoRelayButton")}
+                  </button>
+                )}
+                {showCloudflareRelay && (
+                  <button
+                    type="button"
+                    onClick={() => {
+                      setCloudflareModalOpen(true);
+                      setMenuOpen(false);
+                    }}
+                    className="flex w-full items-center gap-2 rounded px-3 py-2 text-sm hover:bg-surface-alt"
+                  >
+                    <span
+                      className="material-symbols-outlined text-[20px] text-primary"
+                      aria-hidden="true"
+                    >
+                      cloud
+                    </span>
+                    {t("cloudflareRelayButton")}
+                  </button>
+                )}
+              </div>
+            )}
+          </div>
         </div>
       )}
       <ProxyRegistryManager />
       <VercelRelayModal
-        isOpen={relayModalOpen}
-        onClose={() => setRelayModalOpen(false)}
-        onDeployed={handleDeployed}
+        isOpen={vercelModalOpen}
+        onClose={() => setVercelModalOpen(false)}
+        onDeployed={handleVercelDeployed}
+      />
+      <DenoRelayModal
+        isOpen={denoModalOpen}
+        onClose={() => setDenoModalOpen(false)}
+        onDeployed={handleVercelDeployed}
+      />
+      <CloudflareRelayModal
+        isOpen={cloudflareModalOpen}
+        onClose={() => setCloudflareModalOpen(false)}
+        onDeployed={handleCloudflareDeployed}
       />
     </div>
   );
diff --git a/src/app/api/cli-tools/_lib/jsoncConfig.ts b/src/app/api/cli-tools/_lib/jsoncConfig.ts
new file mode 100644
index 0000000000..6141801737
--- /dev/null
+++ b/src/app/api/cli-tools/_lib/jsoncConfig.ts
@@ -0,0 +1,51 @@
+/**
+ * Shared JSONC-tolerant config reader for CLI-tools settings routes.
+ *
+ * Background: several upstream CLI tools (opencode, kilo, droid, cline, etc.)
+ * ship config files that are JSON with the occasional trailing comma or a
+ * stray comment — valid JSONC, but `JSON.parse()` rejects them with a
+ * `SyntaxError`. Until this helper, every `readSettings`/`readConfig` helper
+ * only caught `ENOENT` and re-threw, surfacing as a 500 that the dashboard
+ * misread as "tool not installed".
+ *
+ * Behaviour:
+ *  - strip trailing commas before parsing so JSONC files load cleanly;
+ *  - on ANY read or parse failure, return the caller-supplied fallback
+ *    (typically `null` or `{}`) instead of throwing, so the dashboard shows
+ *    "installed but not configured" rather than "not installed".
+ *
+ * Ported from upstream `decolua/9router@6c10edf8`. Co-authored-by: Zireael.
+ */
+import { promises as fs } from "node:fs";
+
+/**
+ * Parse a JSON/JSONC string, returning `null` on syntax errors instead of
+ * throwing. Trailing commas before `}` or `]` are stripped before parsing.
+ */
+export function parseJsoncOrNull<T = unknown>(content: string): T | null {
+  try {
+    const stripped = content.replace(/,(\s*[}\]])/g, "$1");
+    return JSON.parse(stripped) as T;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Read a JSON/JSONC config file. Returns `fallback` (default: `null`) on any
+ * filesystem or parse error so callers can render an "installed but not
+ * configured" state instead of crashing with a 500.
+ */
+export async function readJsoncConfig<T = unknown>(
+  path: string,
+  fallback: T | null = null
+): Promise<T | null> {
+  let content: string;
+  try {
+    content = await fs.readFile(path, "utf-8");
+  } catch {
+    return fallback;
+  }
+  const parsed = parseJsoncOrNull<T>(content);
+  return parsed ?? fallback;
+}
diff --git a/src/app/api/cli-tools/claude-settings/route.ts b/src/app/api/cli-tools/claude-settings/route.ts
index ab11635644..1a3d735f3f 100644
--- a/src/app/api/cli-tools/claude-settings/route.ts
+++ b/src/app/api/cli-tools/claude-settings/route.ts
@@ -15,22 +15,18 @@ import { saveCliToolLastConfigured, deleteCliToolLastConfigured } from "@/lib/db
 import { cliSettingsEnvSchema } from "@/shared/validation/schemas";
 import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
 import { getApiKeyById } from "@/lib/localDb";
+import { readJsoncConfig } from "../_lib/jsoncConfig";
 
 // Get claude settings path based on OS
 const getClaudeSettingsPath = () => getCliPrimaryConfigPath("claude");
 
-// Read current settings
+// Read current settings.
+// Ported from upstream decolua/9router@6c10edf8: tolerate JSONC (trailing
+// commas) and return null on any parse error so the dashboard renders
+// "installed but not configured" instead of a 500 misread as "not installed".
 const readSettings = async () => {
-  try {
-    const settingsPath = getClaudeSettingsPath();
-    const content = await fs.readFile(settingsPath, "utf-8");
-    return JSON.parse(content);
-  } catch (error: any) {
-    if (error.code === "ENOENT") {
-      return null;
-    }
-    throw error;
-  }
+  const settingsPath = getClaudeSettingsPath();
+  return readJsoncConfig(settingsPath);
 };
 
 // GET - Check claude CLI and read current settings
diff --git a/src/app/api/cli-tools/cline-settings/route.ts b/src/app/api/cli-tools/cline-settings/route.ts
index 090dcaf920..5b8dd37cd7 100644
--- a/src/app/api/cli-tools/cline-settings/route.ts
+++ b/src/app/api/cli-tools/cline-settings/route.ts
@@ -11,32 +11,20 @@ import { saveCliToolLastConfigured, deleteCliToolLastConfigured } from "@/lib/db
 import { cliModelConfigSchema } from "@/shared/validation/schemas";
 import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
 import { resolveApiKey } from "@/shared/services/apiKeyResolver";
+import { readJsoncConfig } from "../_lib/jsoncConfig";
 
 const CLINE_DATA_DIR = path.join(os.homedir(), ".cline", "data");
 const GLOBAL_STATE_PATH = path.join(CLINE_DATA_DIR, "globalState.json");
 const SECRETS_PATH = path.join(CLINE_DATA_DIR, "secrets.json");
 
-// Read globalState.json
-const readGlobalState = async () => {
-  try {
-    const content = await fs.readFile(GLOBAL_STATE_PATH, "utf-8");
-    return JSON.parse(content);
-  } catch (error: any) {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  }
-};
+// Read globalState.json.
+// Ported from upstream decolua/9router@6c10edf8: tolerate JSONC (trailing
+// commas) and return null on any parse error so the dashboard renders
+// "installed but not configured" instead of a 500 misread as "not installed".
+const readGlobalState = async () => readJsoncConfig(GLOBAL_STATE_PATH);
 
-// Read secrets.json
-const readSecrets = async () => {
-  try {
-    const content = await fs.readFile(SECRETS_PATH, "utf-8");
-    return JSON.parse(content);
-  } catch (error: any) {
-    if (error.code === "ENOENT") return {};
-    throw error;
-  }
-};
+// Read secrets.json (same JSONC-tolerant behaviour; defaults to {} for compat).
+const readSecrets = async () => readJsoncConfig<Record<string, unknown>>(SECRETS_PATH, {});
 
 // Check if OmniRoute is configured as OpenAI-compatible provider
 const hasOmniRouteConfig = (globalState: any) => {
diff --git a/src/app/api/cli-tools/droid-settings/route.ts b/src/app/api/cli-tools/droid-settings/route.ts
index c7e15f42a0..7313faef81 100644
--- a/src/app/api/cli-tools/droid-settings/route.ts
+++ b/src/app/api/cli-tools/droid-settings/route.ts
@@ -14,21 +14,16 @@ import { saveCliToolLastConfigured, deleteCliToolLastConfigured } from "@/lib/db
 import { cliModelConfigSchema } from "@/shared/validation/schemas";
 import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
 import { resolveApiKey } from "@/shared/services/apiKeyResolver";
+import { readJsoncConfig } from "../_lib/jsoncConfig";
 
 const getDroidSettingsPath = () => getCliPrimaryConfigPath("droid");
 const getDroidDir = () => path.dirname(getDroidSettingsPath());
 
-// Read current settings.json
-const readSettings = async () => {
-  try {
-    const settingsPath = getDroidSettingsPath();
-    const content = await fs.readFile(settingsPath, "utf-8");
-    return JSON.parse(content);
-  } catch (error: any) {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  }
-};
+// Read current settings.json.
+// Ported from upstream decolua/9router@6c10edf8: tolerate JSONC (trailing
+// commas) and return null on any parse error so the dashboard renders
+// "installed but not configured" instead of a 500 misread as "not installed".
+const readSettings = async () => readJsoncConfig(getDroidSettingsPath());
 
 // Check if settings has OmniRoute customModels
 const hasOmniRouteConfig = (settings: any) => {
diff --git a/src/app/api/cli-tools/kilo-settings/route.ts b/src/app/api/cli-tools/kilo-settings/route.ts
index aac82bebd7..965ac03bea 100644
--- a/src/app/api/cli-tools/kilo-settings/route.ts
+++ b/src/app/api/cli-tools/kilo-settings/route.ts
@@ -11,21 +11,17 @@ import { saveCliToolLastConfigured, deleteCliToolLastConfigured } from "@/lib/db
 import { cliModelConfigSchema } from "@/shared/validation/schemas";
 import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
 import { resolveApiKey } from "@/shared/services/apiKeyResolver";
+import { readJsoncConfig } from "../_lib/jsoncConfig";
 
 const KILO_DATA_DIR = path.join(os.homedir(), ".local", "share", "kilo");
 const AUTH_PATH = path.join(KILO_DATA_DIR, "auth.json");
 const KILO_CONFIG_DIR = path.join(os.homedir(), ".config", "kilo");
 
-// Read auth.json
-const readAuth = async () => {
-  try {
-    const content = await fs.readFile(AUTH_PATH, "utf-8");
-    return JSON.parse(content);
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  }
-};
+// Read auth.json.
+// Ported from upstream decolua/9router@6c10edf8: tolerate JSONC (trailing
+// commas) and return null on any parse error so the dashboard renders
+// "installed but not configured" instead of a 500 misread as "not installed".
+const readAuth = async () => readJsoncConfig(AUTH_PATH);
 
 // Check if OmniRoute OpenAI-compatible provider is configured
 const hasOmniRouteConfig = (auth) => {
diff --git a/src/app/api/cli-tools/openclaw-settings/route.ts b/src/app/api/cli-tools/openclaw-settings/route.ts
index 3b6e37d0d4..19ca818804 100644
--- a/src/app/api/cli-tools/openclaw-settings/route.ts
+++ b/src/app/api/cli-tools/openclaw-settings/route.ts
@@ -14,21 +14,16 @@ import { saveCliToolLastConfigured, deleteCliToolLastConfigured } from "@/lib/db
 import { cliModelConfigSchema } from "@/shared/validation/schemas";
 import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
 import { resolveApiKey } from "@/shared/services/apiKeyResolver";
+import { readJsoncConfig } from "../_lib/jsoncConfig";
 
 const getOpenClawSettingsPath = () => getCliPrimaryConfigPath("openclaw");
 const getOpenClawDir = () => path.dirname(getOpenClawSettingsPath());
 
-// Read current settings.json
-const readSettings = async () => {
-  try {
-    const settingsPath = getOpenClawSettingsPath();
-    const content = await fs.readFile(settingsPath, "utf-8");
-    return JSON.parse(content);
-  } catch (error: any) {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  }
-};
+// Read current settings.json.
+// Ported from upstream decolua/9router@6c10edf8: tolerate JSONC (trailing
+// commas) and return null on any parse error so the dashboard renders
+// "installed but not configured" instead of a 500 misread as "not installed".
+const readSettings = async () => readJsoncConfig(getOpenClawSettingsPath());
 
 // Check if settings has OmniRoute config
 const hasOmniRouteConfig = (settings: any) => {
diff --git a/src/app/api/combos/[id]/route.ts b/src/app/api/combos/[id]/route.ts
index 22dff324e4..46f6280727 100644
--- a/src/app/api/combos/[id]/route.ts
+++ b/src/app/api/combos/[id]/route.ts
@@ -15,8 +15,25 @@ import { validateComboDAG, clampComboDepth } from "@omniroute/open-sse/services/
 import { updateComboSchema } from "@/shared/validation/schemas";
 import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
 import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
-import { buildErrorBody } from "@omniroute/open-sse/utils/error";
 import { QUOTA_MODEL_PREFIX } from "@/lib/quota/quotaModelNaming";
+import { comboErrorResponse } from "@/lib/api/comboErrorResponse";
+
+// Minimal shape for the fields we read off a combo row in this route.
+// `getComboById` returns a structurally `JsonRecord`-typed object, so we
+// narrow at the call sites rather than change the DB helper's return type.
+type ComboRowShape = {
+  name: string;
+  id?: string;
+  config?: unknown;
+  models?: unknown;
+  strategy?: string;
+  isActive?: boolean;
+  allowedProviders?: string[];
+  system_message?: string;
+  tool_filter_regex?: string;
+  context_cache_protection?: boolean;
+  context_length?: number | null;
+};
 
 /**
  * Keys that were present in older combo configs (≤ v3.8.31) but have since been
@@ -69,13 +86,13 @@ export async function GET(request, { params }) {
     const combo = await getComboById(id);
 
     if (!combo) {
-      return NextResponse.json({ error: "Combo not found" }, { status: 404 });
+      return comboErrorResponse("COMBO_007", 404, { id }, request);
     }
 
     return NextResponse.json(combo);
   } catch (error) {
     console.log("Error fetching combo:", error);
-    return NextResponse.json({ error: "Failed to fetch combo" }, { status: 500 });
+    return comboErrorResponse("INTERNAL_001", 500, undefined, request);
   }
 }
 
@@ -88,14 +105,11 @@ export async function PUT(request, { params }) {
   try {
     rawBody = await request.json();
   } catch {
-    return NextResponse.json(
-      {
-        error: {
-          message: "Invalid request",
-          details: [{ field: "body", message: "Invalid JSON body" }],
-        },
-      },
-      { status: 400 }
+    return comboErrorResponse(
+      "COMBO_001",
+      400,
+      { field: "body", reason: "Invalid JSON body" },
+      request
     );
   }
 
@@ -103,19 +117,23 @@ export async function PUT(request, { params }) {
     const { id } = await params;
     const validation = validateBody(updateComboSchema, rawBody);
     if (isValidationFailure(validation)) {
-      return NextResponse.json({ error: validation.error }, { status: 400 });
+      return comboErrorResponse(
+        "COMBO_002",
+        400,
+        { issues: validation.error },
+        request
+      );
     }
-    const currentCombo = await getComboById(id);
+    const currentCombo = (await getComboById(id)) as ComboRowShape | null;
     if (!currentCombo) {
-      return NextResponse.json({ error: "Combo not found" }, { status: 404 });
+      return comboErrorResponse("COMBO_007", 404, { id }, request);
     }
     if (currentCombo.name.startsWith(QUOTA_MODEL_PREFIX)) {
-      return NextResponse.json(
-        buildErrorBody(
-          409,
-          "This combo is managed by Quota Share and cannot be edited here. Manage it from the Quota Share page."
-        ),
-        { status: 409 }
+      return comboErrorResponse(
+        "COMBO_006",
+        409,
+        { name: currentCombo.name, source: "quota-share" },
+        request
       );
     }
     const allCombos = await getCombos();
@@ -124,17 +142,17 @@ export async function PUT(request, { params }) {
     const normalizedUpdate = { ...validation.data };
     if (normalizedUpdate.compressionOverride !== undefined) {
       const legacyCompressionOverride = normalizedUpdate.compressionOverride;
-      const nextConfig =
-        currentCombo.config &&
-        typeof currentCombo.config === "object" &&
-        !Array.isArray(currentCombo.config)
-          ? { ...currentCombo.config }
-          : {};
-      if (legacyCompressionOverride) {
-        nextConfig.compressionMode = legacyCompressionOverride;
-      } else {
-        delete nextConfig.compressionMode;
-      }
+    const nextConfig: Record<string, unknown> =
+      currentCombo.config &&
+      typeof currentCombo.config === "object" &&
+      !Array.isArray(currentCombo.config)
+        ? { ...(currentCombo.config as Record<string, unknown>) }
+        : {};
+    if (legacyCompressionOverride) {
+      nextConfig.compressionMode = legacyCompressionOverride;
+    } else {
+      delete nextConfig.compressionMode;
+    }
       normalizedUpdate.config = nextConfig;
       delete normalizedUpdate.compressionOverride;
     }
@@ -146,8 +164,12 @@ export async function PUT(request, { params }) {
       ? {
           ...normalizedUpdate,
           models: normalizeComboModels(normalizedUpdate.models, {
-            comboName,
-            allCombos,
+            comboName: String(comboName),
+            // `allCombos` from `getCombos()` is typed as the DB-shaped record
+            // (JsonRecord & { version: 2; models: ComboStep[] }) which is
+            // structurally compatible with the local ComboCollectionLike in
+            // `normalizeComboModels` but TS does not infer the relationship.
+            allCombos: allCombos as never,
           }),
         }
       : normalizedUpdate;
@@ -157,15 +179,29 @@ export async function PUT(request, { params }) {
       name: comboName,
     };
     const compositeValidation = validateCompositeTiersConfig(nextComboState);
-    if (!compositeValidation.success) {
-      return NextResponse.json({ error: compositeValidation.error }, { status: 400 });
+    if (compositeValidation.success === false) {
+      const failure = compositeValidation as {
+        success: false;
+        error: { message: string; details: unknown[] };
+      };
+      return comboErrorResponse(
+        "COMBO_003",
+        400,
+        { reason: failure.error.message, details: failure.error.details },
+        request
+      );
     }
 
     // Check if name already exists (exclude current combo)
     if (body.name) {
       const existing = await getComboByName(body.name);
       if (existing && existing.id !== id) {
-        return NextResponse.json({ error: "Combo name already exists" }, { status: 400 });
+        return comboErrorResponse(
+          "COMBO_004",
+          400,
+          { name: body.name, conflictingId: existing.id },
+          request
+        );
       }
     }
 
@@ -178,9 +214,24 @@ export async function PUT(request, { params }) {
           (nextComboState as { config?: { maxComboDepth?: unknown } }).config?.maxComboDepth
         );
         try {
-          validateComboDAG(comboName, updatedCombos, new Set(), 0, configuredDepth);
+          validateComboDAG(String(comboName), updatedCombos, new Set(), 0, configuredDepth);
         } catch (dagError) {
-          return NextResponse.json({ error: dagError.message }, { status: 400 });
+          // Sanitize the raw `dagError.message` — it can leak internal combo
+          // names. Log full error server-side for debugging, return a
+          // sanitized generic message to the client with a short reason tag.
+          console.warn("Combo DAG validation failed:", dagError);
+          const reason =
+            dagError instanceof Error && /cycle/i.test(dagError.message)
+              ? "cycle-detected"
+              : dagError instanceof Error && /depth/i.test(dagError.message)
+                ? "max-depth-exceeded"
+                : "invalid-graph";
+          return comboErrorResponse(
+            "COMBO_005",
+            400,
+            { comboName, reason },
+            request
+          );
         }
       }
     }
@@ -193,7 +244,7 @@ export async function PUT(request, { params }) {
     return NextResponse.json(combo);
   } catch (error) {
     console.log("Error updating combo:", error);
-    return NextResponse.json({ error: "Failed to update combo" }, { status: 500 });
+    return comboErrorResponse("INTERNAL_001", 500, undefined, request);
   }
 }
 
@@ -204,23 +255,22 @@ export async function DELETE(request, { params }) {
 
   try {
     const { id } = await params;
-    const existingCombo = await getComboById(id);
+    const existingCombo = (await getComboById(id)) as ComboRowShape | null;
     if (!existingCombo) {
-      return NextResponse.json({ error: "Combo not found" }, { status: 404 });
+      return comboErrorResponse("COMBO_007", 404, { id }, request);
     }
     if (existingCombo.name.startsWith(QUOTA_MODEL_PREFIX)) {
-      return NextResponse.json(
-        buildErrorBody(
-          409,
-          "This combo is managed by Quota Share and cannot be deleted here. Manage it from the Quota Share page."
-        ),
-        { status: 409 }
+      return comboErrorResponse(
+        "COMBO_006",
+        409,
+        { name: existingCombo.name, source: "quota-share" },
+        request
       );
     }
     const success = await deleteCombo(id);
 
     if (!success) {
-      return NextResponse.json({ error: "Combo not found" }, { status: 404 });
+      return comboErrorResponse("COMBO_007", 404, { id }, request);
     }
 
     // Auto sync to Cloud if enabled
@@ -229,7 +279,7 @@ export async function DELETE(request, { params }) {
     return NextResponse.json({ success: true });
   } catch (error) {
     console.log("Error deleting combo:", error);
-    return NextResponse.json({ error: "Failed to delete combo" }, { status: 500 });
+    return comboErrorResponse("INTERNAL_001", 500, undefined, request);
   }
 }
 
diff --git a/src/app/api/combos/route.ts b/src/app/api/combos/route.ts
index 2817f3fd06..ec29ae5351 100644
--- a/src/app/api/combos/route.ts
+++ b/src/app/api/combos/route.ts
@@ -8,6 +8,7 @@ import { validateComboDAG, clampComboDepth } from "@omniroute/open-sse/services/
 import { createComboSchema } from "@/shared/validation/schemas";
 import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
 import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
+import { comboErrorResponse } from "@/lib/api/comboErrorResponse";
 
 // GET /api/combos - Get all combos
 export async function GET(request: Request) {
@@ -39,7 +40,11 @@ export async function POST(request) {
     const allCombos = await getCombos();
     const normalizedModels = normalizeComboModels(validation.data.models, {
       comboName: validation.data.name,
-      allCombos,
+      // `allCombos` from `getCombos()` is typed as the DB-shaped record
+      // (JsonRecord & { version: 2; models: ComboStep[] }) which is
+      // structurally compatible with the local ComboCollectionLike in
+      // `normalizeComboModels` but TS does not infer the relationship.
+      allCombos: allCombos as never,
     });
     const comboInput = {
       ...validation.data,
@@ -47,8 +52,17 @@ export async function POST(request) {
     };
     const { name, strategy, config } = comboInput;
     const compositeValidation = validateCompositeTiersConfig(comboInput);
-    if (!compositeValidation.success) {
-      return NextResponse.json({ error: compositeValidation.error }, { status: 400 });
+    if (compositeValidation.success === false) {
+      const failure = compositeValidation as {
+        success: false;
+        error: { message: string; details: unknown[] };
+      };
+      return comboErrorResponse(
+        "COMBO_003",
+        400,
+        { reason: failure.error.message, details: failure.error.details },
+        request
+      );
     }
 
     // Check if name already exists
diff --git a/src/app/api/internal/codex-responses-ws/route.ts b/src/app/api/internal/codex-responses-ws/route.ts
index 0e68764444..ddb4760dcf 100644
--- a/src/app/api/internal/codex-responses-ws/route.ts
+++ b/src/app/api/internal/codex-responses-ws/route.ts
@@ -513,6 +513,7 @@ async function persistResponsesWsCallHistory(body: JsonRecord) {
     latencyMs: durationMs,
     timeToFirstTokenMs: durationMs,
     errorCode,
+    endpoint: "/v1/responses",
   });
 
   logProxyEvent({
diff --git a/src/app/api/oauth/[provider]/[action]/route.ts b/src/app/api/oauth/[provider]/[action]/route.ts
index 2ec85a9e3d..fdc00592cc 100755
--- a/src/app/api/oauth/[provider]/[action]/route.ts
+++ b/src/app/api/oauth/[provider]/[action]/route.ts
@@ -196,7 +196,8 @@ export async function GET(
         provider === "kiro" ||
         provider === "amazon-q" ||
         provider === "kimi-coding" ||
-        provider === "kilocode"
+        provider === "kilocode" ||
+        provider === "codebuddy-cn"
       ) {
         // GitHub, Kiro/Amazon Q, Kimi Coding, and KiloCode don't use PKCE for device code
         if ((provider === "kiro" || provider === "amazon-q") && startUrl) {
@@ -527,7 +528,12 @@ export async function POST(
 
       // Poll for token (through proxy if configured)
       let result;
-      if (provider === "github" || provider === "kimi-coding" || provider === "kilocode") {
+      if (
+        provider === "github" ||
+        provider === "kimi-coding" ||
+        provider === "kilocode" ||
+        provider === "codebuddy-cn"
+      ) {
         // For providers that don't use PKCE (GitHub, Kimi Coding, KiloCode), don't pass codeVerifier
         result = await runWithProxyContextOrDirect(proxy, () =>
           (pollForToken as any)(provider, deviceCode)
diff --git a/src/app/api/providers/[id]/test/route.ts b/src/app/api/providers/[id]/test/route.ts
index da59e883a1..c4dccf9736 100644
--- a/src/app/api/providers/[id]/test/route.ts
+++ b/src/app/api/providers/[id]/test/route.ts
@@ -122,6 +122,13 @@ const OAUTH_TEST_CONFIG = {
     checkExpiry: true,
     refreshable: true,
   },
+  "codebuddy-cn": {
+    // Upstream test endpoint mirrors "tokenExists: true" from the CodeBuddy port —
+    // validate auth via token presence + refresh path. Live connectivity is
+    // verified through real /v2/chat/completions traffic.
+    checkExpiry: true,
+    refreshable: true,
+  },
 };
 
 import { CLI_RUNTIME_PROVIDER_MAP } from "./cliRuntimeProviderMap";
diff --git a/src/app/api/resilience/route.ts b/src/app/api/resilience/route.ts
index 1bda9354c1..4f5c862820 100644
--- a/src/app/api/resilience/route.ts
+++ b/src/app/api/resilience/route.ts
@@ -133,6 +133,8 @@ export async function GET() {
         maxRetries: resilience.waitForCooldown.maxRetries,
         maxRetryWaitSec: resilience.waitForCooldown.maxRetryWaitSec,
       },
+      comboCooldownWait: resilience.comboCooldownWait,
+      quotaShareConcurrencyLimit: resilience.quotaShareConcurrencyLimit,
       providerCooldown: resilience.providerCooldown,
       legacy: buildLegacyResilienceCompat(resilience),
     });
@@ -189,10 +191,21 @@ export async function PATCH(request) {
       ...(body.waitForCooldown
         ? { waitForCooldown: body.waitForCooldown as ResilienceSettingsPatch["waitForCooldown"] }
         : {}),
+      ...(body.comboCooldownWait
+        ? {
+            comboCooldownWait:
+              body.comboCooldownWait as ResilienceSettingsPatch["comboCooldownWait"],
+          }
+        : {}),
+      ...(body.quotaShareConcurrencyLimit
+        ? {
+            quotaShareConcurrencyLimit:
+              body.quotaShareConcurrencyLimit as ResilienceSettingsPatch["quotaShareConcurrencyLimit"],
+          }
+        : {}),
       ...(body.providerCooldown
         ? {
-            providerCooldown:
-              body.providerCooldown as ResilienceSettingsPatch["providerCooldown"],
+            providerCooldown: body.providerCooldown as ResilienceSettingsPatch["providerCooldown"],
           }
         : {}),
       ...normalizeLegacyPatch(body),
@@ -229,6 +242,7 @@ export async function PATCH(request) {
         maxRetries: nextResilience.waitForCooldown.maxRetries,
         maxRetryWaitSec: nextResilience.waitForCooldown.maxRetryWaitSec,
       },
+      comboCooldownWait: nextResilience.comboCooldownWait,
       providerCooldown: nextResilience.providerCooldown,
       legacy: buildLegacyResilienceCompat(nextResilience),
     });
diff --git a/src/app/api/settings/compression/run-telemetry/route.ts b/src/app/api/settings/compression/run-telemetry/route.ts
index 04288d713c..d5e797a75f 100644
--- a/src/app/api/settings/compression/run-telemetry/route.ts
+++ b/src/app/api/settings/compression/run-telemetry/route.ts
@@ -1,9 +1,14 @@
-import { NextResponse } from "next/server";
+import { NextRequest, NextResponse } from "next/server";
+import { isAuthenticated } from "@/shared/utils/apiAuth";
 import { getCompressionRunTelemetrySummary } from "@/lib/db/compressionRunTelemetry";
 
 export const dynamic = "force-dynamic";
 
-export async function GET() {
+export async function GET(request: NextRequest) {
+  if (!(await isAuthenticated(request))) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
   try {
     const summary = getCompressionRunTelemetrySummary();
     return NextResponse.json(summary);
diff --git a/src/app/api/settings/free-proxies/[id]/add-to-pool/route.ts b/src/app/api/settings/free-proxies/[id]/add-to-pool/route.ts
index 9861d8c5e7..f1590b1da6 100644
--- a/src/app/api/settings/free-proxies/[id]/add-to-pool/route.ts
+++ b/src/app/api/settings/free-proxies/[id]/add-to-pool/route.ts
@@ -79,11 +79,17 @@ export async function POST(request: Request, { params }: { params: Promise<{ id:
   try {
     const testResult = await _connectivityTester(freeProxy.host, freeProxy.port, freeProxy.type);
     if (!testResult.success) {
-      return Response.json({
-        success: false,
-        error: "Proxy test failed",
-        latencyMs: testResult.latencyMs,
-      });
+      // #4878: a failed connectivity probe must surface a non-2xx status so the
+      // frontend (which gates on res.ok) does NOT optimistically mark the proxy
+      // as "In Pool". 422 = the request was well-formed but the proxy is unusable.
+      return Response.json(
+        {
+          success: false,
+          error: "Proxy test failed",
+          latencyMs: testResult.latencyMs,
+        },
+        { status: 422 }
+      );
     }
 
     const newPoolProxyId = await promoteFreeProxyToPool(id, {
diff --git a/src/app/api/settings/free-proxies/sync/route.ts b/src/app/api/settings/free-proxies/sync/route.ts
index 4fdcaefa3e..d7b9e8bc1b 100644
--- a/src/app/api/settings/free-proxies/sync/route.ts
+++ b/src/app/api/settings/free-proxies/sync/route.ts
@@ -3,6 +3,7 @@ import { createErrorResponse, createErrorResponseFromUnknown } from "@/lib/api/e
 import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
 import { freeProxySyncSchema } from "@/shared/validation/freeProxySchemas";
 import { getEnabledProviders, getProvider } from "@/lib/freeProxyProviders";
+import { recordFreeProxySync } from "@/lib/localDb";
 import type { FreeProxySourceId } from "@/lib/freeProxyProviders/types";
 
 export async function POST(request: Request) {
@@ -45,7 +46,12 @@ export async function POST(request: Request) {
       results[provider.id] = await provider.sync();
     }
 
-    return Response.json({ success: true, results });
+    // #4878: persist the sync timestamp so the UI's "last sync" advances even
+    // when a sync returns zero new/updated proxies (otherwise it stayed frozen
+    // at MAX(last_validated)).
+    const lastSyncAt = await recordFreeProxySync();
+
+    return Response.json({ success: true, results, lastSyncAt });
   } catch (error) {
     return createErrorResponseFromUnknown(error, "Failed to sync free proxies");
   }
diff --git a/src/app/api/settings/proxy/cloudflare-deploy/route.ts b/src/app/api/settings/proxy/cloudflare-deploy/route.ts
new file mode 100644
index 0000000000..e1d35a3ac6
--- /dev/null
+++ b/src/app/api/settings/proxy/cloudflare-deploy/route.ts
@@ -0,0 +1,178 @@
+import { randomBytes } from "crypto";
+import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
+import { createErrorResponse, createErrorResponseFromUnknown } from "@/lib/api/errorResponse";
+import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
+import { cloudflareDeploySchema } from "@/shared/validation/freeProxySchemas";
+import { createProxy } from "@/lib/localDb";
+import { encrypt } from "@/lib/db/encryption";
+import { buildCloudflareWorkerScript } from "@/lib/proxyRelay/cloudflareWorkerScript";
+
+// Port of upstream decolua/9router PR #1360 — Cloudflare Workers proxy relay.
+// Architecture mirrors src/app/api/settings/proxy/vercel-deploy/route.ts so the
+// shared proxyFetch relay short-circuit, x-relay-auth scheme, and inline SSRF
+// guard work unchanged. Only the deployment surface differs (Cloudflare Workers
+// API instead of Vercel /v13/deployments).
+
+const CLOUDFLARE_API_BASE = process.env.CLOUDFLARE_API_BASE || "https://api.cloudflare.com/client/v4";
+
+export async function POST(request: Request) {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
+  let rawBody: unknown = {};
+  try {
+    rawBody = await request.json();
+  } catch {
+    return createErrorResponse({
+      status: 400,
+      message: "Invalid JSON body",
+      type: "invalid_request",
+    });
+  }
+
+  const validation = validateBody(cloudflareDeploySchema, rawBody);
+  if (isValidationFailure(validation)) {
+    return createErrorResponse({
+      status: 400,
+      message: validation.error.message,
+      type: "invalid_request",
+    });
+  }
+
+  const { accountId, apiToken, projectName } = validation.data;
+
+  // Generate random auth secret for the relay — stored in proxy notes, never
+  // returned to client. Same scheme as the Vercel relay so the deployed worker
+  // is not an open SSRF proxy reachable from any third party with the workers.dev URL.
+  const relayAuth = randomBytes(24).toString("hex");
+  const workerScript = buildCloudflareWorkerScript(relayAuth);
+
+  try {
+    // 1. PUT the Worker script — Cloudflare requires multipart/form-data with
+    //    main_module + a metadata blob describing the upload.
+    const workerScriptUrl = `${CLOUDFLARE_API_BASE}/accounts/${accountId}/workers/scripts/${projectName}`;
+    const formData = new FormData();
+    formData.append(
+      "index.js",
+      new Blob([workerScript], { type: "application/javascript+module" }),
+      "index.js"
+    );
+    formData.append(
+      "metadata",
+      new Blob(
+        [
+          JSON.stringify({
+            main_module: "index.js",
+            compatibility_date: "2026-03-20",
+            observability: { enabled: true },
+          }),
+        ],
+        { type: "application/json" }
+      ),
+      "metadata.json"
+    );
+
+    const uploadRes = await fetch(workerScriptUrl, {
+      method: "PUT",
+      headers: { Authorization: `Bearer ${apiToken}` },
+      body: formData,
+    });
+
+    if (!uploadRes.ok) {
+      // Surface only the canonical Cloudflare error message; never forward raw
+      // response text (may carry internal IDs / token hints).
+      let upstreamMessage = "Cloudflare API rejected the Worker upload";
+      try {
+        const parsed = (await uploadRes.json().catch(() => null)) as {
+          errors?: Array<{ message?: string }>;
+        } | null;
+        const candidate = parsed?.errors?.[0]?.message;
+        if (typeof candidate === "string" && candidate.trim()) {
+          upstreamMessage = candidate.trim().slice(0, 200);
+        }
+      } catch {
+        /* fall through to generic message */
+      }
+      return createErrorResponse({
+        status: uploadRes.status,
+        message: `Cloudflare Worker upload failed: ${upstreamMessage}`,
+        type: "upstream_error",
+      });
+    }
+
+    // 2. Enable the workers.dev subdomain for this script so it is reachable.
+    //    A failure here is non-fatal (some accounts already enable subdomains
+    //    by default); the next call surfaces the correct error if anything is
+    //    actually missing.
+    await fetch(`${workerScriptUrl}/subdomain`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${apiToken}`,
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({ enabled: true }),
+    }).catch(() => {});
+
+    // 3. Look up the account's workers.dev subdomain to build the final URL.
+    const subdomainRes = await fetch(
+      `${CLOUDFLARE_API_BASE}/accounts/${accountId}/workers/subdomain`,
+      {
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${apiToken}`,
+          "Content-Type": "application/json",
+        },
+      }
+    );
+
+    let deployUrl = "";
+    if (subdomainRes.ok) {
+      const subdomainData = (await subdomainRes.json().catch(() => null)) as {
+        result?: { subdomain?: string };
+      } | null;
+      const sub = subdomainData?.result?.subdomain;
+      if (typeof sub === "string" && sub) {
+        deployUrl = `https://${projectName}.${sub}.workers.dev`;
+      }
+    }
+
+    if (!deployUrl) {
+      return createErrorResponse({
+        status: 400,
+        message:
+          "Worker deployed but failed to retrieve workers.dev subdomain. Set up a workers.dev subdomain in the Cloudflare dashboard first.",
+        type: "upstream_error",
+      });
+    }
+
+    // Store as proxy pool entry — apiToken is NOT stored. relayAuth is
+    // encrypted at rest when STORAGE_ENCRYPTION_KEY is configured (encrypt() is
+    // a no-op in passthrough mode); the redactor strips both shapes from API responses.
+    const encryptedRelayAuth = encrypt(relayAuth);
+    const notesPayload =
+      encryptedRelayAuth && encryptedRelayAuth !== relayAuth
+        ? { relayAuthEnc: encryptedRelayAuth }
+        : { relayAuth };
+
+    // deployUrl is "https://<name>.<sub>.workers.dev" — strip the protocol so
+    // the `host` column matches the Vercel-relay shape (proxyFetch prepends
+    // "https://" when routing).
+    const hostOnly = deployUrl.replace(/^https?:\/\//, "");
+    const poolProxy = await createProxy({
+      name: `Cloudflare Relay (${projectName})`,
+      type: "cloudflare",
+      host: hostOnly,
+      port: 443,
+      notes: JSON.stringify(notesPayload),
+      source: "cloudflare-relay",
+    });
+
+    return Response.json({
+      success: true,
+      relayUrl: deployUrl,
+      poolProxyId: poolProxy?.id,
+    });
+  } catch (error) {
+    return createErrorResponseFromUnknown(error, "Cloudflare deploy failed");
+  }
+}
diff --git a/src/app/api/settings/proxy/deno-deploy/route.ts b/src/app/api/settings/proxy/deno-deploy/route.ts
new file mode 100644
index 0000000000..8b305770fa
--- /dev/null
+++ b/src/app/api/settings/proxy/deno-deploy/route.ts
@@ -0,0 +1,369 @@
+import { randomBytes } from "crypto";
+import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
+import { createErrorResponse, createErrorResponseFromUnknown } from "@/lib/api/errorResponse";
+import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
+import { denoDeploySchema } from "@/shared/validation/freeProxySchemas";
+import { createProxy } from "@/lib/localDb";
+import { encrypt } from "@/lib/db/encryption";
+
+const DENO_API_BASE = process.env.DENO_DEPLOY_API_BASE || "https://api.deno.com/v2";
+const POLL_INTERVAL_MS = 2000;
+const POLL_MAX_ATTEMPTS = 30; // ~60 s
+
+/**
+ * SSRF-safe resolution of the relay path against an already-validated target.
+ *
+ * The relay worker receives an attacker-controlled `x-relay-path` and must
+ * append it to the target ORIGIN without letting the caller swap the host that
+ * `x-relay-target` was validated for. The pre-#4643-fix worker did
+ * `target.replace(/\/$/, "") + relayPath`, which is bypassable via userinfo
+ * (`/x@evil.com`), a backslash (`\evil.com`), or a protocol-relative path
+ * (`//evil.com/x`). We instead resolve with `new URL(relayPath, targetUrl)` and
+ * re-assert that the resolved host/credentials still match the target.
+ *
+ * Pure (only `URL`, no Node/Deno globals) so the SAME source can be embedded
+ * verbatim into the Deno edge worker AND unit-tested directly in Node. Returns a
+ * tagged result instead of throwing so the worker can map it to an HTTP status.
+ */
+export function resolveRelayTarget(
+  target: string,
+  relayPath: string
+): { ok: true; url: string } | { ok: false; status: 400 | 403; reason: string } {
+  let targetUrl;
+  try {
+    targetUrl = new URL(target);
+  } catch {
+    return { ok: false, status: 400, reason: "invalid x-relay-target" };
+  }
+  // Reject the host-confusion vectors up front. A backslash or '@' has no place
+  // in a legitimate path/query, and `new URL` (special-scheme parsing) would
+  // otherwise treat them as authority/userinfo delimiters.
+  if (
+    typeof relayPath !== "string" ||
+    relayPath.indexOf("@") !== -1 ||
+    relayPath.indexOf("\\") !== -1 ||
+    relayPath.charAt(0) !== "/"
+  ) {
+    return { ok: false, status: 403, reason: "forbidden x-relay-path" };
+  }
+  let finalUrl;
+  try {
+    finalUrl = new URL(relayPath, targetUrl);
+  } catch {
+    return { ok: false, status: 403, reason: "forbidden x-relay-path" };
+  }
+  // A protocol-relative path ("//evil.com/x") resolves to a different host;
+  // userinfo would surface as username/password. Either means the path tried to
+  // re-point the request away from the validated target — reject.
+  if (
+    finalUrl.hostname !== targetUrl.hostname ||
+    finalUrl.protocol !== targetUrl.protocol ||
+    finalUrl.port !== targetUrl.port ||
+    finalUrl.username ||
+    finalUrl.password
+  ) {
+    return { ok: false, status: 403, reason: "forbidden x-relay-path (host mismatch)" };
+  }
+  return { ok: true, url: finalUrl.toString() };
+}
+
+// Inlined Deno Deploy relay worker. The relayAuth secret is generated
+// server-side (no user input); the runtime SSRF guard is inlined into the
+// edge function because Deno Deploy isolates each app and cannot import
+// Node-side helpers. The path-resolution guard (`resolveRelayTarget`) is the
+// SAME source used by the server and by the unit tests — embedded here via
+// Function#toString so the worker enforces byte-for-byte the audited policy.
+// Mirrors the Vercel-relay guard so a future audit can diff the two.
+function buildRelayWorker(relayAuth: string): string {
+  return `${resolveRelayTarget.toString()}
+
+function isPrivateHostname(h) {
+  if (!h) return true;
+  const host = h.trim().toLowerCase().replace(/^\\[|\\]$/g, "");
+  if (
+    host === "localhost" ||
+    host === "0.0.0.0" ||
+    host === "127.0.0.1" ||
+    host === "::1" ||
+    host.endsWith(".localhost") ||
+    host.endsWith(".local") ||
+    host.endsWith(".internal") ||
+    host.startsWith("::ffff:")
+  ) return true;
+  const v4 = host.match(/^(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})$/);
+  if (v4) {
+    const a = +v4[1], b = +v4[2];
+    if (a === 0 || a === 10 || a === 127) return true;
+    if (a === 169 && b === 254) return true;
+    if (a === 192 && b === 168) return true;
+    if (a === 172 && b >= 16 && b <= 31) return true;
+    if (a === 100 && b >= 64 && b <= 127) return true;
+    return false;
+  }
+  if (host.includes(":")) {
+    return host === "::1" || host.startsWith("fc") || host.startsWith("fd") || host.startsWith("fe80:");
+  }
+  return false;
+}
+
+Deno.serve(async (request) => {
+  const auth = request.headers.get("x-relay-auth");
+  if (auth !== "${relayAuth}") return new Response("Unauthorized", { status: 401 });
+  const target = request.headers.get("x-relay-target");
+  if (!target) return new Response("missing x-relay-target", { status: 400 });
+  let targetUrl;
+  try { targetUrl = new URL(target); } catch { return new Response("invalid x-relay-target", { status: 400 }); }
+  if (targetUrl.protocol !== "http:" && targetUrl.protocol !== "https:") {
+    return new Response("forbidden x-relay-target protocol", { status: 403 });
+  }
+  if (targetUrl.username || targetUrl.password) {
+    return new Response("forbidden x-relay-target (embedded credentials)", { status: 403 });
+  }
+  if (isPrivateHostname(targetUrl.hostname)) {
+    return new Response("forbidden x-relay-target (private/loopback host)", { status: 403 });
+  }
+  const relayPath = request.headers.get("x-relay-path") || "/";
+  const resolved = resolveRelayTarget(target, relayPath);
+  if (!resolved.ok) {
+    return new Response(resolved.reason, { status: resolved.status });
+  }
+  const headers = new Headers(request.headers);
+  ["x-relay-target", "x-relay-path", "x-relay-auth", "host"].forEach(h => headers.delete(h));
+  const init = { method: request.method, headers };
+  if (request.method !== "GET" && request.method !== "HEAD") {
+    init.body = request.body;
+    init.duplex = "half";
+  }
+  try {
+    const upstream = await fetch(resolved.url, init);
+    return new Response(upstream.body, { status: upstream.status, headers: upstream.headers });
+  } catch (error) {
+    return new Response(JSON.stringify({ error: String(error && error.message || error) }), {
+      status: 502,
+      headers: { "content-type": "application/json" },
+    });
+  }
+});`;
+}
+
+/**
+ * Test-only hook exposing the generated worker source so the SSRF regression
+ * test can assert the worker no longer string-concatenates the relay path and
+ * embeds the shared `resolveRelayTarget` guard. Not part of the route contract.
+ */
+export const __buildRelayWorkerForTest = buildRelayWorker;
+
+async function pollRevision(
+  revisionId: string,
+  token: string
+): Promise<"succeeded" | "failed" | "timeout"> {
+  for (let i = 0; i < POLL_MAX_ATTEMPTS; i++) {
+    await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
+    try {
+      const res = await fetch(`${DENO_API_BASE}/revisions/${revisionId}`, {
+        headers: { Authorization: `Bearer ${token}` },
+      });
+      if (!res.ok) continue;
+      const data = (await res.json()) as { status?: string };
+      const status = data.status;
+      if (status === "succeeded") return "succeeded";
+      if (status === "failed" || status === "errored") return "failed";
+      // "queued" / "building" — keep polling.
+    } catch {
+      /* network blip; keep polling */
+    }
+  }
+  return "timeout";
+}
+
+export async function POST(request: Request) {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
+  let rawBody: unknown = {};
+  try {
+    rawBody = await request.json();
+  } catch {
+    return createErrorResponse({
+      status: 400,
+      message: "Invalid JSON body",
+      type: "invalid_request",
+    });
+  }
+
+  const validation = validateBody(denoDeploySchema, rawBody);
+  if (isValidationFailure(validation)) {
+    return createErrorResponse({
+      status: 400,
+      message: validation.error.message,
+      type: "invalid_request",
+    });
+  }
+
+  const { denoToken, orgDomain, projectName } = validation.data;
+  const relayAuth = randomBytes(24).toString("hex");
+  const relayCode = buildRelayWorker(relayAuth);
+  const headers = {
+    Authorization: `Bearer ${denoToken}`,
+    "Content-Type": "application/json",
+  };
+
+  try {
+    // 1. Create app slot.
+    const createRes = await fetch(`${DENO_API_BASE}/apps`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({
+        slug: projectName,
+        labels: { "custom.kind": "omniroute-relay" },
+        config: {
+          install: "deno install",
+          runtime: { type: "dynamic", entrypoint: "main.ts" },
+        },
+      }),
+    });
+
+    if (!createRes.ok) {
+      let upstreamMessage = "Deno Deploy API rejected the create-app call";
+      try {
+        const parsed = (await createRes.json().catch(() => null)) as {
+          error?: { message?: string } | string;
+          message?: string;
+        } | null;
+        const candidate =
+          (typeof parsed?.error === "object" && parsed?.error?.message) ||
+          (typeof parsed?.error === "string" && parsed?.error) ||
+          parsed?.message;
+        if (typeof candidate === "string" && candidate.trim()) {
+          upstreamMessage = candidate.trim().slice(0, 200);
+        }
+      } catch {
+        /* fall through */
+      }
+      if (createRes.status === 409) {
+        return createErrorResponse({
+          status: 409,
+          message: `Deno Deploy app "${projectName}" already exists. Choose a different name.`,
+          type: "conflict",
+        });
+      }
+      return createErrorResponse({
+        status: createRes.status,
+        message: `Deno Deploy create-app failed: ${upstreamMessage}`,
+        type: "upstream_error",
+      });
+    }
+
+    const app = (await createRes.json()) as { id?: string };
+    if (!app.id) {
+      return createErrorResponse({
+        status: 502,
+        message: "Deno Deploy returned no app id",
+        type: "upstream_error",
+      });
+    }
+
+    // 2. Push the relay code as a single-file deployment.
+    const deployRes = await fetch(`${DENO_API_BASE}/apps/${app.id}/deploy`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({
+        assets: {
+          "main.ts": {
+            kind: "file",
+            content: relayCode,
+            encoding: "utf-8",
+          },
+        },
+      }),
+    });
+
+    if (!deployRes.ok) {
+      // Best-effort cleanup so a failed deploy does not leave an empty app
+      // behind. Mirrors the upstream PR-1437 behaviour.
+      await fetch(`${DENO_API_BASE}/apps/${app.id}`, {
+        method: "DELETE",
+        headers: { Authorization: `Bearer ${denoToken}` },
+      }).catch(() => {});
+
+      let upstreamMessage = "Deno Deploy rejected the deployment";
+      try {
+        const parsed = (await deployRes.json().catch(() => null)) as {
+          error?: { message?: string } | string;
+        } | null;
+        const candidate =
+          (typeof parsed?.error === "object" && parsed?.error?.message) ||
+          (typeof parsed?.error === "string" && parsed?.error);
+        if (typeof candidate === "string" && candidate.trim()) {
+          upstreamMessage = candidate.trim().slice(0, 200);
+        }
+      } catch {
+        /* fall through */
+      }
+      return createErrorResponse({
+        status: deployRes.status,
+        message: `Deno Deploy failed: ${upstreamMessage}`,
+        type: "upstream_error",
+      });
+    }
+
+    const revision = (await deployRes.json()) as { id?: string; status?: string };
+    const revisionId = revision.id;
+    let finalStatus: "succeeded" | "failed" | "timeout" =
+      revision.status === "succeeded"
+        ? "succeeded"
+        : revision.status === "failed" || revision.status === "errored"
+          ? "failed"
+          : "timeout";
+    if (revisionId && finalStatus !== "succeeded" && finalStatus !== "failed") {
+      finalStatus = await pollRevision(revisionId, denoToken);
+    }
+
+    if (finalStatus !== "succeeded") {
+      await fetch(`${DENO_API_BASE}/apps/${app.id}`, {
+        method: "DELETE",
+        headers: { Authorization: `Bearer ${denoToken}` },
+      }).catch(() => {});
+      return createErrorResponse({
+        status: finalStatus === "timeout" ? 504 : 502,
+        message:
+          finalStatus === "timeout"
+            ? "Deno Deploy did not reach 'succeeded' state within 60 seconds. Check your Deno Deploy dashboard."
+            : "Deno Deploy revision failed.",
+        type: finalStatus === "timeout" ? "timeout" : "upstream_error",
+      });
+    }
+
+    // Deno apps are reachable at `https://<slug>.<org-slug>.deno.net`.
+    // We accept the user's full org domain ("acme.deno.net") and derive the
+    // org slug from it (split on first dot). Tolerates trailing dots / paths
+    // by trimming first.
+    const cleanOrg = orgDomain.replace(/^https?:\/\//i, "").replace(/\/+$/, "");
+    const orgSlug = cleanOrg.split(".")[0];
+    const deployHost = `${projectName}.${orgSlug}.deno.net`;
+
+    // Store as proxy registry entry — token is NOT stored. relayAuth is
+    // encrypted at rest when STORAGE_ENCRYPTION_KEY is configured.
+    const encryptedRelayAuth = encrypt(relayAuth);
+    const notesPayload =
+      encryptedRelayAuth && encryptedRelayAuth !== relayAuth
+        ? { relayAuthEnc: encryptedRelayAuth }
+        : { relayAuth };
+    const poolProxy = await createProxy({
+      name: `Deno Relay (${projectName})`,
+      type: "deno",
+      host: deployHost,
+      port: 443,
+      notes: JSON.stringify(notesPayload),
+      source: "deno-relay",
+    });
+
+    return Response.json({
+      success: true,
+      relayUrl: `https://${deployHost}`,
+      poolProxyId: poolProxy?.id,
+    });
+  } catch (error) {
+    return createErrorResponseFromUnknown(error, "Deno Deploy failed");
+  }
+}
diff --git a/src/app/api/settings/proxy/vercel-deploy/route.ts b/src/app/api/settings/proxy/vercel-deploy/route.ts
index f617cc2cf2..eb46cfb336 100644
--- a/src/app/api/settings/proxy/vercel-deploy/route.ts
+++ b/src/app/api/settings/proxy/vercel-deploy/route.ts
@@ -5,6 +5,10 @@ import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
 import { vercelDeploySchema } from "@/shared/validation/freeProxySchemas";
 import { createProxy } from "@/lib/localDb";
 import { encrypt } from "@/lib/db/encryption";
+// Shared SSRF-safe relay-path resolver — the same pure guard embedded in the
+// Deno Deploy worker. Both edge relays must enforce identical path validation,
+// so they import one source of truth rather than diverging copies.
+import { resolveRelayTarget } from "../deno-deploy/route";
 
 const VERCEL_API_BASE = process.env.VERCEL_API_BASE || "https://api.vercel.com";
 const POLL_INTERVAL_MS = 3000;
@@ -15,8 +19,12 @@ function buildRelayFunction(relayAuth: string): string {
   // The runtime SSRF guard is inlined into the edge function (cannot import
   // Node-side helpers from the Edge runtime); it blocks RFC1918, loopback,
   // link-local, IPv6 ULA, and embedded credentials on the x-relay-target host.
+  // `resolveRelayTarget` (shared with the Deno worker) closes the x-relay-path
+  // host-confusion hole and is embedded verbatim via Function#toString.
   return `export const config = { runtime: "edge" };
 
+${resolveRelayTarget.toString()}
+
 function isPrivateHostname(h) {
   if (!h) return true;
   const host = h.trim().toLowerCase().replace(/^\\[|\\]$/g, "");
@@ -63,9 +71,13 @@ export default async function handler(req) {
     return new Response("forbidden x-relay-target (private/loopback host)", { status: 403 });
   }
   const relayPath = req.headers.get("x-relay-path") || "/";
+  const resolved = resolveRelayTarget(target, relayPath);
+  if (!resolved.ok) {
+    return new Response(resolved.reason, { status: resolved.status });
+  }
   const headers = new Headers(req.headers);
   ["x-relay-target", "x-relay-path", "x-relay-auth", "host"].forEach(h => headers.delete(h));
-  const upstream = await fetch(target.replace(/\\/$/, "") + relayPath, {
+  const upstream = await fetch(resolved.url, {
     method: req.method,
     headers,
     body: req.method !== "GET" && req.method !== "HEAD" ? req.body : undefined,
@@ -75,6 +87,14 @@ export default async function handler(req) {
 }`;
 }
 
+/**
+ * Test-only hook exposing the generated Vercel worker source so the SSRF
+ * regression test can assert it no longer string-concatenates the relay path
+ * and embeds the shared `resolveRelayTarget` guard. Not part of the route
+ * contract.
+ */
+export const __buildRelayFunctionForTest = buildRelayFunction;
+
 async function pollDeployment(deploymentApiUrl: string, token: string): Promise<"READY" | "ERROR"> {
   for (let i = 0; i < POLL_MAX_ATTEMPTS; i++) {
     await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
diff --git a/src/app/api/system/env/repair/route.ts b/src/app/api/system/env/repair/route.ts
index 1f8f8137ef..c87f1a82cc 100644
--- a/src/app/api/system/env/repair/route.ts
+++ b/src/app/api/system/env/repair/route.ts
@@ -38,7 +38,11 @@ export async function GET(request: Request) {
 
   try {
     const { getEnvSyncPlan } = await loadSyncHelpers();
-    const plan = getEnvSyncPlan({ scope: "oauth" });
+    // Pass an explicit rootDir so the helper never derives the root from a
+    // webpack-frozen `import.meta.url` (build-machine path) — that froze the
+    // path and 500'd this route on packaged installs (#5006). cwd matches the
+    // `.env` target used by createEnvBackup() above.
+    const plan = getEnvSyncPlan({ scope: "oauth", rootDir: process.cwd() });
 
     return NextResponse.json({
       available: plan.available,
@@ -63,8 +67,9 @@ export async function POST(request: Request) {
   try {
     const { syncEnv, getEnvSyncPlan } = await loadSyncHelpers();
     const backupPath = createEnvBackup();
-    const result = syncEnv({ scope: "oauth", quiet: true });
-    const plan = getEnvSyncPlan({ scope: "oauth" });
+    // Explicit rootDir (cwd) — see GET above (#5006).
+    const result = syncEnv({ scope: "oauth", quiet: true, rootDir: process.cwd() });
+    const plan = getEnvSyncPlan({ scope: "oauth", rootDir: process.cwd() });
 
     return NextResponse.json({
       success: true,
diff --git a/src/app/api/v1/messages/route.ts b/src/app/api/v1/messages/route.ts
index 66f16d531a..acac8c610b 100644
--- a/src/app/api/v1/messages/route.ts
+++ b/src/app/api/v1/messages/route.ts
@@ -29,10 +29,13 @@ export async function OPTIONS() {
 
 /**
  * POST /v1/messages - Claude format (auto convert via handleChat)
+ *
+ * `preParsedBody` is threaded from withInjectionGuard (#4041) so the body is
+ * parsed at most once per request.
  */
-async function postHandler(request, context) {
+async function postHandler(request: any, context: any, preParsedBody: any = null) {
   await ensureInitialized();
-  return await handleChat(request);
+  return await handleChat(request, null, preParsedBody);
 }
 
 export const POST = withInjectionGuard(postHandler);
diff --git a/src/app/api/v1/models/aliasBackedModels.ts b/src/app/api/v1/models/aliasBackedModels.ts
new file mode 100644
index 0000000000..4d599107da
--- /dev/null
+++ b/src/app/api/v1/models/aliasBackedModels.ts
@@ -0,0 +1,50 @@
+/**
+ * Extract `{providerKey, modelId}` pairs from the `modelAliases` key_value namespace
+ * so `/v1/models` can surface models that were registered ONLY through a model alias
+ * (e.g. `setModelAlias("kimi-k2.6", "custom/kimi-k2.6")`).
+ *
+ * Port of upstream decolua/9router PR #730 — kept as a PURE helper so the route can
+ * walk the result and merge it into the per-provider catalog without dragging DB or
+ * Next-runtime imports into a unit test.
+ *
+ * Each stored alias value is `"<providerKey>/<modelId>"`. `providerKey` may be either
+ * a provider id (e.g. `openai`) or a provider alias / prefix (e.g. `cu`, `custom`);
+ * the caller is responsible for resolving that against the active connection map.
+ *
+ * The split is on the FIRST `/` only — OpenRouter-style ids contain an internal slash
+ * (`openrouter/anthropic/claude-3.5-sonnet`) and must keep their full sub-path as the
+ * model id.
+ */
+export interface AliasBackedModel {
+  providerKey: string;
+  modelId: string;
+}
+
+export function extractAliasBackedModels(
+  aliases: Record<string, unknown> | null | undefined
+): AliasBackedModel[] {
+  if (!aliases || typeof aliases !== "object") return [];
+
+  const seen = new Set<string>();
+  const out: AliasBackedModel[] = [];
+
+  for (const value of Object.values(aliases)) {
+    if (typeof value !== "string") continue;
+    const trimmed = value.trim();
+    if (trimmed.length === 0) continue;
+
+    const slash = trimmed.indexOf("/");
+    if (slash <= 0 || slash === trimmed.length - 1) continue;
+
+    const providerKey = trimmed.slice(0, slash);
+    const modelId = trimmed.slice(slash + 1);
+    if (!providerKey || !modelId) continue;
+
+    const dedupeKey = `${providerKey}/${modelId}`;
+    if (seen.has(dedupeKey)) continue;
+    seen.add(dedupeKey);
+    out.push({ providerKey, modelId });
+  }
+
+  return out;
+}
diff --git a/src/app/api/v1/models/catalog.ts b/src/app/api/v1/models/catalog.ts
index 21df30ac10..e93dddd351 100644
--- a/src/app/api/v1/models/catalog.ts
+++ b/src/app/api/v1/models/catalog.ts
@@ -8,7 +8,9 @@ import {
   getSettings,
   getProviderNodes,
   getModelIsHidden,
+  getModelAliases,
 } from "@/lib/localDb";
+import { extractAliasBackedModels } from "./aliasBackedModels";
 import { appendNoThinkingVariants } from "@omniroute/open-sse/utils/noThinkingAlias";
 import { getAllEmbeddingModels } from "@omniroute/open-sse/config/embeddingRegistry";
 import { getAllImageModels } from "@omniroute/open-sse/config/imageRegistry";
@@ -63,6 +65,12 @@ interface CustomModelEntry {
   supportedEndpoints?: string[];
   inputTokenLimit?: number;
   isHidden?: boolean;
+  // User-set "vision-capable" flag (persisted by addCustomModel / replaceCustomModels
+  // in src/lib/db/models.ts). Surfaced into `/v1/models` via
+  // getCustomVisionCapabilityFields so user-added vision models appear with
+  // `capabilities.vision: true` even when their id does not match the
+  // conservative isVisionModelId heuristic.
+  supportsVision?: boolean;
 }
 
 const FALLBACK_ALIAS_TO_PROVIDER = {
@@ -149,6 +157,39 @@ function getVisionCapabilityFields(modelId: string) {
   };
 }
 
+/**
+ * Vision-capability fields for a user-added custom chat model. Honours an
+ * explicit `supportsVision` flag on the saved entry (the dashboard "vision-
+ * capable" toggle) IN ADDITION TO the conservative id-based heuristic used by
+ * built-in models. Without this, a user who registered e.g. `my-vision-llm`
+ * and ticked vision saw no `capabilities.vision` in `/v1/models`, so the LLM
+ * selector and downstream routing treated the model as text-only.
+ *
+ * Port of upstream decolua/9router 5e5e78d3. Conservative: an explicit
+ * `supportsVision === false` wins so users can downgrade a mis-classified
+ * model (same anti-FP discipline as #4071 / #4072).
+ */
+export function getCustomVisionCapabilityFields(
+  entry: { supportsVision?: boolean } | null | undefined,
+  ...candidateIds: Array<string | null | undefined>
+): { capabilities: { vision: true }; input_modalities: string[]; output_modalities: string[] } | null {
+  if (entry && entry.supportsVision === false) return null;
+  if (entry && entry.supportsVision === true) {
+    return {
+      capabilities: { vision: true },
+      input_modalities: ["text", "image"],
+      output_modalities: ["text"],
+    };
+  }
+  for (const id of candidateIds) {
+    if (typeof id === "string" && id) {
+      const fields = getVisionCapabilityFields(id);
+      if (fields) return fields;
+    }
+  }
+  return null;
+}
+
 function qualifyOpenRouterModelId(modelId: string): string {
   return modelId.startsWith("openrouter/") ? modelId : `openrouter/${modelId}`;
 }
@@ -1262,7 +1303,7 @@ export async function getUnifiedModelsResponse(
           }
           const visionFields =
             modelType === "chat"
-              ? getVisionCapabilityFields(aliasId) || getVisionCapabilityFields(modelId)
+              ? getCustomVisionCapabilityFields(model, aliasId, modelId)
               : null;
 
           if (includeAlias) {
@@ -1295,8 +1336,7 @@ export async function getUnifiedModelsResponse(
             if (models.some((m) => m.id === providerPrefixedId)) continue;
             const providerVisionFields =
               modelType === "chat"
-                ? getVisionCapabilityFields(providerPrefixedId) ||
-                  getVisionCapabilityFields(modelId)
+                ? getCustomVisionCapabilityFields(model, providerPrefixedId, modelId)
                 : null;
             models.push({
               id: providerPrefixedId,
@@ -1323,6 +1363,88 @@ export async function getUnifiedModelsResponse(
       console.log("Could not fetch custom models");
     }
 
+    // Port of decolua/9router#730 — surface models registered ONLY through a model
+    // alias (`key_value` namespace `modelAliases`, value `"<providerKey>/<modelId>"`).
+    // Without this walk, a compatible-provider entry like `setModelAlias("kimi-k2.6",
+    // "custom/kimi-k2.6")` resolves at request time but never shows up in `/v1/models`.
+    // We respect the same gating as the static/custom listing path: provider must be
+    // active (or noAuth+unblocked), model must not be hidden, and the canonical alias
+    // entry must not already exist (so we don't shadow combo / synced / custom rows).
+    try {
+      const modelAliases = await getModelAliases();
+      const aliasBacked = extractAliasBackedModels(modelAliases);
+      for (const { providerKey, modelId } of aliasBacked) {
+        const canonicalProviderId = resolveCanonicalProviderId(providerKey);
+        if (!canonicalProviderId) continue;
+        if (
+          blockedProviders.has(providerKey) ||
+          blockedProviders.has(canonicalProviderId) ||
+          isNoAuthProviderBlocked(blockedProviders, canonicalProviderId, providerKey)
+        ) {
+          continue;
+        }
+
+        const alias = providerIdToAlias[canonicalProviderId] || providerKey;
+        if (
+          !activeAliases.has(alias) &&
+          !activeAliases.has(canonicalProviderId) &&
+          !activeAliases.has(providerKey)
+        ) {
+          continue;
+        }
+
+        if (getModelIsHidden(canonicalProviderId, modelId)) continue;
+
+        const aliasId = `${alias}/${modelId}`;
+        const rawPrefixedId = `${providerKey}/${modelId}`;
+        if (
+          models.some((m: any) => m?.id === aliasId) ||
+          models.some((m: any) => m?.id === rawPrefixedId)
+        ) {
+          continue;
+        }
+
+        const visionFields =
+          getVisionCapabilityFields(aliasId) || getVisionCapabilityFields(modelId);
+
+        if (includeAlias) {
+          models.push({
+            id: aliasId,
+            object: "model",
+            created: timestamp,
+            owned_by: canonicalProviderId,
+            permission: [],
+            root: modelId,
+            parent: null,
+            ...(visionFields || {}),
+          });
+        }
+        if (
+          includeCanonical &&
+          canonicalProviderId !== alias &&
+          !isNoAuthProviderKey(canonicalProviderId) &&
+          prefixRoutesToProvider(canonicalProviderId, canonicalProviderId)
+        ) {
+          const providerPrefixedId = `${canonicalProviderId}/${modelId}`;
+          if (models.some((m: any) => m?.id === providerPrefixedId)) continue;
+          const providerVisionFields =
+            getVisionCapabilityFields(providerPrefixedId) || getVisionCapabilityFields(modelId);
+          models.push({
+            id: providerPrefixedId,
+            object: "model",
+            created: timestamp,
+            owned_by: canonicalProviderId,
+            permission: [],
+            root: modelId,
+            parent: includeAlias ? aliasId : null,
+            ...(providerVisionFields || {}),
+          });
+        }
+      }
+    } catch (e) {
+      console.log("Could not fetch model aliases");
+    }
+
     // Add managed fallback models for compatible providers that don't import a model list.
     for (const conn of connections) {
       const providerId = typeof conn.provider === "string" ? conn.provider : null;
@@ -1370,15 +1492,18 @@ export async function getUnifiedModelsResponse(
     if (apiKey) {
       const { isModelAllowedForKey, getApiKeyMetadata } = await import("@/lib/db/apiKeys");
 
-      // Quota-exclusive keys (allowedQuotas non-empty): show only the
-      // quotaShared-* virtual models for the key's assigned pools (Phase B3).
-      // This takes precedence over the normal allowedModels filter.
+      // Quota-exclusive keys (allowedQuotas non-empty): list ONLY the pool's qtSd/*
+      // virtual models. #4806: build from the hidden qtSd/* combos directly — the base
+      // `models` list drops hidden combos, so filtering it returned nothing (0 models).
       const keyMeta = await getApiKeyMetadata(apiKey);
       if (keyMeta && keyMeta.allowedQuotas && keyMeta.allowedQuotas.length > 0) {
-        const { resolveQuotaKeyScope } = await import("@/lib/quota/quotaKey");
-        const { filterModelsToQuotaPools } = await import("@/lib/quota/quotaCombos");
-        const scope = await resolveQuotaKeyScope(keyMeta.allowedQuotas);
-        finalModels = filterModelsToQuotaPools(models, scope.poolSlugs);
+        const { buildQuotaExclusiveModels } = await import("@/lib/quota/quotaCombos");
+        finalModels = await buildQuotaExclusiveModels(
+          keyMeta.allowedQuotas,
+          combos,
+          timestamp,
+          (c) => buildComboCatalogMetadata(c, combos)
+        );
       } else {
         const filtered = [];
         for (const m of models) {
diff --git a/src/app/api/v1/responses/route.ts b/src/app/api/v1/responses/route.ts
index db5745b276..90639e8b04 100644
--- a/src/app/api/v1/responses/route.ts
+++ b/src/app/api/v1/responses/route.ts
@@ -30,61 +30,77 @@ export async function OPTIONS() {
  * the CLI sends bare "gpt-5.5" over HTTP after WS closes (1008 Policy), and
  * without this rewrite OmniRoute routes it to openrouter instead of codex.
  *
+ * Accepts an optional `preParsedBody` (threaded from withInjectionGuard via #4041)
+ * to avoid re-cloning the request when the body was already parsed upstream.
+ *
  * Safe: only rewrites when codex/model is genuinely registered; all other models
- * pass through unchanged. Errors are caught and the original request is returned.
+ * pass through unchanged. Errors are caught and the original request + body are returned.
  */
-export async function withCodexPreferredModel(request: Request): Promise<Request> {
+export async function withCodexPreferredModel(
+  request: Request,
+  preParsedBody: any = null
+): Promise<{ request: Request; body: any }> {
   try {
-    const clone = request.clone();
-    const body = await clone.json().catch(() => null);
+    const body =
+      preParsedBody ??
+      (await request
+        .clone()
+        .json()
+        .catch(() => null));
     if (!body || typeof body !== "object" || typeof body.model !== "string") {
-      return request;
+      return { request, body };
     }
     const { model, changed } = await resolveResponsesApiModel(
       body.model,
       getModelInfo,
       async (name) => !!(await getComboByName(name))
     );
-    if (!changed) return request;
+    if (!changed) return { request, body };
 
-    return new Request(request.url, {
-      method: request.method,
-      headers: request.headers,
-      body: JSON.stringify({ ...body, model }),
-      signal: request.signal,
-    });
+    const rewrittenBody = { ...body, model };
+    return {
+      request: new Request(request.url, {
+        method: request.method,
+        headers: request.headers,
+        body: JSON.stringify(rewrittenBody),
+        signal: request.signal,
+      }),
+      body: rewrittenBody,
+    };
   } catch {
-    return request;
+    return { request, body: preParsedBody };
   }
 }
 
 /**
  * POST /v1/responses - OpenAI Responses API format
  * Handled by the unified chat handler (openai-responses format auto-detected).
+ *
+ * `preParsedBody` is threaded from withInjectionGuard (#4041) so the body is
+ * parsed at most once per request instead of 3-4x on the hot codex path.
  */
-async function postHandler(request, context) {
+async function postHandler(request: any, context: any, preParsedBody: any = null) {
   // Codex CLI (wire_api="responses") consumes this endpoint over SSE and its reqwest
   // client drops the connection if no bytes arrive within ~5s. Keep the connection
   // warm with early keepalives while the upstream produces its first token (#2544).
   // Non-streaming callers (JSON) keep the original verbatim path untouched.
-  const resolved = await withCodexPreferredModel(request);
+  const { request: resolved, body: resolvedBody } = await withCodexPreferredModel(
+    request,
+    preParsedBody
+  );
   const accept = String(request.headers?.get?.("accept") || "").toLowerCase();
   if (accept.includes("text/event-stream")) {
     // Adaptive threshold: web-session and anonymous-fallback providers are slower
     // to produce the first byte, so use a longer keepalive threshold (15s vs 2s).
-    let model;
-    try {
-      const body = await resolved.clone().json().catch(() => null);
-      model = body?.model;
-    } catch {
-    }
+    // Reuse resolvedBody.model — no extra clone/parse needed (#4041).
+    const model = resolvedBody?.model;
     const thresholdMs = resolveKeepaliveThreshold(model);
-    return await withEarlyStreamKeepalive(handleChat(resolved), {
+    return await withEarlyStreamKeepalive(handleChat(resolved, null, resolvedBody), {
       signal: request.signal,
       thresholdMs,
     });
   }
-  return await handleChat(resolved);
+  return await handleChat(resolved, null, resolvedBody);
 }
 
 export const POST = withInjectionGuard(postHandler);
diff --git a/src/app/api/v1/videos/generations/route.ts b/src/app/api/v1/videos/generations/route.ts
index 065285f3c3..8f0153f85a 100644
--- a/src/app/api/v1/videos/generations/route.ts
+++ b/src/app/api/v1/videos/generations/route.ts
@@ -1,4 +1,5 @@
 import { handleVideoGeneration } from "@omniroute/open-sse/handlers/videoGeneration.ts";
+import { resolveVideoCredentialProvider } from "@omniroute/open-sse/handlers/videoGeneration/googleFlow.ts";
 import { withInjectionGuard } from "@/middleware/promptInjectionGuard";
 import {
   getProviderCredentials,
@@ -99,10 +100,12 @@ async function postHandler(request, context) {
   // Check provider config for auth bypass
   const providerConfig = getVideoProvider(provider);
 
-  // Get credentials — skip for local providers (authType: "none")
+  // Get credentials — skip for local providers (authType: "none").
+  // Google Flow has no standalone connection: it reuses the Antigravity Google
+  // OAuth credential (resolveVideoCredentialProvider maps googleflow → antigravity).
   let credentials = null;
   if (providerConfig && providerConfig.authType !== "none") {
-    credentials = await getProviderCredentials(provider);
+    credentials = await getProviderCredentials(resolveVideoCredentialProvider(provider));
     if (!credentials) {
       return errorResponse(
         HTTP_STATUS.BAD_REQUEST,
diff --git a/src/hooks/useLiveDashboard.ts b/src/hooks/useLiveDashboard.ts
index bd72bdb57f..d5b5dae1bf 100644
--- a/src/hooks/useLiveDashboard.ts
+++ b/src/hooks/useLiveDashboard.ts
@@ -21,10 +21,15 @@ function getDefaultWsUrl(): string {
   if (typeof window === "undefined") return "ws://localhost:20129";
   const protocol = window.location.protocol === "https:" ? "wss:" : "ws:";
   const { hostname } = window.location;
-  if (hostname === "localhost" || hostname === "127.0.0.1") {
+  // Bug #1 fix: Use the WS server's actual port (20129) for both loopback
+  // and non-loopback clients. Previously the non-loopback branch tried to
+  // upgrade the HTTP port (window.location.host) which has no upgrade
+  // handler in src/proxy.ts. If the user wants the upgrade to go through
+  // Next.js (same-origin), they should explicitly pass `wsUrl`.
+  if (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1") {
     return `${protocol}//${hostname}:20129`;
   }
-  return `${protocol}//${window.location.host}/live-ws`;
+  return `${protocol}//${hostname}:20129`;
 }
 
 const DEFAULT_WS_URL = getDefaultWsUrl();
diff --git a/src/i18n/messages/ar.json b/src/i18n/messages/ar.json
index 378d6253f5..54ee1c8594 100644
--- a/src/i18n/messages/ar.json
+++ b/src/i18n/messages/ar.json
@@ -3002,7 +3002,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
diff --git a/src/i18n/messages/az.json b/src/i18n/messages/az.json
index ad09e26600..0960709d8c 100644
--- a/src/i18n/messages/az.json
+++ b/src/i18n/messages/az.json
@@ -3002,7 +3002,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
diff --git a/src/i18n/messages/bg.json b/src/i18n/messages/bg.json
index a8185ac2f3..75d5772827 100644
--- a/src/i18n/messages/bg.json
+++ b/src/i18n/messages/bg.json
@@ -3002,7 +3002,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
diff --git a/src/i18n/messages/bn.json b/src/i18n/messages/bn.json
index d6db74687d..64d7e19366 100644
--- a/src/i18n/messages/bn.json
+++ b/src/i18n/messages/bn.json
@@ -3002,7 +3002,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
diff --git a/src/i18n/messages/cs.json b/src/i18n/messages/cs.json
index f721d7911b..da810e7c5c 100644
--- a/src/i18n/messages/cs.json
+++ b/src/i18n/messages/cs.json
@@ -3002,7 +3002,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Koncová Proxy",
diff --git a/src/i18n/messages/da.json b/src/i18n/messages/da.json
index 53099199ad..941484a660 100644
--- a/src/i18n/messages/da.json
+++ b/src/i18n/messages/da.json
@@ -3002,7 +3002,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
diff --git a/src/i18n/messages/de.json b/src/i18n/messages/de.json
index 748e67498a..17a707aac8 100644
--- a/src/i18n/messages/de.json
+++ b/src/i18n/messages/de.json
@@ -3007,7 +3007,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
diff --git a/src/i18n/messages/en.json b/src/i18n/messages/en.json
index beb013043f..2b8b5edf35 100644
--- a/src/i18n/messages/en.json
+++ b/src/i18n/messages/en.json
@@ -2345,6 +2345,8 @@
     "leastLatency": "Least Latency",
     "comboName": "Combo Name",
     "comboNamePlaceholder": "my-combo",
+    "comboDescription": "Description",
+    "comboDescriptionPlaceholder": "Optional note describing this combo",
     "deleteConfirm": "Delete this combo?",
     "noCombosYet": "No combos yet",
     "comboCreated": "Combo created successfully",
@@ -2384,6 +2386,8 @@
     "resetAwareDesc": "Balances remaining quota against 5h and weekly resets, then round-robins similar scores",
     "strictRandom": "Strict Random",
     "strictRandomDesc": "Shuffle deck — uses each model once before reshuffling",
+    "fusion": "Fusion",
+    "fusionDesc": "Fans the prompt to every panel model in parallel, then a judge model synthesizes one final answer",
     "models": "Models",
     "autoBalance": "Auto-balance",
     "advancedSettings": "Advanced Settings",
@@ -3107,7 +3111,10 @@
     "tierAlwaysProtected": "Always Protected",
     "tierPublic": "Public",
     "hideInternal": "Hide Internal",
-    "showInternal": "Show Internal"
+    "showInternal": "Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
@@ -4482,8 +4489,8 @@
     "showEmails": "Show all emails",
     "hideEmails": "Hide all emails",
     "a": "A",
-    "accountConcurrencyCapHint": "Account Concurrency Cap Hint",
-    "accountConcurrencyCapLabel": "Account Concurrency Cap Label",
+    "accountConcurrencyCapHint": "Max concurrent requests this connection/account can handle. Subscription accounts usually allow only a few (1–3) — going over triggers 429s and cooldowns. Leave empty for the default.",
+    "accountConcurrencyCapLabel": "Account concurrency cap",
     "accountIdHint": "Account Id Hint",
     "accountIdLabel": "Account Id Label",
     "accountIdPlaceholder": "Account Id Placeholder",
@@ -5131,6 +5138,11 @@
     "vercelRelayTokenRequired": "Token is required",
     "vercelRelayDeployFailed": "Deploy failed",
     "vercelRelayTokenHint": "Token is used only during deploy — never stored.",
+    "denoRelayTokenRequired": "Deno Deploy token is required",
+    "denoRelayOrgDomainRequired": "Organization domain is required",
+    "denoRelayDeployFailed": "Deno Deploy failed",
+    "denoRelayTokenHint": "Organization token (prefix ddo_) from console.deno.com → Organization → Settings → Organization Tokens. Used once for deploy and never stored.",
+    "denoRelayOrgDomainHint": "Your Deno Deploy organization's default domain (e.g. acme.deno.net). The relay will be reachable at https://<app-name>.<org-slug>.deno.net.",
     "proxyFreePoolFilterProtocol": "Filter by protocol",
     "proxyFreePoolProtocol": "Protocol",
     "proxyFreePoolCountryPlaceholder": "Country (e.g. US)",
@@ -6020,6 +6032,31 @@
     "vercelRelayFreeTierNote": "Relays are lightweight proxy endpoints deployed on Vercel's free tier to bypass local network/region limitations.",
     "vercelRelayDeploying": "Deploying...",
     "vercelRelayDeploy": "Deploy",
+    "deployRelayButton": "Deploy Relay",
+    "denoRelayButton": "Deploy Deno Relay",
+    "denoRelayModalTitle": "Deploy Deno Relay",
+    "denoRelayWarning": "Warning: A Deno Deploy organization token is required. This token will only be used to create the relay app and will never be stored by OmniRoute.",
+    "denoRelayTokenLabel": "Deno Deploy Organization Token",
+    "denoRelayOrgDomainLabel": "Organization Domain",
+    "denoRelayProjectNameLabel": "Deno App Name",
+    "denoRelayFreeTierNote": "Deno Deploy v2 runs on a global edge network. Free tier: 1M requests & 100GiB outbound traffic per month, no per-request CPU limits, up to 20 active apps & 50 custom domains.",
+    "denoRelayDeploying": "Deploying...",
+    "denoRelayDeploy": "Deploy",
+    "cloudflareRelaySuccess": "Cloudflare Relay deployed successfully",
+    "cloudflareRelayButton": "Deploy Cloudflare Relay",
+    "cloudflareRelayModalTitle": "Deploy Cloudflare Worker Relay",
+    "cloudflareRelayWarning": "Deploys a Cloudflare Worker that proxies LLM requests through Cloudflare's edge network — masking the host IP behind dynamic Cloudflare addresses. The Worker enforces a one-time auth secret so the public workers.dev URL cannot be reused as an open relay.",
+    "cloudflareRelayTokenHowto": "Create the API token under My Profile -> API Tokens -> Create Token -> Custom Token -> Account / Workers Scripts / Edit.",
+    "cloudflareRelayAccountIdLabel": "Cloudflare Account ID",
+    "cloudflareRelayAccountIdHint": "Found on the right side of the Cloudflare dashboard overview page.",
+    "cloudflareRelayApiTokenLabel": "Cloudflare API Token",
+    "cloudflareRelayApiTokenHint": "Requires 'Workers Scripts: Edit' permission. The token is used only at deploy time and is never stored.",
+    "cloudflareRelayProjectNameLabel": "Worker Name",
+    "cloudflareRelayFreeTierNote": "Free tier: 100,000 requests/day per Cloudflare account.",
+    "cloudflareRelayDeploying": "Deploying...",
+    "cloudflareRelayDeploy": "Deploy",
+    "cloudflareRelayCredsRequired": "Account ID and API Token are required",
+    "cloudflareRelayDeployFailed": "Deploy failed",
     "modelLockout": "Model Lockout",
     "modelLockoutPageDescription": "Configure which HTTP error codes trigger per-model lockout and control the cooldown behavior.",
     "modelLockoutEnabled": "Enable Model Lockout",
diff --git a/src/i18n/messages/es.json b/src/i18n/messages/es.json
index edc88a6b02..77d6f0708f 100644
--- a/src/i18n/messages/es.json
+++ b/src/i18n/messages/es.json
@@ -3002,7 +3002,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
diff --git a/src/i18n/messages/fa.json b/src/i18n/messages/fa.json
index ae25b7191a..e8c5292fa9 100644
--- a/src/i18n/messages/fa.json
+++ b/src/i18n/messages/fa.json
@@ -3002,7 +3002,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
diff --git a/src/i18n/messages/fi.json b/src/i18n/messages/fi.json
index 962825340f..2c467843d7 100644
--- a/src/i18n/messages/fi.json
+++ b/src/i18n/messages/fi.json
@@ -3002,7 +3002,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
diff --git a/src/i18n/messages/fr.json b/src/i18n/messages/fr.json
index 268e233dca..574823ffe0 100644
--- a/src/i18n/messages/fr.json
+++ b/src/i18n/messages/fr.json
@@ -3002,7 +3002,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
diff --git a/src/i18n/messages/gu.json b/src/i18n/messages/gu.json
index 270b60d66e..5ea250d8c1 100644
--- a/src/i18n/messages/gu.json
+++ b/src/i18n/messages/gu.json
@@ -3002,7 +3002,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
diff --git a/src/i18n/messages/he.json b/src/i18n/messages/he.json
index 32e51e3e94..090d83d37c 100644
--- a/src/i18n/messages/he.json
+++ b/src/i18n/messages/he.json
@@ -3002,7 +3002,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
diff --git a/src/i18n/messages/hi.json b/src/i18n/messages/hi.json
index aa2f70bdaa..3df29f0bf0 100644
--- a/src/i18n/messages/hi.json
+++ b/src/i18n/messages/hi.json
@@ -3002,7 +3002,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
diff --git a/src/i18n/messages/hu.json b/src/i18n/messages/hu.json
index 2d7312f9b8..0c753c038b 100644
--- a/src/i18n/messages/hu.json
+++ b/src/i18n/messages/hu.json
@@ -3002,7 +3002,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
diff --git a/src/i18n/messages/id.json b/src/i18n/messages/id.json
index 9e66cca345..be779d2d83 100644
--- a/src/i18n/messages/id.json
+++ b/src/i18n/messages/id.json
@@ -3002,7 +3002,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
diff --git a/src/i18n/messages/in.json b/src/i18n/messages/in.json
index 20da251884..85fed9ae72 100644
--- a/src/i18n/messages/in.json
+++ b/src/i18n/messages/in.json
@@ -3002,7 +3002,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
diff --git a/src/i18n/messages/it.json b/src/i18n/messages/it.json
index b121e1e1e0..caba86d97a 100644
--- a/src/i18n/messages/it.json
+++ b/src/i18n/messages/it.json
@@ -393,6 +393,7 @@
     "cloudBenefitAccess": "Cloud Benefit Access",
     "maxRetries": "Max Retries",
     "queueTimeout": "Queue Timeout",
+    "queueDepth": "__MISSING__:Queue Depth",
     "addProvider": "Add Provider",
     "realtime": "Realtime",
     "totalTranslations": "Total Translations",
@@ -709,6 +710,7 @@
     "batchFilesListFilesTable": "File",
     "batchPageLoadingMore": "Caricamento altro...",
     "recommended": "__MISSING__:Recommended",
+    "understand": "__MISSING__:I understand",
     "batchConceptTitle": "Batch processing",
     "batchConceptSubtitle": "Process thousands of requests asynchronously at ~50% of the cost (24h window). Ideal for evaluations, classification, and embeddings.",
     "batchConceptHowItWorks": "How it works",
@@ -773,36 +775,13 @@
     "filesListUploadButton": "Upload",
     "filesListUsedByColumn": "Used by",
     "filesListUsedByNone": "None",
-    "filesListDelete": "Delete",
-    "filesListDownload": "Download",
-    "batchDetailActionCancel": "Cancel batch",
-    "batchDetailActionRetry": "Retry failed requests",
-    "batchDetailCancelling": "Cancelling…",
-    "batchDetailRetrying": "Preparing retry…",
-    "batchDetailCancelConfirm": "Cancel this batch? In-progress requests will stop.",
-    "batchActionCancelError": "Failed to cancel batch. Try again.",
-    "batchActionRetryError": "Failed to retry failed requests. Try again.",
-    "batchConceptRetentionNote": "Results and error files are retained for 30 days (Anthropic: 29 days)",
     "filesListUsedByRoleInput": "input",
     "filesListUsedByRoleOutput": "output",
     "filesListUsedByRoleError": "error",
-    "batchListProgressPartial": "(partial)",
     "filesListSizeColumn": "Size",
+    "batchListProgressPartial": "(partial)",
     "batchListProviderColumn": "Provider",
     "batchListProviderUnknown": "—",
-    "batchListBatchCreated": "Batch {id} created — refreshing list…",
-    "batchListBatchCreatedDismiss": "Dismiss",
-    "batchListRefreshing": "Refreshing…",
-    "batchListRefresh": "Refresh",
-    "uploadFileModalRemove": "Remove",
-    "uploadFileModalUploading": "Uploading…",
-    "wizardInputReading": "Reading file…",
-    "wizardInputReady": "Ready",
-    "wizardInputLargeFileLabel": "Large file — sampling validation",
-    "wizardInputCsvJsonlReady": "JSONL generated — ready to validate.",
-    "wizardInputLargeFileWarning": "Large file detected — validation runs by sampling (first 5 MB + last 100 KB). Full validation happens server-side.",
-    "wizardCostWindow24h": "24h completion window",
-    "wizardValidationFieldsOk": "required fields valid",
     "batchListProviderOther": "Other",
     "batchListTitle": "Batches",
     "batchListCount": "{count} batches",
@@ -839,8 +818,33 @@
     "wizardCostWindow": "Window",
     "wizardDestinationSelectProvider": "Select a provider…",
     "wizardDestinationSelectModel": "Select a model…",
-    "wizardDestinationConnectProvider": "Connect a provider"
+    "wizardDestinationConnectProvider": "Connect a provider",
+    "batchListBatchCreated": "Batch {id} created — refreshing list…",
+    "batchListBatchCreatedDismiss": "Dismiss",
+    "batchListRefreshing": "Refreshing…",
+    "batchListRefresh": "Refresh",
+    "uploadFileModalRemove": "Remove",
+    "uploadFileModalUploading": "Uploading…",
+    "wizardInputReading": "Reading file…",
+    "wizardInputReady": "Ready",
+    "wizardInputLargeFileLabel": "Large file — sampling validation",
+    "wizardInputCsvJsonlReady": "JSONL generated — ready to validate.",
+    "wizardInputLargeFileWarning": "Large file detected — validation runs by sampling (first 5 MB + last 100 KB). Full validation happens server-side.",
+    "wizardCostWindow24h": "24h completion window",
+    "wizardValidationFieldsOk": "required fields valid",
+    "filesListDelete": "Delete",
+    "filesListDownload": "Download",
+    "batchDetailActionCancel": "Cancel batch",
+    "batchDetailActionRetry": "Retry failed requests",
+    "batchDetailCancelling": "Cancelling…",
+    "batchDetailRetrying": "Preparing retry…",
+    "batchDetailCancelConfirm": "Cancel this batch? In-progress requests will stop.",
+    "batchActionCancelError": "Failed to cancel batch. Try again.",
+    "batchActionRetryError": "Failed to retry failed requests. Try again.",
+    "batchConceptRetentionNote": "Results and error files are retained for 30 days (Anthropic: 29 days)"
   },
+  "featureFlagOmnirouteEmergencyFallbackDescription": "__MISSING__:Route budget-exhausted requests to the emergency free fallback provider/model.",
+  "featureFlagArenaEloSyncEnabledDescription": "__MISSING__:Enable periodic Arena AI leaderboard ELO sync for model intelligence rankings.",
   "sidebar": {
     "home": "Casa",
     "dashboard": "Pannello di controllo",
@@ -968,6 +972,7 @@
     "aiFeaturesSection": "AI Features",
     "mcp": "MCP",
     "a2a": "A2A",
+    "plugins": "__MISSING__:Plugins",
     "apiEndpoints": "API Endpoints",
     "batchFiles": "Files",
     "analyticsEvals": "Evals",
@@ -976,6 +981,10 @@
     "analyticsComboHealth": "Combo Health",
     "analyticsCompression": "Compression",
     "costsBudget": "Budget",
+    "costsFreeTiers": "__MISSING__:Free-Tier Budget",
+    "costsFreeTiersSubtitle": "__MISSING__:Monthly free-token allowances",
+    "freeProviderRankings": "__MISSING__:Free Provider Rankings",
+    "freeProviderRankingsSubtitle": "__MISSING__:Best free providers ranked by model ELO scores",
     "costsQuotaShare": "Quota Sharing",
     "costsPricing": "Pricing",
     "logsProxy": "Proxy Logs",
@@ -987,10 +996,12 @@
     "settingsAppearance": "Appearance",
     "settingsAi": "AI Settings",
     "settingsSecurity": "Security",
+    "settingsAccessTokens": "__MISSING__:Access Tokens",
     "settingsFeatureFlags": "Flag di funzionalità",
     "settingsAuthz": "__MISSING__:Authz",
     "settingsRouting": "Routing",
     "settingsResilience": "Resilience",
+    "modelLockout": "__MISSING__:Model Lockout",
     "settingsAdvanced": "Advanced",
     "omniProxySection": "OmniProxy",
     "quotaTracker": "Provider Quota",
@@ -1036,6 +1047,8 @@
     "analyticsCompressionSubtitle": "Token savings stats",
     "analyticsSearchSubtitle": "Search tool analytics",
     "analyticsEvalsSubtitle": "Eval suite results",
+    "providerStats": "__MISSING__:Provider Stats",
+    "providerStatsSubtitle": "__MISSING__:Latency and performance metrics",
     "logsSubtitle": "Application logs",
     "logsProxySubtitle": "Proxy traffic logs",
     "consoleLogsSubtitle": "Console output",
@@ -1055,6 +1068,7 @@
     "agentSkillsSubtitle": "A2A skill registry",
     "mcpSubtitle": "MCP server controls",
     "a2aSubtitle": "A2A protocol server",
+    "pluginsSubtitle": "__MISSING__:Plugin marketplace & installs",
     "mediaSubtitle": "Cached media files",
     "batchFilesSubtitle": "Batch input/output files",
     "settingsSubtitle": "All settings",
@@ -1065,13 +1079,41 @@
     "settingsResilienceSubtitle": "Retries and breakers",
     "settingsAdvancedSubtitle": "Power user options",
     "settingsSecuritySubtitle": "Auth and encryption",
+    "settingsAccessTokensSubtitle": "__MISSING__:Scoped CLI tokens for remote mode",
     "settingsFeatureFlagsSubtitle": "Attiva/disattiva le funzionalità del sistema",
     "settingsSidebar": "Sidebar",
     "settingsSidebarSubtitle": "Customize sidebar layout",
     "settingsAuthzSubtitle": "__MISSING__:Route inventory and bypass policy",
     "docsSubtitle": "Documentation",
     "issuesSubtitle": "Report a bug",
-    "changelogSubtitle": "Release notes"
+    "changelogSubtitle": "Release notes",
+    "costsQuotaPlans": "__MISSING__:Plans & Quotas",
+    "costsQuotaPlansSubtitle": "__MISSING__:Configure plans by provider",
+    "activity": "__MISSING__:Activity",
+    "activitySubtitle": "__MISSING__:Friendly feed of recent events",
+    "logsGroup": "__MISSING__:Logs",
+    "systemGroup": "__MISSING__:System",
+    "costsOverview": "__MISSING__:Overview",
+    "costsOverviewSubtitle": "__MISSING__:Consolidated cost analysis",
+    "agentBridge": "__MISSING__:Agent Bridge",
+    "agentBridgeSubtitle": "__MISSING__:Intercept IDE agent traffic",
+    "trafficInspector": "__MISSING__:Traffic Inspector",
+    "trafficInspectorSubtitle": "__MISSING__:Monitor LLM calls + debug any HTTPS traffic",
+    "cliCode": "__MISSING__:CLI Code",
+    "cliCodeSubtitle": "__MISSING__:Code tools pointing to OmniRoute",
+    "cliAgents": "__MISSING__:CLI Agents",
+    "cliAgentsSubtitle": "__MISSING__:Autonomous CLI agents",
+    "acpAgents": "__MISSING__:ACP Agents",
+    "acpAgentsSubtitle": "__MISSING__:CLIs spawned by OmniRoute",
+    "skipToContent": "__MISSING__:Skip to content",
+    "unpinSection": "__MISSING__:Unpin section",
+    "pinSectionOpen": "__MISSING__:Pin section open",
+    "reloadPage": "__MISSING__:Reload Page",
+    "dragReorderSection": "__MISSING__:Drag to reorder section",
+    "dragReorderItem": "__MISSING__:Drag to reorder",
+    "cannotHide": "__MISSING__:This item cannot be hidden",
+    "alwaysVisible": "__MISSING__:Always visible",
+    "groupSeparatorLabel": "__MISSING__:Separator"
   },
   "webhooks": {
     "title": "Webhook",
@@ -1272,7 +1314,47 @@
     "a2aEvents": "Eventi",
     "a2aArtifacts": "Artefatti",
     "a2aNoTasks": "Nessuna attività A2A registrata.",
-    "a2aLoadingTasks": "Caricamento attività A2A..."
+    "a2aLoadingTasks": "Caricamento attività A2A...",
+    "actor": "__MISSING__:Actor",
+    "actorPlaceholder": "__MISSING__:Filter by actor",
+    "eventTypes": {
+      "apiKey.activate": "__MISSING__:API Key Activated",
+      "apiKey.ban": "__MISSING__:API Key Banned",
+      "apiKey.deactivate": "__MISSING__:API Key Deactivated",
+      "apiKey.regenerate": "__MISSING__:API Key Regenerated",
+      "apiKey.scopes.grant": "__MISSING__:API Key Scopes Granted",
+      "apiKey.scopes.revoke": "__MISSING__:API Key Scopes Revoked",
+      "apiKey.scopes.update": "__MISSING__:API Key Scopes Updated",
+      "apiKey.unban": "__MISSING__:API Key Unbanned",
+      "auth.login.error": "__MISSING__:Login Error",
+      "auth.login.failed": "__MISSING__:Login Failed",
+      "auth.login.locked": "__MISSING__:Login Locked",
+      "auth.login.misconfigured": "__MISSING__:Login Misconfigured",
+      "auth.login.setup_required": "__MISSING__:Login Setup Required",
+      "auth.login.success": "__MISSING__:Login Success",
+      "auth.logout.success": "__MISSING__:Logout Success",
+      "compliance.cleanup": "__MISSING__:Compliance Cleanup",
+      "provider.credentials.applied": "__MISSING__:Provider Credentials Applied",
+      "provider.credentials.batch_revoked": "__MISSING__:Provider Credentials Batch Revoked",
+      "provider.credentials.bulk_created": "__MISSING__:Provider Credentials Bulk Created",
+      "provider.credentials.bulk_imported": "__MISSING__:Provider Credentials Bulk Imported",
+      "provider.credentials.created": "__MISSING__:Provider Credentials Created",
+      "provider.credentials.imported": "__MISSING__:Provider Credentials Imported",
+      "provider.credentials.revoked": "__MISSING__:Provider Credentials Revoked",
+      "provider.credentials.updated": "__MISSING__:Provider Credentials Updated",
+      "provider.validation.ssrf_blocked": "__MISSING__:Provider SSRF Blocked",
+      "quota.plan.updated": "__MISSING__:Quota Plan Updated",
+      "quota.pool.created": "__MISSING__:Quota Pool Created",
+      "quota.pool.deleted": "__MISSING__:Quota Pool Deleted",
+      "quota.pool.updated": "__MISSING__:Quota Pool Updated",
+      "quota.store.driver_changed": "__MISSING__:Quota Store Driver Changed",
+      "server.start": "__MISSING__:Server Start",
+      "service.reveal_api_key": "__MISSING__:Service API Key Revealed",
+      "settings.update": "__MISSING__:Settings Updated",
+      "settings.update_failed": "__MISSING__:Settings Update Failed",
+      "sync.token.created": "__MISSING__:Sync Token Created",
+      "sync.token.revoked": "__MISSING__:Sync Token Revoked"
+    }
   },
   "themesPage": {
     "title": "Themes",
@@ -1381,7 +1463,8 @@
     "settingsResilienceDescription": "Circuit breaker, retry, and fallback configuration",
     "settingsAdvancedDescription": "Advanced payload rules, request limits, and proxy API settings",
     "mitmProxyDescription": "Configure MITM proxy settings for traffic inspection and debugging",
-    "oneProxyDescription": "Configure 1Proxy settings for advanced proxy chaining"
+    "oneProxyDescription": "Configure 1Proxy settings for advanced proxy chaining",
+    "omniSkillsDescription": "__MISSING__:Install and manage sandbox skills for automated prompt and tool execution"
   },
   "home": {
     "quickStart": "Avvio rapido",
@@ -1612,16 +1695,24 @@
     "ownUsageVisibilityDesc": "Consenti a questa chiave di chiamare il proprio endpoint di stato per uso in USD, percentuale di budget e totali dei token.",
     "sharedAccountQuotaVisibility": "Quota account condivisa",
     "sharedAccountQuotaVisibilityDesc": "Consenti a questa chiave di vedere la quota dell’account upstream condiviso quando è configurata una connessione esplicita.",
+    "localUsageCommand": "__MISSING__:Allow local usage command",
+    "localUsageCommandDesc": "__MISSING__:Allows this API key to use @@om-usage to retrieve cached usage and quota information without calling an upstream provider.",
+    "localUsageCommandBadge": "__MISSING__:Usage cmd",
     "keyCreated": "Chiave API creata",
     "keyCreatedSuccess": "Chiave creata con successo!",
     "keyCreatedNote": "Copia e memorizza questa chiave adesso: non verrà più mostrata.",
     "done": "Fatto",
     "savePermissions": "Salva autorizzazioni",
-    "endpointRestrictions": "__MISSING__:Allowed Endpoints",
-    "allEndpointsAllowed": "__MISSING__:This key can access all API endpoints.",
-    "endpointsRestricted": "__MISSING__:Restricted to {count} endpoint{count, plural, one {} other {s}}.",
+    "endpointRestrictions": "Allowed Endpoints",
+    "allEndpointsAllowed": "This key can access all API endpoints.",
+    "endpointsRestricted": "Restricted to {count} endpoint{count, plural, one {} other {s}}.",
     "autoResolve": "Auto-Resolve",
     "autoResolveDesc": "Auto-resolve ambiguous model names to native provider for this API key.",
+    "streamDefaultMode": "__MISSING__:Stream Default Compatibility",
+    "streamDefaultModeDesc": "__MISSING__:Controls omitted `stream` flags for this key. JSON mode returns non-streaming responses unless the client explicitly requests SSE.",
+    "streamDefaultLegacy": "__MISSING__:Legacy",
+    "streamDefaultJson": "__MISSING__:JSON Compatible",
+    "streamDefaultBadge": "__MISSING__:JSON stream default",
     "keyActive": "Key Active",
     "keyActiveDesc": "Enable or disable this API key. Disabled keys are immediately rejected with 403.",
     "accessSchedule": "Access Schedule",
@@ -1667,6 +1758,7 @@
     "keyOnlyAvailableAtCreation": "Full key available only at creation time — copy it when you first create the key",
     "modelsCount": "{count, plural, one {# model} other {# models}}",
     "lastUsedOn": "Ultimo: {date}",
+    "viewCostsFor": "__MISSING__:View costs for {name}",
     "editPermissions": "Modifica autorizzazioni",
     "deleteKey": "Cancella chiave",
     "regenerateKey": "Chiave rigenerata",
@@ -1708,9 +1800,12 @@
     "shownOf": "__MISSING__:{shown} of {total} shown",
     "emptyFilterTitle": "__MISSING__:No keys match your filters",
     "emptyFilterClear": "__MISSING__:Clear filters",
-    "endpointRestrictions": "Allowed Endpoints",
-    "allEndpointsAllowed": "This key can access all API endpoints.",
-    "endpointsRestricted": "Restricted to {count} endpoint{count, plural, one {} other {s}}."
+    "disableNonPublicModels": "__MISSING__:Disable Non-Public Models",
+    "disableNonPublicModelsDesc": "__MISSING__:Reject requests for models that are not discovered or not marked as public in the provider catalog",
+    "normalKeysSection": "__MISSING__:Normal keys",
+    "quotaKeysSection": "__MISSING__:Quota keys",
+    "quotaPill": "__MISSING__:QUOTA",
+    "quotaModeOnly": "__MISSING__:qtSd-only"
   },
   "auditLog": {
     "title": "Registro di controllo",
@@ -1845,6 +1940,8 @@
     "freeQuota": "Free quota/mo",
     "scrapeUrl": "URL to scrape",
     "scrapeUrlPlaceholder": "https://example.com",
+    "scrapeUrlRequired": "__MISSING__:URL is required",
+    "scrapeUrlInvalid": "__MISSING__:Invalid URL — it must start with http:// or https://",
     "scrapeExtract": "Extract",
     "scrapeExtracting": "Extracting…",
     "scrapeFullPage": "Full page",
@@ -1858,6 +1955,8 @@
     "scrapeMetadata": "Metadata",
     "scrapeProvider": "Provider",
     "scrapeSize": "Size",
+    "scrapeEmptyState": "__MISSING__:Enter a URL to extract its content",
+    "scrapeProvidersAvailable": "__MISSING__:Available providers: Firecrawl, Jina Reader, Tavily.",
     "compareRun": "Compare",
     "compareRunning": "Comparing…",
     "autoProvider": "Auto (cheapest)",
@@ -2245,6 +2344,8 @@
     "leastLatency": "Latenza minima",
     "comboName": "Nome combinato",
     "comboNamePlaceholder": "la mia combinazione",
+    "comboDescription": "__MISSING__:Description",
+    "comboDescriptionPlaceholder": "__MISSING__:Optional note describing this combo",
     "deleteConfirm": "Eliminare questa combinazione?",
     "noCombosYet": "Nessuna combo ancora",
     "comboCreated": "Combo creato con successo",
@@ -2284,6 +2385,8 @@
     "resetAwareDesc": "Bilancia la quota rimanente rispetto a 5 ore e ai reimpostazioni settimanali, quindi esegue il round robin di punteggi simili",
     "strictRandom": "Strict Random",
     "strictRandomDesc": "Shuffle deck — uses each model once before reshuffling",
+    "fusion": "__MISSING__:Fusion",
+    "fusionDesc": "__MISSING__:Fans the prompt to every panel model in parallel, then a judge model synthesizes one final answer",
     "models": "Modelli",
     "autoBalance": "Bilanciamento automatico",
     "advancedSettings": "Impostazioni avanzate",
@@ -2982,14 +3085,19 @@
     "ngrokStarted": "è iniziato il tunnel di Ngrok",
     "ngrokStopped": "il tunnel di Ngrok si è fermato",
     "ngrokRequestFailed": "Impossibile aggiornare il tunnel Ngrok",
-    "tokenSaverSubtitle": "Spendi meno token per ogni richiesta.",
-    "tokenSaverToolOutput": "Uscita dello strumento",
-    "tokenSaverLlmOutput": "Uscita LLM",
-    "tokenSaverInputCompression": "Compressione in ingresso",
     "apiEndpointsCatalogUnavailable": "Catalogo API non disponibile",
     "apiEndpointsSearchPlaceholder": "Cerca endpoint...",
     "apiEndpointsRequiresAuth": "Richiede l'autenticazione",
     "apiEndpointsNoMatch": "Nessun endpoint corrisponde al filtro",
+    "vscodeAliasTitle": "__MISSING__:VS Code Token Alias",
+    "vscodeAliasDescriptionReady": "__MISSING__:Ready-to-paste compatibility URLs using the /api/v1/vscode/TOKEN/... endpoint.",
+    "vscodeAliasDescriptionError": "__MISSING__:Showing placeholder URLs because CLI keys could not be loaded in this session.",
+    "vscodeAliasDescriptionLoading": "__MISSING__:Loading CLI keys. Placeholder URLs are shown until a key is available.",
+    "vscodeAliasDescriptionPlaceholder": "__MISSING__:Showing placeholder URLs. Create or activate an API key in CLI Tools to replace TOKEN.",
+    "vscodeAliasManage": "__MISSING__:CLI Tools",
+    "vscodeAliasBaseLabel": "__MISSING__:VS Code base",
+    "vscodeAliasModelsLabel": "__MISSING__:VS Code models",
+    "vscodeAliasChatLabel": "__MISSING__:VS Code chat",
     "localServer": "Server locale",
     "cloudOmniroute": "Cloud OmniRoute",
     "copyUrl": "Copia l'URL",
@@ -3002,7 +3110,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "__MISSING__:Custom System Prompt",
+    "customSystemPromptDescription": "__MISSING__:Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "__MISSING__:e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
@@ -3178,42 +3289,187 @@
     "a2aStep3": "__MISSING__:Track and cancel tasks with {code1} and {code2}."
   },
   "memory": {
-    "title": "Memory Management",
-    "description": "View and manage stored memory entries",
-    "memories": "Memories",
-    "totalEntries": "Total Entries",
-    "tokensUsed": "Tokens Used",
-    "hitRate": "Hit Rate",
-    "loading": "Loading memories...",
-    "noMemories": "No memories found",
-    "search": "Search memories...",
-    "allTypes": "All Types",
-    "export": "Export",
-    "import": "Import",
-    "addMemory": "Add Memory",
-    "type": "Type",
-    "key": "Key",
-    "content": "Content",
-    "created": "Created",
-    "actions": "Actions",
-    "delete": "Delete",
-    "factual": "Factual",
-    "episodic": "Episodic",
-    "procedural": "Procedural",
-    "semantic": "Semantic",
     "a": "A",
-    "pipelineOk": "Pipeline OK ({latencyMs}ms)",
-    "pipelineError": "Errore della pipeline",
-    "healthUnknown": "Salute sconosciuta",
-    "checkingHealth": "Controllo…",
-    "checkHealth": "Controlla la salute",
-    "pageInfo": "Pagina {page} di {totalPages} ({total} totale)",
-    "previous": "Precedente",
-    "next": "Prossimo",
+    "actions": "Actions",
+    "addMemory": "Add Memory",
+    "allTypes": "All Types",
     "cancel": "Cancellare",
-    "save": "Salva",
+    "checkHealth": "Controlla la salute",
+    "checkingHealth": "Controllo…",
+    "compactOld": "__MISSING__:Compact old",
+    "concept": {
+      "title": "__MISSING__:Conversational Memory",
+      "description": "__MISSING__:OmniRoute learns from every conversation, remembering facts, episodes, procedures, and semantic concepts that make responses more accurate and context-aware.",
+      "howWorksToggle": "__MISSING__:How it works",
+      "howWorksContent": "__MISSING__:1. Automatic extraction: at the end of each response, facts and episodes are detected and saved automatically.\n2. Retrieval: before each response, the most relevant memories are searched via FTS5 (exact), vector (semantic), or hybrid RRF.\n3. Injection: relevant memories are injected into the assistant context to improve response quality.\n4. Management: use this page to view, edit, export, and compact old memories."
+    },
+    "content": "Content",
+    "contentPlaceholder": "Valore o contenuto JSON da ricordare",
+    "created": "Created",
+    "delete": "Delete",
+    "deleteConfirmDesc": "__MISSING__:This action cannot be undone. The memory will be permanently removed.",
+    "deleteConfirmTitle": "__MISSING__:Delete memory?",
+    "description": "View and manage stored memory entries",
+    "editMemory": "__MISSING__:Edit memory",
+    "editModal": {
+      "title": "__MISSING__:Edit Memory",
+      "metadataLabel": "__MISSING__:Metadata (JSON)",
+      "metadataInvalid": "__MISSING__:Invalid JSON",
+      "saveFailed": "__MISSING__:Failed to save memory"
+    },
+    "embedding": {
+      "autoLabel": "__MISSING__:Automatic",
+      "autoDesc": "__MISSING__:Uses best available: remote provider > static > transformers",
+      "remoteLabel": "__MISSING__:Remote provider",
+      "remoteDesc": "__MISSING__:Uses embedding via provider API (requires API key)",
+      "staticLabel": "__MISSING__:Static local (potion)",
+      "staticDesc": "__MISSING__:Local embedding without WASM or external dependencies",
+      "transformersLabel": "__MISSING__:Transformers.js (MiniLM)",
+      "transformersDesc": "__MISSING__:Local embedding via @huggingface/transformers (~400MB RAM)",
+      "providerModelLabel": "__MISSING__:Provider / Model",
+      "noRemoteProviders": "__MISSING__:No providers with configured API key",
+      "selectProviderModel": "__MISSING__:Select a model",
+      "staticEnabledLabel": "__MISSING__:Enable Static Potion",
+      "staticEnabledDesc": "__MISSING__:Download and use potion-base-8M model locally",
+      "transformersEnabledLabel": "__MISSING__:Enable Transformers.js",
+      "transformersEnabledDesc": "__MISSING__:Opt-in for local MiniLM (~400MB RAM, ~3s cold start)",
+      "transformersWarning": "__MISSING__:Requires ~400MB RAM and ~3s cold start on the first semantic query."
+    },
+    "emptyState": {
+      "title": "__MISSING__:No memories yet",
+      "description": "__MISSING__:Memories are created automatically from conversations. You can also add them manually using the button above."
+    },
+    "engine": {
+      "statusTitle": "__MISSING__:Engine Status",
+      "embeddingTitle": "__MISSING__:Embedding Source",
+      "rerankTitle": "__MISSING__:Rerank (optional)",
+      "reindexNow": "__MISSING__:Reindex now",
+      "reindexStarted": "__MISSING__:Reindexing started ({pending} pending)",
+      "reindexFailed": "__MISSING__:Failed to start reindexing",
+      "keywordLabel": "__MISSING__:Keyword (FTS5)",
+      "keywordReason": "__MISSING__:Keyword search always available",
+      "embeddingLabel": "__MISSING__:Embedding",
+      "vectorStoreLabel": "__MISSING__:Vector Store",
+      "qdrantLabel": "__MISSING__:Qdrant",
+      "rerankLabel": "__MISSING__:Rerank",
+      "qdrantDisabled": "__MISSING__:Disabled",
+      "qdrantOk": "__MISSING__:Healthy ({latencyMs}ms)",
+      "qdrantError": "__MISSING__:Connection error",
+      "needsReindex": "__MISSING__:{count} memory(ies) need reindexing",
+      "configureCta": "__MISSING__:Configure",
+      "vectorStoreInstallHint": "__MISSING__:To enable vector search: npm install sqlite-vec (needs native Node.js, not WASM), then restart."
+    },
+    "episodic": "Episodic",
+    "export": "Export",
+    "factual": "Factual",
+    "healthUnknown": "Salute sconosciuta",
+    "hitRate": "Hit Rate",
+    "import": "Import",
+    "importError": "__MISSING__:Failed to import file",
+    "importResult": "__MISSING__:{imported} imported, {skipped} skipped",
+    "key": "Key",
     "keyPlaceholder": "per esempio. tema.preferenze.utente",
-    "contentPlaceholder": "Valore o contenuto JSON da ricordare"
+    "loading": "Loading memories...",
+    "memories": "Memories",
+    "next": "Prossimo",
+    "noMemories": "No memories found",
+    "pageInfo": "Pagina {page} di {totalPages} ({total} totale)",
+    "pipelineError": "Errore della pipeline",
+    "pipelineOk": "Pipeline OK ({latencyMs}ms)",
+    "playground": {
+      "infoTitle": "__MISSING__:Memory Playground",
+      "infoDesc": "__MISSING__:Simulate what would be retrieved for a given query. No memories are modified — read-only preview.",
+      "queryLabel": "__MISSING__:Test query",
+      "queryPlaceholder": "__MISSING__:Type a question or test phrase...",
+      "strategyLabel": "__MISSING__:Strategy",
+      "strategyExact": "__MISSING__:Exact (FTS5)",
+      "strategySemantic": "__MISSING__:Semantic (vector)",
+      "strategyHybrid": "__MISSING__:Hybrid (RRF)",
+      "budgetLabel": "__MISSING__:Budget (tokens)",
+      "simulate": "__MISSING__:Simulate",
+      "resultsTitle": "__MISSING__:{count} result(s)",
+      "resolutionTitle": "__MISSING__:Search resolution",
+      "resolutionEmbedding": "__MISSING__:Embedding",
+      "resolutionStore": "__MISSING__:Vector store",
+      "resolutionStrategy": "__MISSING__:Strategy used",
+      "rerankApplied": "__MISSING__:Rerank applied",
+      "fallback": "__MISSING__:Fallback",
+      "noResults": "__MISSING__:No memories found for this query.",
+      "tokensUsed": "__MISSING__:tokens used",
+      "none": "__MISSING__:none",
+      "errorFetch": "__MISSING__:Failed to fetch preview"
+    },
+    "previous": "Precedente",
+    "procedural": "Procedural",
+    "qdrant": {
+      "title": "__MISSING__:Qdrant (Vector Store Tier 2)",
+      "description": "__MISSING__:Optional Qdrant integration for scalable semantic search",
+      "enableLabel": "__MISSING__:Enable Qdrant",
+      "enableDesc": "__MISSING__:When enabled, Qdrant is used as the primary vector store",
+      "testConnection": "__MISSING__:Test connection",
+      "testing": "__MISSING__:Testing...",
+      "statusActive": "__MISSING__:Active",
+      "statusError": "__MISSING__:Error",
+      "statusDisabled": "__MISSING__:Disabled",
+      "healthOk": "__MISSING__:Connection OK ({latencyMs}ms)",
+      "healthError": "__MISSING__:Connection error",
+      "saved": "__MISSING__:Settings saved",
+      "saveError": "__MISSING__:Failed to save",
+      "portLabel": "__MISSING__:Port",
+      "embeddingModelLabel": "__MISSING__:Embedding Model",
+      "optional": "__MISSING__:optional",
+      "apiKeyKeepPlaceholder": "__MISSING__:Leave blank to keep current key",
+      "apiKeyOptional": "__MISSING__:Leave blank if not using authentication",
+      "removeApiKey": "__MISSING__:Remove",
+      "quickSelectModel": "__MISSING__:Quick select",
+      "searchTestTitle": "__MISSING__:Semantic search test",
+      "searchPlaceholder": "__MISSING__:Type a test query...",
+      "searching": "__MISSING__:Searching...",
+      "search": "__MISSING__:Search",
+      "cleanupTitle": "__MISSING__:Clean up old points",
+      "cleanupDesc": "__MISSING__:Remove Qdrant points for expired memories (retention period).",
+      "cleaning": "__MISSING__:Cleaning...",
+      "cleanNow": "__MISSING__:Clean now",
+      "cleanupSuccess": "__MISSING__:{count} point(s) removed",
+      "cleanupFailed": "__MISSING__:Cleanup failed"
+    },
+    "rerank": {
+      "enableLabel": "__MISSING__:Enable Rerank",
+      "enableDesc": "__MISSING__:Reorders results with a reranking model after search",
+      "warning": "__MISSING__:Rerank adds +200-500ms latency and additional cost per request. Use sparingly.",
+      "providerModelLabel": "__MISSING__:Rerank Provider / Model",
+      "noProviderWithKey": "__MISSING__:No provider with configured API key. Configure a provider to use rerank.",
+      "selectProviderModel": "__MISSING__:Select a provider/model"
+    },
+    "save": "Salva",
+    "saving": "__MISSING__:Saving...",
+    "search": "Search memories...",
+    "semantic": "Semantic",
+    "summarize": {
+      "title": "__MISSING__:Compact old memories",
+      "noCandidates": "__MISSING__:No memories eligible for compaction (criteria: >30 days old).",
+      "candidatesDesc": "__MISSING__:{count} memories will be compacted into summaries. This action cannot be undone.",
+      "confirm": "__MISSING__:Compact now"
+    },
+    "tabs": {
+      "memories": "__MISSING__:Memories",
+      "playground": "__MISSING__:Playground",
+      "engine": "__MISSING__:Engine"
+    },
+    "title": "Memory Management",
+    "tokensUsed": "Tokens Used",
+    "tooltip": {
+      "totalEntries": "__MISSING__:Total memories stored for this API key",
+      "tokensUsed": "__MISSING__:Estimated total tokens occupied by active memories",
+      "hitRate": "__MISSING__:Read-by-ID cache hit rate (not semantic recall accuracy)",
+      "factual": "__MISSING__:Objective, permanent facts from user context",
+      "episodic": "__MISSING__:Events and experiences from conversation history",
+      "procedural": "__MISSING__:Procedures, workflows, and instructions the assistant should follow",
+      "semantic": "__MISSING__:Concepts, preferences, and domain knowledge"
+    },
+    "totalEntries": "Total Entries",
+    "type": "Type",
+    "memoryEnabled": "__MISSING__:Memory enabled"
   },
   "skills": {
     "title": "Skills",
@@ -3544,6 +3800,14 @@
     "export": "Export",
     "exporting": "Exporting...",
     "exportFailed": "Export failed",
+    "cleanHistoryButton": "__MISSING__:Clean history",
+    "cleanHistoryTitle": "__MISSING__:Clean log history?",
+    "cleanHistoryMessage": "__MISSING__:This permanently clears all request log rows, legacy detail rows, and local artifact files under DATA_DIR/call_logs. The live page will refresh after cleanup.",
+    "cleanHistoryConfirm": "__MISSING__:Clean history",
+    "cleanHistoryCancel": "__MISSING__:Cancel",
+    "cleanHistorySuccess": "__MISSING__:Cleaned {deleted} log entries, {deletedArtifacts} artifacts, and {deletedDetailedLogs} legacy detail rows.",
+    "cleanHistoryEmpty": "__MISSING__:No request log history was found.",
+    "cleanHistoryFailed": "__MISSING__:Failed to clean log history.",
     "timeRange": "Time Range",
     "lastNHours": "Last {hours}",
     "defaultRange": "default",
@@ -3551,10 +3815,14 @@
       "fetchFailed": "Failed to fetch logs",
       "copyFailed": "Failed to copy log entry",
       "copyLogEntry": "Copy log entry"
-    }
+    },
+    "compressionLogTitle": "__MISSING__:Compression Log",
+    "compressionLogEmpty": "__MISSING__:No compressed requests yet. Compression stats will appear here when requests are processed with compression enabled.",
+    "tokens": "__MISSING__:tokens"
   },
   "onboarding": {
     "welcome": "Benvenuto",
+    "tiers": "__MISSING__:Tiers",
     "security": "Sicurezza",
     "test": "Test",
     "ready": "Pronto!",
@@ -3616,6 +3884,7 @@
   },
   "providers": {
     "title": "Fornitori",
+    "Account Deactivated": "__MISSING__:Account Deactivated",
     "allProviders": "Tutti i fornitori",
     "audioProviders": "Fornitori di audio",
     "showFreeOnly": "Solo gratuito",
@@ -3623,6 +3892,33 @@
     "addFirstProvider": "Aggiungi il tuo primo fornitore",
     "addFirstProviderDesc": "Connetti un provider AI per avviare l'instradamento delle richieste tramite OmniRoute. Puoi utilizzare provider gratuiti, chiavi API o account OAuth.",
     "learnMore": "Saperne di più",
+    "adaptaTutorial": {
+      "title": "__MISSING__:How to connect Adapta Web",
+      "introPrefix": "__MISSING__:Adapta authenticates through Clerk. The token",
+      "introSuffix": "__MISSING__:is a long-lived JWT that lets OmniRoute refresh sessions automatically.",
+      "or": "__MISSING__:or",
+      "step1Title": "__MISSING__:Open Adapta chat",
+      "step1DescPrefix": "__MISSING__:Open",
+      "step1DescSuffix": "__MISSING__:and sign in with your Gold or Business account.",
+      "step2Title": "__MISSING__:Open DevTools",
+      "step2DescPrefix": "__MISSING__:Press",
+      "step2DescSuffix": "__MISSING__:to open Developer Tools.",
+      "step3Title": "__MISSING__:Go to Application → Cookies",
+      "step3DescPrefix": "__MISSING__:In the",
+      "step3DescMiddle": "__MISSING__:expand",
+      "step3DescSuffix": "__MISSING__:and click",
+      "step4Title": "__MISSING__:Copy the cookie value for",
+      "step4DescPrefix": "__MISSING__:Find the cookie named",
+      "step4DescMiddle": "__MISSING__:in the list. Click it and copy the content from the",
+      "step4DescSuffix": "__MISSING__:column. It starts with",
+      "step5Title": "__MISSING__:Paste it here and save",
+      "step5DescPrefix": "__MISSING__:Click",
+      "step5DescMiddle": "__MISSING__:paste the",
+      "step5DescSuffix": "__MISSING__:value into the API Key field, then save. OmniRoute will refresh the session automatically.",
+      "tipLabel": "__MISSING__:Tip:",
+      "tipPrefix": "__MISSING__:The",
+      "tipSuffix": "__MISSING__:cookie is long-lived, usually for months. You only need to renew it if you sign out or Adapta invalidates the session."
+    },
     "editProvider": "Modifica fornitore",
     "deleteProvider": "Elimina fornitore",
     "noProviders": "Nessun provider configurato",
@@ -3648,13 +3944,38 @@
     "apiKeyProviders": "Fornitori di chiavi API",
     "compatibleProviders": "Fornitori compatibili con chiave API",
     "testAll": "Prova tutto",
+    "distributeProxies": "__MISSING__:Distribute Proxies",
+    "distributing": "__MISSING__:Distributing...",
+    "selectedCount": "__MISSING__:{count, plural, one {# selected} other {# selected}}",
+    "accountsCount": "__MISSING__:{count, plural, one {# account} other {# accounts}}",
     "testAllOAuth": "Testa tutte le connessioni OAuth",
     "testAllFree": "Testa tutte le connessioni gratuite",
     "testAllApiKey": "Testa tutte le connessioni della chiave API",
     "testAllCompatible": "Testare tutte le connessioni compatibili",
+    "testAllModels": "__MISSING__:Test all models",
+    "testAllModelsConfirm": "__MISSING__:Test all visible models? Failed models will be hidden if auto-hide is enabled.",
+    "testingAllModels": "__MISSING__:Testing {done}/{total}...",
+    "testAllResults": "__MISSING__:{ok} of {total} models working",
+    "noModelsToTest": "__MISSING__:No models match the current filter",
+    "showAllModels": "__MISSING__:All",
+    "showVisibleOnly": "__MISSING__:Visible only",
+    "freeFilterAll": "__MISSING__:All",
+    "freeFilterFreeOnly": "__MISSING__:Free only",
+    "freeFilterPaidOnly": "__MISSING__:Paid only",
+    "sortFreeFirst": "__MISSING__:Free first",
+    "showHiddenOnly": "__MISSING__:Hidden only",
+    "filterByVisibility": "__MISSING__:Filter by visibility",
+    "autoHideFailed": "__MISSING__:Auto-hide failed models",
+    "autoHideFailedHint": "__MISSING__:When enabled, Test all hides non-transient failures from public catalogs such as /v1/models. Single-model tests never auto-hide.",
     "connected": "{count} Connesso",
     "errorCount": "{count} Errore ({code})",
     "errorCountNoCode": "{count} Errore",
+    "testAllCompleted": "__MISSING__:Tested {total} models: {ok} OK, {failed} failed",
+    "modelAutoHidden": "__MISSING__:Model {model} auto-hidden (test failed)",
+    "filterAll": "__MISSING__:All",
+    "filterVisible": "__MISSING__:Visible only",
+    "filterHidden": "__MISSING__:Hidden only",
+    "modelsHiddenCount": "__MISSING__:{count} hidden",
     "warningCount": "{count} Attenzione",
     "noConnections": "Nessuna connessione",
     "expiredBadge": "Expired",
@@ -3764,7 +4085,16 @@
     "batchUpdateNone": "__MISSING__:No connections were updated (they may no longer exist)",
     "batchRetestLimit": "__MISSING__:Retest up to {max} connections at a time",
     "noConnectionsToTest": "__MISSING__:No matching connections to test",
+    "batchDeleteConfirmTitle": "__MISSING__:Delete connections",
+    "batchDeleteConfirmButton": "__MISSING__:Delete",
+    "filterActive": "__MISSING__:Active",
+    "filterError": "__MISSING__:Error",
+    "filterBanned": "__MISSING__:Banned",
+    "filterCreditsExhausted": "__MISSING__:Credits Exhausted",
+    "noFilteredConnections": "__MISSING__:No connections match the current filter.",
     "failedSetAlias": "Impossibile impostare l'alias",
+    "setAliasSuccess": "__MISSING__:Alias {alias} set",
+    "deleteAliasSuccess": "__MISSING__:Alias {alias} deleted",
     "failedSaveConnection": "Impossibile salvare la connessione",
     "failedSaveConnectionRetry": "Impossibile salvare la connessione. Per favore riprova.",
     "failedRetestConnection": "Impossibile ripetere il test della connessione",
@@ -3798,6 +4128,9 @@
     "connectionCount": "{count} connessione/i",
     "fetchingModels": "Recupero dei modelli disponibili...",
     "failedFetchModels": "Impossibile recuperare i modelli",
+    "noFreeModelsFound": "__MISSING__:No free models found for this provider — nothing imported.",
+    "fetchModelsSuccess": "__MISSING__:Found {count} new models",
+    "fetchModelsFailed": "__MISSING__:Could not auto-fetch models (you can retry from settings)",
     "noModelsFound": "Nessun modello trovato",
     "importFailed": "Importazione non riuscita",
     "noNewModelsAdded": "Non sono stati aggiunti nuovi modelli.",
@@ -3806,6 +4139,10 @@
     "importingModelsTitle": "Importazione di modelli",
     "copyModel": "Copia modello",
     "filterModels": "Filtra modelli…",
+    "testAllRateLimited": "__MISSING__:Rate limit reached, stopped early",
+    "hideFailedAuto": "__MISSING__:Auto-hide failed models",
+    "selectAllModels": "Select all",
+    "hideAllModels": "__MISSING__:Hide all",
     "modelsActive": "attivi",
     "showModel": "Mostra modello",
     "hideModel": "Nascondi modello",
@@ -3814,6 +4151,9 @@
     "rateLimitUnprotected": "Non protetto",
     "enableRateLimitProtection": "Fare clic per abilitare la protezione del limite di velocità",
     "disableRateLimitProtection": "Fare clic per disattivare la protezione del limite di velocità",
+    "testAllProgress": "__MISSING__:Tested {done}/{total}",
+    "testAllFailedHidden": "__MISSING__:{count} failed models hidden",
+    "testAllDone": "__MISSING__:All models tested",
     "productionKey": "Chiave di produzione",
     "enterNewApiKey": "Inserisci la nuova chiave API",
     "codexApplyModalTitle": "Applicare al Codice locale",
@@ -3889,10 +4229,20 @@
     "errorTypeNetworkError": "Errore di rete",
     "errorTypeTestUnsupported": "Test non supportato",
     "errorTypeUpstreamError": "Errore a monte",
+    "errorTypeCreditsExhausted": "__MISSING__:No credits",
+    "errorTypeBanned": "__MISSING__:403 Banned",
     "proxySourceGlobal": "Globale",
     "proxySourceProvider": "Fornitore",
     "proxySourceKey": "Chiave",
     "proxyConfiguredBySource": "Proxy ({source}): {host}",
+    "proxyOn": "__MISSING__:Proxy On",
+    "proxyOff": "__MISSING__:Direct (bypass proxy)",
+    "proxyEnabledTitle": "__MISSING__:Proxy is enabled for this connection",
+    "proxyDisabledTitle": "__MISSING__:Direct connection — bypasses every proxy (including the global proxy) for this connection",
+    "perKeyProxyOn": "__MISSING__:Per-key",
+    "perKeyProxyOff": "__MISSING__:Connection",
+    "perKeyProxyEnabledTitle": "__MISSING__:Per-key proxy assignment enabled for this provider",
+    "perKeyProxyDisabledTitle": "__MISSING__:Per-key proxy assignment disabled for this provider",
     "autoPriority": "Automatico: {priority}",
     "proxy": "Procura",
     "retestAuthentication": "Ritestare l'autenticazione",
@@ -3920,6 +4270,12 @@
     "compatProtocolOpenAI": "OpenAI Chat Completions",
     "compatProtocolOpenAIResponses": "OpenAI Responses API",
     "compatProtocolClaude": "Anthropic Messages",
+    "targetFormatLabel": "__MISSING__:Target Format",
+    "targetFormatHint": "__MISSING__:Override the upstream wire format. Use 'Anthropic Messages' to route OpenAI-compatible providers (e.g. opencode-go) through the /v1/messages endpoint.",
+    "targetFormatAuto": "__MISSING__:Default (auto)",
+    "targetFormatGemini": "__MISSING__:Gemini",
+    "targetFormatGeminiCli": "__MISSING__:Gemini CLI",
+    "targetFormatAntigravity": "__MISSING__:Antigravity",
     "compatUpstreamHeadersLabel": "Extra upstream headers",
     "compatUpstreamHeadersHint": "High-privilege setting — same trust level as editing provider API credentials; only trusted admins should use it. Merged after OmniRoute adds auth from the provider API key. If a custom header uses the same name as an existing one (e.g. Authorization), your value fully replaces the auto-generated header (including the Bearer token) — the upstream only sees what you typed, not the key from settings. Misconfiguration can cause 401 or broken upstream auth. One row per header (e.g. extra Authentication for some gateways). Hover or focus the value to preview. Saves on blur, outside click, or closing this panel.",
     "compatUpstreamHeaderName": "Header name",
@@ -3929,6 +4285,8 @@
     "compatBadgeUpstreamHeaders": "Headers",
     "perModelQuotaLabel": "Per Model Quota Label",
     "perModelQuotaDescription": "Per Model Quota Description",
+    "importFreeModelsOnlyLabel": "__MISSING__:Import only free models",
+    "importFreeModelsOnlyHint": "__MISSING__:When enabled, only this provider's free models are imported. Paid models are skipped.",
     "perModelQuotaToggle": "Attiva/disattiva quota per modello",
     "modelId": "ID modello",
     "customModelPlaceholder": "per esempio. gpt-4.5-turbo",
@@ -3964,7 +4322,6 @@
     "email": "E-mail",
     "healthCheckMinutes": "Controllo dello stato (min)",
     "healthCheckHint": "Intervallo di aggiornamento del token proattivo. 0 = disabilitato.",
-    "selectAllModels": "Select all",
     "deselectAllModels": "Deselect all",
     "modelsActiveCount": "{active}/{total} active",
     "noModelsMatch": "No models match \"{filter}\"",
@@ -3976,6 +4333,9 @@
     "editCompatibleTitle": "Modifica {type} Compatibile",
     "compatibleBaseUrlHint": "Root URL of your {type}-compatible API. Use Advanced Settings for custom endpoint paths.",
     "apiKeyForCheck": "Chiave API (per controllo)",
+    "testModelIdLabel": "__MISSING__:Model ID (optional)",
+    "testModelIdPlaceholder": "__MISSING__:e.g. my-model-id",
+    "testModelIdHint": "__MISSING__:If the provider lacks a /models endpoint, enter a model ID to validate via /chat/completions instead.",
     "compatibleProdPlaceholder": "{type} Compatibile (prodotto)",
     "tokenRefreshed": "Token refreshed successfully",
     "tokenRefreshFailed": "Token refresh failed",
@@ -4069,6 +4429,19 @@
     "codexAuthApplyFailed": "Failed to apply Codex auth.json locally",
     "codexAuthExported": "Codex auth.json exported",
     "codexAuthExportFailed": "Failed to export Codex auth.json",
+    "codexCliGuideButton": "__MISSING__:Codex CLI Guide",
+    "codexCliGuideTitle": "__MISSING__:Codex CLI Guide",
+    "codexCliGuideLoading": "__MISSING__:Loading guide...",
+    "codexCliGuideLoadFailed": "__MISSING__:Could not load the guide.",
+    "codexExternalLinkButton": "__MISSING__:External Codex link",
+    "codexExternalLinkModalTitle": "__MISSING__:External Codex link",
+    "codexExternalLinkModalDescription": "__MISSING__:Share this single-use link with the person who will authenticate the Codex account. They open it in their own browser, complete the OpenAI login, and the connection is registered here. The link expires in 15 minutes.",
+    "codexExternalLinkGenerating": "__MISSING__:Generating link...",
+    "codexExternalLinkWaiting": "__MISSING__:Waiting for browser authentication. This window refreshes automatically.",
+    "codexExternalLinkCreateFailed": "__MISSING__:Failed to generate the link.",
+    "codexExternalLinkNetworkError": "__MISSING__:Could not contact the server.",
+    "codexExternalLinkConnected": "__MISSING__:Codex account connected through the external link.",
+    "codexExternalLinkExpired": "__MISSING__:The link expired before completion.",
     "importCodexAuth": "Importa autenticazione",
     "codexImportModalTitle": "Aut. codice importazione",
     "codexImportTabSingle": "Separare",
@@ -4146,6 +4519,8 @@
     "t3ChatWebCookiePlaceholder": "convex-session-id=abc123...",
     "blockClaudeExtraUsageDescription": "Block Claude Extra Usage Description",
     "blockClaudeExtraUsageLabel": "Block Claude Extra Usage Label",
+    "disableCoolingDescription": "__MISSING__:Skip the transient cooldown so this connection stays eligible even after recoverable errors (terminal states like banned/expired still apply).",
+    "disableCoolingLabel": "__MISSING__:Disable cooldown for this connection",
     "bulkPasteAdded": "{count, plural, one {1 key added} other {# keys added}}",
     "bulkPasteDuplicatesIgnored": "{count, plural, one {1 duplicate skipped} other {# duplicates skipped}}",
     "bulkPasteHint": "Paste one API key per line. Empty lines are ignored and duplicate keys are skipped.",
@@ -4243,6 +4618,17 @@
     "personalAccessTokenLabel": "Personal Access Token Label",
     "qoderPatHint": "Qoder Pat Hint",
     "qoderPatPlaceholder": "Qoder Pat Placeholder",
+    "rateLimitOverridesSection": "__MISSING__:Rate Limit Overrides",
+    "rateLimitOverridesMaxConcurrentHint": "__MISSING__:Max concurrent requests override for this connection. Overrides the account-level cap.",
+    "rateLimitOverridesMaxConcurrentLabel": "__MISSING__:Max Concurrent (Rate Limit)",
+    "rateLimitOverridesMinTimeHint": "__MISSING__:Minimum time (ms) between requests. Overrides the default rate limiter delay.",
+    "rateLimitOverridesMinTimeLabel": "__MISSING__:Min Interval (ms)",
+    "rateLimitOverridesRpmHint": "__MISSING__:Max requests per minute for this connection. Overrides the provider default.",
+    "rateLimitOverridesRpmLabel": "__MISSING__:RPM (Requests/min)",
+    "rateLimitOverridesTpdHint": "__MISSING__:Max tokens per day for this connection. Overrides the provider default.",
+    "rateLimitOverridesTpdLabel": "__MISSING__:TPD (Tokens/day)",
+    "rateLimitOverridesTpmHint": "__MISSING__:Max tokens per minute for this connection. Overrides the provider default.",
+    "rateLimitOverridesTpmLabel": "__MISSING__:TPM (Tokens/min)",
     "refreshOauthTokenTitle": "Refresh Oauth Token Title",
     "regionHint": "Region Hint",
     "regionLabel": "Region Label",
@@ -4257,6 +4643,7 @@
     "searchProvider": "Search Provider",
     "searchProviderDesc": "Search Provider Desc",
     "searchProviders": "Cerca fornitori...",
+    "searchByModel": "__MISSING__:Search by model…",
     "searchProvidersHeading": "Search Providers Heading",
     "searxngBaseUrlHint": "Searxng Base Url Hint",
     "searxngInfo": "Searxng Info",
@@ -4422,7 +4809,21 @@
     "webNoAuthGuideBody": "{provider} non necessita di una chiave API o di un cookie. Salva la connessione per utilizzare il suo endpoint web gratuito.",
     "webSessionCredentialValidationFailed": "Convalida delle credenziali della sessione non riuscita. Accedi di nuovo, copia una nuova credenziale e riprova.",
     "checkCookie": "Controlla il biscotto",
-    "checkWebToken": "Controlla il gettone"
+    "checkWebToken": "Controlla il gettone",
+    "huggingchatLabel": "__MISSING__:HuggingChat (Free)",
+    "huggingchatDesc": "__MISSING__:Free LLM chat via huggingface.co/chat",
+    "phindLabel": "__MISSING__:Phind (Free)",
+    "phindDesc": "__MISSING__:Free dev-focused AI chat",
+    "poeWebLabel": "__MISSING__:Poe Web",
+    "poeWebDesc": "__MISSING__:Multi-model chat via poe.com",
+    "veniceWebLabel": "__MISSING__:Venice Web",
+    "veniceWebDesc": "__MISSING__:Privacy-focused AI chat",
+    "v0VercelWebLabel": "__MISSING__:v0 Vercel Web",
+    "v0VercelWebDesc": "__MISSING__:AI code generation via v0.dev",
+    "kimiWebLabel": "__MISSING__:Kimi Web",
+    "kimiWebDesc": "__MISSING__:Chinese market AI chat via kimi.moonshot.cn",
+    "doubaoWebLabel": "__MISSING__:Doubao Web",
+    "doubaoWebDesc": "__MISSING__:ByteDance AI chat via doubao.com"
   },
   "settings": {
     "title": "Impostazioni",
@@ -4528,6 +4929,7 @@
     "memoryDesc": "Persistent cross-session conversational memory",
     "memoryEnabled": "Enable Memory",
     "memoryEnabledDesc": "When enabled, OmniRoute will inject relevant past context.",
+    "memoryTokenCostWarning": "__MISSING__:Heads up: with memory enabled, OmniRoute injects up to {tokens} tokens of retrieved context into every chat request — this increases token usage and cost. To skip injection for a specific request, send the \"x-omniroute-no-memory: true\" header.",
     "maxTokens": "Max Tokens",
     "retentionDays": "Retention",
     "recent": "Recent",
@@ -4566,6 +4968,15 @@
     "modelsDevInfoOrder": "User Override → models.dev → LiteLLM → Hardcoded Default",
     "systemTheme": "Tema del sistema",
     "debugToggle": "Enable Debug Mode",
+    "homePinProviderQuotaToHome": "Pin Information to Home Page",
+    "homeProviderQuotaLimits": "Provider Quota Limits",
+    "homeProviderQuotaLimitsDesc": "Pin the Provider Quota status container (with Refresh All button) to the top of the Home page.",
+    "homeQuickStart": "Quick Start",
+    "homeQuickStartDesc": "Show the Quick Start panel on the Home page.",
+    "homeProviderTopology": "Provider Topology",
+    "homeProviderTopologyDesc": "Show the Provider Topology on the Home page.",
+    "accountEmailVisibility": "__MISSING__:Account email visibility",
+    "accountEmailVisibilityDesc": "__MISSING__:Show full account emails across providers, combos, logs, quota, and playground screens. Turn this off to mask them by default.",
     "sidebarVisibilityToggle": "Show Sidebar Items",
     "enableCache": "Abilita cache",
     "cacheTTL": "TTL della cache",
@@ -4599,11 +5010,17 @@
     "autoDisableDescription": "Permanently mark provider connections as deactivated if they return specific terminal ban signals (e.g. HTTP 403 'verify your account'). This removes them from the combo rotation.",
     "autoDisableThreshold": "Ban Threshold",
     "autoDisableThresholdDesc": "Consecutive ban signals required before permanent deactivation.",
+    "customBannedSignals": "__MISSING__:Banned Keywords",
+    "customBannedSignalsDesc": "__MISSING__:Additional keywords that trigger permanent account ban detection. Built-in keywords always apply.",
+    "customBannedSignalsPlaceholder": "__MISSING__:e.g. api key revoked",
+    "noCustomBannedSignals": "__MISSING__:No custom keywords. Only built-in keywords are active.",
     "resilienceStructureTitle": "Resilience Structure",
     "resilienceStructureDesc": "Questa pagina configura solo il comportamento. Lo stato dell'interruttore live viene visualizzato nella pagina Salute. I tentativi specifici della combo e il controllo degli slot round-robin rimangono nelle impostazioni della combo.",
     "enableThinking": "Abilita il pensiero",
     "maxThinkingTokens": "Gettoni pensiero massimo",
     "enableProxy": "Abilita proxy",
+    "perKeyProxyEnabled": "__MISSING__:Enable per-key proxy assignment",
+    "perKeyProxyEnabledDesc": "__MISSING__:When enabled, each provider connection can use its own proxy assignment",
     "proxyUrl": "URL proxy",
     "pricingRates": "Formato delle tariffe dei prezzi",
     "currentPricing": "Panoramica dei prezzi attuali",
@@ -4683,6 +5100,13 @@
     "globalProxy": "Procura globale",
     "globalProxyDesc": "Configura un proxy in uscita globale per tutte le chiamate API. Singoli provider, combinazioni e chiavi possono sovrascrivere questo aspetto.",
     "noGlobalProxy": "Nessun proxy globale configurato",
+    "proxyPool": "__MISSING__:Proxy Pool",
+    "freePool": "__MISSING__:Free Pool",
+    "proxyDocumentation": "__MISSING__:Proxy Documentation",
+    "proxyGlobalConfigTab": "__MISSING__:Global Config",
+    "proxyPoolTab": "__MISSING__:Proxy Pool",
+    "freePoolTab": "__MISSING__:Free Pool",
+    "proxyDocumentationTab": "__MISSING__:Documentation",
     "bulkHealthcheck": "Bulk Healthcheck",
     "bulkHealthcheckDesc": "Test all configured proxies against a target URL to find which ones work.",
     "healthcheckTesting": "Testing...",
@@ -4695,6 +5119,51 @@
     "healthcheckStatus": "Status",
     "healthcheckProxyUrl": "Proxy URL",
     "healthcheckLatency": "Latency",
+    "proxyDocumentationScopeTitle": "__MISSING__:Proxy scope resolution",
+    "proxyDocumentationScopeDescBefore": "__MISSING__:OmniRoute resolves the outbound proxy in priority order: ",
+    "proxyDocumentationScopeOrder": "__MISSING__:combo → account → provider → global",
+    "proxyDocumentationScopeDescAfter": "__MISSING__:. The most specific scope wins.",
+    "proxyDocumentationAddTitle": "__MISSING__:Adding a custom proxy",
+    "proxyDocumentationAddDescBefore": "__MISSING__:Go to the ",
+    "proxyDocumentationAddDescMiddle": "__MISSING__: tab → click ",
+    "proxyDocumentationAddCta": "__MISSING__:+ Add proxy",
+    "proxyDocumentationAddDescAfter": "__MISSING__:. Fill in type (http/https/socks5), host, and port. Optionally assign it to a scope.",
+    "proxyDocumentationBulkTitle": "__MISSING__:Bulk import format",
+    "proxyDocumentationBulkDesc": "__MISSING__:Pipe-delimited fields:",
+    "proxyDocumentationSocks5DescBefore": "__MISSING__:SOCKS5 proxies are disabled by default. Set",
+    "proxyDocumentationFreePoolDesc": "__MISSING__:The Free Pool tab aggregates proxies from 1proxy, Proxifly, and IPLocate. Use ⊕ to test and promote a proxy to your registry. Only proxies that pass the connectivity test are added.",
+    "proxyDocumentationVercelRelayDescBefore": "__MISSING__:The Vercel Relay is an outbound edge relay — not an inbound tunnel. Deploying one sends LLM API calls through Vercel's dynamic IPs, bypassing datacenter geo-blocks and rate limits. The relay is protected by a generated secret header",
+    "proxyDocumentationVercelRelayDescAfter": "__MISSING__:Your Vercel token is used only during deploy and is never stored.",
+    "vercelRelayTokenRequired": "__MISSING__:Token is required",
+    "vercelRelayDeployFailed": "__MISSING__:Deploy failed",
+    "vercelRelayTokenHint": "__MISSING__:Token is used only during deploy — never stored.",
+    "denoRelayTokenRequired": "__MISSING__:Deno Deploy token is required",
+    "denoRelayOrgDomainRequired": "__MISSING__:Organization domain is required",
+    "denoRelayDeployFailed": "__MISSING__:Deno Deploy failed",
+    "denoRelayTokenHint": "__MISSING__:Organization token (prefix ddo_) from console.deno.com → Organization → Settings → Organization Tokens. Used once for deploy and never stored.",
+    "denoRelayOrgDomainHint": "__MISSING__:Your Deno Deploy organization's default domain (e.g. acme.deno.net). The relay will be reachable at https://<app-name>.<org-slug>.deno.net.",
+    "proxyFreePoolFilterProtocol": "__MISSING__:Filter by protocol",
+    "proxyFreePoolProtocol": "__MISSING__:Protocol",
+    "proxyFreePoolCountryPlaceholder": "__MISSING__:Country (e.g. US)",
+    "proxyFreePoolFilterCountry": "__MISSING__:Filter by country",
+    "proxyFreePoolMinQualityPlaceholder": "__MISSING__:Min quality",
+    "proxyFreePoolMinQualityLabel": "__MISSING__:Minimum quality score",
+    "proxyFreePoolSyncAll": "__MISSING__:Sync All",
+    "proxyFreePoolTotal": "__MISSING__:Total",
+    "proxyFreePoolInPool": "__MISSING__:In pool",
+    "proxyFreePoolAvgQuality": "__MISSING__:Avg quality",
+    "proxyFreePoolSelected": "__MISSING__:{count} selected",
+    "proxyFreePoolAddSelected": "__MISSING__:Add selected to pool",
+    "proxyFreePoolAddVisible": "__MISSING__:Add all visible to pool",
+    "proxyFreePoolSource": "__MISSING__:Source",
+    "proxyFreePoolHostPort": "__MISSING__:Host:Port",
+    "proxyFreePoolType": "__MISSING__:Type",
+    "proxyFreePoolCountry": "__MISSING__:Country",
+    "proxyFreePoolQuality": "__MISSING__:Quality",
+    "proxyFreePoolLatency": "__MISSING__:Latency",
+    "proxyFreePoolEmpty": "__MISSING__:No proxies found. Click Sync All to fetch from sources.",
+    "close": "__MISSING__:Close",
+    "cancel": "__MISSING__:Cancel",
     "globalLabel": "Globale",
     "configure": "Configura",
     "globalSystemPrompt": "Prompt del sistema globale",
@@ -4951,6 +5420,7 @@
     "systemStorage": "Sistema e archiviazione",
     "allDataLocal": "Tutti i dati archiviati localmente sul tuo computer",
     "databasePath": "Percorso del database",
+    "export": "__MISSING__:Export",
     "exportDatabase": "Esporta banca dati",
     "exportAll": "Esporta tutto (.tar.gz)",
     "importDatabase": "Importa banca dati",
@@ -5038,6 +5508,11 @@
     "adaptiveVolumeRoutingDesc": "Scale connections dynamically based on payload volume and throughput pressure.",
     "lkgpToggleTitle": "Last Known Good Provider (LKGP)",
     "lkgpToggleDesc": "When enabled, the router remembers which provider last served a successful response and tries it first on subsequent requests.",
+    "echoRequestedModelTitle": "__MISSING__:Echo requested model name in responses",
+    "echoRequestedModelDesc": "__MISSING__:When enabled, the response `model` field echoes the alias or combo name the client requested instead of the upstream model name. Fixes strict clients (e.g. Claude Desktop) that reject a response whose model does not match the request.",
+    "webSearchRouteTitle": "__MISSING__:Web search routing",
+    "webSearchRouteDesc": "__MISSING__:When a request includes a native web_search tool, route the whole request to this model instead of the default — useful for providers that don't implement Anthropic's web_search server tool. Leave blank to disable.",
+    "webSearchRoutePlaceholder": "__MISSING__:e.g. openrouter,anthropic/claude-3.5-sonnet",
     "clearLkgpCache": "Clear LKGP Cache",
     "lkgpCacheCleared": "LKGP cache cleared successfully",
     "lkgpCacheClearFailed": "Failed to clear LKGP cache",
@@ -5102,6 +5577,16 @@
     "clearSyncedPricing": "Clear Synced Pricing",
     "compressionTitle": "Prompt Compression",
     "compressionDesc": "Reduce token usage by compressing prompts before sending to providers",
+    "tokenSaverTitle": "__MISSING__:Token Saver",
+    "tokenSaverSubtitle": "__MISSING__:Spend fewer tokens on every request.",
+    "tokenSaverToolOutput": "__MISSING__:Tool output",
+    "tokenSaverToolOutputDesc": "__MISSING__:Clean git, grep, ls, tree, and log output before it reaches the provider.",
+    "tokenSaverLlmOutput": "__MISSING__:LLM output",
+    "tokenSaverLlmOutputDesc": "__MISSING__:Inject terse response instructions without rewriting provider output.",
+    "tokenSaverInputCompression": "__MISSING__:Input compression",
+    "tokenSaverInputCompressionDesc": "__MISSING__:Rewrite eligible chat history while preserving code, URLs, and intent.",
+    "tokenSaverFineTunePrefix": "__MISSING__:Fine-tune each engine on",
+    "tokenSaverFineTuneSuffix": "__MISSING__:or combine engines per request on",
     "compressionMode": "Compression Mode",
     "compressionModeOff": "Off",
     "compressionModeOffDesc": "No compression applied",
@@ -5121,6 +5606,11 @@
     "compressionUltraMinScore": "Soglia di punteggio minimo",
     "compressionUltraSlmFallback": "Ripiego ad Aggressivo",
     "compressionUltraModelPath": "Percorso del modello SLM",
+    "compressionUltraEngine": "__MISSING__:Ultra tier",
+    "compressionUltraEngineHeuristic": "__MISSING__:Heuristic (Tier-A, default)",
+    "compressionUltraEngineSlm": "__MISSING__:SLM (LLMLingua-2, opt-in)",
+    "compressionUltraSlmHint": "__MISSING__:SLM downloads a small ONNX model on first use (cold-start) and transparently falls back to the heuristic on timeout or if unavailable.",
+    "compressionUltraSlmPrewarm": "__MISSING__:Pre-warm SLM model on enable",
     "compressionSummarizerEnabled": "Abilita riepilogatore",
     "compressionMaxTokensPerMessage": "Token massimi per messaggio",
     "compressionMinSavings": "Soglia di risparmio minima",
@@ -5308,13 +5798,22 @@
     "resilienceNo": "NO",
     "resilienceDefault": "Default",
     "storageDatabaseBackupRetention": "Conservazione del backup del database",
+    "storageDatabaseBackups": "__MISSING__:Database backups",
     "storagePurgeData": "Elimina dati",
+    "storagePurgeDataDesc": "__MISSING__:Immediately delete all records without applying retention checks. Use with caution.",
+    "storageRetentionCleanup": "__MISSING__:Retention Settings",
+    "storageRetentionCleanupDesc": "__MISSING__:Configure operational record retention and database backup cleanup.",
+    "retentionCallDays": "__MISSING__:Call {count}d",
+    "retentionAppDays": "__MISSING__:App {count}d",
+    "retentionRows": "__MISSING__:{count} rows",
     "retentionQuotaSnapshots": "Istantanee quota (giorni)",
+    "retentionCompressionAnalytics": "__MISSING__:Compression Analytics (days)",
     "retentionMcpAudit": "Audit MCP (giorni)",
     "retentionA2aEvents": "Eventi A2A (giorni)",
     "retentionCallLogs": "Registri delle chiamate (giorni)",
     "retentionUsageHistory": "Cronologia utilizzo (giorni)",
     "retentionMemoryEntries": "Voci di memoria (giorni)",
+    "saveRetentionSettings": "__MISSING__:Save retention settings",
     "storageAutoVacuumMode": "Modalità di aspirazione automatica",
     "storageScheduledVacuum": "Vuoto programmato",
     "storageVacuumHour": "Ora del vuoto (0-23)",
@@ -5328,10 +5827,16 @@
     "storageIntegrityOk": "✓Va bene",
     "storageIntegrityError": "✗ Errore",
     "storageUsageTokenBuffer": "Buffer dei token di utilizzo",
+    "storageUsageTokenBufferDesc": "__MISSING__:Extra tokens added to reported usage to account for system prompt overhead.",
+    "storageUsageTokenBufferHint": "__MISSING__:Set to 0 to report raw provider token counts. Default: 2000.",
+    "storageUsageTokenBufferCurrent": "__MISSING__:Current: {value}",
     "compressionSettingsAutoTriggerMode": "Modalità di attivazione automatica",
     "compressionSettingsMcpDescriptionCompression": "Compressione della descrizione MCP",
+    "mcpAccessibilityTitle": "__MISSING__:MCP accessibility output",
     "compressionSettingsCavemanIntensity": "Intensità da cavernicolo",
     "compressionSettingsCavemanOutputMode": "Modalità di uscita cavernicolo",
+    "compressionSettingsOutputStyles": "__MISSING__:Output styles",
+    "compressionStylesTileTitle": "__MISSING__:Output styles",
     "compressionSettingsOutputIntensity": "Intensità di uscita",
     "compressionSettingsAutoClarityBypass": "Bypass automatico della chiarezza",
     "resilienceWaitForCooldown": "Attendi il raffreddamento",
@@ -5347,6 +5852,9 @@
     "cliproxyapiUrl": "URL dell'API CLIProxy",
     "cliproxyapiStatus": "Stato CLIProxyAPI",
     "cliproxyapiNotDetected": "Non rilevato",
+    "cliproxyapiImportAuthTitle": "__MISSING__:Import accounts from CLIProxyAPI",
+    "cliproxyapiImportAuthDesc": "__MISSING__:Import the OAuth accounts CLIProxyAPI already saved in ~/.cli-proxy-api/ as OmniRoute connections, so you don't have to log in to each account again. Supported account types (Gemini, Codex, Claude, Antigravity, Qwen, Kimi) are imported; others are skipped.",
+    "cliproxyapiImportAuthButton": "__MISSING__:Import accounts",
     "payloadRulesTitle": "Regole sul carico utile",
     "payloadRulesDesc": "__MISSING__:Configure request payload mutations by model and protocol. Changes are persisted in settings and hot reloaded into the runtime immediately after save.",
     "payloadRuleDefaultTitle": "__MISSING__:default",
@@ -5379,6 +5887,14 @@
     "maxResponseTokensDesc": "__MISSING__:Maximum total tokens allowed in a single response.",
     "modelCooldownsTitle": "Modelli in fase di raffreddamento",
     "modelCooldownsEmpty": "Nessun modello in cooldown in questo momento.",
+    "responsesStateTitle": "__MISSING__:Responses State",
+    "responsesStateDesc": "__MISSING__:Control how OmniRoute forwards previous_response_id.",
+    "responsesStateModeLabel": "__MISSING__:previous_response_id handling",
+    "responsesStateModeAuto": "__MISSING__:Auto",
+    "responsesStateModeStrip": "__MISSING__:Strip",
+    "responsesStateModePreserve": "__MISSING__:Preserve",
+    "responsesStateHint": "__MISSING__:Auto strips previous_response_id unless a connection explicitly enables OpenAI Responses storage. Strip is safest for stateless clients such as VS Code Custom Endpoint; context then depends on the client sending full history.",
+    "responsesStateSaveError": "__MISSING__:Failed to update Responses state setting",
     "codexFastTierTitle": "Livello veloce del Codice",
     "codexFastTierDesc": "Inserisce globalmente service_tier=priority per le richieste OpenAI Codex.",
     "codexFastTierHint": "Se abilitato, OmniRoute aggiunge service_tier=priority alle richieste Codex in uscita per le connessioni che non specificano già un livello. Il livello di priorità richiede una chiave API OpenAI Enterprise o il percorso del Codex ChatGPT-auth; altri tipi di chiave riceveranno un errore relativo al livello da OpenAI. Le impostazioni per connessione nella pagina del provider Codex hanno la precedenza.",
@@ -5485,6 +6001,15 @@
     "resilienceEnableServerWaitDesc": "Quando abilitato, OmniRoute attende la scadenza del primo tempo di recupero e riprova automaticamente.",
     "resilienceMaxAttempts": "Tentativi massimi",
     "resilienceMaxWaitPerAttempt": "Attesa massima per tentativo",
+    "resilienceProviderCooldownTitle": "__MISSING__:Provider Cooldown",
+    "resilienceProviderCooldownScope": "__MISSING__:All combo requests",
+    "resilienceProviderCooldownTrigger": "__MISSING__:When a provider/connection fails",
+    "resilienceProviderCooldownEffect": "__MISSING__:Skips the failed provider for a cooldown period before retrying",
+    "resilienceProviderCooldownDesc": "__MISSING__:Prevents subsequent requests from re-walking the same failing providers. Cooldown scales exponentially with consecutive failures.",
+    "resilienceProviderCooldownEnabled": "__MISSING__:Enable global provider cooldown",
+    "resilienceProviderCooldownEnabledDesc": "__MISSING__:When enabled, failed providers are tracked globally and skipped for a cooldown period.",
+    "resilienceProviderCooldownMin": "__MISSING__:Minimum cooldown",
+    "resilienceProviderCooldownMax": "__MISSING__:Maximum cooldown",
     "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
     "forcedFingerprintBadge": "Required",
     "codexSessionAffinityTitle": "Affinità di sessione del Codice",
@@ -5506,13 +6031,45 @@
     "vercelRelayFreeTierNote": "__MISSING__:Relays are lightweight proxy endpoints deployed on Vercel's free tier to bypass local network/region limitations.",
     "vercelRelayDeploying": "__MISSING__:Deploying...",
     "vercelRelayDeploy": "__MISSING__:Deploy",
-    "homePinProviderQuotaToHome": "Pin Information to Home Page",
-    "homeProviderQuotaLimits": "Provider Quota Limits",
-    "homeProviderQuotaLimitsDesc": "Pin the Provider Quota status container (with Refresh All button) to the top of the Home page.",
-    "homeQuickStart": "Quick Start",
-    "homeQuickStartDesc": "Show the Quick Start panel on the Home page.",
-    "homeProviderTopology": "Provider Topology",
-    "homeProviderTopologyDesc": "Show the Provider Topology on the Home page."
+    "deployRelayButton": "__MISSING__:Deploy Relay",
+    "denoRelayButton": "__MISSING__:Deploy Deno Relay",
+    "denoRelayModalTitle": "__MISSING__:Deploy Deno Relay",
+    "denoRelayWarning": "__MISSING__:Warning: A Deno Deploy organization token is required. This token will only be used to create the relay app and will never be stored by OmniRoute.",
+    "denoRelayTokenLabel": "__MISSING__:Deno Deploy Organization Token",
+    "denoRelayOrgDomainLabel": "__MISSING__:Organization Domain",
+    "denoRelayProjectNameLabel": "__MISSING__:Deno App Name",
+    "denoRelayFreeTierNote": "__MISSING__:Deno Deploy v2 runs on a global edge network. Free tier: 1M requests & 100GiB outbound traffic per month, no per-request CPU limits, up to 20 active apps & 50 custom domains.",
+    "denoRelayDeploying": "__MISSING__:Deploying...",
+    "denoRelayDeploy": "__MISSING__:Deploy",
+    "cloudflareRelaySuccess": "__MISSING__:Cloudflare Relay deployed successfully",
+    "cloudflareRelayButton": "__MISSING__:Deploy Cloudflare Relay",
+    "cloudflareRelayModalTitle": "__MISSING__:Deploy Cloudflare Worker Relay",
+    "cloudflareRelayWarning": "__MISSING__:Deploys a Cloudflare Worker that proxies LLM requests through Cloudflare's edge network — masking the host IP behind dynamic Cloudflare addresses. The Worker enforces a one-time auth secret so the public workers.dev URL cannot be reused as an open relay.",
+    "cloudflareRelayTokenHowto": "__MISSING__:Create the API token under My Profile -> API Tokens -> Create Token -> Custom Token -> Account / Workers Scripts / Edit.",
+    "cloudflareRelayAccountIdLabel": "__MISSING__:Cloudflare Account ID",
+    "cloudflareRelayAccountIdHint": "__MISSING__:Found on the right side of the Cloudflare dashboard overview page.",
+    "cloudflareRelayApiTokenLabel": "__MISSING__:Cloudflare API Token",
+    "cloudflareRelayApiTokenHint": "__MISSING__:Requires 'Workers Scripts: Edit' permission. The token is used only at deploy time and is never stored.",
+    "cloudflareRelayProjectNameLabel": "__MISSING__:Worker Name",
+    "cloudflareRelayFreeTierNote": "__MISSING__:Free tier: 100,000 requests/day per Cloudflare account.",
+    "cloudflareRelayDeploying": "__MISSING__:Deploying...",
+    "cloudflareRelayDeploy": "__MISSING__:Deploy",
+    "cloudflareRelayCredsRequired": "__MISSING__:Account ID and API Token are required",
+    "cloudflareRelayDeployFailed": "__MISSING__:Deploy failed",
+    "modelLockout": "__MISSING__:Model Lockout",
+    "modelLockoutPageDescription": "__MISSING__:Configure which HTTP error codes trigger per-model lockout and control the cooldown behavior.",
+    "modelLockoutEnabled": "__MISSING__:Enable Model Lockout",
+    "modelLockoutEnabledDescription": "__MISSING__:When enabled, models that fail with configured error codes are temporarily locked to prevent retry loops.",
+    "modelLockoutErrorCodes": "__MISSING__:Error Codes",
+    "modelLockoutErrorCodesDescription": "__MISSING__:HTTP status codes that trigger model lockout. Type a code and click Add, or select from suggestions.",
+    "modelLockoutBaseCooldown": "__MISSING__:Base Cooldown (ms)",
+    "modelLockoutBaseCooldownDescription": "__MISSING__:Initial cooldown duration in milliseconds before a model can be retried.",
+    "modelLockoutMaxCooldown": "__MISSING__:Max Cooldown (ms)",
+    "modelLockoutMaxCooldownDescription": "__MISSING__:Maximum cooldown duration in milliseconds. Prevents excessively long lockouts.",
+    "modelLockoutExponentialBackoff": "__MISSING__:Exponential Backoff",
+    "modelLockoutExponentialBackoffDescription": "__MISSING__:When enabled, each consecutive failure increases the cooldown duration exponentially.",
+    "modelLockoutMaxBackoffSteps": "__MISSING__:Max Backoff Steps",
+    "modelLockoutMaxBackoffStepsDescription": "__MISSING__:Maximum number of backoff steps before the cooldown stops growing. The Max Cooldown cap is reached first in most configurations, making this a safety ceiling for when Max Cooldown is raised."
   },
   "contextRtk": {
     "title": "RTK Engine",
@@ -5563,7 +6120,21 @@
     "searchFilters": "Filtri di ricerca...",
     "tooltipDedup": "Con quanta aggressività rimuovere le righe ripetute.",
     "tooltipMaxChars": "Numero massimo di caratteri per blocco di output.",
-    "tooltipMaxLines": "Numero massimo di righe da mantenere dall'output del comando. L'eccesso viene troncato."
+    "tooltipMaxLines": "Numero massimo di righe da mantenere dall'output del comando. L'eccesso viene troncato.",
+    "learnDiscoverTitle": "__MISSING__:Learn & Discover filters",
+    "learnDiscoverDesc": "__MISSING__:Mine your captured command output (Raw Output retention must be on) to suggest new RTK filters. Suggestions only — you review and save them.",
+    "discoverHeading": "__MISSING__:Discover repeated noise",
+    "discoverButton": "__MISSING__:Scan samples",
+    "discoverScanning": "__MISSING__:Scanning…",
+    "discoverEmpty": "__MISSING__:No repeated noise found. Enable Raw Output retention and run a few commands first.",
+    "discoverSamples": "__MISSING__:{count} sample(s) scanned",
+    "discoverHits": "__MISSING__:{hits}× across samples",
+    "learnHeading": "__MISSING__:Learn a filter for a command",
+    "learnCommandPlaceholder": "__MISSING__:e.g. npm install",
+    "learnButton": "__MISSING__:Suggest filter",
+    "learnEmpty": "__MISSING__:No suggestion yet. Type a command you have run and scan.",
+    "learnSamplesUsed": "__MISSING__:Learned from {count} matching sample(s)",
+    "suggestionError": "__MISSING__:Could not load suggestions. Check management auth and try again."
   },
   "contextCombos": {
     "title": "Compression Combos",
@@ -5853,7 +6424,80 @@
     "routeConnectionLabel": "Connessione",
     "scenarioVision": "Visione (comprensione dell'immagine)",
     "scenarioSchemaCoercion": "Coercizione dello schema (output strutturato)",
-    "techniques": "Tecniche:"
+    "techniques": "Tecniche:",
+    "friendlyTitle": "__MISSING__:Translator",
+    "friendlySubtitle": "__MISSING__:Use your existing app with any provider — without rewriting code.",
+    "conceptHeadline": "__MISSING__:Your app speaks one API's \"language\". The Translator converts it to use another provider.",
+    "conceptDiagramAppLabel": "__MISSING__:Your app",
+    "conceptDiagramSourceLabel": "__MISSING__:Source format",
+    "conceptDiagramHubLabel": "__MISSING__:OpenAI (hub)",
+    "conceptDiagramTargetLabel": "__MISSING__:Target provider",
+    "conceptDiagramExampleApp": "__MISSING__:e.g. Anthropic SDK",
+    "conceptDiagramExampleSource": "__MISSING__:claude",
+    "conceptDiagramExampleTarget": "__MISSING__:Gemini",
+    "conceptHowItWorksToggle": "__MISSING__:How it works",
+    "conceptHowItWorksBody": "__MISSING__:Your app sends a request in its own format. The Translator detects the format, converts it through OpenAI as an intermediate hub (or directly when a direct translator is available), sends it to the chosen provider, and returns the response converted back to your app's format.",
+    "tabTranslate": "__MISSING__:Translate",
+    "tabMonitor": "__MISSING__:Monitor",
+    "tabTranslateAriaLabel": "__MISSING__:Go to the Translate tab",
+    "tabMonitorAriaLabel": "__MISSING__:Go to the Monitor tab",
+    "simpleAppUsesLabel": "__MISSING__:My app uses",
+    "simpleAppUsesHint": "__MISSING__:The API format your app speaks (e.g. Anthropic SDK = claude).",
+    "simpleSendToLabel": "__MISSING__:Send to",
+    "simpleSendToHint": "__MISSING__:Where to actually send the request (a provider connected in OmniRoute).",
+    "simpleStartWithLabel": "__MISSING__:Start with",
+    "simpleStartWithExamplePlaceholder": "__MISSING__:Select a ready-made example",
+    "simpleStartWithCustomOption": "__MISSING__:Paste your request (advanced)",
+    "simpleModeLabel": "__MISSING__:Mode",
+    "simpleModePreview": "__MISSING__:Preview translation only",
+    "simpleModeSend": "__MISSING__:Send and see response",
+    "simpleAdvancedToggle": "__MISSING__:Advanced",
+    "simpleInputPanelTitle": "__MISSING__:Input",
+    "simpleInputPanelHint": "__MISSING__:Free-text message or ready-made example",
+    "simpleResultPanelTitle": "__MISSING__:Translation + Response",
+    "narratedDetected": "__MISSING__:✓ Detected: {format}",
+    "narratedTranslating": "__MISSING__:Translating to {target}...",
+    "narratedSending": "__MISSING__:Sending to {target}...",
+    "narratedSuccess": "__MISSING__:→ translated to {target} · response in {latency}ms",
+    "narratedError": "__MISSING__:Failed: {reason}",
+    "narratedSeeTranslatedJson": "__MISSING__:see translated JSON",
+    "narratedSeePipeline": "__MISSING__:see pipeline",
+    "advancedSectionTitle": "__MISSING__:Advanced",
+    "advancedSectionSubtitle": "__MISSING__:Raw JSON, pipeline and technical tools. Everything here is the same as the old tabs — just reorganized.",
+    "advancedRawJsonTitle": "__MISSING__:Raw JSON (auto-detect + Monaco)",
+    "advancedRawJsonSubtitle": "__MISSING__:Paste a JSON request; the format is detected automatically.",
+    "advancedPipelineTitle": "__MISSING__:OpenAI intermediate pipeline",
+    "advancedPipelineSubtitle": "__MISSING__:Visualize each translation step (hub-and-spoke).",
+    "advancedStreamTransformTitle": "__MISSING__:Stream Transformer (Chat → Responses SSE)",
+    "advancedStreamTransformSubtitle": "__MISSING__:Converts Chat Completions SSE into Responses API.",
+    "advancedTestBenchTitle": "__MISSING__:Test Bench (8 scenarios)",
+    "advancedTestBenchSubtitle": "__MISSING__:Runs all scenarios and reports pass/fail + compatibility %.",
+    "advancedCompressionTitle": "__MISSING__:Compression Preview",
+    "advancedCompressionSubtitle": "__MISSING__:Estimate token savings across different compression modes.",
+    "monitorOriginHint": "__MISSING__:Events generated by Translate or the main pipeline appear here in real time.",
+    "monitorEmptyCta": "__MISSING__:Go to the Translate tab and send a request — it will appear here.",
+    "monitorOpenTranslateButton": "__MISSING__:Go to Translate",
+    "pipelineStepClientRequest": "__MISSING__:Client Request",
+    "pipelineStepClientRequestDesc": "__MISSING__:Request received in client format",
+    "pipelineStepFormatDetected": "__MISSING__:Format Detected",
+    "pipelineStepFormatDetectedDesc": "__MISSING__:Auto-detected source format",
+    "pipelineStepOpenAIIntermediate": "__MISSING__:OpenAI Intermediate",
+    "pipelineStepOpenAIIntermediateDesc": "__MISSING__:Translated to OpenAI hub format",
+    "pipelineStepProviderFormat": "__MISSING__:Provider Format",
+    "pipelineStepProviderFormatDesc": "__MISSING__:Translated to provider target format",
+    "pipelineStepProviderResponse": "__MISSING__:Provider Response",
+    "pipelineStepProviderResponseDesc": "__MISSING__:Streaming response from provider",
+    "conceptDiagramArrow1": "__MISSING__:speaks",
+    "conceptDiagramArrow2": "__MISSING__:translates",
+    "conceptDiagramArrow3": "__MISSING__:converts",
+    "conceptDiagramExampleHub": "__MISSING__:OpenAI",
+    "conceptDiagramHubTooltip": "__MISSING__:Intermediate hub used by the translator to convert between formats that don't have a direct mapping.",
+    "conceptDiagramSourceTooltip": "__MISSING__:The API format your app speaks (e.g., Anthropic SDK = claude).",
+    "conceptDiagramTargetTooltip": "__MISSING__:The provider where the request will actually be sent.",
+    "compressionEmptyHint": "__MISSING__:Fill in the input field on the Translate tab (Simple Controls or Raw JSON) to enable the preview.",
+    "compressionModeLabel": "__MISSING__:Compression mode",
+    "compressionPreviewButton": "__MISSING__:Preview Compression",
+    "compressionPreviewing": "__MISSING__:Previewing…"
   },
   "usage": {
     "title": "Utilizzo",
@@ -6010,6 +6654,8 @@
     "notApplicable": "N / A",
     "rawPlanWithValue": "Piano grezzo: {plan}",
     "noPlanFromProvider": "Nessun piano dal fornitore",
+    "tokenExpiresIn": "__MISSING__:Token expires in {time}",
+    "tokenExpired": "__MISSING__:Token expired",
     "noQuotaData": "Nessun dato sulle quote",
     "cardExpand": "__MISSING__:Expand",
     "cardCollapse": "__MISSING__:Collapse",
@@ -6159,6 +6805,11 @@
     "quotaCutoffsButtonDefault": "Predefinito",
     "quotaCutoffsButtonHelp": "Modifica i limiti minimi di quota rimanente per questo account.",
     "quotaCutoffsButtonDisabled": "Per questo account non sono ancora disponibili finestre di quota.",
+    "deactivateAccount": "__MISSING__:Deactivate account (stop routing)",
+    "activateAccount": "__MISSING__:Activate account (resume routing)",
+    "accountActivated": "__MISSING__:Account activated",
+    "accountDeactivated": "__MISSING__:Account deactivated",
+    "toggleActiveFailed": "__MISSING__:Failed to update account status",
     "quotaCutoffsTitle": "Limiti delle quote per {name} ({provider})",
     "quotaCutoffsExplainer": "Sostituisci la percentuale di quota minima rimanente nel momento in cui questo account smette di essere selezionato per ogni finestra di quota. Lascia vuoto per ereditare l'impostazione predefinita del provider.",
     "quotaCutoffsDefaultHint": "Min rimanente predefinito: {default}%",
@@ -6179,6 +6830,7 @@
     "budgetColDailyLim": "Limite giornaliero",
     "budgetColMonthlyLim": "Limite mensile",
     "budgetColUsedPct": "Usato %",
+    "percentUsed": "__MISSING__:{pct}% used",
     "budgetLoading": "Caricamento…",
     "budgetNoKeysMatch": "Nessuna chiave corrisponde ai filtri",
     "budgetLinearExtrapolation": "estrapolazione lineare",
@@ -7124,6 +7776,11 @@
     "modalEditTitle": "Modal Edit Title",
     "labelName": "Label Name",
     "labelType": "Tipo",
+    "labelFamily": "__MISSING__:IP family",
+    "familyAuto": "__MISSING__:Auto (dual-stack)",
+    "familyIpv4": "__MISSING__:IPv4 only",
+    "familyIpv6": "__MISSING__:IPv6 only",
+    "familyHint": "__MISSING__:Egress address family. Auto keeps dual-stack; IPv4/IPv6 pin this proxy to that family (prevents a v4 leak under an IPv6-only proxy).",
     "labelHost": "Ospite",
     "labelPort": "Porta",
     "labelUsername": "Nome utente",
@@ -7266,7 +7923,16 @@
     "improveConfirm": "Improve",
     "exportCode": "Export code",
     "exportCodeTitle": "Export Code",
+    "exportShort": "__MISSING__:Export",
     "noStateToExport": "No playground state available to export.",
+    "closeExportModal": "__MISSING__:Close export modal",
+    "close": "__MISSING__:Close",
+    "exportRealKeyWarning": "__MISSING__:Security warning: export blocked — a real API key was detected in the output. Please reset your API key and try again.",
+    "placeholderHintPrefix": "__MISSING__:Replace",
+    "placeholderHintSuffix": "__MISSING__:with your actual API key, or set it as an environment variable.",
+    "copyLangCode": "__MISSING__:Copy {language} code",
+    "loadingPresets": "__MISSING__:Loading…",
+    "loadPresetPlaceholder": "__MISSING__:Load preset…",
     "copyCode": "Copy",
     "copiedCode": "Copied!",
     "addModel": "+ Add model",
@@ -7291,7 +7957,27 @@
     "invalidJson": "Invalid JSON",
     "running": "Running…",
     "runLabel": "Run",
-    "enterToolResult": "Enter tool result…"
+    "enterToolResult": "Enter tool result…",
+    "build": {
+      "step1Label": "__MISSING__:What to test?",
+      "step2Label": "__MISSING__:Configure",
+      "step3Label": "__MISSING__:Run",
+      "step1Title": "__MISSING__:What do you want to test?",
+      "step1Subtitle": "__MISSING__:Choose the capability you want to explore in this session.",
+      "step2Title": "__MISSING__:Configure",
+      "step2Subtitle": "__MISSING__:Set up the tools or JSON schema that will be used in the request.",
+      "step3Title": "__MISSING__:Run",
+      "modeToolsTitle": "__MISSING__:Tools",
+      "modeToolsDesc": "__MISSING__:Test function calling — define tools and see how the model invokes them.",
+      "modeJsonTitle": "__MISSING__:JSON",
+      "modeJsonDesc": "__MISSING__:Test structured output — constrain the response to a JSON schema.",
+      "modeBothTitle": "__MISSING__:Tools + JSON",
+      "modeBothDesc": "__MISSING__:Combine function calling and structured output in a single request.",
+      "backButton": "__MISSING__:Back",
+      "nextButton": "__MISSING__:Next",
+      "runButton": "__MISSING__:Run",
+      "promptPlaceholder": "__MISSING__:Enter your message… (Enter to send, Shift+Enter for newline)"
+    }
   },
   "miniPlayground": {
     "endpoint": "__MISSING__:Endpoint",
@@ -7395,7 +8081,9 @@
     "loadingLogs": "Loading logs...",
     "noLogs": "No logs yet. Make some API calls to see them here.",
     "noMatchingLogs": "No logs matching current filters.",
-    "callLogsInfo": "Call logs are also saved as JSON files to {dataDir} and rotated based on {retentionDays} and {maxEntries}."
+    "callLogsInfo": "Call logs are also saved as JSON files to {dataDir} and rotated based on {retentionDays} and {maxEntries}.",
+    "loadMore": "__MISSING__:Load More",
+    "loadingMore": "__MISSING__:Loading more..."
   },
   "proxyLogger": {
     "filterAll": "All",
@@ -7432,7 +8120,8 @@
     "loadingProxyLogs": "Loading proxy logs...",
     "noProxyLogs": "No proxy logs yet. Configure proxies and make API calls to see them here.",
     "noMatchingLogs": "No logs match the current filters.",
-    "tlsFingerprint": "Chrome 124 TLS Fingerprint"
+    "tlsFingerprint": "Chrome 124 TLS Fingerprint",
+    "colPublicIp": "__MISSING__:Public IP"
   },
   "endpointOptions": {
     "speech": "Speech",
@@ -7572,7 +8261,86 @@
     "betaConfigSavedSuffix": "(non ancora persistente sul server). L'applicazione del limite per richiesta non è ancora collegata alla pipeline del proxy. Questa schermata consente di progettare e visualizzare la ripartizione delle quote; l'attuazione reale avverrà in una futura iterazione con la persistenza del DB e l'intercettazione delle chiamate a monte.",
     "policyLabel": "Politica:",
     "resetIn": "reimpostato",
-    "quotaTotal": "totale"
+    "quotaTotal": "totale",
+    "kpiAvgUtilization": "__MISSING__:Avg utilization",
+    "kpiBorrowingNow": "__MISSING__:Borrowing now",
+    "conceptTitle": "__MISSING__:How Quota Share works",
+    "conceptIntro": "__MISSING__:Quota Share divides a provider's quota among multiple API keys using work-conserving fair-share: each key receives a proportional slice but can borrow from the free balance without exceeding the global cap.",
+    "conceptFairShare": "__MISSING__:Fair-share: each key receives quota proportional to its configured weight",
+    "conceptBorrowing": "__MISSING__:Borrowing: keys can consume free balance from others without breaching the cap",
+    "conceptGlobalCap": "__MISSING__:Hard global cap: the provider's absolute limit is never exceeded",
+    "conceptWindows": "__MISSING__:Windows: 5h, hourly, daily, weekly, monthly — each tracked independently",
+    "conceptKeyHowTitle": "__MISSING__:Enabling a key for quota",
+    "conceptKeyHowDesc": "__MISSING__:Create the key normally in API Keys — it appears in the wizard's key step automatically. Tick Exclusive there to make it quota-only. No separate enable step.",
+    "conceptExclusiveTitle": "__MISSING__:What \"Exclusive\" does",
+    "conceptExclusiveDesc": "__MISSING__:An exclusive key only sees/uses the pool's quotaShared-* models — every other model is hidden from its /v1/models and blocked.",
+    "burnRateTitle": "__MISSING__:Burn rate",
+    "burnRateExhaustsIn": "__MISSING__:Exhausts in",
+    "dimensionResetIn": "__MISSING__:Resets in",
+    "realConsumedColumn": "__MISSING__:Consumed",
+    "deficitColumn": "__MISSING__:Deficit",
+    "borrowingIndicator": "__MISSING__:borrowing",
+    "migratedFromLocalStorageNotice": "__MISSING__:Pools successfully migrated from localStorage.",
+    "policyCapAbsoluteLabel": "__MISSING__:Absolute cap",
+    "policyCapAbsolutePlaceholder": "__MISSING__:Numeric limit (optional)",
+    "multiDimensionLabel": "__MISSING__:Multi-dimension",
+    "stackedBarTitle": "__MISSING__:Slices by API key",
+    "usedSuffix": "__MISSING__:used {percent}%",
+    "wizardTitle": "__MISSING__:New quota pool",
+    "editPoolTitle": "__MISSING__:Edit pool",
+    "saveChanges": "__MISSING__:Save changes",
+    "wizardStep1Label": "__MISSING__:Account",
+    "wizardStep2Label": "__MISSING__:Limit",
+    "wizardStep3Label": "__MISSING__:Keys",
+    "wizardStep1Title": "__MISSING__:Choose provider connection",
+    "wizardStep1Subtitle": "__MISSING__:Select the provider account this pool will share quota for, set a name and default policy.",
+    "wizardStep2Title": "__MISSING__:Configure quota dimensions",
+    "wizardStep2Subtitle": "__MISSING__:Define the quota plan dimensions (unit, window, limit) for the chosen connection. Leave unchanged to keep current settings.",
+    "wizardStep3Title": "__MISSING__:Allocate API keys",
+    "wizardStep3Subtitle": "__MISSING__:Assign API keys to this pool with weight % allocations and optional caps.",
+    "wizardPoolNameLabel": "__MISSING__:Pool name",
+    "wizardPoolNamePlaceholder": "__MISSING__:My quota pool",
+    "wizardNext": "__MISSING__:Next",
+    "wizardBack": "__MISSING__:Back",
+    "wizardCreatePool": "__MISSING__:Create pool",
+    "wizardDimensionsEditedNotice": "__MISSING__:Dimensions edited — will be saved as a manual override when the pool is created.",
+    "wizardExclusiveLabel": "__MISSING__:Exclusive quota",
+    "wizardExclusiveHint": "__MISSING__:When enabled, these API keys will only be allowed to use this pool's virtual models (allowedQuotas reconciliation is applied on save).",
+    "wizardPreviewLabel": "__MISSING__:Virtual model names preview",
+    "wizardConnectionsLabel": "__MISSING__:Provider connections",
+    "wizardPrimaryBadge": "__MISSING__:primary",
+    "wizardAdditionalConnectionsNote": "__MISSING__:Additional connections use their catalog default limits (editable later).",
+    "wizardSingleProviderNote": "__MISSING__:A pool uses a single provider",
+    "wizardPreviewMoreModels": "__MISSING__:+{count} more",
+    "accountQuotaTitle": "__MISSING__:Account quota",
+    "accountQuotaNone": "__MISSING__:—",
+    "logTitle": "__MISSING__:Usage log",
+    "logEmpty": "__MISSING__:No usage yet",
+    "groupLabel": "__MISSING__:Group",
+    "newGroup": "__MISSING__:New group",
+    "renameGroup": "__MISSING__:Rename group",
+    "groupSelectHint": "__MISSING__:Filter pools by group",
+    "groupAllocationNote": "__MISSING__:Allocations apply to all pools in this group via the shared quota layer.",
+    "groupNamePrompt": "__MISSING__:Enter group name",
+    "wizardGroupLabel": "__MISSING__:Group",
+    "allGroups": "__MISSING__:All groups",
+    "endpointsTitle": "__MISSING__:Available endpoints",
+    "endpointsHint": "__MISSING__:Call these virtual models with any allocated key — routing + quota are handled per group.",
+    "previewForKey": "__MISSING__:Preview for key",
+    "previewKeyNone": "__MISSING__:(all endpoints)",
+    "endpointsBaseUrl": "__MISSING__:Base URL",
+    "endpointsCollapse": "__MISSING__:Collapse",
+    "endpointsExpand": "__MISSING__:Expand",
+    "endpointsAnthropicNote": "__MISSING__:Anthropic-native",
+    "endpointsResponsesNote": "__MISSING__:OpenAI Responses — codex/github",
+    "endpointsWsNote": "__MISSING__:WebSocket — codex only",
+    "betaText": "__MISSING__:Quota Share is functional but bugs are expected. Found one? Please report it.",
+    "betaReportLink": "__MISSING__:Report an issue",
+    "deleteGroup": "__MISSING__:Delete group",
+    "deleteGroupConfirm": "__MISSING__:Delete this group? Its pools must be reassigned or removed first.",
+    "deleteGroupHasPools": "__MISSING__:This group still has pools — reassign or delete them first.",
+    "ungroupedTitle": "__MISSING__:Ungrouped",
+    "ungroupedHint": "__MISSING__:These pools are not assigned to a known group. Edit a pool to move it into a real group."
   },
   "plugins": {
     "title": "Plugins",
@@ -7608,6 +8376,571 @@
     "status": "Status",
     "enabled": "Enabled",
     "disabled": "Disabled",
+    "installedTab": "__MISSING__:Installed",
+    "marketplaceTab": "__MISSING__:Marketplace",
+    "marketplaceUrlLabel": "__MISSING__:Custom Marketplace URL",
+    "marketplaceUrlPlaceholder": "__MISSING__:Leave empty for official Omniroute registry",
+    "saveMarketplaceUrl": "__MISSING__:Save & Reload",
+    "marketplaceUrlSaved": "__MISSING__:Marketplace URL updated",
+    "marketplaceEmpty": "__MISSING__:No plugins found in marketplace.",
+    "verified": "__MISSING__:Verified",
+    "install": "__MISSING__:Install",
+    "installedFromMarketplace": "__MISSING__:Plugin {name} installed!",
     "hooks": "Hooks"
+  },
+  "quotaPlans": {
+    "title": "__MISSING__:Plans & Quotas",
+    "description": "__MISSING__:Configure quota plans per provider — dimensions (%, requests, tokens, $) and time windows",
+    "providerLabel": "__MISSING__:Provider / Connection",
+    "detectedPlanLabel": "__MISSING__:Detected plan",
+    "manualPlanLabel": "__MISSING__:Manual override",
+    "unconfiguredLabel": "__MISSING__:Not configured — manual required",
+    "dimensionLabel": "__MISSING__:Dimensions",
+    "addDimension": "__MISSING__:Add dimension",
+    "removeDimension": "__MISSING__:Remove",
+    "limitLabel": "__MISSING__:Limit",
+    "unitOptions": {
+      "percent": "__MISSING__:%",
+      "requests": "__MISSING__:requests",
+      "tokens": "__MISSING__:tokens",
+      "usd": "__MISSING__:USD ($)"
+    },
+    "windowOptions": {
+      "5h": "__MISSING__:5 hours",
+      "hourly": "__MISSING__:Hourly",
+      "daily": "__MISSING__:Daily",
+      "weekly": "__MISSING__:Weekly",
+      "monthly": "__MISSING__:Monthly"
+    },
+    "useCatalogButton": "__MISSING__:Use catalog",
+    "saveOverrideButton": "__MISSING__:Save override",
+    "revertToCatalogButton": "__MISSING__:Revert to catalog",
+    "unknownProviderNotice": "__MISSING__:Select a provider on the left to configure its quota plan.",
+    "catalogTitle": "__MISSING__:Known catalog",
+    "catalogDescription": "__MISSING__:Automatically detected plans for the following providers:"
+  },
+  "activity": {
+    "title": "__MISSING__:Activity",
+    "description": "__MISSING__:Recent events feed",
+    "emptyTitle": "__MISSING__:No activity yet",
+    "emptyDescription": "__MISSING__:When you add providers, create combos, or rotate keys, events will appear here.",
+    "todayHeader": "__MISSING__:Today",
+    "yesterdayHeader": "__MISSING__:Yesterday",
+    "filterAll": "__MISSING__:All",
+    "filterProviders": "__MISSING__:Providers",
+    "filterCombos": "__MISSING__:Combos",
+    "filterApiKeys": "__MISSING__:API Keys",
+    "filterSettings": "__MISSING__:Settings",
+    "filterQuota": "__MISSING__:Quota",
+    "filterAuth": "__MISSING__:Auth",
+    "filterSystem": "__MISSING__:System",
+    "relative": {
+      "justNow": "__MISSING__:just now",
+      "minutesAgo": "__MISSING__:{n} min ago",
+      "hoursAgo": "__MISSING__:{n} h ago",
+      "yesterday": "__MISSING__:yesterday",
+      "daysAgo": "__MISSING__:{n} days ago"
+    },
+    "eventVerb": {
+      "providerAdded": "__MISSING__:{actor} added provider {target}",
+      "providerRemoved": "__MISSING__:{actor} removed provider {target}",
+      "providerTested": "__MISSING__:{actor} tested provider {target}",
+      "comboCreated": "__MISSING__:{actor} created combo {target}",
+      "comboUpdated": "__MISSING__:{actor} updated combo {target}",
+      "comboDeleted": "__MISSING__:{actor} removed combo {target}",
+      "apiKeyCreated": "__MISSING__:{actor} created API key {target}",
+      "apiKeyRevoked": "__MISSING__:{actor} revoked API key {target}",
+      "apiKeyRotated": "__MISSING__:{actor} rotated API key {target}",
+      "budgetThreshold": "__MISSING__:Budget threshold reached for {target}",
+      "settingUpdated": "__MISSING__:{actor} updated setting {target}",
+      "authLogin": "__MISSING__:{actor} signed in",
+      "authLogout": "__MISSING__:{actor} signed out",
+      "cloudAgentSession": "__MISSING__:Cloud agent session started for {target}",
+      "mcpToolRegistered": "__MISSING__:MCP tool {target} registered",
+      "webhookCreated": "__MISSING__:{actor} created webhook {target}",
+      "webhookDeleted": "__MISSING__:{actor} removed webhook {target}",
+      "quotaPoolCreated": "__MISSING__:{actor} created quota pool {target}",
+      "quotaPoolUpdated": "__MISSING__:{actor} updated quota pool {target}",
+      "quotaPoolDeleted": "__MISSING__:{actor} removed quota pool {target}",
+      "quotaPlanUpdated": "__MISSING__:{actor} updated quota plan {target}",
+      "quotaStoreDriverChanged": "__MISSING__:QuotaStore driver changed",
+      "updateApplied": "__MISSING__:Update {target} applied",
+      "deployCompleted": "__MISSING__:Deploy completed",
+      "skillInstalled": "__MISSING__:{actor} installed skill {target}",
+      "skillRemoved": "__MISSING__:{actor} removed skill {target}",
+      "providerCredentialsCreated": "__MISSING__:{actor} created credentials for {target}",
+      "providerCredentialsApplied": "__MISSING__:Credentials for {target} applied",
+      "providerCredentialsUpdated": "__MISSING__:{actor} updated credentials for {target}",
+      "providerCredentialsRevoked": "__MISSING__:{actor} revoked credentials for {target}",
+      "providerCredentialsBatchRevoked": "__MISSING__:{actor} batch-revoked credentials",
+      "providerCredentialsBatchUpdated": "__MISSING__:{actor} batch-updated credentials",
+      "providerCredentialsBulkCreated": "__MISSING__:{actor} bulk-created credentials",
+      "providerCredentialsBulkImported": "__MISSING__:{actor} bulk-imported credentials",
+      "providerCredentialsImported": "__MISSING__:{actor} imported credentials",
+      "providerSsrfBlocked": "__MISSING__:SSRF attempt blocked for {target}",
+      "authLoginSuccess": "__MISSING__:{actor} signed in",
+      "authLoginError": "__MISSING__:Login error for {actor}",
+      "authLoginFailed": "__MISSING__:Login failed for {actor}",
+      "authLoginLocked": "__MISSING__:{actor} locked out after too many attempts",
+      "authLoginMisconfigured": "__MISSING__:Auth configuration invalid",
+      "authLoginSetupRequired": "__MISSING__:Auth setup required",
+      "authLogoutSuccess": "__MISSING__:{actor} signed out",
+      "syncTokenCreated": "__MISSING__:{actor} created sync token",
+      "syncTokenRevoked": "__MISSING__:{actor} revoked sync token",
+      "settingsUpdate": "__MISSING__:{actor} updated settings",
+      "settingsUpdateFailed": "__MISSING__:Settings update failed",
+      "serviceRevealApiKey": "__MISSING__:{actor} revealed API key for {target}",
+      "genericEvent": "__MISSING__:{actor} {target}"
+    }
+  },
+  "agentBridge": {
+    "title": "__MISSING__:AgentBridge",
+    "subtitle": "__MISSING__:Use IDE agents with OmniRoute models — no config required",
+    "riskBannerTitle": "__MISSING__:Use at your own risk",
+    "riskBannerBody": "__MISSING__:AgentBridge intercepts HTTPS traffic from IDE agents. By activating it you accept responsibility for compliance with the terms of service of each agent. Never use on devices or networks where TLS inspection is prohibited.",
+    "riskBannerDismiss": "__MISSING__:Dismiss",
+    "serverCardTitle": "__MISSING__:AgentBridge Server",
+    "statusRunning": "__MISSING__:Running",
+    "statusStopped": "__MISSING__:Stopped",
+    "statusActive": "__MISSING__:Active",
+    "statusDnsOff": "__MISSING__:DNS off",
+    "statusSetupRequired": "__MISSING__:Setup required",
+    "statusInvestigating": "__MISSING__:Investigating",
+    "serverPort": "__MISSING__:Port",
+    "serverConns": "__MISSING__:Connections",
+    "serverIntercepted": "__MISSING__:Intercepted",
+    "serverLastStarted": "__MISSING__:Last started",
+    "startServer": "__MISSING__:Start",
+    "stopServer": "__MISSING__:Stop",
+    "restartServer": "__MISSING__:Restart",
+    "trustCert": "__MISSING__:Trust Cert",
+    "downloadCert": "__MISSING__:Download Cert",
+    "regenerateCert": "__MISSING__:Regenerate Cert",
+    "starting": "__MISSING__:Starting…",
+    "stopping": "__MISSING__:Stopping…",
+    "restarting": "__MISSING__:Restarting…",
+    "trusting": "__MISSING__:Trusting…",
+    "regenerating": "__MISSING__:Regenerating…",
+    "upstreamCaLabel": "__MISSING__:Upstream CA Certificate (corporate)",
+    "upstreamCaPlaceholder": "__MISSING__:/etc/ssl/certs/corp-ca.pem",
+    "upstreamCaTest": "__MISSING__:Test TLS",
+    "upstreamCaTestOk": "__MISSING__:TLS test passed",
+    "upstreamCaTestError": "__MISSING__:TLS test failed — check the path and CA file",
+    "bypassSectionTitle": "__MISSING__:Bypass List",
+    "bypassSectionDesc": "__MISSING__:Hosts matching these patterns are tunneled directly (no TLS decryption). Defaults include banks, .gov, and corporate SSO.",
+    "bypassDefaultsLabel": "__MISSING__:Default bypass patterns (read-only)",
+    "bypassUserLabel": "__MISSING__:Custom bypass patterns (one per line, glob or regex)",
+    "saveBypassList": "__MISSING__:Save bypass list",
+    "agentListTitle": "__MISSING__:IDE Agents",
+    "filterAll": "__MISSING__:All",
+    "filterActive": "__MISSING__:Active",
+    "filterSetupRequired": "__MISSING__:Setup required",
+    "filterInvestigating": "__MISSING__:Investigating",
+    "searchAgents": "__MISSING__:Search agents…",
+    "noAgentsMatch": "__MISSING__:No agents match the current filter",
+    "agentHosts": "__MISSING__:Intercepted hosts",
+    "certTrusted": "__MISSING__:Certificate trusted",
+    "certNotTrusted": "__MISSING__:Certificate not trusted",
+    "investigatingNotice": "__MISSING__:This agent is under investigation. Hosts and API surface are still being confirmed. Setup will be available once the upstream API is documented.",
+    "modelMappingsLabel": "__MISSING__:Model mappings",
+    "sourceModel": "__MISSING__:Source model (agent native)",
+    "targetModel": "__MISSING__:Target model (OmniRoute)",
+    "noMappings": "__MISSING__:No model mappings configured. Run setup wizard to auto-detect models.",
+    "selectModel": "__MISSING__:Select…",
+    "saveMappings": "__MISSING__:Save mappings",
+    "setupWizard": "__MISSING__:Setup wizard",
+    "startDns": "__MISSING__:Start DNS",
+    "stopDns": "__MISSING__:Stop DNS",
+    "toggling": "__MISSING__:Toggling…",
+    "viewTraffic": "__MISSING__:View traffic",
+    "emptyNoProvidersTitle": "__MISSING__:No providers configured yet",
+    "emptyNoProvidersBody": "__MISSING__:To use AgentBridge, first connect at least one provider. It will be the destination where IDE requests are routed.",
+    "emptyGoToProviders": "__MISSING__:Go to Providers",
+    "wizardTitle": "__MISSING__:Setup wizard",
+    "wizardSubtitle": "__MISSING__:3-step setup",
+    "wizardStep1Label": "__MISSING__:Verify",
+    "wizardStep2Label": "__MISSING__:DNS",
+    "wizardStep3Label": "__MISSING__:Mappings",
+    "wizardStep1Desc": "__MISSING__:Confirm the server is running and the certificate is installed.",
+    "wizardStep2Desc": "__MISSING__:The following entries will be added to /etc/hosts to redirect traffic through AgentBridge:",
+    "wizardStep3Desc": "__MISSING__:You can now configure model mappings in the agent card. Restart the IDE to apply changes.",
+    "wizardStep3Success": "__MISSING__:Agent is configured!",
+    "wizardServerCheck": "__MISSING__:AgentBridge server",
+    "wizardRunning": "__MISSING__:running",
+    "wizardNotRunning": "__MISSING__:not running",
+    "wizardCertCheck": "__MISSING__:Certificate",
+    "wizardTrusted": "__MISSING__:trusted",
+    "wizardNotTrusted": "__MISSING__:not yet trusted — use Trust Cert button",
+    "wizardTutorialTitle": "__MISSING__:Setup instructions:",
+    "wizardEnableDns": "__MISSING__:Add /etc/hosts entries",
+    "wizardDnsAlreadyEnabled": "__MISSING__:DNS already enabled for this agent",
+    "enablingDns": "__MISSING__:Enabling…",
+    "modelSelectorTitle": "__MISSING__:Select target model",
+    "modelSelectorSearch": "__MISSING__:Search models…",
+    "noModelsFound": "__MISSING__:No models found",
+    "quickLinks": "__MISSING__:Quick links",
+    "quickLinkProviders": "__MISSING__:Configure providers",
+    "quickLinkInspector": "__MISSING__:View traffic in Traffic Inspector",
+    "maintenanceTitle": "__MISSING__:Maintenance & Diagnostics",
+    "maintenanceSubtitle": "__MISSING__:Self-test the capture pipeline, undo leftover system state, and move your setup between machines.",
+    "orphanedStateWarning": "__MISSING__:A previous session left system state behind (DNS spoof, CA, or system proxy). Run Repair to clean it up.",
+    "diagnose": "__MISSING__:Diagnose",
+    "diagnosing": "__MISSING__:Diagnosing…",
+    "diagnoseHealthy": "__MISSING__:Capture pipeline is healthy.",
+    "diagnoseUnhealthy": "__MISSING__:Capture pipeline has problems:",
+    "repair": "__MISSING__:Repair",
+    "repairing": "__MISSING__:Repairing…",
+    "repairDone": "__MISSING__:Repaired: {items}",
+    "repairNothing": "__MISSING__:Nothing to repair — system state is clean.",
+    "removeCa": "__MISSING__:Remove CA",
+    "removeCaConfirm": "__MISSING__:Remove CA?",
+    "removeCaDone": "__MISSING__:MITM root CA removed from the OS trust store.",
+    "removing": "__MISSING__:Removing…",
+    "confirm": "__MISSING__:Confirm",
+    "exportConfig": "__MISSING__:Export config",
+    "exporting": "__MISSING__:Exporting…",
+    "importConfig": "__MISSING__:Import config",
+    "importing": "__MISSING__:Importing…",
+    "importInvalidJson": "__MISSING__:The selected file is not valid JSON.",
+    "importDone": "__MISSING__:Imported {bypass} bypass · {hosts} hosts · {agents} agents",
+    "save": "__MISSING__:Save",
+    "saving": "__MISSING__:Saving…",
+    "cancel": "__MISSING__:Cancel",
+    "back": "__MISSING__:Back",
+    "next": "__MISSING__:Next",
+    "done": "__MISSING__:Done",
+    "loading": "__MISSING__:Loading…",
+    "riskNoticeTitle": "__MISSING__:Risk acknowledgment",
+    "riskNoticeBody": "__MISSING__:AgentBridge will intercept HTTPS traffic from this agent by redirecting its API hosts via DNS. Only enable if you accept responsibility for compliance with the agent's terms of service and any applicable network policies.",
+    "pageMoved": {
+      "goNow": "__MISSING__:Go now",
+      "message": "__MISSING__:The MITM Proxy now lives under AgentBridge.",
+      "title": "__MISSING__:This page has moved"
+    }
+  },
+  "trafficInspector": {
+    "title": "__MISSING__:Traffic Inspector",
+    "subtitle": "__MISSING__:Monitor LLM calls and debug any application's HTTPS traffic",
+    "captureModesTitle": "__MISSING__:Capture Modes",
+    "agentBridgeMode": "__MISSING__:AgentBridge",
+    "agentBridgeModeDesc": "__MISSING__:Capture traffic from all connected IDE agents",
+    "customHostsMode": "__MISSING__:Custom Hosts",
+    "customHostsModeDesc": "__MISSING__:Add specific hosts to intercept",
+    "httpProxyMode": "__MISSING__:HTTP Proxy",
+    "httpProxyModeDesc": "__MISSING__:Use HTTP_PROXY environment variable",
+    "systemWideMode": "__MISSING__:System-wide",
+    "systemWideModeDesc": "__MISSING__:Intercept all system traffic (advanced)",
+    "tproxyMode": "__MISSING__:TPROXY Decrypt",
+    "tproxyModeUnavailable": "__MISSING__:TPROXY decrypt requires Linux + root + the native addon",
+    "filterBarTitle": "__MISSING__:Filters",
+    "profileLlmOnly": "__MISSING__:LLM only",
+    "profileCustom": "__MISSING__:Custom",
+    "profileAll": "__MISSING__:All",
+    "filterHost": "__MISSING__:Filter host…",
+    "filterAgent": "__MISSING__:Agent",
+    "filterStatus": "__MISSING__:Status",
+    "pauseBtn": "__MISSING__:Pause",
+    "resumeBtn": "__MISSING__:Resume",
+    "clearBtn": "__MISSING__:Clear",
+    "exportHar": "__MISSING__:Export .har",
+    "recordSession": "__MISSING__:REC",
+    "stopSession": "__MISSING__:Stop",
+    "liveBadge": "__MISSING__:live",
+    "offlineBadge": "__MISSING__:offline",
+    "noRequests": "__MISSING__:No requests captured yet.",
+    "noRequestsDesc": "__MISSING__:Make sure AgentBridge is running or enable another capture mode.",
+    "selectRequest": "__MISSING__:Select a request to inspect it.",
+    "tabConversation": "__MISSING__:Conversation",
+    "tabHeaders": "__MISSING__:Headers",
+    "tabRequest": "__MISSING__:Request",
+    "tabResponse": "__MISSING__:Response",
+    "tabTiming": "__MISSING__:Timing",
+    "tabLlm": "__MISSING__:LLM",
+    "tabStats": "__MISSING__:Stats",
+    "requestHeaders": "__MISSING__:Request Headers",
+    "responseHeaders": "__MISSING__:Response Headers",
+    "rawEvents": "__MISSING__:Raw events",
+    "mergedView": "__MISSING__:Merged view",
+    "noBody": "__MISSING__:No body.",
+    "streaming": "__MISSING__:streaming…",
+    "manageHosts": "__MISSING__:Manage hosts",
+    "copySnippet": "__MISSING__:Copy proxy snippet",
+    "addHost": "__MISSING__:Add",
+    "hostPlaceholder": "__MISSING__:api.openai.com",
+    "noHostsYet": "__MISSING__:No custom hosts added yet.",
+    "noSessionsYet": "__MISSING__:No sessions yet",
+    "allTraffic": "__MISSING__:All traffic (no session)",
+    "sessionsDropdown": "__MISSING__:Sessions",
+    "annotationPlaceholder": "__MISSING__:Add a note…",
+    "contextFingerprint": "__MISSING__:Context fingerprint",
+    "llmProvider": "__MISSING__:Detected provider",
+    "llmApiKind": "__MISSING__:API kind",
+    "llmModel": "__MISSING__:Model",
+    "llmMessages": "__MISSING__:Messages",
+    "llmStream": "__MISSING__:Stream",
+    "llmMappedTo": "__MISSING__:Mapped to",
+    "llmCostEstimate": "__MISSING__:Cost estimate",
+    "systemProxyExitWarning": "__MISSING__:System-wide proxy still active — leave page anyway?",
+    "customHostsTitle": "__MISSING__:Custom Hosts",
+    "loading": "__MISSING__:Loading…",
+    "copied": "__MISSING__:Copied!",
+    "copy": "__MISSING__:Copy",
+    "httpProxyTitle": "__MISSING__:HTTP Proxy Snippet — port {port}",
+    "notRecording": "__MISSING__:Not recording",
+    "anyStatus": "__MISSING__:Any status",
+    "liveOnly": "__MISSING__:Live",
+    "viewingRecordedSession": "__MISSING__:Viewing recorded session",
+    "backToLive": "__MISSING__:Back to live",
+    "untitledSession": "__MISSING__:Untitled session",
+    "contextHistory": "__MISSING__:Context History",
+    "modelResponse": "__MISSING__:Model Response",
+    "conversationNoMessages": "__MISSING__:No messages found in this request.",
+    "conversationNotAvailable": "__MISSING__:Conversation data not available. This may not be an LLM request or the body could not be parsed.",
+    "loadingCharts": "__MISSING__:Loading charts…",
+    "statsErrors": "__MISSING__:Errors",
+    "statsLatency": "__MISSING__:Latency (last 50 requests)",
+    "statsNoData": "__MISSING__:No requests yet. Start a session recording to capture data for stats.",
+    "statsStatusDistribution": "__MISSING__:Status distribution",
+    "statsSuccessful": "__MISSING__:Successful",
+    "statsTotalRequests": "__MISSING__:Total requests",
+    "timingProxyOverhead": "__MISSING__:Proxy overhead",
+    "timingUpstreamResponse": "__MISSING__:Upstream response",
+    "timingNoData": "__MISSING__:No timing data available.",
+    "timingTotalLatency": "__MISSING__:Total latency",
+    "timingTimestamp": "__MISSING__:Timestamp",
+    "timingMethod": "__MISSING__:Method",
+    "timingStatus": "__MISSING__:Status",
+    "timingRequestSize": "__MISSING__:Request size",
+    "timingResponseSize": "__MISSING__:Response size",
+    "pausedNewBadge": "__MISSING__:{count} new",
+    "clearContextFilter": "__MISSING__:clear"
+  },
+  "cliCommon": {
+    "concept": {
+      "code": {
+        "title": "__MISSING__:CLI Code",
+        "phrase": "__MISSING__:Code tools you point at OmniRoute",
+        "flow": "__MISSING__:You → CLI Code → OmniRoute → Provider",
+        "seeOther": "__MISSING__:See →"
+      },
+      "agent": {
+        "title": "__MISSING__:CLI Agents",
+        "phrase": "__MISSING__:Broad-purpose autonomous CLI agents you point at OmniRoute",
+        "flow": "__MISSING__:You → CLI Agent → OmniRoute → Provider",
+        "seeOther": "__MISSING__:See →"
+      },
+      "acp": {
+        "title": "__MISSING__:ACP Agents",
+        "phrase": "__MISSING__:CLIs that OmniRoute spawns as execution backend (reverse flow)",
+        "flow": "__MISSING__:Client → OmniRoute → spawn CLI (stdio/ACP) → response",
+        "seeOther": "__MISSING__:See →"
+      }
+    },
+    "comparison": {
+      "title": "__MISSING__:Understand the 3 CLI types in OmniRoute",
+      "thisPage": "__MISSING__:This page",
+      "open": "__MISSING__:Open →",
+      "code": {
+        "title": "__MISSING__:Code tool",
+        "desc": "__MISSING__:Points to Omni",
+        "flow": "__MISSING__:you → CLI → Omni → provider",
+        "examples": "__MISSING__:e.g.: claude, codex"
+      },
+      "agent": {
+        "title": "__MISSING__:Broad autonomous agent",
+        "desc": "__MISSING__:Points to Omni",
+        "flow": "__MISSING__:you → agent → Omni",
+        "examples": "__MISSING__:e.g.: hermes, goose"
+      },
+      "acp": {
+        "title": "__MISSING__:CLI used as backend by Omni",
+        "desc": "__MISSING__:Reverse execution",
+        "flow": "__MISSING__:Omni → spawn CLI → resp",
+        "examples": "__MISSING__:e.g.: claude, codex (ACP)"
+      }
+    },
+    "card": {
+      "detected": "__MISSING__:Detected",
+      "notDetected": "__MISSING__:Not detected",
+      "configured": "__MISSING__:Configured",
+      "notConfigured": "__MISSING__:Not configured",
+      "configure": "__MISSING__:Configure →",
+      "howToInstall": "__MISSING__:How to install →",
+      "manualConfig": "__MISSING__:Manual config",
+      "installGuide": "__MISSING__:Install guide",
+      "endpointLabel": "__MISSING__:Endpoint",
+      "baseUrlFull": "__MISSING__:Full Base URL",
+      "baseUrlPartial": "__MISSING__:Partial Base URL",
+      "refreshDetection": "__MISSING__:Refresh detection",
+      "alsoAcp": "__MISSING__:also ACP",
+      "connectProviderHint": "__MISSING__:Connect a provider in Providers"
+    },
+    "detail": {
+      "back": "__MISSING__:Back",
+      "apply": "__MISSING__:Save",
+      "reset": "__MISSING__:Clear",
+      "manualConfig": "__MISSING__:Manual configuration",
+      "vendor": "__MISSING__:Vendor",
+      "category": "__MISSING__:Type",
+      "detectionStatus": "__MISSING__:Detection",
+      "configStatus": "__MISSING__:Configuration",
+      "baseUrlLabel": "__MISSING__:Base URL",
+      "apiKeyLabel": "__MISSING__:API Key",
+      "modelMappingLabel": "__MISSING__:Model mapping",
+      "noActiveProviders": "__MISSING__:No active providers.",
+      "noActiveProvidersDesc": "__MISSING__:Go to Providers to connect at least 1 provider before configuring the CLI.",
+      "openProviders": "__MISSING__:Open Providers →"
+    }
+  },
+  "cliCode": {
+    "pageTitle": "__MISSING__:CLI Code's",
+    "pageSubtitle": "__MISSING__:Code tools pointing to OmniRoute",
+    "searchPlaceholder": "__MISSING__:Search CLI…",
+    "filterDetectionLabel": "__MISSING__:Detection",
+    "filterBaseUrlLabel": "__MISSING__:Base URL",
+    "detectionAll": "__MISSING__:All",
+    "detectionInstalled": "__MISSING__:Installed",
+    "detectionNotFound": "__MISSING__:Not found",
+    "baseUrlAll": "__MISSING__:All",
+    "baseUrlFull": "__MISSING__:Full",
+    "baseUrlPartial": "__MISSING__:Partial"
+  },
+  "cliAgents": {
+    "pageTitle": "__MISSING__:CLI Agents",
+    "pageSubtitle": "__MISSING__:Broad-purpose autonomous CLI agents",
+    "refreshDetection": "__MISSING__:Refresh detection",
+    "searchPlaceholder": "__MISSING__:Search agent…",
+    "detectionFilterLabel": "__MISSING__:Detection",
+    "detectionAll": "__MISSING__:All",
+    "detectionInstalled": "__MISSING__:Installed",
+    "detectionNotInstalled": "__MISSING__:Not installed",
+    "visibleCount": "__MISSING__:{count} visible",
+    "emptyState": "__MISSING__:No CLI agents found with the current filters."
+  },
+  "acpAgents": {
+    "pageTitle": "__MISSING__:ACP Agents",
+    "pageSubtitle": "__MISSING__:CLIs that OmniRoute spawns as execution backend",
+    "scanning": "__MISSING__:Detecting agents…",
+    "refresh": "__MISSING__:Refresh",
+    "setupGuideTitle": "__MISSING__:Setup guide",
+    "setupGuideDetectCliTitle": "__MISSING__:Detect CLI",
+    "setupGuideDetectCliDesc": "__MISSING__:Agents are identified by running the --version command in PATH.",
+    "setupGuideCustomAgentTitle": "__MISSING__:Add custom agent",
+    "setupGuideCustomAgentDesc": "__MISSING__:Fill in the form below to register a custom CLI agent.",
+    "setupGuideCommandMissingTitle": "__MISSING__:Command not found",
+    "setupGuideCommandMissingDesc": "__MISSING__:Check that the binary is in PATH.",
+    "fingerprintSettingsHint": "__MISSING__:Configure routing and fingerprints in",
+    "settingsRoutingLink": "__MISSING__:Settings → Routing",
+    "installed": "__MISSING__:Installed",
+    "notFound": "__MISSING__:Not found",
+    "builtIn": "__MISSING__:Built-in",
+    "custom": "__MISSING__:Custom",
+    "agentUseCaseHint": "__MISSING__:Available for spawn via ACP.",
+    "remove": "__MISSING__:Remove",
+    "addCustomAgent": "__MISSING__:Add custom agent",
+    "addCustomAgentDesc": "__MISSING__:Register a custom CLI agent to be spawned via ACP.",
+    "addAgent": "__MISSING__:Add agent",
+    "agentName": "__MISSING__:Name",
+    "agentNamePlaceholder": "__MISSING__:e.g.: My Agent",
+    "binaryName": "__MISSING__:Binary",
+    "binaryNamePlaceholder": "__MISSING__:e.g.: myagent",
+    "versionCommand": "__MISSING__:Version command",
+    "versionCommandPlaceholder": "__MISSING__:e.g.: myagent --version",
+    "spawnArgs": "__MISSING__:Spawn arguments",
+    "spawnArgsPlaceholder": "__MISSING__:e.g.: --quiet, --json",
+    "cliCodeRedirectCta": "__MISSING__:Open CLI Code"
+  },
+  "agentSkills": {
+    "pageTitle": "__MISSING__:Agent Skills",
+    "pageSubtitle": "__MISSING__:Teach your agent to operate OmniRoute — 22 API areas + 20 CLI families",
+    "conceptCard": {
+      "agent": {
+        "title": "__MISSING__:Agent Skills — Outbound",
+        "description": "__MISSING__:Agent Skills are machine-readable SKILL.md documents that external AI agents (Claude Code, Cursor, Copilot…) fetch from GitHub to learn how to operate OmniRoute via REST or CLI. They are read by the agent, not executed by OmniRoute.",
+        "crossLinkLabel": "__MISSING__:Understand the difference →"
+      },
+      "omni": {
+        "title": "__MISSING__:Omni Skills — Inbound",
+        "description": "__MISSING__:Omni Skills are sandbox tools that OmniRoute injects into the model's context on every request. They are executed by OmniRoute, not read by the agent.",
+        "crossLinkLabel": "__MISSING__:Understand the difference →"
+      },
+      "comparison": {
+        "colAgent": "__MISSING__:Agent Skills",
+        "colOmni": "__MISSING__:Omni Skills",
+        "whatIs": {
+          "label": "__MISSING__:What it is",
+          "agent": "__MISSING__:Machine-readable SKILL.md that teaches an external agent to operate OmniRoute",
+          "omni": "__MISSING__:Executable tools that OmniRoute injects as tools into LLM requests"
+        },
+        "direction": {
+          "label": "__MISSING__:Direction",
+          "agent": "__MISSING__:Outbound — external agent learns to control OmniRoute",
+          "omni": "__MISSING__:Inbound — OmniRoute gives tools to models passing through it"
+        },
+        "executor": {
+          "label": "__MISSING__:Executor",
+          "agent": "__MISSING__:External agent (reads markdown → acts via API/CLI)",
+          "omni": "__MISSING__:OmniRoute itself (intercepts tool_calls, Docker sandbox)"
+        },
+        "storage": {
+          "label": "__MISSING__:Storage",
+          "agent": "__MISSING__:Dynamic catalog (/api/agent-skills) → SKILL.md on GitHub",
+          "omni": "__MISSING__:SQLite (SkillsMP / skills.sh / local)"
+        },
+        "tagline": {
+          "label": "__MISSING__:Tagline",
+          "agent": "__MISSING__:Teach your agent to use OmniRoute",
+          "omni": "__MISSING__:Give executable tools to OmniRoute models"
+        }
+      }
+    },
+    "filters": {
+      "category": "__MISSING__:Category",
+      "area": "__MISSING__:Area",
+      "searchPlaceholder": "__MISSING__:Search skills…"
+    },
+    "categoryApi": "__MISSING__:API",
+    "categoryCli": "__MISSING__:CLI",
+    "categoryConfig": "__MISSING__:Config",
+    "filterAll": "__MISSING__:All",
+    "coverageLabel": "__MISSING__:Coverage",
+    "mcpUrl": "__MISSING__:MCP URL",
+    "a2aLink": "__MISSING__:A2A",
+    "copyUrl": "__MISSING__:Copy URL",
+    "viewOnGithub": "__MISSING__:View on GitHub",
+    "previewLoading": "__MISSING__:Loading skill documentation…",
+    "previewError": "__MISSING__:Failed to load skill documentation.",
+    "previewEmpty": "__MISSING__:Select a skill to preview its documentation.",
+    "generateButton": "__MISSING__:Generate missing skills",
+    "coverageBar": {
+      "complete": "__MISSING__:Complete",
+      "partial": "__MISSING__:Partial"
+    },
+    "noSkillsFound": "__MISSING__:No skills found matching your filters.",
+    "regenerateConfirm": "__MISSING__:This will regenerate all missing SKILL.md files. Continue?",
+    "regenerateRunning": "__MISSING__:Regenerating skills…",
+    "regenerateSuccess": "__MISSING__:Skills regenerated successfully.",
+    "regenerateError": "__MISSING__:Failed to regenerate skills."
+  },
+  "freeProviderRankingsPage": {
+    "title": "__MISSING__:Free Provider Rankings",
+    "subtitle": "__MISSING__:Best free providers ranked by model ELO scores from Arena AI leaderboards",
+    "loading": "__MISSING__:Loading rankings...",
+    "errorLoading": "__MISSING__:Failed to load rankings",
+    "emptyState": "__MISSING__:No rankings available yet. Arena ELO data syncs on startup (daily) — check back shortly, or trigger a manual sync. Disable Arena ELO Sync in Feature Flags or set ARENA_ELO_SYNC_ENABLED=false to opt out.",
+    "bestModel": "__MISSING__:Best",
+    "allCategories": "__MISSING__:All Categories",
+    "categoryDefault": "__MISSING__:Default",
+    "categoryCoding": "__MISSING__:Coding",
+    "categoryReview": "__MISSING__:Review",
+    "categoryDocumentation": "__MISSING__:Documentation",
+    "categoryDebugging": "__MISSING__:Debugging",
+    "colRank": "__MISSING__:Rank",
+    "colProvider": "__MISSING__:Provider",
+    "colTopModel": "__MISSING__:Top Model",
+    "colScore": "__MISSING__:Score",
+    "colAvgScore": "__MISSING__:Avg Score",
+    "colModels": "__MISSING__:Models",
+    "colType": "__MISSING__:Type"
   }
 }
diff --git a/src/i18n/messages/ja.json b/src/i18n/messages/ja.json
index 7b070eca85..a0b9085f6c 100644
--- a/src/i18n/messages/ja.json
+++ b/src/i18n/messages/ja.json
@@ -393,6 +393,7 @@
     "cloudBenefitAccess": "Cloud Benefit Access",
     "maxRetries": "Max Retries",
     "queueTimeout": "Queue Timeout",
+    "queueDepth": "__MISSING__:Queue Depth",
     "addProvider": "Add Provider",
     "realtime": "Realtime",
     "totalTranslations": "Total Translations",
@@ -709,6 +710,7 @@
     "batchFilesListFilesTable": "ファイル",
     "batchPageLoadingMore": "さらに読み込み中…",
     "recommended": "__MISSING__:Recommended",
+    "understand": "__MISSING__:I understand",
     "batchConceptTitle": "Batch processing",
     "batchConceptSubtitle": "Process thousands of requests asynchronously at ~50% of the cost (24h window). Ideal for evaluations, classification, and embeddings.",
     "batchConceptHowItWorks": "How it works",
@@ -773,36 +775,13 @@
     "filesListUploadButton": "Upload",
     "filesListUsedByColumn": "Used by",
     "filesListUsedByNone": "None",
-    "filesListDelete": "Delete",
-    "filesListDownload": "Download",
-    "batchDetailActionCancel": "Cancel batch",
-    "batchDetailActionRetry": "Retry failed requests",
-    "batchDetailCancelling": "Cancelling…",
-    "batchDetailRetrying": "Preparing retry…",
-    "batchDetailCancelConfirm": "Cancel this batch? In-progress requests will stop.",
-    "batchActionCancelError": "Failed to cancel batch. Try again.",
-    "batchActionRetryError": "Failed to retry failed requests. Try again.",
-    "batchConceptRetentionNote": "Results and error files are retained for 30 days (Anthropic: 29 days)",
     "filesListUsedByRoleInput": "input",
     "filesListUsedByRoleOutput": "output",
     "filesListUsedByRoleError": "error",
-    "batchListProgressPartial": "(partial)",
     "filesListSizeColumn": "Size",
+    "batchListProgressPartial": "(partial)",
     "batchListProviderColumn": "Provider",
     "batchListProviderUnknown": "—",
-    "batchListBatchCreated": "Batch {id} created — refreshing list…",
-    "batchListBatchCreatedDismiss": "Dismiss",
-    "batchListRefreshing": "Refreshing…",
-    "batchListRefresh": "Refresh",
-    "uploadFileModalRemove": "Remove",
-    "uploadFileModalUploading": "Uploading…",
-    "wizardInputReading": "Reading file…",
-    "wizardInputReady": "Ready",
-    "wizardInputLargeFileLabel": "Large file — sampling validation",
-    "wizardInputCsvJsonlReady": "JSONL generated — ready to validate.",
-    "wizardInputLargeFileWarning": "Large file detected — validation runs by sampling (first 5 MB + last 100 KB). Full validation happens server-side.",
-    "wizardCostWindow24h": "24h completion window",
-    "wizardValidationFieldsOk": "required fields valid",
     "batchListProviderOther": "Other",
     "batchListTitle": "Batches",
     "batchListCount": "{count} batches",
@@ -839,8 +818,33 @@
     "wizardCostWindow": "Window",
     "wizardDestinationSelectProvider": "Select a provider…",
     "wizardDestinationSelectModel": "Select a model…",
-    "wizardDestinationConnectProvider": "Connect a provider"
+    "wizardDestinationConnectProvider": "Connect a provider",
+    "batchListBatchCreated": "Batch {id} created — refreshing list…",
+    "batchListBatchCreatedDismiss": "Dismiss",
+    "batchListRefreshing": "Refreshing…",
+    "batchListRefresh": "Refresh",
+    "uploadFileModalRemove": "Remove",
+    "uploadFileModalUploading": "Uploading…",
+    "wizardInputReading": "Reading file…",
+    "wizardInputReady": "Ready",
+    "wizardInputLargeFileLabel": "Large file — sampling validation",
+    "wizardInputCsvJsonlReady": "JSONL generated — ready to validate.",
+    "wizardInputLargeFileWarning": "Large file detected — validation runs by sampling (first 5 MB + last 100 KB). Full validation happens server-side.",
+    "wizardCostWindow24h": "24h completion window",
+    "wizardValidationFieldsOk": "required fields valid",
+    "filesListDelete": "Delete",
+    "filesListDownload": "Download",
+    "batchDetailActionCancel": "Cancel batch",
+    "batchDetailActionRetry": "Retry failed requests",
+    "batchDetailCancelling": "Cancelling…",
+    "batchDetailRetrying": "Preparing retry…",
+    "batchDetailCancelConfirm": "Cancel this batch? In-progress requests will stop.",
+    "batchActionCancelError": "Failed to cancel batch. Try again.",
+    "batchActionRetryError": "Failed to retry failed requests. Try again.",
+    "batchConceptRetentionNote": "Results and error files are retained for 30 days (Anthropic: 29 days)"
   },
+  "featureFlagOmnirouteEmergencyFallbackDescription": "__MISSING__:Route budget-exhausted requests to the emergency free fallback provider/model.",
+  "featureFlagArenaEloSyncEnabledDescription": "__MISSING__:Enable periodic Arena AI leaderboard ELO sync for model intelligence rankings.",
   "sidebar": {
     "home": "ホーム",
     "dashboard": "ダッシュボード",
@@ -968,6 +972,7 @@
     "aiFeaturesSection": "AI Features",
     "mcp": "MCP",
     "a2a": "A2A",
+    "plugins": "__MISSING__:Plugins",
     "apiEndpoints": "API Endpoints",
     "batchFiles": "Files",
     "analyticsEvals": "Evals",
@@ -976,6 +981,10 @@
     "analyticsComboHealth": "Combo Health",
     "analyticsCompression": "Compression",
     "costsBudget": "Budget",
+    "costsFreeTiers": "__MISSING__:Free-Tier Budget",
+    "costsFreeTiersSubtitle": "__MISSING__:Monthly free-token allowances",
+    "freeProviderRankings": "__MISSING__:Free Provider Rankings",
+    "freeProviderRankingsSubtitle": "__MISSING__:Best free providers ranked by model ELO scores",
     "costsQuotaShare": "Quota Sharing",
     "costsPricing": "Pricing",
     "logsProxy": "Proxy Logs",
@@ -987,10 +996,12 @@
     "settingsAppearance": "Appearance",
     "settingsAi": "AI Settings",
     "settingsSecurity": "Security",
+    "settingsAccessTokens": "__MISSING__:Access Tokens",
     "settingsFeatureFlags": "機能フラグ",
     "settingsAuthz": "__MISSING__:Authz",
     "settingsRouting": "Routing",
     "settingsResilience": "Resilience",
+    "modelLockout": "__MISSING__:Model Lockout",
     "settingsAdvanced": "Advanced",
     "omniProxySection": "OmniProxy",
     "quotaTracker": "Provider Quota",
@@ -1036,6 +1047,8 @@
     "analyticsCompressionSubtitle": "Token savings stats",
     "analyticsSearchSubtitle": "Search tool analytics",
     "analyticsEvalsSubtitle": "Eval suite results",
+    "providerStats": "__MISSING__:Provider Stats",
+    "providerStatsSubtitle": "__MISSING__:Latency and performance metrics",
     "logsSubtitle": "Application logs",
     "logsProxySubtitle": "Proxy traffic logs",
     "consoleLogsSubtitle": "Console output",
@@ -1055,6 +1068,7 @@
     "agentSkillsSubtitle": "A2A skill registry",
     "mcpSubtitle": "MCP server controls",
     "a2aSubtitle": "A2A protocol server",
+    "pluginsSubtitle": "__MISSING__:Plugin marketplace & installs",
     "mediaSubtitle": "Cached media files",
     "batchFilesSubtitle": "Batch input/output files",
     "settingsSubtitle": "All settings",
@@ -1065,13 +1079,41 @@
     "settingsResilienceSubtitle": "Retries and breakers",
     "settingsAdvancedSubtitle": "Power user options",
     "settingsSecuritySubtitle": "Auth and encryption",
+    "settingsAccessTokensSubtitle": "__MISSING__:Scoped CLI tokens for remote mode",
     "settingsFeatureFlagsSubtitle": "システム機能の切り替え",
     "settingsSidebar": "Sidebar",
     "settingsSidebarSubtitle": "Customize sidebar layout",
     "settingsAuthzSubtitle": "__MISSING__:Route inventory and bypass policy",
     "docsSubtitle": "Documentation",
     "issuesSubtitle": "Report a bug",
-    "changelogSubtitle": "Release notes"
+    "changelogSubtitle": "Release notes",
+    "costsQuotaPlans": "__MISSING__:Plans & Quotas",
+    "costsQuotaPlansSubtitle": "__MISSING__:Configure plans by provider",
+    "activity": "__MISSING__:Activity",
+    "activitySubtitle": "__MISSING__:Friendly feed of recent events",
+    "logsGroup": "__MISSING__:Logs",
+    "systemGroup": "__MISSING__:System",
+    "costsOverview": "__MISSING__:Overview",
+    "costsOverviewSubtitle": "__MISSING__:Consolidated cost analysis",
+    "agentBridge": "__MISSING__:Agent Bridge",
+    "agentBridgeSubtitle": "__MISSING__:Intercept IDE agent traffic",
+    "trafficInspector": "__MISSING__:Traffic Inspector",
+    "trafficInspectorSubtitle": "__MISSING__:Monitor LLM calls + debug any HTTPS traffic",
+    "cliCode": "__MISSING__:CLI Code",
+    "cliCodeSubtitle": "__MISSING__:Code tools pointing to OmniRoute",
+    "cliAgents": "__MISSING__:CLI Agents",
+    "cliAgentsSubtitle": "__MISSING__:Autonomous CLI agents",
+    "acpAgents": "__MISSING__:ACP Agents",
+    "acpAgentsSubtitle": "__MISSING__:CLIs spawned by OmniRoute",
+    "skipToContent": "__MISSING__:Skip to content",
+    "unpinSection": "__MISSING__:Unpin section",
+    "pinSectionOpen": "__MISSING__:Pin section open",
+    "reloadPage": "__MISSING__:Reload Page",
+    "dragReorderSection": "__MISSING__:Drag to reorder section",
+    "dragReorderItem": "__MISSING__:Drag to reorder",
+    "cannotHide": "__MISSING__:This item cannot be hidden",
+    "alwaysVisible": "__MISSING__:Always visible",
+    "groupSeparatorLabel": "__MISSING__:Separator"
   },
   "webhooks": {
     "title": "Webhook",
@@ -1272,7 +1314,47 @@
     "a2aEvents": "イベント",
     "a2aArtifacts": "アーティファクト",
     "a2aNoTasks": "A2A タスクは記録されません。",
-    "a2aLoadingTasks": "A2A タスクをロードしています..."
+    "a2aLoadingTasks": "A2A タスクをロードしています...",
+    "actor": "__MISSING__:Actor",
+    "actorPlaceholder": "__MISSING__:Filter by actor",
+    "eventTypes": {
+      "apiKey.activate": "__MISSING__:API Key Activated",
+      "apiKey.ban": "__MISSING__:API Key Banned",
+      "apiKey.deactivate": "__MISSING__:API Key Deactivated",
+      "apiKey.regenerate": "__MISSING__:API Key Regenerated",
+      "apiKey.scopes.grant": "__MISSING__:API Key Scopes Granted",
+      "apiKey.scopes.revoke": "__MISSING__:API Key Scopes Revoked",
+      "apiKey.scopes.update": "__MISSING__:API Key Scopes Updated",
+      "apiKey.unban": "__MISSING__:API Key Unbanned",
+      "auth.login.error": "__MISSING__:Login Error",
+      "auth.login.failed": "__MISSING__:Login Failed",
+      "auth.login.locked": "__MISSING__:Login Locked",
+      "auth.login.misconfigured": "__MISSING__:Login Misconfigured",
+      "auth.login.setup_required": "__MISSING__:Login Setup Required",
+      "auth.login.success": "__MISSING__:Login Success",
+      "auth.logout.success": "__MISSING__:Logout Success",
+      "compliance.cleanup": "__MISSING__:Compliance Cleanup",
+      "provider.credentials.applied": "__MISSING__:Provider Credentials Applied",
+      "provider.credentials.batch_revoked": "__MISSING__:Provider Credentials Batch Revoked",
+      "provider.credentials.bulk_created": "__MISSING__:Provider Credentials Bulk Created",
+      "provider.credentials.bulk_imported": "__MISSING__:Provider Credentials Bulk Imported",
+      "provider.credentials.created": "__MISSING__:Provider Credentials Created",
+      "provider.credentials.imported": "__MISSING__:Provider Credentials Imported",
+      "provider.credentials.revoked": "__MISSING__:Provider Credentials Revoked",
+      "provider.credentials.updated": "__MISSING__:Provider Credentials Updated",
+      "provider.validation.ssrf_blocked": "__MISSING__:Provider SSRF Blocked",
+      "quota.plan.updated": "__MISSING__:Quota Plan Updated",
+      "quota.pool.created": "__MISSING__:Quota Pool Created",
+      "quota.pool.deleted": "__MISSING__:Quota Pool Deleted",
+      "quota.pool.updated": "__MISSING__:Quota Pool Updated",
+      "quota.store.driver_changed": "__MISSING__:Quota Store Driver Changed",
+      "server.start": "__MISSING__:Server Start",
+      "service.reveal_api_key": "__MISSING__:Service API Key Revealed",
+      "settings.update": "__MISSING__:Settings Updated",
+      "settings.update_failed": "__MISSING__:Settings Update Failed",
+      "sync.token.created": "__MISSING__:Sync Token Created",
+      "sync.token.revoked": "__MISSING__:Sync Token Revoked"
+    }
   },
   "themesPage": {
     "title": "Themes",
@@ -1381,7 +1463,8 @@
     "settingsResilienceDescription": "Circuit breaker, retry, and fallback configuration",
     "settingsAdvancedDescription": "Advanced payload rules, request limits, and proxy API settings",
     "mitmProxyDescription": "Configure MITM proxy settings for traffic inspection and debugging",
-    "oneProxyDescription": "Configure 1Proxy settings for advanced proxy chaining"
+    "oneProxyDescription": "Configure 1Proxy settings for advanced proxy chaining",
+    "omniSkillsDescription": "__MISSING__:Install and manage sandbox skills for automated prompt and tool execution"
   },
   "home": {
     "quickStart": "クイックスタート",
@@ -1612,16 +1695,24 @@
     "ownUsageVisibilityDesc": "このキーが自身の USD 使用量、予算割合、トークン合計を確認するためにステータス endpoint を呼び出せるようにします。",
     "sharedAccountQuotaVisibility": "共有アカウントクォータ",
     "sharedAccountQuotaVisibilityDesc": "明示的な接続が 1 つ設定されている場合、このキーに共有 upstream アカウントクォータの表示を許可します。",
+    "localUsageCommand": "__MISSING__:Allow local usage command",
+    "localUsageCommandDesc": "__MISSING__:Allows this API key to use @@om-usage to retrieve cached usage and quota information without calling an upstream provider.",
+    "localUsageCommandBadge": "__MISSING__:Usage cmd",
     "keyCreated": "APIキーが作成されました",
     "keyCreatedSuccess": "キーが正常に作成されました。",
     "keyCreatedNote": "このキーをコピーして保存してください。再度表示されなくなります。",
     "done": "完了",
     "savePermissions": "権限の保存",
-    "endpointRestrictions": "__MISSING__:Allowed Endpoints",
-    "allEndpointsAllowed": "__MISSING__:This key can access all API endpoints.",
-    "endpointsRestricted": "__MISSING__:Restricted to {count} endpoint{count, plural, one {} other {s}}.",
+    "endpointRestrictions": "Allowed Endpoints",
+    "allEndpointsAllowed": "This key can access all API endpoints.",
+    "endpointsRestricted": "Restricted to {count} endpoint{count, plural, one {} other {s}}.",
     "autoResolve": "Auto-Resolve",
     "autoResolveDesc": "Auto-resolve ambiguous model names to native provider for this API key.",
+    "streamDefaultMode": "__MISSING__:Stream Default Compatibility",
+    "streamDefaultModeDesc": "__MISSING__:Controls omitted `stream` flags for this key. JSON mode returns non-streaming responses unless the client explicitly requests SSE.",
+    "streamDefaultLegacy": "__MISSING__:Legacy",
+    "streamDefaultJson": "__MISSING__:JSON Compatible",
+    "streamDefaultBadge": "__MISSING__:JSON stream default",
     "keyActive": "Key Active",
     "keyActiveDesc": "Enable or disable this API key. Disabled keys are immediately rejected with 403.",
     "accessSchedule": "Access Schedule",
@@ -1667,6 +1758,7 @@
     "keyOnlyAvailableAtCreation": "Full key available only at creation time — copy it when you first create the key",
     "modelsCount": "{count, plural, one {# model} other {# models}}",
     "lastUsedOn": "最後: {date}",
+    "viewCostsFor": "__MISSING__:View costs for {name}",
     "editPermissions": "権限の編集",
     "deleteKey": "削除キー",
     "regenerateKey": "キーを再生成する",
@@ -1708,9 +1800,12 @@
     "shownOf": "__MISSING__:{shown} of {total} shown",
     "emptyFilterTitle": "__MISSING__:No keys match your filters",
     "emptyFilterClear": "__MISSING__:Clear filters",
-    "endpointRestrictions": "Allowed Endpoints",
-    "allEndpointsAllowed": "This key can access all API endpoints.",
-    "endpointsRestricted": "Restricted to {count} endpoint{count, plural, one {} other {s}}."
+    "disableNonPublicModels": "__MISSING__:Disable Non-Public Models",
+    "disableNonPublicModelsDesc": "__MISSING__:Reject requests for models that are not discovered or not marked as public in the provider catalog",
+    "normalKeysSection": "__MISSING__:Normal keys",
+    "quotaKeysSection": "__MISSING__:Quota keys",
+    "quotaPill": "__MISSING__:QUOTA",
+    "quotaModeOnly": "__MISSING__:qtSd-only"
   },
   "auditLog": {
     "title": "監査ログ",
@@ -1845,6 +1940,8 @@
     "freeQuota": "Free quota/mo",
     "scrapeUrl": "URL to scrape",
     "scrapeUrlPlaceholder": "https://example.com",
+    "scrapeUrlRequired": "__MISSING__:URL is required",
+    "scrapeUrlInvalid": "__MISSING__:Invalid URL — it must start with http:// or https://",
     "scrapeExtract": "Extract",
     "scrapeExtracting": "Extracting…",
     "scrapeFullPage": "Full page",
@@ -1858,6 +1955,8 @@
     "scrapeMetadata": "Metadata",
     "scrapeProvider": "Provider",
     "scrapeSize": "Size",
+    "scrapeEmptyState": "__MISSING__:Enter a URL to extract its content",
+    "scrapeProvidersAvailable": "__MISSING__:Available providers: Firecrawl, Jina Reader, Tavily.",
     "compareRun": "Compare",
     "compareRunning": "Comparing…",
     "autoProvider": "Auto (cheapest)",
@@ -2245,6 +2344,8 @@
     "leastLatency": "最小レイテンシ",
     "comboName": "コンボ名",
     "comboNamePlaceholder": "私のコンボ",
+    "comboDescription": "__MISSING__:Description",
+    "comboDescriptionPlaceholder": "__MISSING__:Optional note describing this combo",
     "deleteConfirm": "このコンボを削除しますか?",
     "noCombosYet": "まだコンボはありません",
     "comboCreated": "コンボが正常に作成されました",
@@ -2284,6 +2385,8 @@
     "resetAwareDesc": "残りの割り当てと 5 時間および毎週のリセットのバランスをとり、同様のスコアをラウンドロビンします。",
     "strictRandom": "Strict Random",
     "strictRandomDesc": "Shuffle deck — uses each model once before reshuffling",
+    "fusion": "__MISSING__:Fusion",
+    "fusionDesc": "__MISSING__:Fans the prompt to every panel model in parallel, then a judge model synthesizes one final answer",
     "models": "モデル",
     "autoBalance": "オートバランス",
     "advancedSettings": "詳細設定",
@@ -2982,14 +3085,19 @@
     "ngrokStarted": "ngrokトンネルが開始されました",
     "ngrokStopped": "ngrokトンネルが停止しました",
     "ngrokRequestFailed": "ngrok トンネルの更新に失敗しました",
-    "tokenSaverSubtitle": "すべてのリクエストで消費するトークンを減らします。",
-    "tokenSaverToolOutput": "ツールの出力",
-    "tokenSaverLlmOutput": "LLM出力",
-    "tokenSaverInputCompression": "入力圧縮",
     "apiEndpointsCatalogUnavailable": "APIカタログが利用できません",
     "apiEndpointsSearchPlaceholder": "エンドポイントを検索...",
     "apiEndpointsRequiresAuth": "認証が必要です",
     "apiEndpointsNoMatch": "フィルターに一致するエンドポイントはありません",
+    "vscodeAliasTitle": "__MISSING__:VS Code Token Alias",
+    "vscodeAliasDescriptionReady": "__MISSING__:Ready-to-paste compatibility URLs using the /api/v1/vscode/TOKEN/... endpoint.",
+    "vscodeAliasDescriptionError": "__MISSING__:Showing placeholder URLs because CLI keys could not be loaded in this session.",
+    "vscodeAliasDescriptionLoading": "__MISSING__:Loading CLI keys. Placeholder URLs are shown until a key is available.",
+    "vscodeAliasDescriptionPlaceholder": "__MISSING__:Showing placeholder URLs. Create or activate an API key in CLI Tools to replace TOKEN.",
+    "vscodeAliasManage": "__MISSING__:CLI Tools",
+    "vscodeAliasBaseLabel": "__MISSING__:VS Code base",
+    "vscodeAliasModelsLabel": "__MISSING__:VS Code models",
+    "vscodeAliasChatLabel": "__MISSING__:VS Code chat",
     "localServer": "ローカルサーバー",
     "cloudOmniroute": "クラウドオムニルート",
     "copyUrl": "URLをコピー",
@@ -3002,7 +3110,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "エンドポイント プロキシ",
@@ -3178,42 +3289,187 @@
     "a2aStep3": "__MISSING__:Track and cancel tasks with {code1} and {code2}."
   },
   "memory": {
-    "title": "Memory Management",
-    "description": "View and manage stored memory entries",
-    "memories": "Memories",
-    "totalEntries": "Total Entries",
-    "tokensUsed": "Tokens Used",
-    "hitRate": "Hit Rate",
-    "loading": "Loading memories...",
-    "noMemories": "No memories found",
-    "search": "Search memories...",
-    "allTypes": "All Types",
-    "export": "Export",
-    "import": "Import",
-    "addMemory": "Add Memory",
-    "type": "Type",
-    "key": "Key",
-    "content": "Content",
-    "created": "Created",
-    "actions": "Actions",
-    "delete": "Delete",
-    "factual": "Factual",
-    "episodic": "Episodic",
-    "procedural": "Procedural",
-    "semantic": "Semantic",
     "a": "A",
-    "pipelineOk": "パイプラインは OK ({latencyMs}ms)",
-    "pipelineError": "パイプラインエラー",
-    "healthUnknown": "健康状態不明",
-    "checkingHealth": "確認中…",
-    "checkHealth": "健康状態をチェックする",
-    "pageInfo": "ページ {page} / {totalPages} (合計 {total})",
-    "previous": "前へ",
-    "next": "次へ",
+    "actions": "Actions",
+    "addMemory": "Add Memory",
+    "allTypes": "All Types",
     "cancel": "キャンセル",
-    "save": "保存",
+    "checkHealth": "健康状態をチェックする",
+    "checkingHealth": "確認中…",
+    "compactOld": "__MISSING__:Compact old",
+    "concept": {
+      "title": "__MISSING__:Conversational Memory",
+      "description": "__MISSING__:OmniRoute learns from every conversation, remembering facts, episodes, procedures, and semantic concepts that make responses more accurate and context-aware.",
+      "howWorksToggle": "__MISSING__:How it works",
+      "howWorksContent": "__MISSING__:1. Automatic extraction: at the end of each response, facts and episodes are detected and saved automatically.\n2. Retrieval: before each response, the most relevant memories are searched via FTS5 (exact), vector (semantic), or hybrid RRF.\n3. Injection: relevant memories are injected into the assistant context to improve response quality.\n4. Management: use this page to view, edit, export, and compact old memories."
+    },
+    "content": "Content",
+    "contentPlaceholder": "覚えておくべき値または JSON コンテンツ",
+    "created": "Created",
+    "delete": "Delete",
+    "deleteConfirmDesc": "__MISSING__:This action cannot be undone. The memory will be permanently removed.",
+    "deleteConfirmTitle": "__MISSING__:Delete memory?",
+    "description": "View and manage stored memory entries",
+    "editMemory": "__MISSING__:Edit memory",
+    "editModal": {
+      "title": "__MISSING__:Edit Memory",
+      "metadataLabel": "__MISSING__:Metadata (JSON)",
+      "metadataInvalid": "__MISSING__:Invalid JSON",
+      "saveFailed": "__MISSING__:Failed to save memory"
+    },
+    "embedding": {
+      "autoLabel": "__MISSING__:Automatic",
+      "autoDesc": "__MISSING__:Uses best available: remote provider > static > transformers",
+      "remoteLabel": "__MISSING__:Remote provider",
+      "remoteDesc": "__MISSING__:Uses embedding via provider API (requires API key)",
+      "staticLabel": "__MISSING__:Static local (potion)",
+      "staticDesc": "__MISSING__:Local embedding without WASM or external dependencies",
+      "transformersLabel": "__MISSING__:Transformers.js (MiniLM)",
+      "transformersDesc": "__MISSING__:Local embedding via @huggingface/transformers (~400MB RAM)",
+      "providerModelLabel": "__MISSING__:Provider / Model",
+      "noRemoteProviders": "__MISSING__:No providers with configured API key",
+      "selectProviderModel": "__MISSING__:Select a model",
+      "staticEnabledLabel": "__MISSING__:Enable Static Potion",
+      "staticEnabledDesc": "__MISSING__:Download and use potion-base-8M model locally",
+      "transformersEnabledLabel": "__MISSING__:Enable Transformers.js",
+      "transformersEnabledDesc": "__MISSING__:Opt-in for local MiniLM (~400MB RAM, ~3s cold start)",
+      "transformersWarning": "__MISSING__:Requires ~400MB RAM and ~3s cold start on the first semantic query."
+    },
+    "emptyState": {
+      "title": "__MISSING__:No memories yet",
+      "description": "__MISSING__:Memories are created automatically from conversations. You can also add them manually using the button above."
+    },
+    "engine": {
+      "statusTitle": "__MISSING__:Engine Status",
+      "embeddingTitle": "__MISSING__:Embedding Source",
+      "rerankTitle": "__MISSING__:Rerank (optional)",
+      "reindexNow": "__MISSING__:Reindex now",
+      "reindexStarted": "__MISSING__:Reindexing started ({pending} pending)",
+      "reindexFailed": "__MISSING__:Failed to start reindexing",
+      "keywordLabel": "__MISSING__:Keyword (FTS5)",
+      "keywordReason": "__MISSING__:Keyword search always available",
+      "embeddingLabel": "__MISSING__:Embedding",
+      "vectorStoreLabel": "__MISSING__:Vector Store",
+      "qdrantLabel": "__MISSING__:Qdrant",
+      "rerankLabel": "__MISSING__:Rerank",
+      "qdrantDisabled": "__MISSING__:Disabled",
+      "qdrantOk": "__MISSING__:Healthy ({latencyMs}ms)",
+      "qdrantError": "__MISSING__:Connection error",
+      "needsReindex": "__MISSING__:{count} memory(ies) need reindexing",
+      "configureCta": "__MISSING__:Configure",
+      "vectorStoreInstallHint": "__MISSING__:To enable vector search: npm install sqlite-vec (needs native Node.js, not WASM), then restart."
+    },
+    "episodic": "Episodic",
+    "export": "Export",
+    "factual": "Factual",
+    "healthUnknown": "健康状態不明",
+    "hitRate": "Hit Rate",
+    "import": "Import",
+    "importError": "__MISSING__:Failed to import file",
+    "importResult": "__MISSING__:{imported} imported, {skipped} skipped",
+    "key": "Key",
     "keyPlaceholder": "例: user.preferences.テーマ",
-    "contentPlaceholder": "覚えておくべき値または JSON コンテンツ"
+    "loading": "Loading memories...",
+    "memories": "Memories",
+    "next": "次へ",
+    "noMemories": "No memories found",
+    "pageInfo": "ページ {page} / {totalPages} (合計 {total})",
+    "pipelineError": "パイプラインエラー",
+    "pipelineOk": "パイプラインは OK ({latencyMs}ms)",
+    "playground": {
+      "infoTitle": "__MISSING__:Memory Playground",
+      "infoDesc": "__MISSING__:Simulate what would be retrieved for a given query. No memories are modified — read-only preview.",
+      "queryLabel": "__MISSING__:Test query",
+      "queryPlaceholder": "__MISSING__:Type a question or test phrase...",
+      "strategyLabel": "__MISSING__:Strategy",
+      "strategyExact": "__MISSING__:Exact (FTS5)",
+      "strategySemantic": "__MISSING__:Semantic (vector)",
+      "strategyHybrid": "__MISSING__:Hybrid (RRF)",
+      "budgetLabel": "__MISSING__:Budget (tokens)",
+      "simulate": "__MISSING__:Simulate",
+      "resultsTitle": "__MISSING__:{count} result(s)",
+      "resolutionTitle": "__MISSING__:Search resolution",
+      "resolutionEmbedding": "__MISSING__:Embedding",
+      "resolutionStore": "__MISSING__:Vector store",
+      "resolutionStrategy": "__MISSING__:Strategy used",
+      "rerankApplied": "__MISSING__:Rerank applied",
+      "fallback": "__MISSING__:Fallback",
+      "noResults": "__MISSING__:No memories found for this query.",
+      "tokensUsed": "__MISSING__:tokens used",
+      "none": "__MISSING__:none",
+      "errorFetch": "__MISSING__:Failed to fetch preview"
+    },
+    "previous": "前へ",
+    "procedural": "Procedural",
+    "qdrant": {
+      "title": "__MISSING__:Qdrant (Vector Store Tier 2)",
+      "description": "__MISSING__:Optional Qdrant integration for scalable semantic search",
+      "enableLabel": "__MISSING__:Enable Qdrant",
+      "enableDesc": "__MISSING__:When enabled, Qdrant is used as the primary vector store",
+      "testConnection": "__MISSING__:Test connection",
+      "testing": "__MISSING__:Testing...",
+      "statusActive": "__MISSING__:Active",
+      "statusError": "__MISSING__:Error",
+      "statusDisabled": "__MISSING__:Disabled",
+      "healthOk": "__MISSING__:Connection OK ({latencyMs}ms)",
+      "healthError": "__MISSING__:Connection error",
+      "saved": "__MISSING__:Settings saved",
+      "saveError": "__MISSING__:Failed to save",
+      "portLabel": "__MISSING__:Port",
+      "embeddingModelLabel": "__MISSING__:Embedding Model",
+      "optional": "__MISSING__:optional",
+      "apiKeyKeepPlaceholder": "__MISSING__:Leave blank to keep current key",
+      "apiKeyOptional": "__MISSING__:Leave blank if not using authentication",
+      "removeApiKey": "__MISSING__:Remove",
+      "quickSelectModel": "__MISSING__:Quick select",
+      "searchTestTitle": "__MISSING__:Semantic search test",
+      "searchPlaceholder": "__MISSING__:Type a test query...",
+      "searching": "__MISSING__:Searching...",
+      "search": "__MISSING__:Search",
+      "cleanupTitle": "__MISSING__:Clean up old points",
+      "cleanupDesc": "__MISSING__:Remove Qdrant points for expired memories (retention period).",
+      "cleaning": "__MISSING__:Cleaning...",
+      "cleanNow": "__MISSING__:Clean now",
+      "cleanupSuccess": "__MISSING__:{count} point(s) removed",
+      "cleanupFailed": "__MISSING__:Cleanup failed"
+    },
+    "rerank": {
+      "enableLabel": "__MISSING__:Enable Rerank",
+      "enableDesc": "__MISSING__:Reorders results with a reranking model after search",
+      "warning": "__MISSING__:Rerank adds +200-500ms latency and additional cost per request. Use sparingly.",
+      "providerModelLabel": "__MISSING__:Rerank Provider / Model",
+      "noProviderWithKey": "__MISSING__:No provider with configured API key. Configure a provider to use rerank.",
+      "selectProviderModel": "__MISSING__:Select a provider/model"
+    },
+    "save": "保存",
+    "saving": "__MISSING__:Saving...",
+    "search": "Search memories...",
+    "semantic": "Semantic",
+    "summarize": {
+      "title": "__MISSING__:Compact old memories",
+      "noCandidates": "__MISSING__:No memories eligible for compaction (criteria: >30 days old).",
+      "candidatesDesc": "__MISSING__:{count} memories will be compacted into summaries. This action cannot be undone.",
+      "confirm": "__MISSING__:Compact now"
+    },
+    "tabs": {
+      "memories": "__MISSING__:Memories",
+      "playground": "__MISSING__:Playground",
+      "engine": "__MISSING__:Engine"
+    },
+    "title": "Memory Management",
+    "tokensUsed": "Tokens Used",
+    "tooltip": {
+      "totalEntries": "__MISSING__:Total memories stored for this API key",
+      "tokensUsed": "__MISSING__:Estimated total tokens occupied by active memories",
+      "hitRate": "__MISSING__:Read-by-ID cache hit rate (not semantic recall accuracy)",
+      "factual": "__MISSING__:Objective, permanent facts from user context",
+      "episodic": "__MISSING__:Events and experiences from conversation history",
+      "procedural": "__MISSING__:Procedures, workflows, and instructions the assistant should follow",
+      "semantic": "__MISSING__:Concepts, preferences, and domain knowledge"
+    },
+    "totalEntries": "Total Entries",
+    "type": "Type",
+    "memoryEnabled": "__MISSING__:Memory enabled"
   },
   "skills": {
     "title": "Skills",
@@ -3544,6 +3800,14 @@
     "export": "Export",
     "exporting": "Exporting...",
     "exportFailed": "Export failed",
+    "cleanHistoryButton": "__MISSING__:Clean history",
+    "cleanHistoryTitle": "__MISSING__:Clean log history?",
+    "cleanHistoryMessage": "__MISSING__:This permanently clears all request log rows, legacy detail rows, and local artifact files under DATA_DIR/call_logs. The live page will refresh after cleanup.",
+    "cleanHistoryConfirm": "__MISSING__:Clean history",
+    "cleanHistoryCancel": "__MISSING__:Cancel",
+    "cleanHistorySuccess": "__MISSING__:Cleaned {deleted} log entries, {deletedArtifacts} artifacts, and {deletedDetailedLogs} legacy detail rows.",
+    "cleanHistoryEmpty": "__MISSING__:No request log history was found.",
+    "cleanHistoryFailed": "__MISSING__:Failed to clean log history.",
     "timeRange": "Time Range",
     "lastNHours": "Last {hours}",
     "defaultRange": "default",
@@ -3551,10 +3815,14 @@
       "fetchFailed": "Failed to fetch logs",
       "copyFailed": "Failed to copy log entry",
       "copyLogEntry": "Copy log entry"
-    }
+    },
+    "compressionLogTitle": "__MISSING__:Compression Log",
+    "compressionLogEmpty": "__MISSING__:No compressed requests yet. Compression stats will appear here when requests are processed with compression enabled.",
+    "tokens": "__MISSING__:tokens"
   },
   "onboarding": {
     "welcome": "ようこそ",
+    "tiers": "__MISSING__:Tiers",
     "security": "セキュリティ",
     "test": "テスト",
     "ready": "準備完了！",
@@ -3616,6 +3884,7 @@
   },
   "providers": {
     "title": "プロバイダー",
+    "Account Deactivated": "__MISSING__:Account Deactivated",
     "allProviders": "すべてのプロバイダー",
     "audioProviders": "オーディオプロバイダー",
     "showFreeOnly": "無料のみ",
@@ -3623,6 +3892,33 @@
     "addFirstProvider": "最初のプロバイダーを追加する",
     "addFirstProviderDesc": "AI プロバイダーに接続して、OmniRoute 経由でリクエストのルーティングを開始します。無料のプロバイダー、API キー、または OAuth アカウントを使用できます。",
     "learnMore": "さらに詳しく",
+    "adaptaTutorial": {
+      "title": "__MISSING__:How to connect Adapta Web",
+      "introPrefix": "__MISSING__:Adapta authenticates through Clerk. The token",
+      "introSuffix": "__MISSING__:is a long-lived JWT that lets OmniRoute refresh sessions automatically.",
+      "or": "__MISSING__:or",
+      "step1Title": "__MISSING__:Open Adapta chat",
+      "step1DescPrefix": "__MISSING__:Open",
+      "step1DescSuffix": "__MISSING__:and sign in with your Gold or Business account.",
+      "step2Title": "__MISSING__:Open DevTools",
+      "step2DescPrefix": "__MISSING__:Press",
+      "step2DescSuffix": "__MISSING__:to open Developer Tools.",
+      "step3Title": "__MISSING__:Go to Application → Cookies",
+      "step3DescPrefix": "__MISSING__:In the",
+      "step3DescMiddle": "__MISSING__:expand",
+      "step3DescSuffix": "__MISSING__:and click",
+      "step4Title": "__MISSING__:Copy the cookie value for",
+      "step4DescPrefix": "__MISSING__:Find the cookie named",
+      "step4DescMiddle": "__MISSING__:in the list. Click it and copy the content from the",
+      "step4DescSuffix": "__MISSING__:column. It starts with",
+      "step5Title": "__MISSING__:Paste it here and save",
+      "step5DescPrefix": "__MISSING__:Click",
+      "step5DescMiddle": "__MISSING__:paste the",
+      "step5DescSuffix": "__MISSING__:value into the API Key field, then save. OmniRoute will refresh the session automatically.",
+      "tipLabel": "__MISSING__:Tip:",
+      "tipPrefix": "__MISSING__:The",
+      "tipSuffix": "__MISSING__:cookie is long-lived, usually for months. You only need to renew it if you sign out or Adapta invalidates the session."
+    },
     "editProvider": "プロバイダーの編集",
     "deleteProvider": "プロバイダーの削除",
     "noProviders": "プロバイダーが構成されていません",
@@ -3648,13 +3944,38 @@
     "apiKeyProviders": "APIキープロバイダー",
     "compatibleProviders": "API キー互換プロバイダー",
     "testAll": "すべてをテストする",
+    "distributeProxies": "__MISSING__:Distribute Proxies",
+    "distributing": "__MISSING__:Distributing...",
+    "selectedCount": "__MISSING__:{count, plural, one {# selected} other {# selected}}",
+    "accountsCount": "__MISSING__:{count, plural, one {# account} other {# accounts}}",
     "testAllOAuth": "すべての OAuth 接続をテストする",
     "testAllFree": "すべての無料接続をテストする",
     "testAllApiKey": "すべての API キー接続をテストする",
     "testAllCompatible": "すべての互換性のある接続をテストする",
+    "testAllModels": "__MISSING__:Test all models",
+    "testAllModelsConfirm": "__MISSING__:Test all visible models? Failed models will be hidden if auto-hide is enabled.",
+    "testingAllModels": "__MISSING__:Testing {done}/{total}...",
+    "testAllResults": "__MISSING__:{ok} of {total} models working",
+    "noModelsToTest": "__MISSING__:No models match the current filter",
+    "showAllModels": "__MISSING__:All",
+    "showVisibleOnly": "__MISSING__:Visible only",
+    "freeFilterAll": "__MISSING__:All",
+    "freeFilterFreeOnly": "__MISSING__:Free only",
+    "freeFilterPaidOnly": "__MISSING__:Paid only",
+    "sortFreeFirst": "__MISSING__:Free first",
+    "showHiddenOnly": "__MISSING__:Hidden only",
+    "filterByVisibility": "__MISSING__:Filter by visibility",
+    "autoHideFailed": "__MISSING__:Auto-hide failed models",
+    "autoHideFailedHint": "__MISSING__:When enabled, Test all hides non-transient failures from public catalogs such as /v1/models. Single-model tests never auto-hide.",
     "connected": "{count} 接続されました",
     "errorCount": "{count} エラー ({code})",
     "errorCountNoCode": "{count} エラー",
+    "testAllCompleted": "__MISSING__:Tested {total} models: {ok} OK, {failed} failed",
+    "modelAutoHidden": "__MISSING__:Model {model} auto-hidden (test failed)",
+    "filterAll": "__MISSING__:All",
+    "filterVisible": "__MISSING__:Visible only",
+    "filterHidden": "__MISSING__:Hidden only",
+    "modelsHiddenCount": "__MISSING__:{count} hidden",
     "warningCount": "{count} 警告",
     "noConnections": "接続がありません",
     "expiredBadge": "Expired",
@@ -3764,7 +4085,16 @@
     "batchUpdateNone": "__MISSING__:No connections were updated (they may no longer exist)",
     "batchRetestLimit": "__MISSING__:Retest up to {max} connections at a time",
     "noConnectionsToTest": "__MISSING__:No matching connections to test",
+    "batchDeleteConfirmTitle": "__MISSING__:Delete connections",
+    "batchDeleteConfirmButton": "__MISSING__:Delete",
+    "filterActive": "__MISSING__:Active",
+    "filterError": "__MISSING__:Error",
+    "filterBanned": "__MISSING__:Banned",
+    "filterCreditsExhausted": "__MISSING__:Credits Exhausted",
+    "noFilteredConnections": "__MISSING__:No connections match the current filter.",
     "failedSetAlias": "エイリアスの設定に失敗しました",
+    "setAliasSuccess": "__MISSING__:Alias {alias} set",
+    "deleteAliasSuccess": "__MISSING__:Alias {alias} deleted",
     "failedSaveConnection": "接続の保存に失敗しました",
     "failedSaveConnectionRetry": "接続を保存できませんでした。もう一度試してください。",
     "failedRetestConnection": "接続の再テストに失敗しました",
@@ -3798,6 +4128,9 @@
     "connectionCount": "{count} 接続",
     "fetchingModels": "利用可能なモデルを取得しています...",
     "failedFetchModels": "モデルの取得に失敗しました",
+    "noFreeModelsFound": "__MISSING__:No free models found for this provider — nothing imported.",
+    "fetchModelsSuccess": "__MISSING__:Found {count} new models",
+    "fetchModelsFailed": "__MISSING__:Could not auto-fetch models (you can retry from settings)",
     "noModelsFound": "モデルが見つかりません",
     "importFailed": "インポートに失敗しました",
     "noNewModelsAdded": "新しいモデルは追加されませんでした。",
@@ -3806,6 +4139,10 @@
     "importingModelsTitle": "モデルのインポート",
     "copyModel": "モデルをコピーする",
     "filterModels": "モデルを絞り込む…",
+    "testAllRateLimited": "__MISSING__:Rate limit reached, stopped early",
+    "hideFailedAuto": "__MISSING__:Auto-hide failed models",
+    "selectAllModels": "Select all",
+    "hideAllModels": "__MISSING__:Hide all",
     "modelsActive": "有効",
     "showModel": "モデルを表示",
     "hideModel": "モデルを非表示",
@@ -3814,6 +4151,9 @@
     "rateLimitUnprotected": "保護されていない",
     "enableRateLimitProtection": "クリックしてレート制限保護を有効にします",
     "disableRateLimitProtection": "クリックしてレート制限保護を無効にします",
+    "testAllProgress": "__MISSING__:Tested {done}/{total}",
+    "testAllFailedHidden": "__MISSING__:{count} failed models hidden",
+    "testAllDone": "__MISSING__:All models tested",
     "productionKey": "プロダクションキー",
     "enterNewApiKey": "新しいAPIキーを入力してください",
     "codexApplyModalTitle": "ローカルコーデックスに適用する",
@@ -3889,10 +4229,20 @@
     "errorTypeNetworkError": "ネットワークエラー",
     "errorTypeTestUnsupported": "テストはサポートされていません",
     "errorTypeUpstreamError": "上流エラー",
+    "errorTypeCreditsExhausted": "__MISSING__:No credits",
+    "errorTypeBanned": "__MISSING__:403 Banned",
     "proxySourceGlobal": "グローバル",
     "proxySourceProvider": "プロバイダー",
     "proxySourceKey": "キー",
     "proxyConfiguredBySource": "プロキシ ({source}): {host}",
+    "proxyOn": "__MISSING__:Proxy On",
+    "proxyOff": "__MISSING__:Direct (bypass proxy)",
+    "proxyEnabledTitle": "__MISSING__:Proxy is enabled for this connection",
+    "proxyDisabledTitle": "__MISSING__:Direct connection — bypasses every proxy (including the global proxy) for this connection",
+    "perKeyProxyOn": "__MISSING__:Per-key",
+    "perKeyProxyOff": "__MISSING__:Connection",
+    "perKeyProxyEnabledTitle": "__MISSING__:Per-key proxy assignment enabled for this provider",
+    "perKeyProxyDisabledTitle": "__MISSING__:Per-key proxy assignment disabled for this provider",
     "autoPriority": "自動: {priority}",
     "proxy": "プロキシ",
     "retestAuthentication": "認証を再テストする",
@@ -3920,6 +4270,12 @@
     "compatProtocolOpenAI": "OpenAI Chat Completions",
     "compatProtocolOpenAIResponses": "OpenAI Responses API",
     "compatProtocolClaude": "Anthropic Messages",
+    "targetFormatLabel": "__MISSING__:Target Format",
+    "targetFormatHint": "__MISSING__:Override the upstream wire format. Use 'Anthropic Messages' to route OpenAI-compatible providers (e.g. opencode-go) through the /v1/messages endpoint.",
+    "targetFormatAuto": "__MISSING__:Default (auto)",
+    "targetFormatGemini": "__MISSING__:Gemini",
+    "targetFormatGeminiCli": "__MISSING__:Gemini CLI",
+    "targetFormatAntigravity": "__MISSING__:Antigravity",
     "compatUpstreamHeadersLabel": "Extra upstream headers",
     "compatUpstreamHeadersHint": "High-privilege setting — same trust level as editing provider API credentials; only trusted admins should use it. Merged after OmniRoute adds auth from the provider API key. If a custom header uses the same name as an existing one (e.g. Authorization), your value fully replaces the auto-generated header (including the Bearer token) — the upstream only sees what you typed, not the key from settings. Misconfiguration can cause 401 or broken upstream auth. One row per header (e.g. extra Authentication for some gateways). Hover or focus the value to preview. Saves on blur, outside click, or closing this panel.",
     "compatUpstreamHeaderName": "Header name",
@@ -3929,6 +4285,8 @@
     "compatBadgeUpstreamHeaders": "Headers",
     "perModelQuotaLabel": "Per Model Quota Label",
     "perModelQuotaDescription": "Per Model Quota Description",
+    "importFreeModelsOnlyLabel": "__MISSING__:Import only free models",
+    "importFreeModelsOnlyHint": "__MISSING__:When enabled, only this provider's free models are imported. Paid models are skipped.",
     "perModelQuotaToggle": "モデルごとのクォータの切り替え",
     "modelId": "モデルID",
     "customModelPlaceholder": "例: gpt-4.5-ターボ",
@@ -3964,7 +4322,6 @@
     "email": "電子メール",
     "healthCheckMinutes": "ヘルスチェック (分)",
     "healthCheckHint": "プロアクティブなトークンの更新間隔。 0 = 無効。",
-    "selectAllModels": "Select all",
     "deselectAllModels": "Deselect all",
     "modelsActiveCount": "{active}/{total} active",
     "noModelsMatch": "No models match \"{filter}\"",
@@ -3976,6 +4333,9 @@
     "editCompatibleTitle": "編集 {type} 互換",
     "compatibleBaseUrlHint": "Root URL of your {type}-compatible API. Use Advanced Settings for custom endpoint paths.",
     "apiKeyForCheck": "APIキー（チェック用）",
+    "testModelIdLabel": "__MISSING__:Model ID (optional)",
+    "testModelIdPlaceholder": "__MISSING__:e.g. my-model-id",
+    "testModelIdHint": "__MISSING__:If the provider lacks a /models endpoint, enter a model ID to validate via /chat/completions instead.",
     "compatibleProdPlaceholder": "{type} 互換性あり (製品)",
     "tokenRefreshed": "Token refreshed successfully",
     "tokenRefreshFailed": "Token refresh failed",
@@ -4069,6 +4429,19 @@
     "codexAuthApplyFailed": "Failed to apply Codex auth.json locally",
     "codexAuthExported": "Codex auth.json exported",
     "codexAuthExportFailed": "Failed to export Codex auth.json",
+    "codexCliGuideButton": "__MISSING__:Codex CLI Guide",
+    "codexCliGuideTitle": "__MISSING__:Codex CLI Guide",
+    "codexCliGuideLoading": "__MISSING__:Loading guide...",
+    "codexCliGuideLoadFailed": "__MISSING__:Could not load the guide.",
+    "codexExternalLinkButton": "__MISSING__:External Codex link",
+    "codexExternalLinkModalTitle": "__MISSING__:External Codex link",
+    "codexExternalLinkModalDescription": "__MISSING__:Share this single-use link with the person who will authenticate the Codex account. They open it in their own browser, complete the OpenAI login, and the connection is registered here. The link expires in 15 minutes.",
+    "codexExternalLinkGenerating": "__MISSING__:Generating link...",
+    "codexExternalLinkWaiting": "__MISSING__:Waiting for browser authentication. This window refreshes automatically.",
+    "codexExternalLinkCreateFailed": "__MISSING__:Failed to generate the link.",
+    "codexExternalLinkNetworkError": "__MISSING__:Could not contact the server.",
+    "codexExternalLinkConnected": "__MISSING__:Codex account connected through the external link.",
+    "codexExternalLinkExpired": "__MISSING__:The link expired before completion.",
     "importCodexAuth": "インポート認証",
     "codexImportModalTitle": "コーデックス認証のインポート",
     "codexImportTabSingle": "シングル",
@@ -4146,6 +4519,8 @@
     "t3ChatWebCookiePlaceholder": "凸セッションID=abc123...",
     "blockClaudeExtraUsageDescription": "Block Claude Extra Usage Description",
     "blockClaudeExtraUsageLabel": "Block Claude Extra Usage Label",
+    "disableCoolingDescription": "__MISSING__:Skip the transient cooldown so this connection stays eligible even after recoverable errors (terminal states like banned/expired still apply).",
+    "disableCoolingLabel": "__MISSING__:Disable cooldown for this connection",
     "bulkPasteAdded": "{count, plural, one {1 key added} other {# keys added}}",
     "bulkPasteDuplicatesIgnored": "{count, plural, one {1 duplicate skipped} other {# duplicates skipped}}",
     "bulkPasteHint": "Paste one API key per line. Empty lines are ignored and duplicate keys are skipped.",
@@ -4243,6 +4618,17 @@
     "personalAccessTokenLabel": "Personal Access Token Label",
     "qoderPatHint": "Qoder Pat Hint",
     "qoderPatPlaceholder": "Qoder Pat Placeholder",
+    "rateLimitOverridesSection": "__MISSING__:Rate Limit Overrides",
+    "rateLimitOverridesMaxConcurrentHint": "__MISSING__:Max concurrent requests override for this connection. Overrides the account-level cap.",
+    "rateLimitOverridesMaxConcurrentLabel": "__MISSING__:Max Concurrent (Rate Limit)",
+    "rateLimitOverridesMinTimeHint": "__MISSING__:Minimum time (ms) between requests. Overrides the default rate limiter delay.",
+    "rateLimitOverridesMinTimeLabel": "__MISSING__:Min Interval (ms)",
+    "rateLimitOverridesRpmHint": "__MISSING__:Max requests per minute for this connection. Overrides the provider default.",
+    "rateLimitOverridesRpmLabel": "__MISSING__:RPM (Requests/min)",
+    "rateLimitOverridesTpdHint": "__MISSING__:Max tokens per day for this connection. Overrides the provider default.",
+    "rateLimitOverridesTpdLabel": "__MISSING__:TPD (Tokens/day)",
+    "rateLimitOverridesTpmHint": "__MISSING__:Max tokens per minute for this connection. Overrides the provider default.",
+    "rateLimitOverridesTpmLabel": "__MISSING__:TPM (Tokens/min)",
     "refreshOauthTokenTitle": "Refresh Oauth Token Title",
     "regionHint": "Region Hint",
     "regionLabel": "Region Label",
@@ -4257,6 +4643,7 @@
     "searchProvider": "Search Provider",
     "searchProviderDesc": "Search Provider Desc",
     "searchProviders": "プロバイダーを検索...",
+    "searchByModel": "__MISSING__:Search by model…",
     "searchProvidersHeading": "Search Providers Heading",
     "searxngBaseUrlHint": "Searxng Base Url Hint",
     "searxngInfo": "Searxng Info",
@@ -4422,7 +4809,21 @@
     "webNoAuthGuideBody": "{provider} には API キーや Cookie は必要ありません。無料の Web エンドポイントを使用するには、接続を保存します。",
     "webSessionCredentialValidationFailed": "セッション資格情報の検証に失敗しました。再度サインインし、新しい資格情報をコピーして、再試行してください。",
     "checkCookie": "クッキーをチェックする",
-    "checkWebToken": "トークンをチェックする"
+    "checkWebToken": "トークンをチェックする",
+    "huggingchatLabel": "__MISSING__:HuggingChat (Free)",
+    "huggingchatDesc": "__MISSING__:Free LLM chat via huggingface.co/chat",
+    "phindLabel": "__MISSING__:Phind (Free)",
+    "phindDesc": "__MISSING__:Free dev-focused AI chat",
+    "poeWebLabel": "__MISSING__:Poe Web",
+    "poeWebDesc": "__MISSING__:Multi-model chat via poe.com",
+    "veniceWebLabel": "__MISSING__:Venice Web",
+    "veniceWebDesc": "__MISSING__:Privacy-focused AI chat",
+    "v0VercelWebLabel": "__MISSING__:v0 Vercel Web",
+    "v0VercelWebDesc": "__MISSING__:AI code generation via v0.dev",
+    "kimiWebLabel": "__MISSING__:Kimi Web",
+    "kimiWebDesc": "__MISSING__:Chinese market AI chat via kimi.moonshot.cn",
+    "doubaoWebLabel": "__MISSING__:Doubao Web",
+    "doubaoWebDesc": "__MISSING__:ByteDance AI chat via doubao.com"
   },
   "settings": {
     "title": "設定",
@@ -4528,6 +4929,7 @@
     "memoryDesc": "Persistent cross-session conversational memory",
     "memoryEnabled": "Enable Memory",
     "memoryEnabledDesc": "When enabled, OmniRoute will inject relevant past context.",
+    "memoryTokenCostWarning": "__MISSING__:Heads up: with memory enabled, OmniRoute injects up to {tokens} tokens of retrieved context into every chat request — this increases token usage and cost. To skip injection for a specific request, send the \"x-omniroute-no-memory: true\" header.",
     "maxTokens": "Max Tokens",
     "retentionDays": "Retention",
     "recent": "Recent",
@@ -4566,6 +4968,15 @@
     "modelsDevInfoOrder": "User Override → models.dev → LiteLLM → Hardcoded Default",
     "systemTheme": "システムテーマ",
     "debugToggle": "Enable Debug Mode",
+    "homePinProviderQuotaToHome": "Pin Information to Home Page",
+    "homeProviderQuotaLimits": "Provider Quota Limits",
+    "homeProviderQuotaLimitsDesc": "Pin the Provider Quota status container (with Refresh All button) to the top of the Home page.",
+    "homeQuickStart": "Quick Start",
+    "homeQuickStartDesc": "Show the Quick Start panel on the Home page.",
+    "homeProviderTopology": "Provider Topology",
+    "homeProviderTopologyDesc": "Show the Provider Topology on the Home page.",
+    "accountEmailVisibility": "__MISSING__:Account email visibility",
+    "accountEmailVisibilityDesc": "__MISSING__:Show full account emails across providers, combos, logs, quota, and playground screens. Turn this off to mask them by default.",
     "sidebarVisibilityToggle": "Show Sidebar Items",
     "enableCache": "キャッシュを有効にする",
     "cacheTTL": "キャッシュTTL",
@@ -4599,11 +5010,17 @@
     "autoDisableDescription": "Permanently mark provider connections as deactivated if they return specific terminal ban signals (e.g. HTTP 403 'verify your account'). This removes them from the combo rotation.",
     "autoDisableThreshold": "Ban Threshold",
     "autoDisableThresholdDesc": "Consecutive ban signals required before permanent deactivation.",
+    "customBannedSignals": "__MISSING__:Banned Keywords",
+    "customBannedSignalsDesc": "__MISSING__:Additional keywords that trigger permanent account ban detection. Built-in keywords always apply.",
+    "customBannedSignalsPlaceholder": "__MISSING__:e.g. api key revoked",
+    "noCustomBannedSignals": "__MISSING__:No custom keywords. Only built-in keywords are active.",
     "resilienceStructureTitle": "Resilience Structure",
     "resilienceStructureDesc": "このページでは動作を設定するだけです。ライブ ブレーカーの状態は [ヘルス] ページに表示されます。コンボ固有のリトライとラウンドロビン スロット制御はコンボ設定に残ります。",
     "enableThinking": "思考を可能にする",
     "maxThinkingTokens": "最大思考トークン",
     "enableProxy": "プロキシを有効にする",
+    "perKeyProxyEnabled": "__MISSING__:Enable per-key proxy assignment",
+    "perKeyProxyEnabledDesc": "__MISSING__:When enabled, each provider connection can use its own proxy assignment",
     "proxyUrl": "プロキシ URL",
     "pricingRates": "価格設定レートの形式",
     "currentPricing": "現在の価格の概要",
@@ -4683,6 +5100,13 @@
     "globalProxy": "グローバルプロキシ",
     "globalProxyDesc": "すべての API 呼び出しに対してグローバル送信プロキシを構成します。個々のプロバイダー、コンボ、およびキーはこれをオーバーライドできます。",
     "noGlobalProxy": "グローバル プロキシが構成されていません",
+    "proxyPool": "__MISSING__:Proxy Pool",
+    "freePool": "__MISSING__:Free Pool",
+    "proxyDocumentation": "__MISSING__:Proxy Documentation",
+    "proxyGlobalConfigTab": "__MISSING__:Global Config",
+    "proxyPoolTab": "__MISSING__:Proxy Pool",
+    "freePoolTab": "__MISSING__:Free Pool",
+    "proxyDocumentationTab": "__MISSING__:Documentation",
     "bulkHealthcheck": "Bulk Healthcheck",
     "bulkHealthcheckDesc": "Test all configured proxies against a target URL to find which ones work.",
     "healthcheckTesting": "Testing...",
@@ -4695,6 +5119,51 @@
     "healthcheckStatus": "Status",
     "healthcheckProxyUrl": "Proxy URL",
     "healthcheckLatency": "Latency",
+    "proxyDocumentationScopeTitle": "__MISSING__:Proxy scope resolution",
+    "proxyDocumentationScopeDescBefore": "__MISSING__:OmniRoute resolves the outbound proxy in priority order: ",
+    "proxyDocumentationScopeOrder": "__MISSING__:combo → account → provider → global",
+    "proxyDocumentationScopeDescAfter": "__MISSING__:. The most specific scope wins.",
+    "proxyDocumentationAddTitle": "__MISSING__:Adding a custom proxy",
+    "proxyDocumentationAddDescBefore": "__MISSING__:Go to the ",
+    "proxyDocumentationAddDescMiddle": "__MISSING__: tab → click ",
+    "proxyDocumentationAddCta": "__MISSING__:+ Add proxy",
+    "proxyDocumentationAddDescAfter": "__MISSING__:. Fill in type (http/https/socks5), host, and port. Optionally assign it to a scope.",
+    "proxyDocumentationBulkTitle": "__MISSING__:Bulk import format",
+    "proxyDocumentationBulkDesc": "__MISSING__:Pipe-delimited fields:",
+    "proxyDocumentationSocks5DescBefore": "__MISSING__:SOCKS5 proxies are disabled by default. Set",
+    "proxyDocumentationFreePoolDesc": "__MISSING__:The Free Pool tab aggregates proxies from 1proxy, Proxifly, and IPLocate. Use ⊕ to test and promote a proxy to your registry. Only proxies that pass the connectivity test are added.",
+    "proxyDocumentationVercelRelayDescBefore": "__MISSING__:The Vercel Relay is an outbound edge relay — not an inbound tunnel. Deploying one sends LLM API calls through Vercel's dynamic IPs, bypassing datacenter geo-blocks and rate limits. The relay is protected by a generated secret header",
+    "proxyDocumentationVercelRelayDescAfter": "__MISSING__:Your Vercel token is used only during deploy and is never stored.",
+    "vercelRelayTokenRequired": "__MISSING__:Token is required",
+    "vercelRelayDeployFailed": "__MISSING__:Deploy failed",
+    "vercelRelayTokenHint": "__MISSING__:Token is used only during deploy — never stored.",
+    "denoRelayTokenRequired": "__MISSING__:Deno Deploy token is required",
+    "denoRelayOrgDomainRequired": "__MISSING__:Organization domain is required",
+    "denoRelayDeployFailed": "__MISSING__:Deno Deploy failed",
+    "denoRelayTokenHint": "__MISSING__:Organization token (prefix ddo_) from console.deno.com → Organization → Settings → Organization Tokens. Used once for deploy and never stored.",
+    "denoRelayOrgDomainHint": "__MISSING__:Your Deno Deploy organization's default domain (e.g. acme.deno.net). The relay will be reachable at https://<app-name>.<org-slug>.deno.net.",
+    "proxyFreePoolFilterProtocol": "__MISSING__:Filter by protocol",
+    "proxyFreePoolProtocol": "__MISSING__:Protocol",
+    "proxyFreePoolCountryPlaceholder": "__MISSING__:Country (e.g. US)",
+    "proxyFreePoolFilterCountry": "__MISSING__:Filter by country",
+    "proxyFreePoolMinQualityPlaceholder": "__MISSING__:Min quality",
+    "proxyFreePoolMinQualityLabel": "__MISSING__:Minimum quality score",
+    "proxyFreePoolSyncAll": "__MISSING__:Sync All",
+    "proxyFreePoolTotal": "__MISSING__:Total",
+    "proxyFreePoolInPool": "__MISSING__:In pool",
+    "proxyFreePoolAvgQuality": "__MISSING__:Avg quality",
+    "proxyFreePoolSelected": "__MISSING__:{count} selected",
+    "proxyFreePoolAddSelected": "__MISSING__:Add selected to pool",
+    "proxyFreePoolAddVisible": "__MISSING__:Add all visible to pool",
+    "proxyFreePoolSource": "__MISSING__:Source",
+    "proxyFreePoolHostPort": "__MISSING__:Host:Port",
+    "proxyFreePoolType": "__MISSING__:Type",
+    "proxyFreePoolCountry": "__MISSING__:Country",
+    "proxyFreePoolQuality": "__MISSING__:Quality",
+    "proxyFreePoolLatency": "__MISSING__:Latency",
+    "proxyFreePoolEmpty": "__MISSING__:No proxies found. Click Sync All to fetch from sources.",
+    "close": "__MISSING__:Close",
+    "cancel": "__MISSING__:Cancel",
     "globalLabel": "グローバル",
     "configure": "設定する",
     "globalSystemPrompt": "グローバル システム プロンプト",
@@ -4951,6 +5420,7 @@
     "systemStorage": "システムとストレージ",
     "allDataLocal": "すべてのデータはマシン上にローカルに保存されます",
     "databasePath": "データベースのパス",
+    "export": "__MISSING__:Export",
     "exportDatabase": "データベースのエクスポート",
     "exportAll": "すべてエクスポート (.tar.gz)",
     "importDatabase": "データベースのインポート",
@@ -5038,6 +5508,11 @@
     "adaptiveVolumeRoutingDesc": "Scale connections dynamically based on payload volume and throughput pressure.",
     "lkgpToggleTitle": "Last Known Good Provider (LKGP)",
     "lkgpToggleDesc": "When enabled, the router remembers which provider last served a successful response and tries it first on subsequent requests.",
+    "echoRequestedModelTitle": "__MISSING__:Echo requested model name in responses",
+    "echoRequestedModelDesc": "__MISSING__:When enabled, the response `model` field echoes the alias or combo name the client requested instead of the upstream model name. Fixes strict clients (e.g. Claude Desktop) that reject a response whose model does not match the request.",
+    "webSearchRouteTitle": "__MISSING__:Web search routing",
+    "webSearchRouteDesc": "__MISSING__:When a request includes a native web_search tool, route the whole request to this model instead of the default — useful for providers that don't implement Anthropic's web_search server tool. Leave blank to disable.",
+    "webSearchRoutePlaceholder": "__MISSING__:e.g. openrouter,anthropic/claude-3.5-sonnet",
     "clearLkgpCache": "Clear LKGP Cache",
     "lkgpCacheCleared": "LKGP cache cleared successfully",
     "lkgpCacheClearFailed": "Failed to clear LKGP cache",
@@ -5102,6 +5577,16 @@
     "clearSyncedPricing": "Clear Synced Pricing",
     "compressionTitle": "Prompt Compression",
     "compressionDesc": "Reduce token usage by compressing prompts before sending to providers",
+    "tokenSaverTitle": "__MISSING__:Token Saver",
+    "tokenSaverSubtitle": "__MISSING__:Spend fewer tokens on every request.",
+    "tokenSaverToolOutput": "__MISSING__:Tool output",
+    "tokenSaverToolOutputDesc": "__MISSING__:Clean git, grep, ls, tree, and log output before it reaches the provider.",
+    "tokenSaverLlmOutput": "__MISSING__:LLM output",
+    "tokenSaverLlmOutputDesc": "__MISSING__:Inject terse response instructions without rewriting provider output.",
+    "tokenSaverInputCompression": "__MISSING__:Input compression",
+    "tokenSaverInputCompressionDesc": "__MISSING__:Rewrite eligible chat history while preserving code, URLs, and intent.",
+    "tokenSaverFineTunePrefix": "__MISSING__:Fine-tune each engine on",
+    "tokenSaverFineTuneSuffix": "__MISSING__:or combine engines per request on",
     "compressionMode": "Compression Mode",
     "compressionModeOff": "Off",
     "compressionModeOffDesc": "No compression applied",
@@ -5121,6 +5606,11 @@
     "compressionUltraMinScore": "最小スコアしきい値",
     "compressionUltraSlmFallback": "アグレッシブへのフォールバック",
     "compressionUltraModelPath": "SLM モデルのパス",
+    "compressionUltraEngine": "__MISSING__:Ultra tier",
+    "compressionUltraEngineHeuristic": "__MISSING__:Heuristic (Tier-A, default)",
+    "compressionUltraEngineSlm": "__MISSING__:SLM (LLMLingua-2, opt-in)",
+    "compressionUltraSlmHint": "__MISSING__:SLM downloads a small ONNX model on first use (cold-start) and transparently falls back to the heuristic on timeout or if unavailable.",
+    "compressionUltraSlmPrewarm": "__MISSING__:Pre-warm SLM model on enable",
     "compressionSummarizerEnabled": "サマライザーを有効にする",
     "compressionMaxTokensPerMessage": "メッセージあたりの最大トークン数",
     "compressionMinSavings": "最小貯蓄額のしきい値",
@@ -5308,13 +5798,22 @@
     "resilienceNo": "いいえ",
     "resilienceDefault": "Default",
     "storageDatabaseBackupRetention": "データベースバックアップの保持",
+    "storageDatabaseBackups": "__MISSING__:Database backups",
     "storagePurgeData": "データのパージ",
+    "storagePurgeDataDesc": "__MISSING__:Immediately delete all records without applying retention checks. Use with caution.",
+    "storageRetentionCleanup": "__MISSING__:Retention Settings",
+    "storageRetentionCleanupDesc": "__MISSING__:Configure operational record retention and database backup cleanup.",
+    "retentionCallDays": "__MISSING__:Call {count}d",
+    "retentionAppDays": "__MISSING__:App {count}d",
+    "retentionRows": "__MISSING__:{count} rows",
     "retentionQuotaSnapshots": "クォータのスナップショット (日)",
+    "retentionCompressionAnalytics": "__MISSING__:Compression Analytics (days)",
     "retentionMcpAudit": "MCP 監査 (日)",
     "retentionA2aEvents": "A2A イベント (日)",
     "retentionCallLogs": "通話記録 (日)",
     "retentionUsageHistory": "利用履歴（日）",
     "retentionMemoryEntries": "メモリエントリ (日)",
+    "saveRetentionSettings": "__MISSING__:Save retention settings",
     "storageAutoVacuumMode": "自動真空モード",
     "storageScheduledVacuum": "スケジュールされたバキューム",
     "storageVacuumHour": "真空時間 (0-23)",
@@ -5328,10 +5827,16 @@
     "storageIntegrityOk": "✓ OK",
     "storageIntegrityError": "✗ エラー",
     "storageUsageTokenBuffer": "使用量トークンバッファ",
+    "storageUsageTokenBufferDesc": "__MISSING__:Extra tokens added to reported usage to account for system prompt overhead.",
+    "storageUsageTokenBufferHint": "__MISSING__:Set to 0 to report raw provider token counts. Default: 2000.",
+    "storageUsageTokenBufferCurrent": "__MISSING__:Current: {value}",
     "compressionSettingsAutoTriggerMode": "オートトリガーモード",
     "compressionSettingsMcpDescriptionCompression": "MCP 記述圧縮",
+    "mcpAccessibilityTitle": "__MISSING__:MCP accessibility output",
     "compressionSettingsCavemanIntensity": "穴居人の激しさ",
     "compressionSettingsCavemanOutputMode": "穴居人出力モード",
+    "compressionSettingsOutputStyles": "__MISSING__:Output styles",
+    "compressionStylesTileTitle": "__MISSING__:Output styles",
     "compressionSettingsOutputIntensity": "出力強度",
     "compressionSettingsAutoClarityBypass": "自動明瞭度バイパス",
     "resilienceWaitForCooldown": "クールダウンを待ちます",
@@ -5347,6 +5852,9 @@
     "cliproxyapiUrl": "CLIProxyAPI URL",
     "cliproxyapiStatus": "CLIProxyAPI ステータス",
     "cliproxyapiNotDetected": "検出されませんでした",
+    "cliproxyapiImportAuthTitle": "__MISSING__:Import accounts from CLIProxyAPI",
+    "cliproxyapiImportAuthDesc": "__MISSING__:Import the OAuth accounts CLIProxyAPI already saved in ~/.cli-proxy-api/ as OmniRoute connections, so you don't have to log in to each account again. Supported account types (Gemini, Codex, Claude, Antigravity, Qwen, Kimi) are imported; others are skipped.",
+    "cliproxyapiImportAuthButton": "__MISSING__:Import accounts",
     "payloadRulesTitle": "ペイロードルール",
     "payloadRulesDesc": "__MISSING__:Configure request payload mutations by model and protocol. Changes are persisted in settings and hot reloaded into the runtime immediately after save.",
     "payloadRuleDefaultTitle": "__MISSING__:default",
@@ -5379,6 +5887,14 @@
     "maxResponseTokensDesc": "__MISSING__:Maximum total tokens allowed in a single response.",
     "modelCooldownsTitle": "クールダウン中のモデル",
     "modelCooldownsEmpty": "現在クールダウン中のモデルはありません。",
+    "responsesStateTitle": "__MISSING__:Responses State",
+    "responsesStateDesc": "__MISSING__:Control how OmniRoute forwards previous_response_id.",
+    "responsesStateModeLabel": "__MISSING__:previous_response_id handling",
+    "responsesStateModeAuto": "__MISSING__:Auto",
+    "responsesStateModeStrip": "__MISSING__:Strip",
+    "responsesStateModePreserve": "__MISSING__:Preserve",
+    "responsesStateHint": "__MISSING__:Auto strips previous_response_id unless a connection explicitly enables OpenAI Responses storage. Strip is safest for stateless clients such as VS Code Custom Endpoint; context then depends on the client sending full history.",
+    "responsesStateSaveError": "__MISSING__:Failed to update Responses state setting",
     "codexFastTierTitle": "コーデックス高速層",
     "codexFastTierDesc": "OpenAI Codex リクエストの service_tier=priority をグローバルに挿入します。",
     "codexFastTierHint": "有効にすると、OmniRoute は層がまだ指定されていない接続のアウトバウンド Codex リクエストに service_tier=priority を追加します。優先レベルには、OpenAI Enterprise API キーまたは ChatGPT-auth Codex パスが必要です。他のキー タイプは、OpenAI から層関連のエラーを受け取ります。 Codex プロバイダー ページの接続ごとの設定が優先されます。",
@@ -5485,6 +6001,15 @@
     "resilienceEnableServerWaitDesc": "有効にすると、OmniRoute は最初のクールダウンが期限切れになるまで待機し、自動的に再試行します。",
     "resilienceMaxAttempts": "最大試行回数",
     "resilienceMaxWaitPerAttempt": "試行ごとの最大待機時間",
+    "resilienceProviderCooldownTitle": "__MISSING__:Provider Cooldown",
+    "resilienceProviderCooldownScope": "__MISSING__:All combo requests",
+    "resilienceProviderCooldownTrigger": "__MISSING__:When a provider/connection fails",
+    "resilienceProviderCooldownEffect": "__MISSING__:Skips the failed provider for a cooldown period before retrying",
+    "resilienceProviderCooldownDesc": "__MISSING__:Prevents subsequent requests from re-walking the same failing providers. Cooldown scales exponentially with consecutive failures.",
+    "resilienceProviderCooldownEnabled": "__MISSING__:Enable global provider cooldown",
+    "resilienceProviderCooldownEnabledDesc": "__MISSING__:When enabled, failed providers are tracked globally and skipped for a cooldown period.",
+    "resilienceProviderCooldownMin": "__MISSING__:Minimum cooldown",
+    "resilienceProviderCooldownMax": "__MISSING__:Maximum cooldown",
     "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
     "forcedFingerprintBadge": "Required",
     "codexSessionAffinityTitle": "コーデックスセッションアフィニティ",
@@ -5506,13 +6031,45 @@
     "vercelRelayFreeTierNote": "__MISSING__:Relays are lightweight proxy endpoints deployed on Vercel's free tier to bypass local network/region limitations.",
     "vercelRelayDeploying": "__MISSING__:Deploying...",
     "vercelRelayDeploy": "__MISSING__:Deploy",
-    "homePinProviderQuotaToHome": "Pin Information to Home Page",
-    "homeProviderQuotaLimits": "Provider Quota Limits",
-    "homeProviderQuotaLimitsDesc": "Pin the Provider Quota status container (with Refresh All button) to the top of the Home page.",
-    "homeQuickStart": "Quick Start",
-    "homeQuickStartDesc": "Show the Quick Start panel on the Home page.",
-    "homeProviderTopology": "Provider Topology",
-    "homeProviderTopologyDesc": "Show the Provider Topology on the Home page."
+    "deployRelayButton": "__MISSING__:Deploy Relay",
+    "denoRelayButton": "__MISSING__:Deploy Deno Relay",
+    "denoRelayModalTitle": "__MISSING__:Deploy Deno Relay",
+    "denoRelayWarning": "__MISSING__:Warning: A Deno Deploy organization token is required. This token will only be used to create the relay app and will never be stored by OmniRoute.",
+    "denoRelayTokenLabel": "__MISSING__:Deno Deploy Organization Token",
+    "denoRelayOrgDomainLabel": "__MISSING__:Organization Domain",
+    "denoRelayProjectNameLabel": "__MISSING__:Deno App Name",
+    "denoRelayFreeTierNote": "__MISSING__:Deno Deploy v2 runs on a global edge network. Free tier: 1M requests & 100GiB outbound traffic per month, no per-request CPU limits, up to 20 active apps & 50 custom domains.",
+    "denoRelayDeploying": "__MISSING__:Deploying...",
+    "denoRelayDeploy": "__MISSING__:Deploy",
+    "cloudflareRelaySuccess": "__MISSING__:Cloudflare Relay deployed successfully",
+    "cloudflareRelayButton": "__MISSING__:Deploy Cloudflare Relay",
+    "cloudflareRelayModalTitle": "__MISSING__:Deploy Cloudflare Worker Relay",
+    "cloudflareRelayWarning": "__MISSING__:Deploys a Cloudflare Worker that proxies LLM requests through Cloudflare's edge network — masking the host IP behind dynamic Cloudflare addresses. The Worker enforces a one-time auth secret so the public workers.dev URL cannot be reused as an open relay.",
+    "cloudflareRelayTokenHowto": "__MISSING__:Create the API token under My Profile -> API Tokens -> Create Token -> Custom Token -> Account / Workers Scripts / Edit.",
+    "cloudflareRelayAccountIdLabel": "__MISSING__:Cloudflare Account ID",
+    "cloudflareRelayAccountIdHint": "__MISSING__:Found on the right side of the Cloudflare dashboard overview page.",
+    "cloudflareRelayApiTokenLabel": "__MISSING__:Cloudflare API Token",
+    "cloudflareRelayApiTokenHint": "__MISSING__:Requires 'Workers Scripts: Edit' permission. The token is used only at deploy time and is never stored.",
+    "cloudflareRelayProjectNameLabel": "__MISSING__:Worker Name",
+    "cloudflareRelayFreeTierNote": "__MISSING__:Free tier: 100,000 requests/day per Cloudflare account.",
+    "cloudflareRelayDeploying": "__MISSING__:Deploying...",
+    "cloudflareRelayDeploy": "__MISSING__:Deploy",
+    "cloudflareRelayCredsRequired": "__MISSING__:Account ID and API Token are required",
+    "cloudflareRelayDeployFailed": "__MISSING__:Deploy failed",
+    "modelLockout": "__MISSING__:Model Lockout",
+    "modelLockoutPageDescription": "__MISSING__:Configure which HTTP error codes trigger per-model lockout and control the cooldown behavior.",
+    "modelLockoutEnabled": "__MISSING__:Enable Model Lockout",
+    "modelLockoutEnabledDescription": "__MISSING__:When enabled, models that fail with configured error codes are temporarily locked to prevent retry loops.",
+    "modelLockoutErrorCodes": "__MISSING__:Error Codes",
+    "modelLockoutErrorCodesDescription": "__MISSING__:HTTP status codes that trigger model lockout. Type a code and click Add, or select from suggestions.",
+    "modelLockoutBaseCooldown": "__MISSING__:Base Cooldown (ms)",
+    "modelLockoutBaseCooldownDescription": "__MISSING__:Initial cooldown duration in milliseconds before a model can be retried.",
+    "modelLockoutMaxCooldown": "__MISSING__:Max Cooldown (ms)",
+    "modelLockoutMaxCooldownDescription": "__MISSING__:Maximum cooldown duration in milliseconds. Prevents excessively long lockouts.",
+    "modelLockoutExponentialBackoff": "__MISSING__:Exponential Backoff",
+    "modelLockoutExponentialBackoffDescription": "__MISSING__:When enabled, each consecutive failure increases the cooldown duration exponentially.",
+    "modelLockoutMaxBackoffSteps": "__MISSING__:Max Backoff Steps",
+    "modelLockoutMaxBackoffStepsDescription": "__MISSING__:Maximum number of backoff steps before the cooldown stops growing. The Max Cooldown cap is reached first in most configurations, making this a safety ceiling for when Max Cooldown is raised."
   },
   "contextRtk": {
     "title": "RTK Engine",
@@ -5563,7 +6120,21 @@
     "searchFilters": "検索フィルター...",
     "tooltipDedup": "繰り返される行をどれだけ積極的に削除するか。",
     "tooltipMaxChars": "出力ブロックあたりの最大文字数。",
-    "tooltipMaxLines": "コマンド出力から保持する最大行数。超過分は切り捨てられます。"
+    "tooltipMaxLines": "コマンド出力から保持する最大行数。超過分は切り捨てられます。",
+    "learnDiscoverTitle": "__MISSING__:Learn & Discover filters",
+    "learnDiscoverDesc": "__MISSING__:Mine your captured command output (Raw Output retention must be on) to suggest new RTK filters. Suggestions only — you review and save them.",
+    "discoverHeading": "__MISSING__:Discover repeated noise",
+    "discoverButton": "__MISSING__:Scan samples",
+    "discoverScanning": "__MISSING__:Scanning…",
+    "discoverEmpty": "__MISSING__:No repeated noise found. Enable Raw Output retention and run a few commands first.",
+    "discoverSamples": "__MISSING__:{count} sample(s) scanned",
+    "discoverHits": "__MISSING__:{hits}× across samples",
+    "learnHeading": "__MISSING__:Learn a filter for a command",
+    "learnCommandPlaceholder": "__MISSING__:e.g. npm install",
+    "learnButton": "__MISSING__:Suggest filter",
+    "learnEmpty": "__MISSING__:No suggestion yet. Type a command you have run and scan.",
+    "learnSamplesUsed": "__MISSING__:Learned from {count} matching sample(s)",
+    "suggestionError": "__MISSING__:Could not load suggestions. Check management auth and try again."
   },
   "contextCombos": {
     "title": "Compression Combos",
@@ -5853,7 +6424,80 @@
     "routeConnectionLabel": "接続",
     "scenarioVision": "ビジョン（イメージ理解）",
     "scenarioSchemaCoercion": "スキーマ強制 (構造化出力)",
-    "techniques": "テクニック:"
+    "techniques": "テクニック:",
+    "friendlyTitle": "__MISSING__:Translator",
+    "friendlySubtitle": "__MISSING__:Use your existing app with any provider — without rewriting code.",
+    "conceptHeadline": "__MISSING__:Your app speaks one API's \"language\". The Translator converts it to use another provider.",
+    "conceptDiagramAppLabel": "__MISSING__:Your app",
+    "conceptDiagramSourceLabel": "__MISSING__:Source format",
+    "conceptDiagramHubLabel": "__MISSING__:OpenAI (hub)",
+    "conceptDiagramTargetLabel": "__MISSING__:Target provider",
+    "conceptDiagramExampleApp": "__MISSING__:e.g. Anthropic SDK",
+    "conceptDiagramExampleSource": "__MISSING__:claude",
+    "conceptDiagramExampleTarget": "__MISSING__:Gemini",
+    "conceptHowItWorksToggle": "__MISSING__:How it works",
+    "conceptHowItWorksBody": "__MISSING__:Your app sends a request in its own format. The Translator detects the format, converts it through OpenAI as an intermediate hub (or directly when a direct translator is available), sends it to the chosen provider, and returns the response converted back to your app's format.",
+    "tabTranslate": "__MISSING__:Translate",
+    "tabMonitor": "__MISSING__:Monitor",
+    "tabTranslateAriaLabel": "__MISSING__:Go to the Translate tab",
+    "tabMonitorAriaLabel": "__MISSING__:Go to the Monitor tab",
+    "simpleAppUsesLabel": "__MISSING__:My app uses",
+    "simpleAppUsesHint": "__MISSING__:The API format your app speaks (e.g. Anthropic SDK = claude).",
+    "simpleSendToLabel": "__MISSING__:Send to",
+    "simpleSendToHint": "__MISSING__:Where to actually send the request (a provider connected in OmniRoute).",
+    "simpleStartWithLabel": "__MISSING__:Start with",
+    "simpleStartWithExamplePlaceholder": "__MISSING__:Select a ready-made example",
+    "simpleStartWithCustomOption": "__MISSING__:Paste your request (advanced)",
+    "simpleModeLabel": "__MISSING__:Mode",
+    "simpleModePreview": "__MISSING__:Preview translation only",
+    "simpleModeSend": "__MISSING__:Send and see response",
+    "simpleAdvancedToggle": "__MISSING__:Advanced",
+    "simpleInputPanelTitle": "__MISSING__:Input",
+    "simpleInputPanelHint": "__MISSING__:Free-text message or ready-made example",
+    "simpleResultPanelTitle": "__MISSING__:Translation + Response",
+    "narratedDetected": "__MISSING__:✓ Detected: {format}",
+    "narratedTranslating": "__MISSING__:Translating to {target}...",
+    "narratedSending": "__MISSING__:Sending to {target}...",
+    "narratedSuccess": "__MISSING__:→ translated to {target} · response in {latency}ms",
+    "narratedError": "__MISSING__:Failed: {reason}",
+    "narratedSeeTranslatedJson": "__MISSING__:see translated JSON",
+    "narratedSeePipeline": "__MISSING__:see pipeline",
+    "advancedSectionTitle": "__MISSING__:Advanced",
+    "advancedSectionSubtitle": "__MISSING__:Raw JSON, pipeline and technical tools. Everything here is the same as the old tabs — just reorganized.",
+    "advancedRawJsonTitle": "__MISSING__:Raw JSON (auto-detect + Monaco)",
+    "advancedRawJsonSubtitle": "__MISSING__:Paste a JSON request; the format is detected automatically.",
+    "advancedPipelineTitle": "__MISSING__:OpenAI intermediate pipeline",
+    "advancedPipelineSubtitle": "__MISSING__:Visualize each translation step (hub-and-spoke).",
+    "advancedStreamTransformTitle": "__MISSING__:Stream Transformer (Chat → Responses SSE)",
+    "advancedStreamTransformSubtitle": "__MISSING__:Converts Chat Completions SSE into Responses API.",
+    "advancedTestBenchTitle": "__MISSING__:Test Bench (8 scenarios)",
+    "advancedTestBenchSubtitle": "__MISSING__:Runs all scenarios and reports pass/fail + compatibility %.",
+    "advancedCompressionTitle": "__MISSING__:Compression Preview",
+    "advancedCompressionSubtitle": "__MISSING__:Estimate token savings across different compression modes.",
+    "monitorOriginHint": "__MISSING__:Events generated by Translate or the main pipeline appear here in real time.",
+    "monitorEmptyCta": "__MISSING__:Go to the Translate tab and send a request — it will appear here.",
+    "monitorOpenTranslateButton": "__MISSING__:Go to Translate",
+    "pipelineStepClientRequest": "__MISSING__:Client Request",
+    "pipelineStepClientRequestDesc": "__MISSING__:Request received in client format",
+    "pipelineStepFormatDetected": "__MISSING__:Format Detected",
+    "pipelineStepFormatDetectedDesc": "__MISSING__:Auto-detected source format",
+    "pipelineStepOpenAIIntermediate": "__MISSING__:OpenAI Intermediate",
+    "pipelineStepOpenAIIntermediateDesc": "__MISSING__:Translated to OpenAI hub format",
+    "pipelineStepProviderFormat": "__MISSING__:Provider Format",
+    "pipelineStepProviderFormatDesc": "__MISSING__:Translated to provider target format",
+    "pipelineStepProviderResponse": "__MISSING__:Provider Response",
+    "pipelineStepProviderResponseDesc": "__MISSING__:Streaming response from provider",
+    "conceptDiagramArrow1": "__MISSING__:speaks",
+    "conceptDiagramArrow2": "__MISSING__:translates",
+    "conceptDiagramArrow3": "__MISSING__:converts",
+    "conceptDiagramExampleHub": "__MISSING__:OpenAI",
+    "conceptDiagramHubTooltip": "__MISSING__:Intermediate hub used by the translator to convert between formats that don't have a direct mapping.",
+    "conceptDiagramSourceTooltip": "__MISSING__:The API format your app speaks (e.g., Anthropic SDK = claude).",
+    "conceptDiagramTargetTooltip": "__MISSING__:The provider where the request will actually be sent.",
+    "compressionEmptyHint": "__MISSING__:Fill in the input field on the Translate tab (Simple Controls or Raw JSON) to enable the preview.",
+    "compressionModeLabel": "__MISSING__:Compression mode",
+    "compressionPreviewButton": "__MISSING__:Preview Compression",
+    "compressionPreviewing": "__MISSING__:Previewing…"
   },
   "usage": {
     "title": "使用法",
@@ -6010,6 +6654,8 @@
     "notApplicable": "該当なし",
     "rawPlanWithValue": "未加工のプラン: {plan}",
     "noPlanFromProvider": "プロバイダーからのプランなし",
+    "tokenExpiresIn": "__MISSING__:Token expires in {time}",
+    "tokenExpired": "__MISSING__:Token expired",
     "noQuotaData": "クォータ データがありません",
     "cardExpand": "__MISSING__:Expand",
     "cardCollapse": "__MISSING__:Collapse",
@@ -6159,6 +6805,11 @@
     "quotaCutoffsButtonDefault": "デフォルト",
     "quotaCutoffsButtonHelp": "このアカウントの残りの最小クォータのカットオフを編集します。",
     "quotaCutoffsButtonDisabled": "このアカウントではまだ利用可能なクォータ ウィンドウがありません。",
+    "deactivateAccount": "__MISSING__:Deactivate account (stop routing)",
+    "activateAccount": "__MISSING__:Activate account (resume routing)",
+    "accountActivated": "__MISSING__:Account activated",
+    "accountDeactivated": "__MISSING__:Account deactivated",
+    "toggleActiveFailed": "__MISSING__:Failed to update account status",
     "quotaCutoffsTitle": "{name} ({provider}) のクォータ カットオフ",
     "quotaCutoffsExplainer": "このアカウントが各クォータ ウィンドウで選択されなくなる最小残りクォータ パーセンテージをオーバーライドします。プロバイダーのデフォルトを継承するには、空白のままにします。",
     "quotaCutoffsDefaultHint": "デフォルトの残りの最小値: {default}%",
@@ -6179,6 +6830,7 @@
     "budgetColDailyLim": "毎日の制限",
     "budgetColMonthlyLim": "月間限度額",
     "budgetColUsedPct": "使用済み%",
+    "percentUsed": "__MISSING__:{pct}% used",
     "budgetLoading": "読み込み中…",
     "budgetNoKeysMatch": "フィルタに一致するキーはありません",
     "budgetLinearExtrapolation": "線形外挿",
@@ -7124,6 +7776,11 @@
     "modalEditTitle": "Modal Edit Title",
     "labelName": "Label Name",
     "labelType": "種類",
+    "labelFamily": "__MISSING__:IP family",
+    "familyAuto": "__MISSING__:Auto (dual-stack)",
+    "familyIpv4": "__MISSING__:IPv4 only",
+    "familyIpv6": "__MISSING__:IPv6 only",
+    "familyHint": "__MISSING__:Egress address family. Auto keeps dual-stack; IPv4/IPv6 pin this proxy to that family (prevents a v4 leak under an IPv6-only proxy).",
     "labelHost": "ホスト",
     "labelPort": "港",
     "labelUsername": "ユーザー名",
@@ -7266,7 +7923,16 @@
     "improveConfirm": "Improve",
     "exportCode": "Export code",
     "exportCodeTitle": "Export Code",
+    "exportShort": "__MISSING__:Export",
     "noStateToExport": "No playground state available to export.",
+    "closeExportModal": "__MISSING__:Close export modal",
+    "close": "__MISSING__:Close",
+    "exportRealKeyWarning": "__MISSING__:Security warning: export blocked — a real API key was detected in the output. Please reset your API key and try again.",
+    "placeholderHintPrefix": "__MISSING__:Replace",
+    "placeholderHintSuffix": "__MISSING__:with your actual API key, or set it as an environment variable.",
+    "copyLangCode": "__MISSING__:Copy {language} code",
+    "loadingPresets": "__MISSING__:Loading…",
+    "loadPresetPlaceholder": "__MISSING__:Load preset…",
     "copyCode": "Copy",
     "copiedCode": "Copied!",
     "addModel": "+ Add model",
@@ -7291,7 +7957,27 @@
     "invalidJson": "Invalid JSON",
     "running": "Running…",
     "runLabel": "Run",
-    "enterToolResult": "Enter tool result…"
+    "enterToolResult": "Enter tool result…",
+    "build": {
+      "step1Label": "__MISSING__:What to test?",
+      "step2Label": "__MISSING__:Configure",
+      "step3Label": "__MISSING__:Run",
+      "step1Title": "__MISSING__:What do you want to test?",
+      "step1Subtitle": "__MISSING__:Choose the capability you want to explore in this session.",
+      "step2Title": "__MISSING__:Configure",
+      "step2Subtitle": "__MISSING__:Set up the tools or JSON schema that will be used in the request.",
+      "step3Title": "__MISSING__:Run",
+      "modeToolsTitle": "__MISSING__:Tools",
+      "modeToolsDesc": "__MISSING__:Test function calling — define tools and see how the model invokes them.",
+      "modeJsonTitle": "__MISSING__:JSON",
+      "modeJsonDesc": "__MISSING__:Test structured output — constrain the response to a JSON schema.",
+      "modeBothTitle": "__MISSING__:Tools + JSON",
+      "modeBothDesc": "__MISSING__:Combine function calling and structured output in a single request.",
+      "backButton": "__MISSING__:Back",
+      "nextButton": "__MISSING__:Next",
+      "runButton": "__MISSING__:Run",
+      "promptPlaceholder": "__MISSING__:Enter your message… (Enter to send, Shift+Enter for newline)"
+    }
   },
   "miniPlayground": {
     "endpoint": "__MISSING__:Endpoint",
@@ -7395,7 +8081,9 @@
     "loadingLogs": "Loading logs...",
     "noLogs": "No logs yet. Make some API calls to see them here.",
     "noMatchingLogs": "No logs matching current filters.",
-    "callLogsInfo": "Call logs are also saved as JSON files to {dataDir} and rotated based on {retentionDays} and {maxEntries}."
+    "callLogsInfo": "Call logs are also saved as JSON files to {dataDir} and rotated based on {retentionDays} and {maxEntries}.",
+    "loadMore": "__MISSING__:Load More",
+    "loadingMore": "__MISSING__:Loading more..."
   },
   "proxyLogger": {
     "filterAll": "All",
@@ -7432,7 +8120,8 @@
     "loadingProxyLogs": "Loading proxy logs...",
     "noProxyLogs": "No proxy logs yet. Configure proxies and make API calls to see them here.",
     "noMatchingLogs": "No logs match the current filters.",
-    "tlsFingerprint": "Chrome 124 TLS Fingerprint"
+    "tlsFingerprint": "Chrome 124 TLS Fingerprint",
+    "colPublicIp": "__MISSING__:Public IP"
   },
   "endpointOptions": {
     "speech": "Speech",
@@ -7572,7 +8261,86 @@
     "betaConfigSavedSuffix": "(まだサーバー上に永続化されていません)。リクエストごとの上限の強制はまだプロキシ パイプラインに組み込まれていません。この画面では、クォータ分割を設計および視覚化できます。実際の適用は、DB 永続性とアップストリーム コール インターセプトを伴う将来の反復で行われます。",
     "policyLabel": "ポリシー:",
     "resetIn": "リセットして",
-    "quotaTotal": "合計"
+    "quotaTotal": "合計",
+    "kpiAvgUtilization": "__MISSING__:Avg utilization",
+    "kpiBorrowingNow": "__MISSING__:Borrowing now",
+    "conceptTitle": "__MISSING__:How Quota Share works",
+    "conceptIntro": "__MISSING__:Quota Share divides a provider's quota among multiple API keys using work-conserving fair-share: each key receives a proportional slice but can borrow from the free balance without exceeding the global cap.",
+    "conceptFairShare": "__MISSING__:Fair-share: each key receives quota proportional to its configured weight",
+    "conceptBorrowing": "__MISSING__:Borrowing: keys can consume free balance from others without breaching the cap",
+    "conceptGlobalCap": "__MISSING__:Hard global cap: the provider's absolute limit is never exceeded",
+    "conceptWindows": "__MISSING__:Windows: 5h, hourly, daily, weekly, monthly — each tracked independently",
+    "conceptKeyHowTitle": "__MISSING__:Enabling a key for quota",
+    "conceptKeyHowDesc": "__MISSING__:Create the key normally in API Keys — it appears in the wizard's key step automatically. Tick Exclusive there to make it quota-only. No separate enable step.",
+    "conceptExclusiveTitle": "__MISSING__:What \"Exclusive\" does",
+    "conceptExclusiveDesc": "__MISSING__:An exclusive key only sees/uses the pool's quotaShared-* models — every other model is hidden from its /v1/models and blocked.",
+    "burnRateTitle": "__MISSING__:Burn rate",
+    "burnRateExhaustsIn": "__MISSING__:Exhausts in",
+    "dimensionResetIn": "__MISSING__:Resets in",
+    "realConsumedColumn": "__MISSING__:Consumed",
+    "deficitColumn": "__MISSING__:Deficit",
+    "borrowingIndicator": "__MISSING__:borrowing",
+    "migratedFromLocalStorageNotice": "__MISSING__:Pools successfully migrated from localStorage.",
+    "policyCapAbsoluteLabel": "__MISSING__:Absolute cap",
+    "policyCapAbsolutePlaceholder": "__MISSING__:Numeric limit (optional)",
+    "multiDimensionLabel": "__MISSING__:Multi-dimension",
+    "stackedBarTitle": "__MISSING__:Slices by API key",
+    "usedSuffix": "__MISSING__:used {percent}%",
+    "wizardTitle": "__MISSING__:New quota pool",
+    "editPoolTitle": "__MISSING__:Edit pool",
+    "saveChanges": "__MISSING__:Save changes",
+    "wizardStep1Label": "__MISSING__:Account",
+    "wizardStep2Label": "__MISSING__:Limit",
+    "wizardStep3Label": "__MISSING__:Keys",
+    "wizardStep1Title": "__MISSING__:Choose provider connection",
+    "wizardStep1Subtitle": "__MISSING__:Select the provider account this pool will share quota for, set a name and default policy.",
+    "wizardStep2Title": "__MISSING__:Configure quota dimensions",
+    "wizardStep2Subtitle": "__MISSING__:Define the quota plan dimensions (unit, window, limit) for the chosen connection. Leave unchanged to keep current settings.",
+    "wizardStep3Title": "__MISSING__:Allocate API keys",
+    "wizardStep3Subtitle": "__MISSING__:Assign API keys to this pool with weight % allocations and optional caps.",
+    "wizardPoolNameLabel": "__MISSING__:Pool name",
+    "wizardPoolNamePlaceholder": "__MISSING__:My quota pool",
+    "wizardNext": "__MISSING__:Next",
+    "wizardBack": "__MISSING__:Back",
+    "wizardCreatePool": "__MISSING__:Create pool",
+    "wizardDimensionsEditedNotice": "__MISSING__:Dimensions edited — will be saved as a manual override when the pool is created.",
+    "wizardExclusiveLabel": "__MISSING__:Exclusive quota",
+    "wizardExclusiveHint": "__MISSING__:When enabled, these API keys will only be allowed to use this pool's virtual models (allowedQuotas reconciliation is applied on save).",
+    "wizardPreviewLabel": "__MISSING__:Virtual model names preview",
+    "wizardConnectionsLabel": "__MISSING__:Provider connections",
+    "wizardPrimaryBadge": "__MISSING__:primary",
+    "wizardAdditionalConnectionsNote": "__MISSING__:Additional connections use their catalog default limits (editable later).",
+    "wizardSingleProviderNote": "__MISSING__:A pool uses a single provider",
+    "wizardPreviewMoreModels": "__MISSING__:+{count} more",
+    "accountQuotaTitle": "__MISSING__:Account quota",
+    "accountQuotaNone": "__MISSING__:—",
+    "logTitle": "__MISSING__:Usage log",
+    "logEmpty": "__MISSING__:No usage yet",
+    "groupLabel": "__MISSING__:Group",
+    "newGroup": "__MISSING__:New group",
+    "renameGroup": "__MISSING__:Rename group",
+    "groupSelectHint": "__MISSING__:Filter pools by group",
+    "groupAllocationNote": "__MISSING__:Allocations apply to all pools in this group via the shared quota layer.",
+    "groupNamePrompt": "__MISSING__:Enter group name",
+    "wizardGroupLabel": "__MISSING__:Group",
+    "allGroups": "__MISSING__:All groups",
+    "endpointsTitle": "__MISSING__:Available endpoints",
+    "endpointsHint": "__MISSING__:Call these virtual models with any allocated key — routing + quota are handled per group.",
+    "previewForKey": "__MISSING__:Preview for key",
+    "previewKeyNone": "__MISSING__:(all endpoints)",
+    "endpointsBaseUrl": "__MISSING__:Base URL",
+    "endpointsCollapse": "__MISSING__:Collapse",
+    "endpointsExpand": "__MISSING__:Expand",
+    "endpointsAnthropicNote": "__MISSING__:Anthropic-native",
+    "endpointsResponsesNote": "__MISSING__:OpenAI Responses — codex/github",
+    "endpointsWsNote": "__MISSING__:WebSocket — codex only",
+    "betaText": "__MISSING__:Quota Share is functional but bugs are expected. Found one? Please report it.",
+    "betaReportLink": "__MISSING__:Report an issue",
+    "deleteGroup": "__MISSING__:Delete group",
+    "deleteGroupConfirm": "__MISSING__:Delete this group? Its pools must be reassigned or removed first.",
+    "deleteGroupHasPools": "__MISSING__:This group still has pools — reassign or delete them first.",
+    "ungroupedTitle": "__MISSING__:Ungrouped",
+    "ungroupedHint": "__MISSING__:These pools are not assigned to a known group. Edit a pool to move it into a real group."
   },
   "plugins": {
     "title": "Plugins",
@@ -7608,6 +8376,571 @@
     "status": "Status",
     "enabled": "Enabled",
     "disabled": "Disabled",
+    "installedTab": "__MISSING__:Installed",
+    "marketplaceTab": "__MISSING__:Marketplace",
+    "marketplaceUrlLabel": "__MISSING__:Custom Marketplace URL",
+    "marketplaceUrlPlaceholder": "__MISSING__:Leave empty for official Omniroute registry",
+    "saveMarketplaceUrl": "__MISSING__:Save & Reload",
+    "marketplaceUrlSaved": "__MISSING__:Marketplace URL updated",
+    "marketplaceEmpty": "__MISSING__:No plugins found in marketplace.",
+    "verified": "__MISSING__:Verified",
+    "install": "__MISSING__:Install",
+    "installedFromMarketplace": "__MISSING__:Plugin {name} installed!",
     "hooks": "Hooks"
+  },
+  "quotaPlans": {
+    "title": "__MISSING__:Plans & Quotas",
+    "description": "__MISSING__:Configure quota plans per provider — dimensions (%, requests, tokens, $) and time windows",
+    "providerLabel": "__MISSING__:Provider / Connection",
+    "detectedPlanLabel": "__MISSING__:Detected plan",
+    "manualPlanLabel": "__MISSING__:Manual override",
+    "unconfiguredLabel": "__MISSING__:Not configured — manual required",
+    "dimensionLabel": "__MISSING__:Dimensions",
+    "addDimension": "__MISSING__:Add dimension",
+    "removeDimension": "__MISSING__:Remove",
+    "limitLabel": "__MISSING__:Limit",
+    "unitOptions": {
+      "percent": "__MISSING__:%",
+      "requests": "__MISSING__:requests",
+      "tokens": "__MISSING__:tokens",
+      "usd": "__MISSING__:USD ($)"
+    },
+    "windowOptions": {
+      "5h": "__MISSING__:5 hours",
+      "hourly": "__MISSING__:Hourly",
+      "daily": "__MISSING__:Daily",
+      "weekly": "__MISSING__:Weekly",
+      "monthly": "__MISSING__:Monthly"
+    },
+    "useCatalogButton": "__MISSING__:Use catalog",
+    "saveOverrideButton": "__MISSING__:Save override",
+    "revertToCatalogButton": "__MISSING__:Revert to catalog",
+    "unknownProviderNotice": "__MISSING__:Select a provider on the left to configure its quota plan.",
+    "catalogTitle": "__MISSING__:Known catalog",
+    "catalogDescription": "__MISSING__:Automatically detected plans for the following providers:"
+  },
+  "activity": {
+    "title": "__MISSING__:Activity",
+    "description": "__MISSING__:Recent events feed",
+    "emptyTitle": "__MISSING__:No activity yet",
+    "emptyDescription": "__MISSING__:When you add providers, create combos, or rotate keys, events will appear here.",
+    "todayHeader": "__MISSING__:Today",
+    "yesterdayHeader": "__MISSING__:Yesterday",
+    "filterAll": "__MISSING__:All",
+    "filterProviders": "__MISSING__:Providers",
+    "filterCombos": "__MISSING__:Combos",
+    "filterApiKeys": "__MISSING__:API Keys",
+    "filterSettings": "__MISSING__:Settings",
+    "filterQuota": "__MISSING__:Quota",
+    "filterAuth": "__MISSING__:Auth",
+    "filterSystem": "__MISSING__:System",
+    "relative": {
+      "justNow": "__MISSING__:just now",
+      "minutesAgo": "__MISSING__:{n} min ago",
+      "hoursAgo": "__MISSING__:{n} h ago",
+      "yesterday": "__MISSING__:yesterday",
+      "daysAgo": "__MISSING__:{n} days ago"
+    },
+    "eventVerb": {
+      "providerAdded": "__MISSING__:{actor} added provider {target}",
+      "providerRemoved": "__MISSING__:{actor} removed provider {target}",
+      "providerTested": "__MISSING__:{actor} tested provider {target}",
+      "comboCreated": "__MISSING__:{actor} created combo {target}",
+      "comboUpdated": "__MISSING__:{actor} updated combo {target}",
+      "comboDeleted": "__MISSING__:{actor} removed combo {target}",
+      "apiKeyCreated": "__MISSING__:{actor} created API key {target}",
+      "apiKeyRevoked": "__MISSING__:{actor} revoked API key {target}",
+      "apiKeyRotated": "__MISSING__:{actor} rotated API key {target}",
+      "budgetThreshold": "__MISSING__:Budget threshold reached for {target}",
+      "settingUpdated": "__MISSING__:{actor} updated setting {target}",
+      "authLogin": "__MISSING__:{actor} signed in",
+      "authLogout": "__MISSING__:{actor} signed out",
+      "cloudAgentSession": "__MISSING__:Cloud agent session started for {target}",
+      "mcpToolRegistered": "__MISSING__:MCP tool {target} registered",
+      "webhookCreated": "__MISSING__:{actor} created webhook {target}",
+      "webhookDeleted": "__MISSING__:{actor} removed webhook {target}",
+      "quotaPoolCreated": "__MISSING__:{actor} created quota pool {target}",
+      "quotaPoolUpdated": "__MISSING__:{actor} updated quota pool {target}",
+      "quotaPoolDeleted": "__MISSING__:{actor} removed quota pool {target}",
+      "quotaPlanUpdated": "__MISSING__:{actor} updated quota plan {target}",
+      "quotaStoreDriverChanged": "__MISSING__:QuotaStore driver changed",
+      "updateApplied": "__MISSING__:Update {target} applied",
+      "deployCompleted": "__MISSING__:Deploy completed",
+      "skillInstalled": "__MISSING__:{actor} installed skill {target}",
+      "skillRemoved": "__MISSING__:{actor} removed skill {target}",
+      "providerCredentialsCreated": "__MISSING__:{actor} created credentials for {target}",
+      "providerCredentialsApplied": "__MISSING__:Credentials for {target} applied",
+      "providerCredentialsUpdated": "__MISSING__:{actor} updated credentials for {target}",
+      "providerCredentialsRevoked": "__MISSING__:{actor} revoked credentials for {target}",
+      "providerCredentialsBatchRevoked": "__MISSING__:{actor} batch-revoked credentials",
+      "providerCredentialsBatchUpdated": "__MISSING__:{actor} batch-updated credentials",
+      "providerCredentialsBulkCreated": "__MISSING__:{actor} bulk-created credentials",
+      "providerCredentialsBulkImported": "__MISSING__:{actor} bulk-imported credentials",
+      "providerCredentialsImported": "__MISSING__:{actor} imported credentials",
+      "providerSsrfBlocked": "__MISSING__:SSRF attempt blocked for {target}",
+      "authLoginSuccess": "__MISSING__:{actor} signed in",
+      "authLoginError": "__MISSING__:Login error for {actor}",
+      "authLoginFailed": "__MISSING__:Login failed for {actor}",
+      "authLoginLocked": "__MISSING__:{actor} locked out after too many attempts",
+      "authLoginMisconfigured": "__MISSING__:Auth configuration invalid",
+      "authLoginSetupRequired": "__MISSING__:Auth setup required",
+      "authLogoutSuccess": "__MISSING__:{actor} signed out",
+      "syncTokenCreated": "__MISSING__:{actor} created sync token",
+      "syncTokenRevoked": "__MISSING__:{actor} revoked sync token",
+      "settingsUpdate": "__MISSING__:{actor} updated settings",
+      "settingsUpdateFailed": "__MISSING__:Settings update failed",
+      "serviceRevealApiKey": "__MISSING__:{actor} revealed API key for {target}",
+      "genericEvent": "__MISSING__:{actor} {target}"
+    }
+  },
+  "agentBridge": {
+    "title": "__MISSING__:AgentBridge",
+    "subtitle": "__MISSING__:Use IDE agents with OmniRoute models — no config required",
+    "riskBannerTitle": "__MISSING__:Use at your own risk",
+    "riskBannerBody": "__MISSING__:AgentBridge intercepts HTTPS traffic from IDE agents. By activating it you accept responsibility for compliance with the terms of service of each agent. Never use on devices or networks where TLS inspection is prohibited.",
+    "riskBannerDismiss": "__MISSING__:Dismiss",
+    "serverCardTitle": "__MISSING__:AgentBridge Server",
+    "statusRunning": "__MISSING__:Running",
+    "statusStopped": "__MISSING__:Stopped",
+    "statusActive": "__MISSING__:Active",
+    "statusDnsOff": "__MISSING__:DNS off",
+    "statusSetupRequired": "__MISSING__:Setup required",
+    "statusInvestigating": "__MISSING__:Investigating",
+    "serverPort": "__MISSING__:Port",
+    "serverConns": "__MISSING__:Connections",
+    "serverIntercepted": "__MISSING__:Intercepted",
+    "serverLastStarted": "__MISSING__:Last started",
+    "startServer": "__MISSING__:Start",
+    "stopServer": "__MISSING__:Stop",
+    "restartServer": "__MISSING__:Restart",
+    "trustCert": "__MISSING__:Trust Cert",
+    "downloadCert": "__MISSING__:Download Cert",
+    "regenerateCert": "__MISSING__:Regenerate Cert",
+    "starting": "__MISSING__:Starting…",
+    "stopping": "__MISSING__:Stopping…",
+    "restarting": "__MISSING__:Restarting…",
+    "trusting": "__MISSING__:Trusting…",
+    "regenerating": "__MISSING__:Regenerating…",
+    "upstreamCaLabel": "__MISSING__:Upstream CA Certificate (corporate)",
+    "upstreamCaPlaceholder": "__MISSING__:/etc/ssl/certs/corp-ca.pem",
+    "upstreamCaTest": "__MISSING__:Test TLS",
+    "upstreamCaTestOk": "__MISSING__:TLS test passed",
+    "upstreamCaTestError": "__MISSING__:TLS test failed — check the path and CA file",
+    "bypassSectionTitle": "__MISSING__:Bypass List",
+    "bypassSectionDesc": "__MISSING__:Hosts matching these patterns are tunneled directly (no TLS decryption). Defaults include banks, .gov, and corporate SSO.",
+    "bypassDefaultsLabel": "__MISSING__:Default bypass patterns (read-only)",
+    "bypassUserLabel": "__MISSING__:Custom bypass patterns (one per line, glob or regex)",
+    "saveBypassList": "__MISSING__:Save bypass list",
+    "agentListTitle": "__MISSING__:IDE Agents",
+    "filterAll": "__MISSING__:All",
+    "filterActive": "__MISSING__:Active",
+    "filterSetupRequired": "__MISSING__:Setup required",
+    "filterInvestigating": "__MISSING__:Investigating",
+    "searchAgents": "__MISSING__:Search agents…",
+    "noAgentsMatch": "__MISSING__:No agents match the current filter",
+    "agentHosts": "__MISSING__:Intercepted hosts",
+    "certTrusted": "__MISSING__:Certificate trusted",
+    "certNotTrusted": "__MISSING__:Certificate not trusted",
+    "investigatingNotice": "__MISSING__:This agent is under investigation. Hosts and API surface are still being confirmed. Setup will be available once the upstream API is documented.",
+    "modelMappingsLabel": "__MISSING__:Model mappings",
+    "sourceModel": "__MISSING__:Source model (agent native)",
+    "targetModel": "__MISSING__:Target model (OmniRoute)",
+    "noMappings": "__MISSING__:No model mappings configured. Run setup wizard to auto-detect models.",
+    "selectModel": "__MISSING__:Select…",
+    "saveMappings": "__MISSING__:Save mappings",
+    "setupWizard": "__MISSING__:Setup wizard",
+    "startDns": "__MISSING__:Start DNS",
+    "stopDns": "__MISSING__:Stop DNS",
+    "toggling": "__MISSING__:Toggling…",
+    "viewTraffic": "__MISSING__:View traffic",
+    "emptyNoProvidersTitle": "__MISSING__:No providers configured yet",
+    "emptyNoProvidersBody": "__MISSING__:To use AgentBridge, first connect at least one provider. It will be the destination where IDE requests are routed.",
+    "emptyGoToProviders": "__MISSING__:Go to Providers",
+    "wizardTitle": "__MISSING__:Setup wizard",
+    "wizardSubtitle": "__MISSING__:3-step setup",
+    "wizardStep1Label": "__MISSING__:Verify",
+    "wizardStep2Label": "__MISSING__:DNS",
+    "wizardStep3Label": "__MISSING__:Mappings",
+    "wizardStep1Desc": "__MISSING__:Confirm the server is running and the certificate is installed.",
+    "wizardStep2Desc": "__MISSING__:The following entries will be added to /etc/hosts to redirect traffic through AgentBridge:",
+    "wizardStep3Desc": "__MISSING__:You can now configure model mappings in the agent card. Restart the IDE to apply changes.",
+    "wizardStep3Success": "__MISSING__:Agent is configured!",
+    "wizardServerCheck": "__MISSING__:AgentBridge server",
+    "wizardRunning": "__MISSING__:running",
+    "wizardNotRunning": "__MISSING__:not running",
+    "wizardCertCheck": "__MISSING__:Certificate",
+    "wizardTrusted": "__MISSING__:trusted",
+    "wizardNotTrusted": "__MISSING__:not yet trusted — use Trust Cert button",
+    "wizardTutorialTitle": "__MISSING__:Setup instructions:",
+    "wizardEnableDns": "__MISSING__:Add /etc/hosts entries",
+    "wizardDnsAlreadyEnabled": "__MISSING__:DNS already enabled for this agent",
+    "enablingDns": "__MISSING__:Enabling…",
+    "modelSelectorTitle": "__MISSING__:Select target model",
+    "modelSelectorSearch": "__MISSING__:Search models…",
+    "noModelsFound": "__MISSING__:No models found",
+    "quickLinks": "__MISSING__:Quick links",
+    "quickLinkProviders": "__MISSING__:Configure providers",
+    "quickLinkInspector": "__MISSING__:View traffic in Traffic Inspector",
+    "maintenanceTitle": "__MISSING__:Maintenance & Diagnostics",
+    "maintenanceSubtitle": "__MISSING__:Self-test the capture pipeline, undo leftover system state, and move your setup between machines.",
+    "orphanedStateWarning": "__MISSING__:A previous session left system state behind (DNS spoof, CA, or system proxy). Run Repair to clean it up.",
+    "diagnose": "__MISSING__:Diagnose",
+    "diagnosing": "__MISSING__:Diagnosing…",
+    "diagnoseHealthy": "__MISSING__:Capture pipeline is healthy.",
+    "diagnoseUnhealthy": "__MISSING__:Capture pipeline has problems:",
+    "repair": "__MISSING__:Repair",
+    "repairing": "__MISSING__:Repairing…",
+    "repairDone": "__MISSING__:Repaired: {items}",
+    "repairNothing": "__MISSING__:Nothing to repair — system state is clean.",
+    "removeCa": "__MISSING__:Remove CA",
+    "removeCaConfirm": "__MISSING__:Remove CA?",
+    "removeCaDone": "__MISSING__:MITM root CA removed from the OS trust store.",
+    "removing": "__MISSING__:Removing…",
+    "confirm": "__MISSING__:Confirm",
+    "exportConfig": "__MISSING__:Export config",
+    "exporting": "__MISSING__:Exporting…",
+    "importConfig": "__MISSING__:Import config",
+    "importing": "__MISSING__:Importing…",
+    "importInvalidJson": "__MISSING__:The selected file is not valid JSON.",
+    "importDone": "__MISSING__:Imported {bypass} bypass · {hosts} hosts · {agents} agents",
+    "save": "__MISSING__:Save",
+    "saving": "__MISSING__:Saving…",
+    "cancel": "__MISSING__:Cancel",
+    "back": "__MISSING__:Back",
+    "next": "__MISSING__:Next",
+    "done": "__MISSING__:Done",
+    "loading": "__MISSING__:Loading…",
+    "riskNoticeTitle": "__MISSING__:Risk acknowledgment",
+    "riskNoticeBody": "__MISSING__:AgentBridge will intercept HTTPS traffic from this agent by redirecting its API hosts via DNS. Only enable if you accept responsibility for compliance with the agent's terms of service and any applicable network policies.",
+    "pageMoved": {
+      "goNow": "__MISSING__:Go now",
+      "message": "__MISSING__:The MITM Proxy now lives under AgentBridge.",
+      "title": "__MISSING__:This page has moved"
+    }
+  },
+  "trafficInspector": {
+    "title": "__MISSING__:Traffic Inspector",
+    "subtitle": "__MISSING__:Monitor LLM calls and debug any application's HTTPS traffic",
+    "captureModesTitle": "__MISSING__:Capture Modes",
+    "agentBridgeMode": "__MISSING__:AgentBridge",
+    "agentBridgeModeDesc": "__MISSING__:Capture traffic from all connected IDE agents",
+    "customHostsMode": "__MISSING__:Custom Hosts",
+    "customHostsModeDesc": "__MISSING__:Add specific hosts to intercept",
+    "httpProxyMode": "__MISSING__:HTTP Proxy",
+    "httpProxyModeDesc": "__MISSING__:Use HTTP_PROXY environment variable",
+    "systemWideMode": "__MISSING__:System-wide",
+    "systemWideModeDesc": "__MISSING__:Intercept all system traffic (advanced)",
+    "tproxyMode": "__MISSING__:TPROXY Decrypt",
+    "tproxyModeUnavailable": "__MISSING__:TPROXY decrypt requires Linux + root + the native addon",
+    "filterBarTitle": "__MISSING__:Filters",
+    "profileLlmOnly": "__MISSING__:LLM only",
+    "profileCustom": "__MISSING__:Custom",
+    "profileAll": "__MISSING__:All",
+    "filterHost": "__MISSING__:Filter host…",
+    "filterAgent": "__MISSING__:Agent",
+    "filterStatus": "__MISSING__:Status",
+    "pauseBtn": "__MISSING__:Pause",
+    "resumeBtn": "__MISSING__:Resume",
+    "clearBtn": "__MISSING__:Clear",
+    "exportHar": "__MISSING__:Export .har",
+    "recordSession": "__MISSING__:REC",
+    "stopSession": "__MISSING__:Stop",
+    "liveBadge": "__MISSING__:live",
+    "offlineBadge": "__MISSING__:offline",
+    "noRequests": "__MISSING__:No requests captured yet.",
+    "noRequestsDesc": "__MISSING__:Make sure AgentBridge is running or enable another capture mode.",
+    "selectRequest": "__MISSING__:Select a request to inspect it.",
+    "tabConversation": "__MISSING__:Conversation",
+    "tabHeaders": "__MISSING__:Headers",
+    "tabRequest": "__MISSING__:Request",
+    "tabResponse": "__MISSING__:Response",
+    "tabTiming": "__MISSING__:Timing",
+    "tabLlm": "__MISSING__:LLM",
+    "tabStats": "__MISSING__:Stats",
+    "requestHeaders": "__MISSING__:Request Headers",
+    "responseHeaders": "__MISSING__:Response Headers",
+    "rawEvents": "__MISSING__:Raw events",
+    "mergedView": "__MISSING__:Merged view",
+    "noBody": "__MISSING__:No body.",
+    "streaming": "__MISSING__:streaming…",
+    "manageHosts": "__MISSING__:Manage hosts",
+    "copySnippet": "__MISSING__:Copy proxy snippet",
+    "addHost": "__MISSING__:Add",
+    "hostPlaceholder": "__MISSING__:api.openai.com",
+    "noHostsYet": "__MISSING__:No custom hosts added yet.",
+    "noSessionsYet": "__MISSING__:No sessions yet",
+    "allTraffic": "__MISSING__:All traffic (no session)",
+    "sessionsDropdown": "__MISSING__:Sessions",
+    "annotationPlaceholder": "__MISSING__:Add a note…",
+    "contextFingerprint": "__MISSING__:Context fingerprint",
+    "llmProvider": "__MISSING__:Detected provider",
+    "llmApiKind": "__MISSING__:API kind",
+    "llmModel": "__MISSING__:Model",
+    "llmMessages": "__MISSING__:Messages",
+    "llmStream": "__MISSING__:Stream",
+    "llmMappedTo": "__MISSING__:Mapped to",
+    "llmCostEstimate": "__MISSING__:Cost estimate",
+    "systemProxyExitWarning": "__MISSING__:System-wide proxy still active — leave page anyway?",
+    "customHostsTitle": "__MISSING__:Custom Hosts",
+    "loading": "__MISSING__:Loading…",
+    "copied": "__MISSING__:Copied!",
+    "copy": "__MISSING__:Copy",
+    "httpProxyTitle": "__MISSING__:HTTP Proxy Snippet — port {port}",
+    "notRecording": "__MISSING__:Not recording",
+    "anyStatus": "__MISSING__:Any status",
+    "liveOnly": "__MISSING__:Live",
+    "viewingRecordedSession": "__MISSING__:Viewing recorded session",
+    "backToLive": "__MISSING__:Back to live",
+    "untitledSession": "__MISSING__:Untitled session",
+    "contextHistory": "__MISSING__:Context History",
+    "modelResponse": "__MISSING__:Model Response",
+    "conversationNoMessages": "__MISSING__:No messages found in this request.",
+    "conversationNotAvailable": "__MISSING__:Conversation data not available. This may not be an LLM request or the body could not be parsed.",
+    "loadingCharts": "__MISSING__:Loading charts…",
+    "statsErrors": "__MISSING__:Errors",
+    "statsLatency": "__MISSING__:Latency (last 50 requests)",
+    "statsNoData": "__MISSING__:No requests yet. Start a session recording to capture data for stats.",
+    "statsStatusDistribution": "__MISSING__:Status distribution",
+    "statsSuccessful": "__MISSING__:Successful",
+    "statsTotalRequests": "__MISSING__:Total requests",
+    "timingProxyOverhead": "__MISSING__:Proxy overhead",
+    "timingUpstreamResponse": "__MISSING__:Upstream response",
+    "timingNoData": "__MISSING__:No timing data available.",
+    "timingTotalLatency": "__MISSING__:Total latency",
+    "timingTimestamp": "__MISSING__:Timestamp",
+    "timingMethod": "__MISSING__:Method",
+    "timingStatus": "__MISSING__:Status",
+    "timingRequestSize": "__MISSING__:Request size",
+    "timingResponseSize": "__MISSING__:Response size",
+    "pausedNewBadge": "__MISSING__:{count} new",
+    "clearContextFilter": "__MISSING__:clear"
+  },
+  "cliCommon": {
+    "concept": {
+      "code": {
+        "title": "__MISSING__:CLI Code",
+        "phrase": "__MISSING__:Code tools you point at OmniRoute",
+        "flow": "__MISSING__:You → CLI Code → OmniRoute → Provider",
+        "seeOther": "__MISSING__:See →"
+      },
+      "agent": {
+        "title": "__MISSING__:CLI Agents",
+        "phrase": "__MISSING__:Broad-purpose autonomous CLI agents you point at OmniRoute",
+        "flow": "__MISSING__:You → CLI Agent → OmniRoute → Provider",
+        "seeOther": "__MISSING__:See →"
+      },
+      "acp": {
+        "title": "__MISSING__:ACP Agents",
+        "phrase": "__MISSING__:CLIs that OmniRoute spawns as execution backend (reverse flow)",
+        "flow": "__MISSING__:Client → OmniRoute → spawn CLI (stdio/ACP) → response",
+        "seeOther": "__MISSING__:See →"
+      }
+    },
+    "comparison": {
+      "title": "__MISSING__:Understand the 3 CLI types in OmniRoute",
+      "thisPage": "__MISSING__:This page",
+      "open": "__MISSING__:Open →",
+      "code": {
+        "title": "__MISSING__:Code tool",
+        "desc": "__MISSING__:Points to Omni",
+        "flow": "__MISSING__:you → CLI → Omni → provider",
+        "examples": "__MISSING__:e.g.: claude, codex"
+      },
+      "agent": {
+        "title": "__MISSING__:Broad autonomous agent",
+        "desc": "__MISSING__:Points to Omni",
+        "flow": "__MISSING__:you → agent → Omni",
+        "examples": "__MISSING__:e.g.: hermes, goose"
+      },
+      "acp": {
+        "title": "__MISSING__:CLI used as backend by Omni",
+        "desc": "__MISSING__:Reverse execution",
+        "flow": "__MISSING__:Omni → spawn CLI → resp",
+        "examples": "__MISSING__:e.g.: claude, codex (ACP)"
+      }
+    },
+    "card": {
+      "detected": "__MISSING__:Detected",
+      "notDetected": "__MISSING__:Not detected",
+      "configured": "__MISSING__:Configured",
+      "notConfigured": "__MISSING__:Not configured",
+      "configure": "__MISSING__:Configure →",
+      "howToInstall": "__MISSING__:How to install →",
+      "manualConfig": "__MISSING__:Manual config",
+      "installGuide": "__MISSING__:Install guide",
+      "endpointLabel": "__MISSING__:Endpoint",
+      "baseUrlFull": "__MISSING__:Full Base URL",
+      "baseUrlPartial": "__MISSING__:Partial Base URL",
+      "refreshDetection": "__MISSING__:Refresh detection",
+      "alsoAcp": "__MISSING__:also ACP",
+      "connectProviderHint": "__MISSING__:Connect a provider in Providers"
+    },
+    "detail": {
+      "back": "__MISSING__:Back",
+      "apply": "__MISSING__:Save",
+      "reset": "__MISSING__:Clear",
+      "manualConfig": "__MISSING__:Manual configuration",
+      "vendor": "__MISSING__:Vendor",
+      "category": "__MISSING__:Type",
+      "detectionStatus": "__MISSING__:Detection",
+      "configStatus": "__MISSING__:Configuration",
+      "baseUrlLabel": "__MISSING__:Base URL",
+      "apiKeyLabel": "__MISSING__:API Key",
+      "modelMappingLabel": "__MISSING__:Model mapping",
+      "noActiveProviders": "__MISSING__:No active providers.",
+      "noActiveProvidersDesc": "__MISSING__:Go to Providers to connect at least 1 provider before configuring the CLI.",
+      "openProviders": "__MISSING__:Open Providers →"
+    }
+  },
+  "cliCode": {
+    "pageTitle": "__MISSING__:CLI Code's",
+    "pageSubtitle": "__MISSING__:Code tools pointing to OmniRoute",
+    "searchPlaceholder": "__MISSING__:Search CLI…",
+    "filterDetectionLabel": "__MISSING__:Detection",
+    "filterBaseUrlLabel": "__MISSING__:Base URL",
+    "detectionAll": "__MISSING__:All",
+    "detectionInstalled": "__MISSING__:Installed",
+    "detectionNotFound": "__MISSING__:Not found",
+    "baseUrlAll": "__MISSING__:All",
+    "baseUrlFull": "__MISSING__:Full",
+    "baseUrlPartial": "__MISSING__:Partial"
+  },
+  "cliAgents": {
+    "pageTitle": "__MISSING__:CLI Agents",
+    "pageSubtitle": "__MISSING__:Broad-purpose autonomous CLI agents",
+    "refreshDetection": "__MISSING__:Refresh detection",
+    "searchPlaceholder": "__MISSING__:Search agent…",
+    "detectionFilterLabel": "__MISSING__:Detection",
+    "detectionAll": "__MISSING__:All",
+    "detectionInstalled": "__MISSING__:Installed",
+    "detectionNotInstalled": "__MISSING__:Not installed",
+    "visibleCount": "__MISSING__:{count} visible",
+    "emptyState": "__MISSING__:No CLI agents found with the current filters."
+  },
+  "acpAgents": {
+    "pageTitle": "__MISSING__:ACP Agents",
+    "pageSubtitle": "__MISSING__:CLIs that OmniRoute spawns as execution backend",
+    "scanning": "__MISSING__:Detecting agents…",
+    "refresh": "__MISSING__:Refresh",
+    "setupGuideTitle": "__MISSING__:Setup guide",
+    "setupGuideDetectCliTitle": "__MISSING__:Detect CLI",
+    "setupGuideDetectCliDesc": "__MISSING__:Agents are identified by running the --version command in PATH.",
+    "setupGuideCustomAgentTitle": "__MISSING__:Add custom agent",
+    "setupGuideCustomAgentDesc": "__MISSING__:Fill in the form below to register a custom CLI agent.",
+    "setupGuideCommandMissingTitle": "__MISSING__:Command not found",
+    "setupGuideCommandMissingDesc": "__MISSING__:Check that the binary is in PATH.",
+    "fingerprintSettingsHint": "__MISSING__:Configure routing and fingerprints in",
+    "settingsRoutingLink": "__MISSING__:Settings → Routing",
+    "installed": "__MISSING__:Installed",
+    "notFound": "__MISSING__:Not found",
+    "builtIn": "__MISSING__:Built-in",
+    "custom": "__MISSING__:Custom",
+    "agentUseCaseHint": "__MISSING__:Available for spawn via ACP.",
+    "remove": "__MISSING__:Remove",
+    "addCustomAgent": "__MISSING__:Add custom agent",
+    "addCustomAgentDesc": "__MISSING__:Register a custom CLI agent to be spawned via ACP.",
+    "addAgent": "__MISSING__:Add agent",
+    "agentName": "__MISSING__:Name",
+    "agentNamePlaceholder": "__MISSING__:e.g.: My Agent",
+    "binaryName": "__MISSING__:Binary",
+    "binaryNamePlaceholder": "__MISSING__:e.g.: myagent",
+    "versionCommand": "__MISSING__:Version command",
+    "versionCommandPlaceholder": "__MISSING__:e.g.: myagent --version",
+    "spawnArgs": "__MISSING__:Spawn arguments",
+    "spawnArgsPlaceholder": "__MISSING__:e.g.: --quiet, --json",
+    "cliCodeRedirectCta": "__MISSING__:Open CLI Code"
+  },
+  "agentSkills": {
+    "pageTitle": "__MISSING__:Agent Skills",
+    "pageSubtitle": "__MISSING__:Teach your agent to operate OmniRoute — 22 API areas + 20 CLI families",
+    "conceptCard": {
+      "agent": {
+        "title": "__MISSING__:Agent Skills — Outbound",
+        "description": "__MISSING__:Agent Skills are machine-readable SKILL.md documents that external AI agents (Claude Code, Cursor, Copilot…) fetch from GitHub to learn how to operate OmniRoute via REST or CLI. They are read by the agent, not executed by OmniRoute.",
+        "crossLinkLabel": "__MISSING__:Understand the difference →"
+      },
+      "omni": {
+        "title": "__MISSING__:Omni Skills — Inbound",
+        "description": "__MISSING__:Omni Skills are sandbox tools that OmniRoute injects into the model's context on every request. They are executed by OmniRoute, not read by the agent.",
+        "crossLinkLabel": "__MISSING__:Understand the difference →"
+      },
+      "comparison": {
+        "colAgent": "__MISSING__:Agent Skills",
+        "colOmni": "__MISSING__:Omni Skills",
+        "whatIs": {
+          "label": "__MISSING__:What it is",
+          "agent": "__MISSING__:Machine-readable SKILL.md that teaches an external agent to operate OmniRoute",
+          "omni": "__MISSING__:Executable tools that OmniRoute injects as tools into LLM requests"
+        },
+        "direction": {
+          "label": "__MISSING__:Direction",
+          "agent": "__MISSING__:Outbound — external agent learns to control OmniRoute",
+          "omni": "__MISSING__:Inbound — OmniRoute gives tools to models passing through it"
+        },
+        "executor": {
+          "label": "__MISSING__:Executor",
+          "agent": "__MISSING__:External agent (reads markdown → acts via API/CLI)",
+          "omni": "__MISSING__:OmniRoute itself (intercepts tool_calls, Docker sandbox)"
+        },
+        "storage": {
+          "label": "__MISSING__:Storage",
+          "agent": "__MISSING__:Dynamic catalog (/api/agent-skills) → SKILL.md on GitHub",
+          "omni": "__MISSING__:SQLite (SkillsMP / skills.sh / local)"
+        },
+        "tagline": {
+          "label": "__MISSING__:Tagline",
+          "agent": "__MISSING__:Teach your agent to use OmniRoute",
+          "omni": "__MISSING__:Give executable tools to OmniRoute models"
+        }
+      }
+    },
+    "filters": {
+      "category": "__MISSING__:Category",
+      "area": "__MISSING__:Area",
+      "searchPlaceholder": "__MISSING__:Search skills…"
+    },
+    "categoryApi": "__MISSING__:API",
+    "categoryCli": "__MISSING__:CLI",
+    "categoryConfig": "__MISSING__:Config",
+    "filterAll": "__MISSING__:All",
+    "coverageLabel": "__MISSING__:Coverage",
+    "mcpUrl": "__MISSING__:MCP URL",
+    "a2aLink": "__MISSING__:A2A",
+    "copyUrl": "__MISSING__:Copy URL",
+    "viewOnGithub": "__MISSING__:View on GitHub",
+    "previewLoading": "__MISSING__:Loading skill documentation…",
+    "previewError": "__MISSING__:Failed to load skill documentation.",
+    "previewEmpty": "__MISSING__:Select a skill to preview its documentation.",
+    "generateButton": "__MISSING__:Generate missing skills",
+    "coverageBar": {
+      "complete": "__MISSING__:Complete",
+      "partial": "__MISSING__:Partial"
+    },
+    "noSkillsFound": "__MISSING__:No skills found matching your filters.",
+    "regenerateConfirm": "__MISSING__:This will regenerate all missing SKILL.md files. Continue?",
+    "regenerateRunning": "__MISSING__:Regenerating skills…",
+    "regenerateSuccess": "__MISSING__:Skills regenerated successfully.",
+    "regenerateError": "__MISSING__:Failed to regenerate skills."
+  },
+  "freeProviderRankingsPage": {
+    "title": "__MISSING__:Free Provider Rankings",
+    "subtitle": "__MISSING__:Best free providers ranked by model ELO scores from Arena AI leaderboards",
+    "loading": "__MISSING__:Loading rankings...",
+    "errorLoading": "__MISSING__:Failed to load rankings",
+    "emptyState": "__MISSING__:No rankings available yet. Arena ELO data syncs on startup (daily) — check back shortly, or trigger a manual sync. Disable Arena ELO Sync in Feature Flags or set ARENA_ELO_SYNC_ENABLED=false to opt out.",
+    "bestModel": "__MISSING__:Best",
+    "allCategories": "__MISSING__:All Categories",
+    "categoryDefault": "__MISSING__:Default",
+    "categoryCoding": "__MISSING__:Coding",
+    "categoryReview": "__MISSING__:Review",
+    "categoryDocumentation": "__MISSING__:Documentation",
+    "categoryDebugging": "__MISSING__:Debugging",
+    "colRank": "__MISSING__:Rank",
+    "colProvider": "__MISSING__:Provider",
+    "colTopModel": "__MISSING__:Top Model",
+    "colScore": "__MISSING__:Score",
+    "colAvgScore": "__MISSING__:Avg Score",
+    "colModels": "__MISSING__:Models",
+    "colType": "__MISSING__:Type"
   }
 }
diff --git a/src/i18n/messages/ko.json b/src/i18n/messages/ko.json
index 5b53418e1c..764aefb0ef 100644
--- a/src/i18n/messages/ko.json
+++ b/src/i18n/messages/ko.json
@@ -393,6 +393,7 @@
     "cloudBenefitAccess": "Cloud Benefit Access",
     "maxRetries": "Max Retries",
     "queueTimeout": "Queue Timeout",
+    "queueDepth": "__MISSING__:Queue Depth",
     "addProvider": "Add Provider",
     "realtime": "Realtime",
     "totalTranslations": "Total Translations",
@@ -709,6 +710,7 @@
     "batchFilesListFilesTable": "파일",
     "batchPageLoadingMore": "더 로드 중…",
     "recommended": "__MISSING__:Recommended",
+    "understand": "__MISSING__:I understand",
     "batchConceptTitle": "Batch processing",
     "batchConceptSubtitle": "Process thousands of requests asynchronously at ~50% of the cost (24h window). Ideal for evaluations, classification, and embeddings.",
     "batchConceptHowItWorks": "How it works",
@@ -773,36 +775,13 @@
     "filesListUploadButton": "Upload",
     "filesListUsedByColumn": "Used by",
     "filesListUsedByNone": "None",
-    "filesListDelete": "Delete",
-    "filesListDownload": "Download",
-    "batchDetailActionCancel": "Cancel batch",
-    "batchDetailActionRetry": "Retry failed requests",
-    "batchDetailCancelling": "Cancelling…",
-    "batchDetailRetrying": "Preparing retry…",
-    "batchDetailCancelConfirm": "Cancel this batch? In-progress requests will stop.",
-    "batchActionCancelError": "Failed to cancel batch. Try again.",
-    "batchActionRetryError": "Failed to retry failed requests. Try again.",
-    "batchConceptRetentionNote": "Results and error files are retained for 30 days (Anthropic: 29 days)",
     "filesListUsedByRoleInput": "input",
     "filesListUsedByRoleOutput": "output",
     "filesListUsedByRoleError": "error",
-    "batchListProgressPartial": "(partial)",
     "filesListSizeColumn": "Size",
+    "batchListProgressPartial": "(partial)",
     "batchListProviderColumn": "Provider",
     "batchListProviderUnknown": "—",
-    "batchListBatchCreated": "Batch {id} created — refreshing list…",
-    "batchListBatchCreatedDismiss": "Dismiss",
-    "batchListRefreshing": "Refreshing…",
-    "batchListRefresh": "Refresh",
-    "uploadFileModalRemove": "Remove",
-    "uploadFileModalUploading": "Uploading…",
-    "wizardInputReading": "Reading file…",
-    "wizardInputReady": "Ready",
-    "wizardInputLargeFileLabel": "Large file — sampling validation",
-    "wizardInputCsvJsonlReady": "JSONL generated — ready to validate.",
-    "wizardInputLargeFileWarning": "Large file detected — validation runs by sampling (first 5 MB + last 100 KB). Full validation happens server-side.",
-    "wizardCostWindow24h": "24h completion window",
-    "wizardValidationFieldsOk": "required fields valid",
     "batchListProviderOther": "Other",
     "batchListTitle": "Batches",
     "batchListCount": "{count} batches",
@@ -839,8 +818,33 @@
     "wizardCostWindow": "Window",
     "wizardDestinationSelectProvider": "Select a provider…",
     "wizardDestinationSelectModel": "Select a model…",
-    "wizardDestinationConnectProvider": "Connect a provider"
+    "wizardDestinationConnectProvider": "Connect a provider",
+    "batchListBatchCreated": "Batch {id} created — refreshing list…",
+    "batchListBatchCreatedDismiss": "Dismiss",
+    "batchListRefreshing": "Refreshing…",
+    "batchListRefresh": "Refresh",
+    "uploadFileModalRemove": "Remove",
+    "uploadFileModalUploading": "Uploading…",
+    "wizardInputReading": "Reading file…",
+    "wizardInputReady": "Ready",
+    "wizardInputLargeFileLabel": "Large file — sampling validation",
+    "wizardInputCsvJsonlReady": "JSONL generated — ready to validate.",
+    "wizardInputLargeFileWarning": "Large file detected — validation runs by sampling (first 5 MB + last 100 KB). Full validation happens server-side.",
+    "wizardCostWindow24h": "24h completion window",
+    "wizardValidationFieldsOk": "required fields valid",
+    "filesListDelete": "Delete",
+    "filesListDownload": "Download",
+    "batchDetailActionCancel": "Cancel batch",
+    "batchDetailActionRetry": "Retry failed requests",
+    "batchDetailCancelling": "Cancelling…",
+    "batchDetailRetrying": "Preparing retry…",
+    "batchDetailCancelConfirm": "Cancel this batch? In-progress requests will stop.",
+    "batchActionCancelError": "Failed to cancel batch. Try again.",
+    "batchActionRetryError": "Failed to retry failed requests. Try again.",
+    "batchConceptRetentionNote": "Results and error files are retained for 30 days (Anthropic: 29 days)"
   },
+  "featureFlagOmnirouteEmergencyFallbackDescription": "__MISSING__:Route budget-exhausted requests to the emergency free fallback provider/model.",
+  "featureFlagArenaEloSyncEnabledDescription": "__MISSING__:Enable periodic Arena AI leaderboard ELO sync for model intelligence rankings.",
   "sidebar": {
     "home": "홈",
     "dashboard": "대시보드",
@@ -968,6 +972,7 @@
     "aiFeaturesSection": "AI Features",
     "mcp": "MCP",
     "a2a": "A2A",
+    "plugins": "__MISSING__:Plugins",
     "apiEndpoints": "API Endpoints",
     "batchFiles": "Files",
     "analyticsEvals": "Evals",
@@ -976,6 +981,10 @@
     "analyticsComboHealth": "Combo Health",
     "analyticsCompression": "Compression",
     "costsBudget": "Budget",
+    "costsFreeTiers": "__MISSING__:Free-Tier Budget",
+    "costsFreeTiersSubtitle": "__MISSING__:Monthly free-token allowances",
+    "freeProviderRankings": "__MISSING__:Free Provider Rankings",
+    "freeProviderRankingsSubtitle": "__MISSING__:Best free providers ranked by model ELO scores",
     "costsQuotaShare": "Quota Sharing",
     "costsPricing": "Pricing",
     "logsProxy": "Proxy Logs",
@@ -987,10 +996,12 @@
     "settingsAppearance": "Appearance",
     "settingsAi": "AI Settings",
     "settingsSecurity": "Security",
+    "settingsAccessTokens": "__MISSING__:Access Tokens",
     "settingsFeatureFlags": "기능 플래그",
     "settingsAuthz": "__MISSING__:Authz",
     "settingsRouting": "Routing",
     "settingsResilience": "Resilience",
+    "modelLockout": "__MISSING__:Model Lockout",
     "settingsAdvanced": "Advanced",
     "omniProxySection": "OmniProxy",
     "quotaTracker": "Provider Quota",
@@ -1036,6 +1047,8 @@
     "analyticsCompressionSubtitle": "Token savings stats",
     "analyticsSearchSubtitle": "Search tool analytics",
     "analyticsEvalsSubtitle": "Eval suite results",
+    "providerStats": "__MISSING__:Provider Stats",
+    "providerStatsSubtitle": "__MISSING__:Latency and performance metrics",
     "logsSubtitle": "Application logs",
     "logsProxySubtitle": "Proxy traffic logs",
     "consoleLogsSubtitle": "Console output",
@@ -1055,6 +1068,7 @@
     "agentSkillsSubtitle": "A2A skill registry",
     "mcpSubtitle": "MCP server controls",
     "a2aSubtitle": "A2A protocol server",
+    "pluginsSubtitle": "__MISSING__:Plugin marketplace & installs",
     "mediaSubtitle": "Cached media files",
     "batchFilesSubtitle": "Batch input/output files",
     "settingsSubtitle": "All settings",
@@ -1065,13 +1079,41 @@
     "settingsResilienceSubtitle": "Retries and breakers",
     "settingsAdvancedSubtitle": "Power user options",
     "settingsSecuritySubtitle": "Auth and encryption",
+    "settingsAccessTokensSubtitle": "__MISSING__:Scoped CLI tokens for remote mode",
     "settingsFeatureFlagsSubtitle": "시스템 기능 전환",
     "settingsSidebar": "Sidebar",
     "settingsSidebarSubtitle": "Customize sidebar layout",
     "settingsAuthzSubtitle": "__MISSING__:Route inventory and bypass policy",
     "docsSubtitle": "Documentation",
     "issuesSubtitle": "Report a bug",
-    "changelogSubtitle": "Release notes"
+    "changelogSubtitle": "Release notes",
+    "costsQuotaPlans": "__MISSING__:Plans & Quotas",
+    "costsQuotaPlansSubtitle": "__MISSING__:Configure plans by provider",
+    "activity": "__MISSING__:Activity",
+    "activitySubtitle": "__MISSING__:Friendly feed of recent events",
+    "logsGroup": "__MISSING__:Logs",
+    "systemGroup": "__MISSING__:System",
+    "costsOverview": "__MISSING__:Overview",
+    "costsOverviewSubtitle": "__MISSING__:Consolidated cost analysis",
+    "agentBridge": "__MISSING__:Agent Bridge",
+    "agentBridgeSubtitle": "__MISSING__:Intercept IDE agent traffic",
+    "trafficInspector": "__MISSING__:Traffic Inspector",
+    "trafficInspectorSubtitle": "__MISSING__:Monitor LLM calls + debug any HTTPS traffic",
+    "cliCode": "__MISSING__:CLI Code",
+    "cliCodeSubtitle": "__MISSING__:Code tools pointing to OmniRoute",
+    "cliAgents": "__MISSING__:CLI Agents",
+    "cliAgentsSubtitle": "__MISSING__:Autonomous CLI agents",
+    "acpAgents": "__MISSING__:ACP Agents",
+    "acpAgentsSubtitle": "__MISSING__:CLIs spawned by OmniRoute",
+    "skipToContent": "__MISSING__:Skip to content",
+    "unpinSection": "__MISSING__:Unpin section",
+    "pinSectionOpen": "__MISSING__:Pin section open",
+    "reloadPage": "__MISSING__:Reload Page",
+    "dragReorderSection": "__MISSING__:Drag to reorder section",
+    "dragReorderItem": "__MISSING__:Drag to reorder",
+    "cannotHide": "__MISSING__:This item cannot be hidden",
+    "alwaysVisible": "__MISSING__:Always visible",
+    "groupSeparatorLabel": "__MISSING__:Separator"
   },
   "webhooks": {
     "title": "웹훅",
@@ -1272,7 +1314,47 @@
     "a2aEvents": "이벤트",
     "a2aArtifacts": "유물",
     "a2aNoTasks": "기록된 A2A 작업이 없습니다.",
-    "a2aLoadingTasks": "A2A 작업 로드 중..."
+    "a2aLoadingTasks": "A2A 작업 로드 중...",
+    "actor": "__MISSING__:Actor",
+    "actorPlaceholder": "__MISSING__:Filter by actor",
+    "eventTypes": {
+      "apiKey.activate": "__MISSING__:API Key Activated",
+      "apiKey.ban": "__MISSING__:API Key Banned",
+      "apiKey.deactivate": "__MISSING__:API Key Deactivated",
+      "apiKey.regenerate": "__MISSING__:API Key Regenerated",
+      "apiKey.scopes.grant": "__MISSING__:API Key Scopes Granted",
+      "apiKey.scopes.revoke": "__MISSING__:API Key Scopes Revoked",
+      "apiKey.scopes.update": "__MISSING__:API Key Scopes Updated",
+      "apiKey.unban": "__MISSING__:API Key Unbanned",
+      "auth.login.error": "__MISSING__:Login Error",
+      "auth.login.failed": "__MISSING__:Login Failed",
+      "auth.login.locked": "__MISSING__:Login Locked",
+      "auth.login.misconfigured": "__MISSING__:Login Misconfigured",
+      "auth.login.setup_required": "__MISSING__:Login Setup Required",
+      "auth.login.success": "__MISSING__:Login Success",
+      "auth.logout.success": "__MISSING__:Logout Success",
+      "compliance.cleanup": "__MISSING__:Compliance Cleanup",
+      "provider.credentials.applied": "__MISSING__:Provider Credentials Applied",
+      "provider.credentials.batch_revoked": "__MISSING__:Provider Credentials Batch Revoked",
+      "provider.credentials.bulk_created": "__MISSING__:Provider Credentials Bulk Created",
+      "provider.credentials.bulk_imported": "__MISSING__:Provider Credentials Bulk Imported",
+      "provider.credentials.created": "__MISSING__:Provider Credentials Created",
+      "provider.credentials.imported": "__MISSING__:Provider Credentials Imported",
+      "provider.credentials.revoked": "__MISSING__:Provider Credentials Revoked",
+      "provider.credentials.updated": "__MISSING__:Provider Credentials Updated",
+      "provider.validation.ssrf_blocked": "__MISSING__:Provider SSRF Blocked",
+      "quota.plan.updated": "__MISSING__:Quota Plan Updated",
+      "quota.pool.created": "__MISSING__:Quota Pool Created",
+      "quota.pool.deleted": "__MISSING__:Quota Pool Deleted",
+      "quota.pool.updated": "__MISSING__:Quota Pool Updated",
+      "quota.store.driver_changed": "__MISSING__:Quota Store Driver Changed",
+      "server.start": "__MISSING__:Server Start",
+      "service.reveal_api_key": "__MISSING__:Service API Key Revealed",
+      "settings.update": "__MISSING__:Settings Updated",
+      "settings.update_failed": "__MISSING__:Settings Update Failed",
+      "sync.token.created": "__MISSING__:Sync Token Created",
+      "sync.token.revoked": "__MISSING__:Sync Token Revoked"
+    }
   },
   "themesPage": {
     "title": "Themes",
@@ -1381,7 +1463,8 @@
     "settingsResilienceDescription": "Circuit breaker, retry, and fallback configuration",
     "settingsAdvancedDescription": "Advanced payload rules, request limits, and proxy API settings",
     "mitmProxyDescription": "Configure MITM proxy settings for traffic inspection and debugging",
-    "oneProxyDescription": "Configure 1Proxy settings for advanced proxy chaining"
+    "oneProxyDescription": "Configure 1Proxy settings for advanced proxy chaining",
+    "omniSkillsDescription": "__MISSING__:Install and manage sandbox skills for automated prompt and tool execution"
   },
   "home": {
     "quickStart": "빠른 시작",
@@ -1612,16 +1695,24 @@
     "ownUsageVisibilityDesc": "이 키가 자신의 USD 사용량, 예산 비율, 토큰 합계를 확인하기 위해 상태 endpoint를 호출하도록 허용합니다.",
     "sharedAccountQuotaVisibility": "공유 계정 할당량",
     "sharedAccountQuotaVisibilityDesc": "명시적 연결이 하나 구성된 경우 이 키가 공유 upstream 계정 할당량을 볼 수 있도록 허용합니다.",
+    "localUsageCommand": "__MISSING__:Allow local usage command",
+    "localUsageCommandDesc": "__MISSING__:Allows this API key to use @@om-usage to retrieve cached usage and quota information without calling an upstream provider.",
+    "localUsageCommandBadge": "__MISSING__:Usage cmd",
     "keyCreated": "API 키가 생성되었습니다.",
     "keyCreatedSuccess": "키가 생성되었습니다!",
     "keyCreatedNote": "지금 이 키를 복사하여 저장하세요. 다시 표시되지 않습니다.",
     "done": "완료",
     "savePermissions": "저장 권한",
-    "endpointRestrictions": "__MISSING__:Allowed Endpoints",
-    "allEndpointsAllowed": "__MISSING__:This key can access all API endpoints.",
-    "endpointsRestricted": "__MISSING__:Restricted to {count} endpoint{count, plural, one {} other {s}}.",
+    "endpointRestrictions": "Allowed Endpoints",
+    "allEndpointsAllowed": "This key can access all API endpoints.",
+    "endpointsRestricted": "Restricted to {count} endpoint{count, plural, one {} other {s}}.",
     "autoResolve": "Auto-Resolve",
     "autoResolveDesc": "Auto-resolve ambiguous model names to native provider for this API key.",
+    "streamDefaultMode": "__MISSING__:Stream Default Compatibility",
+    "streamDefaultModeDesc": "__MISSING__:Controls omitted `stream` flags for this key. JSON mode returns non-streaming responses unless the client explicitly requests SSE.",
+    "streamDefaultLegacy": "__MISSING__:Legacy",
+    "streamDefaultJson": "__MISSING__:JSON Compatible",
+    "streamDefaultBadge": "__MISSING__:JSON stream default",
     "keyActive": "Key Active",
     "keyActiveDesc": "Enable or disable this API key. Disabled keys are immediately rejected with 403.",
     "accessSchedule": "Access Schedule",
@@ -1667,6 +1758,7 @@
     "keyOnlyAvailableAtCreation": "Full key available only at creation time — copy it when you first create the key",
     "modelsCount": "{count, plural, one {# model} other {# models}}",
     "lastUsedOn": "마지막: {date}",
+    "viewCostsFor": "__MISSING__:View costs for {name}",
     "editPermissions": "권한 편집",
     "deleteKey": "키 삭제",
     "regenerateKey": "키 재생성",
@@ -1708,9 +1800,12 @@
     "shownOf": "__MISSING__:{shown} of {total} shown",
     "emptyFilterTitle": "__MISSING__:No keys match your filters",
     "emptyFilterClear": "__MISSING__:Clear filters",
-    "endpointRestrictions": "Allowed Endpoints",
-    "allEndpointsAllowed": "This key can access all API endpoints.",
-    "endpointsRestricted": "Restricted to {count} endpoint{count, plural, one {} other {s}}."
+    "disableNonPublicModels": "__MISSING__:Disable Non-Public Models",
+    "disableNonPublicModelsDesc": "__MISSING__:Reject requests for models that are not discovered or not marked as public in the provider catalog",
+    "normalKeysSection": "__MISSING__:Normal keys",
+    "quotaKeysSection": "__MISSING__:Quota keys",
+    "quotaPill": "__MISSING__:QUOTA",
+    "quotaModeOnly": "__MISSING__:qtSd-only"
   },
   "auditLog": {
     "title": "감사 로그",
@@ -1845,6 +1940,8 @@
     "freeQuota": "Free quota/mo",
     "scrapeUrl": "URL to scrape",
     "scrapeUrlPlaceholder": "https://example.com",
+    "scrapeUrlRequired": "__MISSING__:URL is required",
+    "scrapeUrlInvalid": "__MISSING__:Invalid URL — it must start with http:// or https://",
     "scrapeExtract": "Extract",
     "scrapeExtracting": "Extracting…",
     "scrapeFullPage": "Full page",
@@ -1858,6 +1955,8 @@
     "scrapeMetadata": "Metadata",
     "scrapeProvider": "Provider",
     "scrapeSize": "Size",
+    "scrapeEmptyState": "__MISSING__:Enter a URL to extract its content",
+    "scrapeProvidersAvailable": "__MISSING__:Available providers: Firecrawl, Jina Reader, Tavily.",
     "compareRun": "Compare",
     "compareRunning": "Comparing…",
     "autoProvider": "Auto (cheapest)",
@@ -2245,6 +2344,8 @@
     "leastLatency": "최소 지연 시간",
     "comboName": "콤보 이름",
     "comboNamePlaceholder": "내 콤보",
+    "comboDescription": "__MISSING__:Description",
+    "comboDescriptionPlaceholder": "__MISSING__:Optional note describing this combo",
     "deleteConfirm": "이 콤보를 삭제하시겠습니까?",
     "noCombosYet": "아직 콤보가 없습니다.",
     "comboCreated": "콤보가 성공적으로 생성되었습니다.",
@@ -2284,6 +2385,8 @@
     "resetAwareDesc": "5시간 및 주간 재설정을 기준으로 남은 할당량의 균형을 맞추고 비슷한 점수를 라운드 로빈 방식으로 진행합니다.",
     "strictRandom": "Strict Random",
     "strictRandomDesc": "Shuffle deck — uses each model once before reshuffling",
+    "fusion": "__MISSING__:Fusion",
+    "fusionDesc": "__MISSING__:Fans the prompt to every panel model in parallel, then a judge model synthesizes one final answer",
     "models": "모델",
     "autoBalance": "자동 균형",
     "advancedSettings": "고급 설정",
@@ -2982,14 +3085,19 @@
     "ngrokStarted": "ngrok 터널이 시작되었습니다",
     "ngrokStopped": "Ngrok 터널이 중지되었습니다.",
     "ngrokRequestFailed": "ngrok 터널을 업데이트하지 못했습니다.",
-    "tokenSaverSubtitle": "모든 요청에 대해 더 적은 토큰을 소비하십시오.",
-    "tokenSaverToolOutput": "도구 출력",
-    "tokenSaverLlmOutput": "LLM 출력",
-    "tokenSaverInputCompression": "입력 압축",
     "apiEndpointsCatalogUnavailable": "API 카탈로그를 사용할 수 없습니다.",
     "apiEndpointsSearchPlaceholder": "엔드포인트 검색...",
     "apiEndpointsRequiresAuth": "인증이 필요합니다",
     "apiEndpointsNoMatch": "필터와 일치하는 엔드포인트가 없습니다.",
+    "vscodeAliasTitle": "__MISSING__:VS Code Token Alias",
+    "vscodeAliasDescriptionReady": "__MISSING__:Ready-to-paste compatibility URLs using the /api/v1/vscode/TOKEN/... endpoint.",
+    "vscodeAliasDescriptionError": "__MISSING__:Showing placeholder URLs because CLI keys could not be loaded in this session.",
+    "vscodeAliasDescriptionLoading": "__MISSING__:Loading CLI keys. Placeholder URLs are shown until a key is available.",
+    "vscodeAliasDescriptionPlaceholder": "__MISSING__:Showing placeholder URLs. Create or activate an API key in CLI Tools to replace TOKEN.",
+    "vscodeAliasManage": "__MISSING__:CLI Tools",
+    "vscodeAliasBaseLabel": "__MISSING__:VS Code base",
+    "vscodeAliasModelsLabel": "__MISSING__:VS Code models",
+    "vscodeAliasChatLabel": "__MISSING__:VS Code chat",
     "localServer": "로컬 서버",
     "cloudOmniroute": "클라우드 옴니루트",
     "copyUrl": "URL 복사",
@@ -3002,7 +3110,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "엔드포인트 프록시",
@@ -3178,42 +3289,187 @@
     "a2aStep3": "__MISSING__:Track and cancel tasks with {code1} and {code2}."
   },
   "memory": {
-    "title": "Memory Management",
-    "description": "View and manage stored memory entries",
-    "memories": "Memories",
-    "totalEntries": "Total Entries",
-    "tokensUsed": "Tokens Used",
-    "hitRate": "Hit Rate",
-    "loading": "Loading memories...",
-    "noMemories": "No memories found",
-    "search": "Search memories...",
-    "allTypes": "All Types",
-    "export": "Export",
-    "import": "Import",
-    "addMemory": "Add Memory",
-    "type": "Type",
-    "key": "Key",
-    "content": "Content",
-    "created": "Created",
-    "actions": "Actions",
-    "delete": "Delete",
-    "factual": "Factual",
-    "episodic": "Episodic",
-    "procedural": "Procedural",
-    "semantic": "Semantic",
     "a": "A",
-    "pipelineOk": "파이프라인 정상({latencyMs}ms)",
-    "pipelineError": "파이프라인 오류",
-    "healthUnknown": "건강 상태를 알 수 없음",
-    "checkingHealth": "확인 중…",
-    "checkHealth": "건강 확인",
-    "pageInfo": "페이지 {page}/{totalPages}(총 {total})",
-    "previous": "이전",
-    "next": "다음",
+    "actions": "Actions",
+    "addMemory": "Add Memory",
+    "allTypes": "All Types",
     "cancel": "취소",
-    "save": "저장",
+    "checkHealth": "건강 확인",
+    "checkingHealth": "확인 중…",
+    "compactOld": "__MISSING__:Compact old",
+    "concept": {
+      "title": "__MISSING__:Conversational Memory",
+      "description": "__MISSING__:OmniRoute learns from every conversation, remembering facts, episodes, procedures, and semantic concepts that make responses more accurate and context-aware.",
+      "howWorksToggle": "__MISSING__:How it works",
+      "howWorksContent": "__MISSING__:1. Automatic extraction: at the end of each response, facts and episodes are detected and saved automatically.\n2. Retrieval: before each response, the most relevant memories are searched via FTS5 (exact), vector (semantic), or hybrid RRF.\n3. Injection: relevant memories are injected into the assistant context to improve response quality.\n4. Management: use this page to view, edit, export, and compact old memories."
+    },
+    "content": "Content",
+    "contentPlaceholder": "기억해야 할 값 또는 JSON 콘텐츠",
+    "created": "Created",
+    "delete": "Delete",
+    "deleteConfirmDesc": "__MISSING__:This action cannot be undone. The memory will be permanently removed.",
+    "deleteConfirmTitle": "__MISSING__:Delete memory?",
+    "description": "View and manage stored memory entries",
+    "editMemory": "__MISSING__:Edit memory",
+    "editModal": {
+      "title": "__MISSING__:Edit Memory",
+      "metadataLabel": "__MISSING__:Metadata (JSON)",
+      "metadataInvalid": "__MISSING__:Invalid JSON",
+      "saveFailed": "__MISSING__:Failed to save memory"
+    },
+    "embedding": {
+      "autoLabel": "__MISSING__:Automatic",
+      "autoDesc": "__MISSING__:Uses best available: remote provider > static > transformers",
+      "remoteLabel": "__MISSING__:Remote provider",
+      "remoteDesc": "__MISSING__:Uses embedding via provider API (requires API key)",
+      "staticLabel": "__MISSING__:Static local (potion)",
+      "staticDesc": "__MISSING__:Local embedding without WASM or external dependencies",
+      "transformersLabel": "__MISSING__:Transformers.js (MiniLM)",
+      "transformersDesc": "__MISSING__:Local embedding via @huggingface/transformers (~400MB RAM)",
+      "providerModelLabel": "__MISSING__:Provider / Model",
+      "noRemoteProviders": "__MISSING__:No providers with configured API key",
+      "selectProviderModel": "__MISSING__:Select a model",
+      "staticEnabledLabel": "__MISSING__:Enable Static Potion",
+      "staticEnabledDesc": "__MISSING__:Download and use potion-base-8M model locally",
+      "transformersEnabledLabel": "__MISSING__:Enable Transformers.js",
+      "transformersEnabledDesc": "__MISSING__:Opt-in for local MiniLM (~400MB RAM, ~3s cold start)",
+      "transformersWarning": "__MISSING__:Requires ~400MB RAM and ~3s cold start on the first semantic query."
+    },
+    "emptyState": {
+      "title": "__MISSING__:No memories yet",
+      "description": "__MISSING__:Memories are created automatically from conversations. You can also add them manually using the button above."
+    },
+    "engine": {
+      "statusTitle": "__MISSING__:Engine Status",
+      "embeddingTitle": "__MISSING__:Embedding Source",
+      "rerankTitle": "__MISSING__:Rerank (optional)",
+      "reindexNow": "__MISSING__:Reindex now",
+      "reindexStarted": "__MISSING__:Reindexing started ({pending} pending)",
+      "reindexFailed": "__MISSING__:Failed to start reindexing",
+      "keywordLabel": "__MISSING__:Keyword (FTS5)",
+      "keywordReason": "__MISSING__:Keyword search always available",
+      "embeddingLabel": "__MISSING__:Embedding",
+      "vectorStoreLabel": "__MISSING__:Vector Store",
+      "qdrantLabel": "__MISSING__:Qdrant",
+      "rerankLabel": "__MISSING__:Rerank",
+      "qdrantDisabled": "__MISSING__:Disabled",
+      "qdrantOk": "__MISSING__:Healthy ({latencyMs}ms)",
+      "qdrantError": "__MISSING__:Connection error",
+      "needsReindex": "__MISSING__:{count} memory(ies) need reindexing",
+      "configureCta": "__MISSING__:Configure",
+      "vectorStoreInstallHint": "__MISSING__:To enable vector search: npm install sqlite-vec (needs native Node.js, not WASM), then restart."
+    },
+    "episodic": "Episodic",
+    "export": "Export",
+    "factual": "Factual",
+    "healthUnknown": "건강 상태를 알 수 없음",
+    "hitRate": "Hit Rate",
+    "import": "Import",
+    "importError": "__MISSING__:Failed to import file",
+    "importResult": "__MISSING__:{imported} imported, {skipped} skipped",
+    "key": "Key",
     "keyPlaceholder": "예를 들어 사용자.기본 설정.테마",
-    "contentPlaceholder": "기억해야 할 값 또는 JSON 콘텐츠"
+    "loading": "Loading memories...",
+    "memories": "Memories",
+    "next": "다음",
+    "noMemories": "No memories found",
+    "pageInfo": "페이지 {page}/{totalPages}(총 {total})",
+    "pipelineError": "파이프라인 오류",
+    "pipelineOk": "파이프라인 정상({latencyMs}ms)",
+    "playground": {
+      "infoTitle": "__MISSING__:Memory Playground",
+      "infoDesc": "__MISSING__:Simulate what would be retrieved for a given query. No memories are modified — read-only preview.",
+      "queryLabel": "__MISSING__:Test query",
+      "queryPlaceholder": "__MISSING__:Type a question or test phrase...",
+      "strategyLabel": "__MISSING__:Strategy",
+      "strategyExact": "__MISSING__:Exact (FTS5)",
+      "strategySemantic": "__MISSING__:Semantic (vector)",
+      "strategyHybrid": "__MISSING__:Hybrid (RRF)",
+      "budgetLabel": "__MISSING__:Budget (tokens)",
+      "simulate": "__MISSING__:Simulate",
+      "resultsTitle": "__MISSING__:{count} result(s)",
+      "resolutionTitle": "__MISSING__:Search resolution",
+      "resolutionEmbedding": "__MISSING__:Embedding",
+      "resolutionStore": "__MISSING__:Vector store",
+      "resolutionStrategy": "__MISSING__:Strategy used",
+      "rerankApplied": "__MISSING__:Rerank applied",
+      "fallback": "__MISSING__:Fallback",
+      "noResults": "__MISSING__:No memories found for this query.",
+      "tokensUsed": "__MISSING__:tokens used",
+      "none": "__MISSING__:none",
+      "errorFetch": "__MISSING__:Failed to fetch preview"
+    },
+    "previous": "이전",
+    "procedural": "Procedural",
+    "qdrant": {
+      "title": "__MISSING__:Qdrant (Vector Store Tier 2)",
+      "description": "__MISSING__:Optional Qdrant integration for scalable semantic search",
+      "enableLabel": "__MISSING__:Enable Qdrant",
+      "enableDesc": "__MISSING__:When enabled, Qdrant is used as the primary vector store",
+      "testConnection": "__MISSING__:Test connection",
+      "testing": "__MISSING__:Testing...",
+      "statusActive": "__MISSING__:Active",
+      "statusError": "__MISSING__:Error",
+      "statusDisabled": "__MISSING__:Disabled",
+      "healthOk": "__MISSING__:Connection OK ({latencyMs}ms)",
+      "healthError": "__MISSING__:Connection error",
+      "saved": "__MISSING__:Settings saved",
+      "saveError": "__MISSING__:Failed to save",
+      "portLabel": "__MISSING__:Port",
+      "embeddingModelLabel": "__MISSING__:Embedding Model",
+      "optional": "__MISSING__:optional",
+      "apiKeyKeepPlaceholder": "__MISSING__:Leave blank to keep current key",
+      "apiKeyOptional": "__MISSING__:Leave blank if not using authentication",
+      "removeApiKey": "__MISSING__:Remove",
+      "quickSelectModel": "__MISSING__:Quick select",
+      "searchTestTitle": "__MISSING__:Semantic search test",
+      "searchPlaceholder": "__MISSING__:Type a test query...",
+      "searching": "__MISSING__:Searching...",
+      "search": "__MISSING__:Search",
+      "cleanupTitle": "__MISSING__:Clean up old points",
+      "cleanupDesc": "__MISSING__:Remove Qdrant points for expired memories (retention period).",
+      "cleaning": "__MISSING__:Cleaning...",
+      "cleanNow": "__MISSING__:Clean now",
+      "cleanupSuccess": "__MISSING__:{count} point(s) removed",
+      "cleanupFailed": "__MISSING__:Cleanup failed"
+    },
+    "rerank": {
+      "enableLabel": "__MISSING__:Enable Rerank",
+      "enableDesc": "__MISSING__:Reorders results with a reranking model after search",
+      "warning": "__MISSING__:Rerank adds +200-500ms latency and additional cost per request. Use sparingly.",
+      "providerModelLabel": "__MISSING__:Rerank Provider / Model",
+      "noProviderWithKey": "__MISSING__:No provider with configured API key. Configure a provider to use rerank.",
+      "selectProviderModel": "__MISSING__:Select a provider/model"
+    },
+    "save": "저장",
+    "saving": "__MISSING__:Saving...",
+    "search": "Search memories...",
+    "semantic": "Semantic",
+    "summarize": {
+      "title": "__MISSING__:Compact old memories",
+      "noCandidates": "__MISSING__:No memories eligible for compaction (criteria: >30 days old).",
+      "candidatesDesc": "__MISSING__:{count} memories will be compacted into summaries. This action cannot be undone.",
+      "confirm": "__MISSING__:Compact now"
+    },
+    "tabs": {
+      "memories": "__MISSING__:Memories",
+      "playground": "__MISSING__:Playground",
+      "engine": "__MISSING__:Engine"
+    },
+    "title": "Memory Management",
+    "tokensUsed": "Tokens Used",
+    "tooltip": {
+      "totalEntries": "__MISSING__:Total memories stored for this API key",
+      "tokensUsed": "__MISSING__:Estimated total tokens occupied by active memories",
+      "hitRate": "__MISSING__:Read-by-ID cache hit rate (not semantic recall accuracy)",
+      "factual": "__MISSING__:Objective, permanent facts from user context",
+      "episodic": "__MISSING__:Events and experiences from conversation history",
+      "procedural": "__MISSING__:Procedures, workflows, and instructions the assistant should follow",
+      "semantic": "__MISSING__:Concepts, preferences, and domain knowledge"
+    },
+    "totalEntries": "Total Entries",
+    "type": "Type",
+    "memoryEnabled": "__MISSING__:Memory enabled"
   },
   "skills": {
     "title": "Skills",
@@ -3544,6 +3800,14 @@
     "export": "Export",
     "exporting": "Exporting...",
     "exportFailed": "Export failed",
+    "cleanHistoryButton": "__MISSING__:Clean history",
+    "cleanHistoryTitle": "__MISSING__:Clean log history?",
+    "cleanHistoryMessage": "__MISSING__:This permanently clears all request log rows, legacy detail rows, and local artifact files under DATA_DIR/call_logs. The live page will refresh after cleanup.",
+    "cleanHistoryConfirm": "__MISSING__:Clean history",
+    "cleanHistoryCancel": "__MISSING__:Cancel",
+    "cleanHistorySuccess": "__MISSING__:Cleaned {deleted} log entries, {deletedArtifacts} artifacts, and {deletedDetailedLogs} legacy detail rows.",
+    "cleanHistoryEmpty": "__MISSING__:No request log history was found.",
+    "cleanHistoryFailed": "__MISSING__:Failed to clean log history.",
     "timeRange": "Time Range",
     "lastNHours": "Last {hours}",
     "defaultRange": "default",
@@ -3551,10 +3815,14 @@
       "fetchFailed": "Failed to fetch logs",
       "copyFailed": "Failed to copy log entry",
       "copyLogEntry": "Copy log entry"
-    }
+    },
+    "compressionLogTitle": "__MISSING__:Compression Log",
+    "compressionLogEmpty": "__MISSING__:No compressed requests yet. Compression stats will appear here when requests are processed with compression enabled.",
+    "tokens": "__MISSING__:tokens"
   },
   "onboarding": {
     "welcome": "환영합니다",
+    "tiers": "__MISSING__:Tiers",
     "security": "보안",
     "test": "테스트",
     "ready": "준비됐어요!",
@@ -3616,6 +3884,7 @@
   },
   "providers": {
     "title": "공급자",
+    "Account Deactivated": "__MISSING__:Account Deactivated",
     "allProviders": "모든 제공자",
     "audioProviders": "오디오 제공업체",
     "showFreeOnly": "무료만",
@@ -3623,6 +3892,33 @@
     "addFirstProvider": "첫 번째 공급자 추가",
     "addFirstProviderDesc": "OmniRoute를 통해 요청 라우팅을 시작하려면 AI 공급자를 연결하세요. 무료 공급자, API 키 또는 OAuth 계정을 사용할 수 있습니다.",
     "learnMore": "자세히 알아보기",
+    "adaptaTutorial": {
+      "title": "__MISSING__:How to connect Adapta Web",
+      "introPrefix": "__MISSING__:Adapta authenticates through Clerk. The token",
+      "introSuffix": "__MISSING__:is a long-lived JWT that lets OmniRoute refresh sessions automatically.",
+      "or": "__MISSING__:or",
+      "step1Title": "__MISSING__:Open Adapta chat",
+      "step1DescPrefix": "__MISSING__:Open",
+      "step1DescSuffix": "__MISSING__:and sign in with your Gold or Business account.",
+      "step2Title": "__MISSING__:Open DevTools",
+      "step2DescPrefix": "__MISSING__:Press",
+      "step2DescSuffix": "__MISSING__:to open Developer Tools.",
+      "step3Title": "__MISSING__:Go to Application → Cookies",
+      "step3DescPrefix": "__MISSING__:In the",
+      "step3DescMiddle": "__MISSING__:expand",
+      "step3DescSuffix": "__MISSING__:and click",
+      "step4Title": "__MISSING__:Copy the cookie value for",
+      "step4DescPrefix": "__MISSING__:Find the cookie named",
+      "step4DescMiddle": "__MISSING__:in the list. Click it and copy the content from the",
+      "step4DescSuffix": "__MISSING__:column. It starts with",
+      "step5Title": "__MISSING__:Paste it here and save",
+      "step5DescPrefix": "__MISSING__:Click",
+      "step5DescMiddle": "__MISSING__:paste the",
+      "step5DescSuffix": "__MISSING__:value into the API Key field, then save. OmniRoute will refresh the session automatically.",
+      "tipLabel": "__MISSING__:Tip:",
+      "tipPrefix": "__MISSING__:The",
+      "tipSuffix": "__MISSING__:cookie is long-lived, usually for months. You only need to renew it if you sign out or Adapta invalidates the session."
+    },
     "editProvider": "제공자 편집",
     "deleteProvider": "공급자 삭제",
     "noProviders": "구성된 제공업체가 없습니다.",
@@ -3648,13 +3944,38 @@
     "apiKeyProviders": "API 키 제공자",
     "compatibleProviders": "API 키 호환 제공자",
     "testAll": "모두 테스트",
+    "distributeProxies": "__MISSING__:Distribute Proxies",
+    "distributing": "__MISSING__:Distributing...",
+    "selectedCount": "__MISSING__:{count, plural, one {# selected} other {# selected}}",
+    "accountsCount": "__MISSING__:{count, plural, one {# account} other {# accounts}}",
     "testAllOAuth": "모든 OAuth 연결 테스트",
     "testAllFree": "모든 무료 연결 테스트",
     "testAllApiKey": "모든 API 키 연결 테스트",
     "testAllCompatible": "모든 호환 연결 테스트",
+    "testAllModels": "__MISSING__:Test all models",
+    "testAllModelsConfirm": "__MISSING__:Test all visible models? Failed models will be hidden if auto-hide is enabled.",
+    "testingAllModels": "__MISSING__:Testing {done}/{total}...",
+    "testAllResults": "__MISSING__:{ok} of {total} models working",
+    "noModelsToTest": "__MISSING__:No models match the current filter",
+    "showAllModels": "__MISSING__:All",
+    "showVisibleOnly": "__MISSING__:Visible only",
+    "freeFilterAll": "__MISSING__:All",
+    "freeFilterFreeOnly": "__MISSING__:Free only",
+    "freeFilterPaidOnly": "__MISSING__:Paid only",
+    "sortFreeFirst": "__MISSING__:Free first",
+    "showHiddenOnly": "__MISSING__:Hidden only",
+    "filterByVisibility": "__MISSING__:Filter by visibility",
+    "autoHideFailed": "__MISSING__:Auto-hide failed models",
+    "autoHideFailedHint": "__MISSING__:When enabled, Test all hides non-transient failures from public catalogs such as /v1/models. Single-model tests never auto-hide.",
     "connected": "{count} 연결됨",
     "errorCount": "{count} 오류({code})",
     "errorCountNoCode": "{count} 오류",
+    "testAllCompleted": "__MISSING__:Tested {total} models: {ok} OK, {failed} failed",
+    "modelAutoHidden": "__MISSING__:Model {model} auto-hidden (test failed)",
+    "filterAll": "__MISSING__:All",
+    "filterVisible": "__MISSING__:Visible only",
+    "filterHidden": "__MISSING__:Hidden only",
+    "modelsHiddenCount": "__MISSING__:{count} hidden",
     "warningCount": "{count} 경고",
     "noConnections": "연결 없음",
     "expiredBadge": "Expired",
@@ -3764,7 +4085,16 @@
     "batchUpdateNone": "__MISSING__:No connections were updated (they may no longer exist)",
     "batchRetestLimit": "__MISSING__:Retest up to {max} connections at a time",
     "noConnectionsToTest": "__MISSING__:No matching connections to test",
+    "batchDeleteConfirmTitle": "__MISSING__:Delete connections",
+    "batchDeleteConfirmButton": "__MISSING__:Delete",
+    "filterActive": "__MISSING__:Active",
+    "filterError": "__MISSING__:Error",
+    "filterBanned": "__MISSING__:Banned",
+    "filterCreditsExhausted": "__MISSING__:Credits Exhausted",
+    "noFilteredConnections": "__MISSING__:No connections match the current filter.",
     "failedSetAlias": "별칭을 설정하지 못했습니다.",
+    "setAliasSuccess": "__MISSING__:Alias {alias} set",
+    "deleteAliasSuccess": "__MISSING__:Alias {alias} deleted",
     "failedSaveConnection": "연결을 저장하지 못했습니다.",
     "failedSaveConnectionRetry": "연결을 저장하지 못했습니다. 다시 시도해 주세요.",
     "failedRetestConnection": "연결을 다시 테스트하지 못했습니다.",
@@ -3798,6 +4128,9 @@
     "connectionCount": "{count} 연결",
     "fetchingModels": "사용 가능한 모델을 가져오는 중...",
     "failedFetchModels": "모델을 가져오지 못했습니다.",
+    "noFreeModelsFound": "__MISSING__:No free models found for this provider — nothing imported.",
+    "fetchModelsSuccess": "__MISSING__:Found {count} new models",
+    "fetchModelsFailed": "__MISSING__:Could not auto-fetch models (you can retry from settings)",
     "noModelsFound": "모델을 찾을 수 없습니다.",
     "importFailed": "가져오기 실패",
     "noNewModelsAdded": "새로운 모델이 추가되지 않았습니다.",
@@ -3806,6 +4139,10 @@
     "importingModelsTitle": "모델 가져오기",
     "copyModel": "모델 복사",
     "filterModels": "모델 필터링…",
+    "testAllRateLimited": "__MISSING__:Rate limit reached, stopped early",
+    "hideFailedAuto": "__MISSING__:Auto-hide failed models",
+    "selectAllModels": "Select all",
+    "hideAllModels": "__MISSING__:Hide all",
     "modelsActive": "활성",
     "showModel": "모델 표시",
     "hideModel": "모델 숨기기",
@@ -3814,6 +4151,9 @@
     "rateLimitUnprotected": "보호되지 않음",
     "enableRateLimitProtection": "속도 제한 보호를 활성화하려면 클릭하세요.",
     "disableRateLimitProtection": "속도 제한 보호를 비활성화하려면 클릭하세요.",
+    "testAllProgress": "__MISSING__:Tested {done}/{total}",
+    "testAllFailedHidden": "__MISSING__:{count} failed models hidden",
+    "testAllDone": "__MISSING__:All models tested",
     "productionKey": "생산 키",
     "enterNewApiKey": "새 API 키를 입력하세요",
     "codexApplyModalTitle": "지역 코덱스에 적용",
@@ -3889,10 +4229,20 @@
     "errorTypeNetworkError": "네트워크 오류",
     "errorTypeTestUnsupported": "지원되지 않는 테스트",
     "errorTypeUpstreamError": "업스트림 오류",
+    "errorTypeCreditsExhausted": "__MISSING__:No credits",
+    "errorTypeBanned": "__MISSING__:403 Banned",
     "proxySourceGlobal": "글로벌",
     "proxySourceProvider": "공급자",
     "proxySourceKey": "열쇠",
     "proxyConfiguredBySource": "프록시({source}): {host}",
+    "proxyOn": "__MISSING__:Proxy On",
+    "proxyOff": "__MISSING__:Direct (bypass proxy)",
+    "proxyEnabledTitle": "__MISSING__:Proxy is enabled for this connection",
+    "proxyDisabledTitle": "__MISSING__:Direct connection — bypasses every proxy (including the global proxy) for this connection",
+    "perKeyProxyOn": "__MISSING__:Per-key",
+    "perKeyProxyOff": "__MISSING__:Connection",
+    "perKeyProxyEnabledTitle": "__MISSING__:Per-key proxy assignment enabled for this provider",
+    "perKeyProxyDisabledTitle": "__MISSING__:Per-key proxy assignment disabled for this provider",
     "autoPriority": "자동: {priority}",
     "proxy": "프록시",
     "retestAuthentication": "인증 재테스트",
@@ -3920,6 +4270,12 @@
     "compatProtocolOpenAI": "OpenAI Chat Completions",
     "compatProtocolOpenAIResponses": "OpenAI Responses API",
     "compatProtocolClaude": "Anthropic Messages",
+    "targetFormatLabel": "__MISSING__:Target Format",
+    "targetFormatHint": "__MISSING__:Override the upstream wire format. Use 'Anthropic Messages' to route OpenAI-compatible providers (e.g. opencode-go) through the /v1/messages endpoint.",
+    "targetFormatAuto": "__MISSING__:Default (auto)",
+    "targetFormatGemini": "__MISSING__:Gemini",
+    "targetFormatGeminiCli": "__MISSING__:Gemini CLI",
+    "targetFormatAntigravity": "__MISSING__:Antigravity",
     "compatUpstreamHeadersLabel": "Extra upstream headers",
     "compatUpstreamHeadersHint": "High-privilege setting — same trust level as editing provider API credentials; only trusted admins should use it. Merged after OmniRoute adds auth from the provider API key. If a custom header uses the same name as an existing one (e.g. Authorization), your value fully replaces the auto-generated header (including the Bearer token) — the upstream only sees what you typed, not the key from settings. Misconfiguration can cause 401 or broken upstream auth. One row per header (e.g. extra Authentication for some gateways). Hover or focus the value to preview. Saves on blur, outside click, or closing this panel.",
     "compatUpstreamHeaderName": "Header name",
@@ -3929,6 +4285,8 @@
     "compatBadgeUpstreamHeaders": "Headers",
     "perModelQuotaLabel": "Per Model Quota Label",
     "perModelQuotaDescription": "Per Model Quota Description",
+    "importFreeModelsOnlyLabel": "__MISSING__:Import only free models",
+    "importFreeModelsOnlyHint": "__MISSING__:When enabled, only this provider's free models are imported. Paid models are skipped.",
     "perModelQuotaToggle": "모델별 할당량 토글",
     "modelId": "모델 ID",
     "customModelPlaceholder": "예를 들어 gpt-4.5-터보",
@@ -3964,7 +4322,6 @@
     "email": "이메일",
     "healthCheckMinutes": "상태 점검(분)",
     "healthCheckHint": "사전 토큰 새로 고침 간격. 0 = 비활성화됨.",
-    "selectAllModels": "Select all",
     "deselectAllModels": "Deselect all",
     "modelsActiveCount": "{active}/{total} active",
     "noModelsMatch": "No models match \"{filter}\"",
@@ -3976,6 +4333,9 @@
     "editCompatibleTitle": "{type} 호환 가능 편집",
     "compatibleBaseUrlHint": "Root URL of your {type}-compatible API. Use Advanced Settings for custom endpoint paths.",
     "apiKeyForCheck": "API Key(확인용)",
+    "testModelIdLabel": "__MISSING__:Model ID (optional)",
+    "testModelIdPlaceholder": "__MISSING__:e.g. my-model-id",
+    "testModelIdHint": "__MISSING__:If the provider lacks a /models endpoint, enter a model ID to validate via /chat/completions instead.",
     "compatibleProdPlaceholder": "{type} 호환 가능(프로덕션)",
     "tokenRefreshed": "Token refreshed successfully",
     "tokenRefreshFailed": "Token refresh failed",
@@ -4069,6 +4429,19 @@
     "codexAuthApplyFailed": "Failed to apply Codex auth.json locally",
     "codexAuthExported": "Codex auth.json exported",
     "codexAuthExportFailed": "Failed to export Codex auth.json",
+    "codexCliGuideButton": "__MISSING__:Codex CLI Guide",
+    "codexCliGuideTitle": "__MISSING__:Codex CLI Guide",
+    "codexCliGuideLoading": "__MISSING__:Loading guide...",
+    "codexCliGuideLoadFailed": "__MISSING__:Could not load the guide.",
+    "codexExternalLinkButton": "__MISSING__:External Codex link",
+    "codexExternalLinkModalTitle": "__MISSING__:External Codex link",
+    "codexExternalLinkModalDescription": "__MISSING__:Share this single-use link with the person who will authenticate the Codex account. They open it in their own browser, complete the OpenAI login, and the connection is registered here. The link expires in 15 minutes.",
+    "codexExternalLinkGenerating": "__MISSING__:Generating link...",
+    "codexExternalLinkWaiting": "__MISSING__:Waiting for browser authentication. This window refreshes automatically.",
+    "codexExternalLinkCreateFailed": "__MISSING__:Failed to generate the link.",
+    "codexExternalLinkNetworkError": "__MISSING__:Could not contact the server.",
+    "codexExternalLinkConnected": "__MISSING__:Codex account connected through the external link.",
+    "codexExternalLinkExpired": "__MISSING__:The link expired before completion.",
     "importCodexAuth": "인증 가져오기",
     "codexImportModalTitle": "Codex 인증 가져오기",
     "codexImportTabSingle": "싱글",
@@ -4146,6 +4519,8 @@
     "t3ChatWebCookiePlaceholder": "볼록-세션-id=abc123...",
     "blockClaudeExtraUsageDescription": "Block Claude Extra Usage Description",
     "blockClaudeExtraUsageLabel": "Block Claude Extra Usage Label",
+    "disableCoolingDescription": "__MISSING__:Skip the transient cooldown so this connection stays eligible even after recoverable errors (terminal states like banned/expired still apply).",
+    "disableCoolingLabel": "__MISSING__:Disable cooldown for this connection",
     "bulkPasteAdded": "{count, plural, one {1 key added} other {# keys added}}",
     "bulkPasteDuplicatesIgnored": "{count, plural, one {1 duplicate skipped} other {# duplicates skipped}}",
     "bulkPasteHint": "Paste one API key per line. Empty lines are ignored and duplicate keys are skipped.",
@@ -4243,6 +4618,17 @@
     "personalAccessTokenLabel": "Personal Access Token Label",
     "qoderPatHint": "Qoder Pat Hint",
     "qoderPatPlaceholder": "Qoder Pat Placeholder",
+    "rateLimitOverridesSection": "__MISSING__:Rate Limit Overrides",
+    "rateLimitOverridesMaxConcurrentHint": "__MISSING__:Max concurrent requests override for this connection. Overrides the account-level cap.",
+    "rateLimitOverridesMaxConcurrentLabel": "__MISSING__:Max Concurrent (Rate Limit)",
+    "rateLimitOverridesMinTimeHint": "__MISSING__:Minimum time (ms) between requests. Overrides the default rate limiter delay.",
+    "rateLimitOverridesMinTimeLabel": "__MISSING__:Min Interval (ms)",
+    "rateLimitOverridesRpmHint": "__MISSING__:Max requests per minute for this connection. Overrides the provider default.",
+    "rateLimitOverridesRpmLabel": "__MISSING__:RPM (Requests/min)",
+    "rateLimitOverridesTpdHint": "__MISSING__:Max tokens per day for this connection. Overrides the provider default.",
+    "rateLimitOverridesTpdLabel": "__MISSING__:TPD (Tokens/day)",
+    "rateLimitOverridesTpmHint": "__MISSING__:Max tokens per minute for this connection. Overrides the provider default.",
+    "rateLimitOverridesTpmLabel": "__MISSING__:TPM (Tokens/min)",
     "refreshOauthTokenTitle": "Refresh Oauth Token Title",
     "regionHint": "Region Hint",
     "regionLabel": "Region Label",
@@ -4257,6 +4643,7 @@
     "searchProvider": "Search Provider",
     "searchProviderDesc": "Search Provider Desc",
     "searchProviders": "공급자 검색...",
+    "searchByModel": "__MISSING__:Search by model…",
     "searchProvidersHeading": "Search Providers Heading",
     "searxngBaseUrlHint": "Searxng Base Url Hint",
     "searxngInfo": "Searxng Info",
@@ -4422,7 +4809,21 @@
     "webNoAuthGuideBody": "{provider}에는 API 키나 쿠키가 필요하지 않습니다. 무료 웹 엔드포인트를 사용하려면 연결을 저장하세요.",
     "webSessionCredentialValidationFailed": "세션 자격 증명 유효성 검사에 실패했습니다. 다시 로그인하고 새로운 자격 증명을 복사한 후 다시 시도하세요.",
     "checkCookie": "쿠키 확인",
-    "checkWebToken": "토큰 확인"
+    "checkWebToken": "토큰 확인",
+    "huggingchatLabel": "__MISSING__:HuggingChat (Free)",
+    "huggingchatDesc": "__MISSING__:Free LLM chat via huggingface.co/chat",
+    "phindLabel": "__MISSING__:Phind (Free)",
+    "phindDesc": "__MISSING__:Free dev-focused AI chat",
+    "poeWebLabel": "__MISSING__:Poe Web",
+    "poeWebDesc": "__MISSING__:Multi-model chat via poe.com",
+    "veniceWebLabel": "__MISSING__:Venice Web",
+    "veniceWebDesc": "__MISSING__:Privacy-focused AI chat",
+    "v0VercelWebLabel": "__MISSING__:v0 Vercel Web",
+    "v0VercelWebDesc": "__MISSING__:AI code generation via v0.dev",
+    "kimiWebLabel": "__MISSING__:Kimi Web",
+    "kimiWebDesc": "__MISSING__:Chinese market AI chat via kimi.moonshot.cn",
+    "doubaoWebLabel": "__MISSING__:Doubao Web",
+    "doubaoWebDesc": "__MISSING__:ByteDance AI chat via doubao.com"
   },
   "settings": {
     "title": "설정",
@@ -4528,6 +4929,7 @@
     "memoryDesc": "Persistent cross-session conversational memory",
     "memoryEnabled": "Enable Memory",
     "memoryEnabledDesc": "When enabled, OmniRoute will inject relevant past context.",
+    "memoryTokenCostWarning": "__MISSING__:Heads up: with memory enabled, OmniRoute injects up to {tokens} tokens of retrieved context into every chat request — this increases token usage and cost. To skip injection for a specific request, send the \"x-omniroute-no-memory: true\" header.",
     "maxTokens": "Max Tokens",
     "retentionDays": "Retention",
     "recent": "Recent",
@@ -4566,6 +4968,15 @@
     "modelsDevInfoOrder": "User Override → models.dev → LiteLLM → Hardcoded Default",
     "systemTheme": "시스템 테마",
     "debugToggle": "Enable Debug Mode",
+    "homePinProviderQuotaToHome": "Pin Information to Home Page",
+    "homeProviderQuotaLimits": "Provider Quota Limits",
+    "homeProviderQuotaLimitsDesc": "Pin the Provider Quota status container (with Refresh All button) to the top of the Home page.",
+    "homeQuickStart": "Quick Start",
+    "homeQuickStartDesc": "Show the Quick Start panel on the Home page.",
+    "homeProviderTopology": "Provider Topology",
+    "homeProviderTopologyDesc": "Show the Provider Topology on the Home page.",
+    "accountEmailVisibility": "__MISSING__:Account email visibility",
+    "accountEmailVisibilityDesc": "__MISSING__:Show full account emails across providers, combos, logs, quota, and playground screens. Turn this off to mask them by default.",
     "sidebarVisibilityToggle": "Show Sidebar Items",
     "enableCache": "캐시 활성화",
     "cacheTTL": "캐시 TTL",
@@ -4599,11 +5010,17 @@
     "autoDisableDescription": "Permanently mark provider connections as deactivated if they return specific terminal ban signals (e.g. HTTP 403 'verify your account'). This removes them from the combo rotation.",
     "autoDisableThreshold": "Ban Threshold",
     "autoDisableThresholdDesc": "Consecutive ban signals required before permanent deactivation.",
+    "customBannedSignals": "__MISSING__:Banned Keywords",
+    "customBannedSignalsDesc": "__MISSING__:Additional keywords that trigger permanent account ban detection. Built-in keywords always apply.",
+    "customBannedSignalsPlaceholder": "__MISSING__:e.g. api key revoked",
+    "noCustomBannedSignals": "__MISSING__:No custom keywords. Only built-in keywords are active.",
     "resilienceStructureTitle": "Resilience Structure",
     "resilienceStructureDesc": "이 페이지는 동작만 구성합니다. 라이브 차단기 상태는 상태 페이지에 표시됩니다. 콤보별 재시도 및 라운드 로빈 슬롯 제어는 콤보 설정에 유지됩니다.",
     "enableThinking": "사고 활성화",
     "maxThinkingTokens": "맥스 씽킹 토큰",
     "enableProxy": "프록시 활성화",
+    "perKeyProxyEnabled": "__MISSING__:Enable per-key proxy assignment",
+    "perKeyProxyEnabledDesc": "__MISSING__:When enabled, each provider connection can use its own proxy assignment",
     "proxyUrl": "프록시 URL",
     "pricingRates": "가격 요율 형식",
     "currentPricing": "현재 가격 개요",
@@ -4683,6 +5100,13 @@
     "globalProxy": "글로벌 프록시",
     "globalProxyDesc": "모든 API 호출에 대해 글로벌 아웃바운드 프록시를 구성합니다. 개별 공급자, 콤보 및 키가 이를 재정의할 수 있습니다.",
     "noGlobalProxy": "글로벌 프록시가 구성되지 않았습니다.",
+    "proxyPool": "__MISSING__:Proxy Pool",
+    "freePool": "__MISSING__:Free Pool",
+    "proxyDocumentation": "__MISSING__:Proxy Documentation",
+    "proxyGlobalConfigTab": "__MISSING__:Global Config",
+    "proxyPoolTab": "__MISSING__:Proxy Pool",
+    "freePoolTab": "__MISSING__:Free Pool",
+    "proxyDocumentationTab": "__MISSING__:Documentation",
     "bulkHealthcheck": "Bulk Healthcheck",
     "bulkHealthcheckDesc": "Test all configured proxies against a target URL to find which ones work.",
     "healthcheckTesting": "Testing...",
@@ -4695,6 +5119,51 @@
     "healthcheckStatus": "Status",
     "healthcheckProxyUrl": "Proxy URL",
     "healthcheckLatency": "Latency",
+    "proxyDocumentationScopeTitle": "__MISSING__:Proxy scope resolution",
+    "proxyDocumentationScopeDescBefore": "__MISSING__:OmniRoute resolves the outbound proxy in priority order: ",
+    "proxyDocumentationScopeOrder": "__MISSING__:combo → account → provider → global",
+    "proxyDocumentationScopeDescAfter": "__MISSING__:. The most specific scope wins.",
+    "proxyDocumentationAddTitle": "__MISSING__:Adding a custom proxy",
+    "proxyDocumentationAddDescBefore": "__MISSING__:Go to the ",
+    "proxyDocumentationAddDescMiddle": "__MISSING__: tab → click ",
+    "proxyDocumentationAddCta": "__MISSING__:+ Add proxy",
+    "proxyDocumentationAddDescAfter": "__MISSING__:. Fill in type (http/https/socks5), host, and port. Optionally assign it to a scope.",
+    "proxyDocumentationBulkTitle": "__MISSING__:Bulk import format",
+    "proxyDocumentationBulkDesc": "__MISSING__:Pipe-delimited fields:",
+    "proxyDocumentationSocks5DescBefore": "__MISSING__:SOCKS5 proxies are disabled by default. Set",
+    "proxyDocumentationFreePoolDesc": "__MISSING__:The Free Pool tab aggregates proxies from 1proxy, Proxifly, and IPLocate. Use ⊕ to test and promote a proxy to your registry. Only proxies that pass the connectivity test are added.",
+    "proxyDocumentationVercelRelayDescBefore": "__MISSING__:The Vercel Relay is an outbound edge relay — not an inbound tunnel. Deploying one sends LLM API calls through Vercel's dynamic IPs, bypassing datacenter geo-blocks and rate limits. The relay is protected by a generated secret header",
+    "proxyDocumentationVercelRelayDescAfter": "__MISSING__:Your Vercel token is used only during deploy and is never stored.",
+    "vercelRelayTokenRequired": "__MISSING__:Token is required",
+    "vercelRelayDeployFailed": "__MISSING__:Deploy failed",
+    "vercelRelayTokenHint": "__MISSING__:Token is used only during deploy — never stored.",
+    "denoRelayTokenRequired": "__MISSING__:Deno Deploy token is required",
+    "denoRelayOrgDomainRequired": "__MISSING__:Organization domain is required",
+    "denoRelayDeployFailed": "__MISSING__:Deno Deploy failed",
+    "denoRelayTokenHint": "__MISSING__:Organization token (prefix ddo_) from console.deno.com → Organization → Settings → Organization Tokens. Used once for deploy and never stored.",
+    "denoRelayOrgDomainHint": "__MISSING__:Your Deno Deploy organization's default domain (e.g. acme.deno.net). The relay will be reachable at https://<app-name>.<org-slug>.deno.net.",
+    "proxyFreePoolFilterProtocol": "__MISSING__:Filter by protocol",
+    "proxyFreePoolProtocol": "__MISSING__:Protocol",
+    "proxyFreePoolCountryPlaceholder": "__MISSING__:Country (e.g. US)",
+    "proxyFreePoolFilterCountry": "__MISSING__:Filter by country",
+    "proxyFreePoolMinQualityPlaceholder": "__MISSING__:Min quality",
+    "proxyFreePoolMinQualityLabel": "__MISSING__:Minimum quality score",
+    "proxyFreePoolSyncAll": "__MISSING__:Sync All",
+    "proxyFreePoolTotal": "__MISSING__:Total",
+    "proxyFreePoolInPool": "__MISSING__:In pool",
+    "proxyFreePoolAvgQuality": "__MISSING__:Avg quality",
+    "proxyFreePoolSelected": "__MISSING__:{count} selected",
+    "proxyFreePoolAddSelected": "__MISSING__:Add selected to pool",
+    "proxyFreePoolAddVisible": "__MISSING__:Add all visible to pool",
+    "proxyFreePoolSource": "__MISSING__:Source",
+    "proxyFreePoolHostPort": "__MISSING__:Host:Port",
+    "proxyFreePoolType": "__MISSING__:Type",
+    "proxyFreePoolCountry": "__MISSING__:Country",
+    "proxyFreePoolQuality": "__MISSING__:Quality",
+    "proxyFreePoolLatency": "__MISSING__:Latency",
+    "proxyFreePoolEmpty": "__MISSING__:No proxies found. Click Sync All to fetch from sources.",
+    "close": "__MISSING__:Close",
+    "cancel": "__MISSING__:Cancel",
     "globalLabel": "글로벌",
     "configure": "구성",
     "globalSystemPrompt": "글로벌 시스템 프롬프트",
@@ -4951,6 +5420,7 @@
     "systemStorage": "시스템 및 스토리지",
     "allDataLocal": "모든 데이터는 컴퓨터에 로컬로 저장됩니다.",
     "databasePath": "데이터베이스 경로",
+    "export": "__MISSING__:Export",
     "exportDatabase": "데이터베이스 내보내기",
     "exportAll": "모두 내보내기(.tar.gz)",
     "importDatabase": "데이터베이스 가져오기",
@@ -5038,6 +5508,11 @@
     "adaptiveVolumeRoutingDesc": "Scale connections dynamically based on payload volume and throughput pressure.",
     "lkgpToggleTitle": "Last Known Good Provider (LKGP)",
     "lkgpToggleDesc": "When enabled, the router remembers which provider last served a successful response and tries it first on subsequent requests.",
+    "echoRequestedModelTitle": "__MISSING__:Echo requested model name in responses",
+    "echoRequestedModelDesc": "__MISSING__:When enabled, the response `model` field echoes the alias or combo name the client requested instead of the upstream model name. Fixes strict clients (e.g. Claude Desktop) that reject a response whose model does not match the request.",
+    "webSearchRouteTitle": "__MISSING__:Web search routing",
+    "webSearchRouteDesc": "__MISSING__:When a request includes a native web_search tool, route the whole request to this model instead of the default — useful for providers that don't implement Anthropic's web_search server tool. Leave blank to disable.",
+    "webSearchRoutePlaceholder": "__MISSING__:e.g. openrouter,anthropic/claude-3.5-sonnet",
     "clearLkgpCache": "Clear LKGP Cache",
     "lkgpCacheCleared": "LKGP cache cleared successfully",
     "lkgpCacheClearFailed": "Failed to clear LKGP cache",
@@ -5102,6 +5577,16 @@
     "clearSyncedPricing": "Clear Synced Pricing",
     "compressionTitle": "Prompt Compression",
     "compressionDesc": "Reduce token usage by compressing prompts before sending to providers",
+    "tokenSaverTitle": "__MISSING__:Token Saver",
+    "tokenSaverSubtitle": "__MISSING__:Spend fewer tokens on every request.",
+    "tokenSaverToolOutput": "__MISSING__:Tool output",
+    "tokenSaverToolOutputDesc": "__MISSING__:Clean git, grep, ls, tree, and log output before it reaches the provider.",
+    "tokenSaverLlmOutput": "__MISSING__:LLM output",
+    "tokenSaverLlmOutputDesc": "__MISSING__:Inject terse response instructions without rewriting provider output.",
+    "tokenSaverInputCompression": "__MISSING__:Input compression",
+    "tokenSaverInputCompressionDesc": "__MISSING__:Rewrite eligible chat history while preserving code, URLs, and intent.",
+    "tokenSaverFineTunePrefix": "__MISSING__:Fine-tune each engine on",
+    "tokenSaverFineTuneSuffix": "__MISSING__:or combine engines per request on",
     "compressionMode": "Compression Mode",
     "compressionModeOff": "Off",
     "compressionModeOffDesc": "No compression applied",
@@ -5121,6 +5606,11 @@
     "compressionUltraMinScore": "최소 점수 기준",
     "compressionUltraSlmFallback": "공격적으로 대체",
     "compressionUltraModelPath": "SLM 모델 경로",
+    "compressionUltraEngine": "__MISSING__:Ultra tier",
+    "compressionUltraEngineHeuristic": "__MISSING__:Heuristic (Tier-A, default)",
+    "compressionUltraEngineSlm": "__MISSING__:SLM (LLMLingua-2, opt-in)",
+    "compressionUltraSlmHint": "__MISSING__:SLM downloads a small ONNX model on first use (cold-start) and transparently falls back to the heuristic on timeout or if unavailable.",
+    "compressionUltraSlmPrewarm": "__MISSING__:Pre-warm SLM model on enable",
     "compressionSummarizerEnabled": "요약기 활성화",
     "compressionMaxTokensPerMessage": "메시지당 최대 토큰",
     "compressionMinSavings": "최소 절감 임계값",
@@ -5308,13 +5798,22 @@
     "resilienceNo": "아니요",
     "resilienceDefault": "Default",
     "storageDatabaseBackupRetention": "데이터베이스 백업 보존",
+    "storageDatabaseBackups": "__MISSING__:Database backups",
     "storagePurgeData": "데이터 삭제",
+    "storagePurgeDataDesc": "__MISSING__:Immediately delete all records without applying retention checks. Use with caution.",
+    "storageRetentionCleanup": "__MISSING__:Retention Settings",
+    "storageRetentionCleanupDesc": "__MISSING__:Configure operational record retention and database backup cleanup.",
+    "retentionCallDays": "__MISSING__:Call {count}d",
+    "retentionAppDays": "__MISSING__:App {count}d",
+    "retentionRows": "__MISSING__:{count} rows",
     "retentionQuotaSnapshots": "할당량 스냅샷(일)",
+    "retentionCompressionAnalytics": "__MISSING__:Compression Analytics (days)",
     "retentionMcpAudit": "MCP 감사(일)",
     "retentionA2aEvents": "A2A 이벤트(일)",
     "retentionCallLogs": "통화 기록(일)",
     "retentionUsageHistory": "이용내역(일)",
     "retentionMemoryEntries": "메모리 항목(일)",
+    "saveRetentionSettings": "__MISSING__:Save retention settings",
     "storageAutoVacuumMode": "자동 진공 모드",
     "storageScheduledVacuum": "예약된 진공",
     "storageVacuumHour": "진공 시간(0-23)",
@@ -5328,10 +5827,16 @@
     "storageIntegrityOk": "✓ 알았어",
     "storageIntegrityError": "✗ 오류",
     "storageUsageTokenBuffer": "사용 토큰 버퍼",
+    "storageUsageTokenBufferDesc": "__MISSING__:Extra tokens added to reported usage to account for system prompt overhead.",
+    "storageUsageTokenBufferHint": "__MISSING__:Set to 0 to report raw provider token counts. Default: 2000.",
+    "storageUsageTokenBufferCurrent": "__MISSING__:Current: {value}",
     "compressionSettingsAutoTriggerMode": "자동 트리거 모드",
     "compressionSettingsMcpDescriptionCompression": "MCP 설명 압축",
+    "mcpAccessibilityTitle": "__MISSING__:MCP accessibility output",
     "compressionSettingsCavemanIntensity": "원시인의 강도",
     "compressionSettingsCavemanOutputMode": "원시인 출력 모드",
+    "compressionSettingsOutputStyles": "__MISSING__:Output styles",
+    "compressionStylesTileTitle": "__MISSING__:Output styles",
     "compressionSettingsOutputIntensity": "출력 강도",
     "compressionSettingsAutoClarityBypass": "자동 선명도 우회",
     "resilienceWaitForCooldown": "쿨다운을 기다리세요",
@@ -5347,6 +5852,9 @@
     "cliproxyapiUrl": "CLIProxyAPI URL",
     "cliproxyapiStatus": "CLIProxyAPI 상태",
     "cliproxyapiNotDetected": "감지되지 않음",
+    "cliproxyapiImportAuthTitle": "__MISSING__:Import accounts from CLIProxyAPI",
+    "cliproxyapiImportAuthDesc": "__MISSING__:Import the OAuth accounts CLIProxyAPI already saved in ~/.cli-proxy-api/ as OmniRoute connections, so you don't have to log in to each account again. Supported account types (Gemini, Codex, Claude, Antigravity, Qwen, Kimi) are imported; others are skipped.",
+    "cliproxyapiImportAuthButton": "__MISSING__:Import accounts",
     "payloadRulesTitle": "페이로드 규칙",
     "payloadRulesDesc": "__MISSING__:Configure request payload mutations by model and protocol. Changes are persisted in settings and hot reloaded into the runtime immediately after save.",
     "payloadRuleDefaultTitle": "__MISSING__:default",
@@ -5379,6 +5887,14 @@
     "maxResponseTokensDesc": "__MISSING__:Maximum total tokens allowed in a single response.",
     "modelCooldownsTitle": "쿨다운 중인 모델",
     "modelCooldownsEmpty": "현재 대기 중인 모델이 없습니다.",
+    "responsesStateTitle": "__MISSING__:Responses State",
+    "responsesStateDesc": "__MISSING__:Control how OmniRoute forwards previous_response_id.",
+    "responsesStateModeLabel": "__MISSING__:previous_response_id handling",
+    "responsesStateModeAuto": "__MISSING__:Auto",
+    "responsesStateModeStrip": "__MISSING__:Strip",
+    "responsesStateModePreserve": "__MISSING__:Preserve",
+    "responsesStateHint": "__MISSING__:Auto strips previous_response_id unless a connection explicitly enables OpenAI Responses storage. Strip is safest for stateless clients such as VS Code Custom Endpoint; context then depends on the client sending full history.",
+    "responsesStateSaveError": "__MISSING__:Failed to update Responses state setting",
     "codexFastTierTitle": "코덱스 패스트 티어",
     "codexFastTierDesc": "OpenAI Codex 요청에 대해 service_tier=priority를 전역적으로 삽입합니다.",
     "codexFastTierHint": "활성화되면 OmniRoute는 아직 계층을 지정하지 않은 연결에 대한 아웃바운드 Codex 요청에 service_tier=priority를 추가합니다. 우선 순위 계층에는 OpenAI Enterprise API 키 또는 ChatGPT 인증 Codex 경로가 필요합니다. 다른 키 유형은 OpenAI로부터 계층 관련 오류를 수신합니다. Codex 공급자 페이지의 연결별 설정이 우선적으로 적용됩니다.",
@@ -5485,6 +6001,15 @@
     "resilienceEnableServerWaitDesc": "활성화되면 OmniRoute는 첫 번째 대기 시간이 만료될 때까지 기다렸다가 자동으로 재시도합니다.",
     "resilienceMaxAttempts": "최대 시도 횟수",
     "resilienceMaxWaitPerAttempt": "시도당 최대 대기 시간",
+    "resilienceProviderCooldownTitle": "__MISSING__:Provider Cooldown",
+    "resilienceProviderCooldownScope": "__MISSING__:All combo requests",
+    "resilienceProviderCooldownTrigger": "__MISSING__:When a provider/connection fails",
+    "resilienceProviderCooldownEffect": "__MISSING__:Skips the failed provider for a cooldown period before retrying",
+    "resilienceProviderCooldownDesc": "__MISSING__:Prevents subsequent requests from re-walking the same failing providers. Cooldown scales exponentially with consecutive failures.",
+    "resilienceProviderCooldownEnabled": "__MISSING__:Enable global provider cooldown",
+    "resilienceProviderCooldownEnabledDesc": "__MISSING__:When enabled, failed providers are tracked globally and skipped for a cooldown period.",
+    "resilienceProviderCooldownMin": "__MISSING__:Minimum cooldown",
+    "resilienceProviderCooldownMax": "__MISSING__:Maximum cooldown",
     "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
     "forcedFingerprintBadge": "Required",
     "codexSessionAffinityTitle": "Codex 세션 어피니티",
@@ -5506,13 +6031,45 @@
     "vercelRelayFreeTierNote": "__MISSING__:Relays are lightweight proxy endpoints deployed on Vercel's free tier to bypass local network/region limitations.",
     "vercelRelayDeploying": "__MISSING__:Deploying...",
     "vercelRelayDeploy": "__MISSING__:Deploy",
-    "homePinProviderQuotaToHome": "Pin Information to Home Page",
-    "homeProviderQuotaLimits": "Provider Quota Limits",
-    "homeProviderQuotaLimitsDesc": "Pin the Provider Quota status container (with Refresh All button) to the top of the Home page.",
-    "homeQuickStart": "Quick Start",
-    "homeQuickStartDesc": "Show the Quick Start panel on the Home page.",
-    "homeProviderTopology": "Provider Topology",
-    "homeProviderTopologyDesc": "Show the Provider Topology on the Home page."
+    "deployRelayButton": "__MISSING__:Deploy Relay",
+    "denoRelayButton": "__MISSING__:Deploy Deno Relay",
+    "denoRelayModalTitle": "__MISSING__:Deploy Deno Relay",
+    "denoRelayWarning": "__MISSING__:Warning: A Deno Deploy organization token is required. This token will only be used to create the relay app and will never be stored by OmniRoute.",
+    "denoRelayTokenLabel": "__MISSING__:Deno Deploy Organization Token",
+    "denoRelayOrgDomainLabel": "__MISSING__:Organization Domain",
+    "denoRelayProjectNameLabel": "__MISSING__:Deno App Name",
+    "denoRelayFreeTierNote": "__MISSING__:Deno Deploy v2 runs on a global edge network. Free tier: 1M requests & 100GiB outbound traffic per month, no per-request CPU limits, up to 20 active apps & 50 custom domains.",
+    "denoRelayDeploying": "__MISSING__:Deploying...",
+    "denoRelayDeploy": "__MISSING__:Deploy",
+    "cloudflareRelaySuccess": "__MISSING__:Cloudflare Relay deployed successfully",
+    "cloudflareRelayButton": "__MISSING__:Deploy Cloudflare Relay",
+    "cloudflareRelayModalTitle": "__MISSING__:Deploy Cloudflare Worker Relay",
+    "cloudflareRelayWarning": "__MISSING__:Deploys a Cloudflare Worker that proxies LLM requests through Cloudflare's edge network — masking the host IP behind dynamic Cloudflare addresses. The Worker enforces a one-time auth secret so the public workers.dev URL cannot be reused as an open relay.",
+    "cloudflareRelayTokenHowto": "__MISSING__:Create the API token under My Profile -> API Tokens -> Create Token -> Custom Token -> Account / Workers Scripts / Edit.",
+    "cloudflareRelayAccountIdLabel": "__MISSING__:Cloudflare Account ID",
+    "cloudflareRelayAccountIdHint": "__MISSING__:Found on the right side of the Cloudflare dashboard overview page.",
+    "cloudflareRelayApiTokenLabel": "__MISSING__:Cloudflare API Token",
+    "cloudflareRelayApiTokenHint": "__MISSING__:Requires 'Workers Scripts: Edit' permission. The token is used only at deploy time and is never stored.",
+    "cloudflareRelayProjectNameLabel": "__MISSING__:Worker Name",
+    "cloudflareRelayFreeTierNote": "__MISSING__:Free tier: 100,000 requests/day per Cloudflare account.",
+    "cloudflareRelayDeploying": "__MISSING__:Deploying...",
+    "cloudflareRelayDeploy": "__MISSING__:Deploy",
+    "cloudflareRelayCredsRequired": "__MISSING__:Account ID and API Token are required",
+    "cloudflareRelayDeployFailed": "__MISSING__:Deploy failed",
+    "modelLockout": "__MISSING__:Model Lockout",
+    "modelLockoutPageDescription": "__MISSING__:Configure which HTTP error codes trigger per-model lockout and control the cooldown behavior.",
+    "modelLockoutEnabled": "__MISSING__:Enable Model Lockout",
+    "modelLockoutEnabledDescription": "__MISSING__:When enabled, models that fail with configured error codes are temporarily locked to prevent retry loops.",
+    "modelLockoutErrorCodes": "__MISSING__:Error Codes",
+    "modelLockoutErrorCodesDescription": "__MISSING__:HTTP status codes that trigger model lockout. Type a code and click Add, or select from suggestions.",
+    "modelLockoutBaseCooldown": "__MISSING__:Base Cooldown (ms)",
+    "modelLockoutBaseCooldownDescription": "__MISSING__:Initial cooldown duration in milliseconds before a model can be retried.",
+    "modelLockoutMaxCooldown": "__MISSING__:Max Cooldown (ms)",
+    "modelLockoutMaxCooldownDescription": "__MISSING__:Maximum cooldown duration in milliseconds. Prevents excessively long lockouts.",
+    "modelLockoutExponentialBackoff": "__MISSING__:Exponential Backoff",
+    "modelLockoutExponentialBackoffDescription": "__MISSING__:When enabled, each consecutive failure increases the cooldown duration exponentially.",
+    "modelLockoutMaxBackoffSteps": "__MISSING__:Max Backoff Steps",
+    "modelLockoutMaxBackoffStepsDescription": "__MISSING__:Maximum number of backoff steps before the cooldown stops growing. The Max Cooldown cap is reached first in most configurations, making this a safety ceiling for when Max Cooldown is raised."
   },
   "contextRtk": {
     "title": "RTK Engine",
@@ -5563,7 +6120,21 @@
     "searchFilters": "검색 필터...",
     "tooltipDedup": "반복되는 줄을 얼마나 적극적으로 제거하는지.",
     "tooltipMaxChars": "출력 블록당 최대 문자 수입니다.",
-    "tooltipMaxLines": "명령 출력에서 유지할 최대 줄입니다. 초과분은 잘립니다."
+    "tooltipMaxLines": "명령 출력에서 유지할 최대 줄입니다. 초과분은 잘립니다.",
+    "learnDiscoverTitle": "__MISSING__:Learn & Discover filters",
+    "learnDiscoverDesc": "__MISSING__:Mine your captured command output (Raw Output retention must be on) to suggest new RTK filters. Suggestions only — you review and save them.",
+    "discoverHeading": "__MISSING__:Discover repeated noise",
+    "discoverButton": "__MISSING__:Scan samples",
+    "discoverScanning": "__MISSING__:Scanning…",
+    "discoverEmpty": "__MISSING__:No repeated noise found. Enable Raw Output retention and run a few commands first.",
+    "discoverSamples": "__MISSING__:{count} sample(s) scanned",
+    "discoverHits": "__MISSING__:{hits}× across samples",
+    "learnHeading": "__MISSING__:Learn a filter for a command",
+    "learnCommandPlaceholder": "__MISSING__:e.g. npm install",
+    "learnButton": "__MISSING__:Suggest filter",
+    "learnEmpty": "__MISSING__:No suggestion yet. Type a command you have run and scan.",
+    "learnSamplesUsed": "__MISSING__:Learned from {count} matching sample(s)",
+    "suggestionError": "__MISSING__:Could not load suggestions. Check management auth and try again."
   },
   "contextCombos": {
     "title": "Compression Combos",
@@ -5853,7 +6424,80 @@
     "routeConnectionLabel": "연결",
     "scenarioVision": "비전(이미지 이해)",
     "scenarioSchemaCoercion": "스키마 강제(구조화된 출력)",
-    "techniques": "기술:"
+    "techniques": "기술:",
+    "friendlyTitle": "__MISSING__:Translator",
+    "friendlySubtitle": "__MISSING__:Use your existing app with any provider — without rewriting code.",
+    "conceptHeadline": "__MISSING__:Your app speaks one API's \"language\". The Translator converts it to use another provider.",
+    "conceptDiagramAppLabel": "__MISSING__:Your app",
+    "conceptDiagramSourceLabel": "__MISSING__:Source format",
+    "conceptDiagramHubLabel": "__MISSING__:OpenAI (hub)",
+    "conceptDiagramTargetLabel": "__MISSING__:Target provider",
+    "conceptDiagramExampleApp": "__MISSING__:e.g. Anthropic SDK",
+    "conceptDiagramExampleSource": "__MISSING__:claude",
+    "conceptDiagramExampleTarget": "__MISSING__:Gemini",
+    "conceptHowItWorksToggle": "__MISSING__:How it works",
+    "conceptHowItWorksBody": "__MISSING__:Your app sends a request in its own format. The Translator detects the format, converts it through OpenAI as an intermediate hub (or directly when a direct translator is available), sends it to the chosen provider, and returns the response converted back to your app's format.",
+    "tabTranslate": "__MISSING__:Translate",
+    "tabMonitor": "__MISSING__:Monitor",
+    "tabTranslateAriaLabel": "__MISSING__:Go to the Translate tab",
+    "tabMonitorAriaLabel": "__MISSING__:Go to the Monitor tab",
+    "simpleAppUsesLabel": "__MISSING__:My app uses",
+    "simpleAppUsesHint": "__MISSING__:The API format your app speaks (e.g. Anthropic SDK = claude).",
+    "simpleSendToLabel": "__MISSING__:Send to",
+    "simpleSendToHint": "__MISSING__:Where to actually send the request (a provider connected in OmniRoute).",
+    "simpleStartWithLabel": "__MISSING__:Start with",
+    "simpleStartWithExamplePlaceholder": "__MISSING__:Select a ready-made example",
+    "simpleStartWithCustomOption": "__MISSING__:Paste your request (advanced)",
+    "simpleModeLabel": "__MISSING__:Mode",
+    "simpleModePreview": "__MISSING__:Preview translation only",
+    "simpleModeSend": "__MISSING__:Send and see response",
+    "simpleAdvancedToggle": "__MISSING__:Advanced",
+    "simpleInputPanelTitle": "__MISSING__:Input",
+    "simpleInputPanelHint": "__MISSING__:Free-text message or ready-made example",
+    "simpleResultPanelTitle": "__MISSING__:Translation + Response",
+    "narratedDetected": "__MISSING__:✓ Detected: {format}",
+    "narratedTranslating": "__MISSING__:Translating to {target}...",
+    "narratedSending": "__MISSING__:Sending to {target}...",
+    "narratedSuccess": "__MISSING__:→ translated to {target} · response in {latency}ms",
+    "narratedError": "__MISSING__:Failed: {reason}",
+    "narratedSeeTranslatedJson": "__MISSING__:see translated JSON",
+    "narratedSeePipeline": "__MISSING__:see pipeline",
+    "advancedSectionTitle": "__MISSING__:Advanced",
+    "advancedSectionSubtitle": "__MISSING__:Raw JSON, pipeline and technical tools. Everything here is the same as the old tabs — just reorganized.",
+    "advancedRawJsonTitle": "__MISSING__:Raw JSON (auto-detect + Monaco)",
+    "advancedRawJsonSubtitle": "__MISSING__:Paste a JSON request; the format is detected automatically.",
+    "advancedPipelineTitle": "__MISSING__:OpenAI intermediate pipeline",
+    "advancedPipelineSubtitle": "__MISSING__:Visualize each translation step (hub-and-spoke).",
+    "advancedStreamTransformTitle": "__MISSING__:Stream Transformer (Chat → Responses SSE)",
+    "advancedStreamTransformSubtitle": "__MISSING__:Converts Chat Completions SSE into Responses API.",
+    "advancedTestBenchTitle": "__MISSING__:Test Bench (8 scenarios)",
+    "advancedTestBenchSubtitle": "__MISSING__:Runs all scenarios and reports pass/fail + compatibility %.",
+    "advancedCompressionTitle": "__MISSING__:Compression Preview",
+    "advancedCompressionSubtitle": "__MISSING__:Estimate token savings across different compression modes.",
+    "monitorOriginHint": "__MISSING__:Events generated by Translate or the main pipeline appear here in real time.",
+    "monitorEmptyCta": "__MISSING__:Go to the Translate tab and send a request — it will appear here.",
+    "monitorOpenTranslateButton": "__MISSING__:Go to Translate",
+    "pipelineStepClientRequest": "__MISSING__:Client Request",
+    "pipelineStepClientRequestDesc": "__MISSING__:Request received in client format",
+    "pipelineStepFormatDetected": "__MISSING__:Format Detected",
+    "pipelineStepFormatDetectedDesc": "__MISSING__:Auto-detected source format",
+    "pipelineStepOpenAIIntermediate": "__MISSING__:OpenAI Intermediate",
+    "pipelineStepOpenAIIntermediateDesc": "__MISSING__:Translated to OpenAI hub format",
+    "pipelineStepProviderFormat": "__MISSING__:Provider Format",
+    "pipelineStepProviderFormatDesc": "__MISSING__:Translated to provider target format",
+    "pipelineStepProviderResponse": "__MISSING__:Provider Response",
+    "pipelineStepProviderResponseDesc": "__MISSING__:Streaming response from provider",
+    "conceptDiagramArrow1": "__MISSING__:speaks",
+    "conceptDiagramArrow2": "__MISSING__:translates",
+    "conceptDiagramArrow3": "__MISSING__:converts",
+    "conceptDiagramExampleHub": "__MISSING__:OpenAI",
+    "conceptDiagramHubTooltip": "__MISSING__:Intermediate hub used by the translator to convert between formats that don't have a direct mapping.",
+    "conceptDiagramSourceTooltip": "__MISSING__:The API format your app speaks (e.g., Anthropic SDK = claude).",
+    "conceptDiagramTargetTooltip": "__MISSING__:The provider where the request will actually be sent.",
+    "compressionEmptyHint": "__MISSING__:Fill in the input field on the Translate tab (Simple Controls or Raw JSON) to enable the preview.",
+    "compressionModeLabel": "__MISSING__:Compression mode",
+    "compressionPreviewButton": "__MISSING__:Preview Compression",
+    "compressionPreviewing": "__MISSING__:Previewing…"
   },
   "usage": {
     "title": "사용법",
@@ -6010,6 +6654,8 @@
     "notApplicable": "해당 없음",
     "rawPlanWithValue": "기본 계획: {plan}",
     "noPlanFromProvider": "공급자의 계획 없음",
+    "tokenExpiresIn": "__MISSING__:Token expires in {time}",
+    "tokenExpired": "__MISSING__:Token expired",
     "noQuotaData": "할당량 데이터 없음",
     "cardExpand": "__MISSING__:Expand",
     "cardCollapse": "__MISSING__:Collapse",
@@ -6159,6 +6805,11 @@
     "quotaCutoffsButtonDefault": "기본값",
     "quotaCutoffsButtonHelp": "이 계정의 최소 남은 할당량 기준을 편집하세요.",
     "quotaCutoffsButtonDisabled": "이 계정에는 아직 할당량 기간이 없습니다.",
+    "deactivateAccount": "__MISSING__:Deactivate account (stop routing)",
+    "activateAccount": "__MISSING__:Activate account (resume routing)",
+    "accountActivated": "__MISSING__:Account activated",
+    "accountDeactivated": "__MISSING__:Account deactivated",
+    "toggleActiveFailed": "__MISSING__:Failed to update account status",
     "quotaCutoffsTitle": "{name}({provider})에 대한 할당량 마감",
     "quotaCutoffsExplainer": "각 할당량 창에 대해 이 계정이 선택되지 않는 최소 남은 할당량 비율을 재정의합니다. 공급자 기본값을 상속하려면 비워 두세요.",
     "quotaCutoffsDefaultHint": "남은 기본 분: {default}%",
@@ -6179,6 +6830,7 @@
     "budgetColDailyLim": "데일리림",
     "budgetColMonthlyLim": "월간 리미트",
     "budgetColUsedPct": "사용률(%)",
+    "percentUsed": "__MISSING__:{pct}% used",
     "budgetLoading": "로드 중…",
     "budgetNoKeysMatch": "키 일치 필터가 없습니다.",
     "budgetLinearExtrapolation": "선형 외삽",
@@ -7124,6 +7776,11 @@
     "modalEditTitle": "Modal Edit Title",
     "labelName": "Label Name",
     "labelType": "유형",
+    "labelFamily": "__MISSING__:IP family",
+    "familyAuto": "__MISSING__:Auto (dual-stack)",
+    "familyIpv4": "__MISSING__:IPv4 only",
+    "familyIpv6": "__MISSING__:IPv6 only",
+    "familyHint": "__MISSING__:Egress address family. Auto keeps dual-stack; IPv4/IPv6 pin this proxy to that family (prevents a v4 leak under an IPv6-only proxy).",
     "labelHost": "호스트",
     "labelPort": "항구",
     "labelUsername": "사용자 이름",
@@ -7266,7 +7923,16 @@
     "improveConfirm": "Improve",
     "exportCode": "Export code",
     "exportCodeTitle": "Export Code",
+    "exportShort": "__MISSING__:Export",
     "noStateToExport": "No playground state available to export.",
+    "closeExportModal": "__MISSING__:Close export modal",
+    "close": "__MISSING__:Close",
+    "exportRealKeyWarning": "__MISSING__:Security warning: export blocked — a real API key was detected in the output. Please reset your API key and try again.",
+    "placeholderHintPrefix": "__MISSING__:Replace",
+    "placeholderHintSuffix": "__MISSING__:with your actual API key, or set it as an environment variable.",
+    "copyLangCode": "__MISSING__:Copy {language} code",
+    "loadingPresets": "__MISSING__:Loading…",
+    "loadPresetPlaceholder": "__MISSING__:Load preset…",
     "copyCode": "Copy",
     "copiedCode": "Copied!",
     "addModel": "+ Add model",
@@ -7291,7 +7957,27 @@
     "invalidJson": "Invalid JSON",
     "running": "Running…",
     "runLabel": "Run",
-    "enterToolResult": "Enter tool result…"
+    "enterToolResult": "Enter tool result…",
+    "build": {
+      "step1Label": "__MISSING__:What to test?",
+      "step2Label": "__MISSING__:Configure",
+      "step3Label": "__MISSING__:Run",
+      "step1Title": "__MISSING__:What do you want to test?",
+      "step1Subtitle": "__MISSING__:Choose the capability you want to explore in this session.",
+      "step2Title": "__MISSING__:Configure",
+      "step2Subtitle": "__MISSING__:Set up the tools or JSON schema that will be used in the request.",
+      "step3Title": "__MISSING__:Run",
+      "modeToolsTitle": "__MISSING__:Tools",
+      "modeToolsDesc": "__MISSING__:Test function calling — define tools and see how the model invokes them.",
+      "modeJsonTitle": "__MISSING__:JSON",
+      "modeJsonDesc": "__MISSING__:Test structured output — constrain the response to a JSON schema.",
+      "modeBothTitle": "__MISSING__:Tools + JSON",
+      "modeBothDesc": "__MISSING__:Combine function calling and structured output in a single request.",
+      "backButton": "__MISSING__:Back",
+      "nextButton": "__MISSING__:Next",
+      "runButton": "__MISSING__:Run",
+      "promptPlaceholder": "__MISSING__:Enter your message… (Enter to send, Shift+Enter for newline)"
+    }
   },
   "miniPlayground": {
     "endpoint": "__MISSING__:Endpoint",
@@ -7395,7 +8081,9 @@
     "loadingLogs": "Loading logs...",
     "noLogs": "No logs yet. Make some API calls to see them here.",
     "noMatchingLogs": "No logs matching current filters.",
-    "callLogsInfo": "Call logs are also saved as JSON files to {dataDir} and rotated based on {retentionDays} and {maxEntries}."
+    "callLogsInfo": "Call logs are also saved as JSON files to {dataDir} and rotated based on {retentionDays} and {maxEntries}.",
+    "loadMore": "__MISSING__:Load More",
+    "loadingMore": "__MISSING__:Loading more..."
   },
   "proxyLogger": {
     "filterAll": "All",
@@ -7432,7 +8120,8 @@
     "loadingProxyLogs": "Loading proxy logs...",
     "noProxyLogs": "No proxy logs yet. Configure proxies and make API calls to see them here.",
     "noMatchingLogs": "No logs match the current filters.",
-    "tlsFingerprint": "Chrome 124 TLS Fingerprint"
+    "tlsFingerprint": "Chrome 124 TLS Fingerprint",
+    "colPublicIp": "__MISSING__:Public IP"
   },
   "endpointOptions": {
     "speech": "Speech",
@@ -7572,7 +8261,86 @@
     "betaConfigSavedSuffix": "(아직 서버에 유지되지 않음) 요청별 한도 적용은 아직 프록시 파이프라인에 연결되지 않았습니다. 이 화면을 사용하면 할당량 분할을 디자인하고 시각화할 수 있습니다. 실제 시행은 DB 지속성 및 업스트림 호출 차단을 통해 향후 반복에 착수할 것입니다.",
     "policyLabel": "정책:",
     "resetIn": "재설정",
-    "quotaTotal": "합계"
+    "quotaTotal": "합계",
+    "kpiAvgUtilization": "__MISSING__:Avg utilization",
+    "kpiBorrowingNow": "__MISSING__:Borrowing now",
+    "conceptTitle": "__MISSING__:How Quota Share works",
+    "conceptIntro": "__MISSING__:Quota Share divides a provider's quota among multiple API keys using work-conserving fair-share: each key receives a proportional slice but can borrow from the free balance without exceeding the global cap.",
+    "conceptFairShare": "__MISSING__:Fair-share: each key receives quota proportional to its configured weight",
+    "conceptBorrowing": "__MISSING__:Borrowing: keys can consume free balance from others without breaching the cap",
+    "conceptGlobalCap": "__MISSING__:Hard global cap: the provider's absolute limit is never exceeded",
+    "conceptWindows": "__MISSING__:Windows: 5h, hourly, daily, weekly, monthly — each tracked independently",
+    "conceptKeyHowTitle": "__MISSING__:Enabling a key for quota",
+    "conceptKeyHowDesc": "__MISSING__:Create the key normally in API Keys — it appears in the wizard's key step automatically. Tick Exclusive there to make it quota-only. No separate enable step.",
+    "conceptExclusiveTitle": "__MISSING__:What \"Exclusive\" does",
+    "conceptExclusiveDesc": "__MISSING__:An exclusive key only sees/uses the pool's quotaShared-* models — every other model is hidden from its /v1/models and blocked.",
+    "burnRateTitle": "__MISSING__:Burn rate",
+    "burnRateExhaustsIn": "__MISSING__:Exhausts in",
+    "dimensionResetIn": "__MISSING__:Resets in",
+    "realConsumedColumn": "__MISSING__:Consumed",
+    "deficitColumn": "__MISSING__:Deficit",
+    "borrowingIndicator": "__MISSING__:borrowing",
+    "migratedFromLocalStorageNotice": "__MISSING__:Pools successfully migrated from localStorage.",
+    "policyCapAbsoluteLabel": "__MISSING__:Absolute cap",
+    "policyCapAbsolutePlaceholder": "__MISSING__:Numeric limit (optional)",
+    "multiDimensionLabel": "__MISSING__:Multi-dimension",
+    "stackedBarTitle": "__MISSING__:Slices by API key",
+    "usedSuffix": "__MISSING__:used {percent}%",
+    "wizardTitle": "__MISSING__:New quota pool",
+    "editPoolTitle": "__MISSING__:Edit pool",
+    "saveChanges": "__MISSING__:Save changes",
+    "wizardStep1Label": "__MISSING__:Account",
+    "wizardStep2Label": "__MISSING__:Limit",
+    "wizardStep3Label": "__MISSING__:Keys",
+    "wizardStep1Title": "__MISSING__:Choose provider connection",
+    "wizardStep1Subtitle": "__MISSING__:Select the provider account this pool will share quota for, set a name and default policy.",
+    "wizardStep2Title": "__MISSING__:Configure quota dimensions",
+    "wizardStep2Subtitle": "__MISSING__:Define the quota plan dimensions (unit, window, limit) for the chosen connection. Leave unchanged to keep current settings.",
+    "wizardStep3Title": "__MISSING__:Allocate API keys",
+    "wizardStep3Subtitle": "__MISSING__:Assign API keys to this pool with weight % allocations and optional caps.",
+    "wizardPoolNameLabel": "__MISSING__:Pool name",
+    "wizardPoolNamePlaceholder": "__MISSING__:My quota pool",
+    "wizardNext": "__MISSING__:Next",
+    "wizardBack": "__MISSING__:Back",
+    "wizardCreatePool": "__MISSING__:Create pool",
+    "wizardDimensionsEditedNotice": "__MISSING__:Dimensions edited — will be saved as a manual override when the pool is created.",
+    "wizardExclusiveLabel": "__MISSING__:Exclusive quota",
+    "wizardExclusiveHint": "__MISSING__:When enabled, these API keys will only be allowed to use this pool's virtual models (allowedQuotas reconciliation is applied on save).",
+    "wizardPreviewLabel": "__MISSING__:Virtual model names preview",
+    "wizardConnectionsLabel": "__MISSING__:Provider connections",
+    "wizardPrimaryBadge": "__MISSING__:primary",
+    "wizardAdditionalConnectionsNote": "__MISSING__:Additional connections use their catalog default limits (editable later).",
+    "wizardSingleProviderNote": "__MISSING__:A pool uses a single provider",
+    "wizardPreviewMoreModels": "__MISSING__:+{count} more",
+    "accountQuotaTitle": "__MISSING__:Account quota",
+    "accountQuotaNone": "__MISSING__:—",
+    "logTitle": "__MISSING__:Usage log",
+    "logEmpty": "__MISSING__:No usage yet",
+    "groupLabel": "__MISSING__:Group",
+    "newGroup": "__MISSING__:New group",
+    "renameGroup": "__MISSING__:Rename group",
+    "groupSelectHint": "__MISSING__:Filter pools by group",
+    "groupAllocationNote": "__MISSING__:Allocations apply to all pools in this group via the shared quota layer.",
+    "groupNamePrompt": "__MISSING__:Enter group name",
+    "wizardGroupLabel": "__MISSING__:Group",
+    "allGroups": "__MISSING__:All groups",
+    "endpointsTitle": "__MISSING__:Available endpoints",
+    "endpointsHint": "__MISSING__:Call these virtual models with any allocated key — routing + quota are handled per group.",
+    "previewForKey": "__MISSING__:Preview for key",
+    "previewKeyNone": "__MISSING__:(all endpoints)",
+    "endpointsBaseUrl": "__MISSING__:Base URL",
+    "endpointsCollapse": "__MISSING__:Collapse",
+    "endpointsExpand": "__MISSING__:Expand",
+    "endpointsAnthropicNote": "__MISSING__:Anthropic-native",
+    "endpointsResponsesNote": "__MISSING__:OpenAI Responses — codex/github",
+    "endpointsWsNote": "__MISSING__:WebSocket — codex only",
+    "betaText": "__MISSING__:Quota Share is functional but bugs are expected. Found one? Please report it.",
+    "betaReportLink": "__MISSING__:Report an issue",
+    "deleteGroup": "__MISSING__:Delete group",
+    "deleteGroupConfirm": "__MISSING__:Delete this group? Its pools must be reassigned or removed first.",
+    "deleteGroupHasPools": "__MISSING__:This group still has pools — reassign or delete them first.",
+    "ungroupedTitle": "__MISSING__:Ungrouped",
+    "ungroupedHint": "__MISSING__:These pools are not assigned to a known group. Edit a pool to move it into a real group."
   },
   "plugins": {
     "title": "Plugins",
@@ -7608,6 +8376,571 @@
     "status": "Status",
     "enabled": "Enabled",
     "disabled": "Disabled",
+    "installedTab": "__MISSING__:Installed",
+    "marketplaceTab": "__MISSING__:Marketplace",
+    "marketplaceUrlLabel": "__MISSING__:Custom Marketplace URL",
+    "marketplaceUrlPlaceholder": "__MISSING__:Leave empty for official Omniroute registry",
+    "saveMarketplaceUrl": "__MISSING__:Save & Reload",
+    "marketplaceUrlSaved": "__MISSING__:Marketplace URL updated",
+    "marketplaceEmpty": "__MISSING__:No plugins found in marketplace.",
+    "verified": "__MISSING__:Verified",
+    "install": "__MISSING__:Install",
+    "installedFromMarketplace": "__MISSING__:Plugin {name} installed!",
     "hooks": "Hooks"
+  },
+  "quotaPlans": {
+    "title": "__MISSING__:Plans & Quotas",
+    "description": "__MISSING__:Configure quota plans per provider — dimensions (%, requests, tokens, $) and time windows",
+    "providerLabel": "__MISSING__:Provider / Connection",
+    "detectedPlanLabel": "__MISSING__:Detected plan",
+    "manualPlanLabel": "__MISSING__:Manual override",
+    "unconfiguredLabel": "__MISSING__:Not configured — manual required",
+    "dimensionLabel": "__MISSING__:Dimensions",
+    "addDimension": "__MISSING__:Add dimension",
+    "removeDimension": "__MISSING__:Remove",
+    "limitLabel": "__MISSING__:Limit",
+    "unitOptions": {
+      "percent": "__MISSING__:%",
+      "requests": "__MISSING__:requests",
+      "tokens": "__MISSING__:tokens",
+      "usd": "__MISSING__:USD ($)"
+    },
+    "windowOptions": {
+      "5h": "__MISSING__:5 hours",
+      "hourly": "__MISSING__:Hourly",
+      "daily": "__MISSING__:Daily",
+      "weekly": "__MISSING__:Weekly",
+      "monthly": "__MISSING__:Monthly"
+    },
+    "useCatalogButton": "__MISSING__:Use catalog",
+    "saveOverrideButton": "__MISSING__:Save override",
+    "revertToCatalogButton": "__MISSING__:Revert to catalog",
+    "unknownProviderNotice": "__MISSING__:Select a provider on the left to configure its quota plan.",
+    "catalogTitle": "__MISSING__:Known catalog",
+    "catalogDescription": "__MISSING__:Automatically detected plans for the following providers:"
+  },
+  "activity": {
+    "title": "__MISSING__:Activity",
+    "description": "__MISSING__:Recent events feed",
+    "emptyTitle": "__MISSING__:No activity yet",
+    "emptyDescription": "__MISSING__:When you add providers, create combos, or rotate keys, events will appear here.",
+    "todayHeader": "__MISSING__:Today",
+    "yesterdayHeader": "__MISSING__:Yesterday",
+    "filterAll": "__MISSING__:All",
+    "filterProviders": "__MISSING__:Providers",
+    "filterCombos": "__MISSING__:Combos",
+    "filterApiKeys": "__MISSING__:API Keys",
+    "filterSettings": "__MISSING__:Settings",
+    "filterQuota": "__MISSING__:Quota",
+    "filterAuth": "__MISSING__:Auth",
+    "filterSystem": "__MISSING__:System",
+    "relative": {
+      "justNow": "__MISSING__:just now",
+      "minutesAgo": "__MISSING__:{n} min ago",
+      "hoursAgo": "__MISSING__:{n} h ago",
+      "yesterday": "__MISSING__:yesterday",
+      "daysAgo": "__MISSING__:{n} days ago"
+    },
+    "eventVerb": {
+      "providerAdded": "__MISSING__:{actor} added provider {target}",
+      "providerRemoved": "__MISSING__:{actor} removed provider {target}",
+      "providerTested": "__MISSING__:{actor} tested provider {target}",
+      "comboCreated": "__MISSING__:{actor} created combo {target}",
+      "comboUpdated": "__MISSING__:{actor} updated combo {target}",
+      "comboDeleted": "__MISSING__:{actor} removed combo {target}",
+      "apiKeyCreated": "__MISSING__:{actor} created API key {target}",
+      "apiKeyRevoked": "__MISSING__:{actor} revoked API key {target}",
+      "apiKeyRotated": "__MISSING__:{actor} rotated API key {target}",
+      "budgetThreshold": "__MISSING__:Budget threshold reached for {target}",
+      "settingUpdated": "__MISSING__:{actor} updated setting {target}",
+      "authLogin": "__MISSING__:{actor} signed in",
+      "authLogout": "__MISSING__:{actor} signed out",
+      "cloudAgentSession": "__MISSING__:Cloud agent session started for {target}",
+      "mcpToolRegistered": "__MISSING__:MCP tool {target} registered",
+      "webhookCreated": "__MISSING__:{actor} created webhook {target}",
+      "webhookDeleted": "__MISSING__:{actor} removed webhook {target}",
+      "quotaPoolCreated": "__MISSING__:{actor} created quota pool {target}",
+      "quotaPoolUpdated": "__MISSING__:{actor} updated quota pool {target}",
+      "quotaPoolDeleted": "__MISSING__:{actor} removed quota pool {target}",
+      "quotaPlanUpdated": "__MISSING__:{actor} updated quota plan {target}",
+      "quotaStoreDriverChanged": "__MISSING__:QuotaStore driver changed",
+      "updateApplied": "__MISSING__:Update {target} applied",
+      "deployCompleted": "__MISSING__:Deploy completed",
+      "skillInstalled": "__MISSING__:{actor} installed skill {target}",
+      "skillRemoved": "__MISSING__:{actor} removed skill {target}",
+      "providerCredentialsCreated": "__MISSING__:{actor} created credentials for {target}",
+      "providerCredentialsApplied": "__MISSING__:Credentials for {target} applied",
+      "providerCredentialsUpdated": "__MISSING__:{actor} updated credentials for {target}",
+      "providerCredentialsRevoked": "__MISSING__:{actor} revoked credentials for {target}",
+      "providerCredentialsBatchRevoked": "__MISSING__:{actor} batch-revoked credentials",
+      "providerCredentialsBatchUpdated": "__MISSING__:{actor} batch-updated credentials",
+      "providerCredentialsBulkCreated": "__MISSING__:{actor} bulk-created credentials",
+      "providerCredentialsBulkImported": "__MISSING__:{actor} bulk-imported credentials",
+      "providerCredentialsImported": "__MISSING__:{actor} imported credentials",
+      "providerSsrfBlocked": "__MISSING__:SSRF attempt blocked for {target}",
+      "authLoginSuccess": "__MISSING__:{actor} signed in",
+      "authLoginError": "__MISSING__:Login error for {actor}",
+      "authLoginFailed": "__MISSING__:Login failed for {actor}",
+      "authLoginLocked": "__MISSING__:{actor} locked out after too many attempts",
+      "authLoginMisconfigured": "__MISSING__:Auth configuration invalid",
+      "authLoginSetupRequired": "__MISSING__:Auth setup required",
+      "authLogoutSuccess": "__MISSING__:{actor} signed out",
+      "syncTokenCreated": "__MISSING__:{actor} created sync token",
+      "syncTokenRevoked": "__MISSING__:{actor} revoked sync token",
+      "settingsUpdate": "__MISSING__:{actor} updated settings",
+      "settingsUpdateFailed": "__MISSING__:Settings update failed",
+      "serviceRevealApiKey": "__MISSING__:{actor} revealed API key for {target}",
+      "genericEvent": "__MISSING__:{actor} {target}"
+    }
+  },
+  "agentBridge": {
+    "title": "__MISSING__:AgentBridge",
+    "subtitle": "__MISSING__:Use IDE agents with OmniRoute models — no config required",
+    "riskBannerTitle": "__MISSING__:Use at your own risk",
+    "riskBannerBody": "__MISSING__:AgentBridge intercepts HTTPS traffic from IDE agents. By activating it you accept responsibility for compliance with the terms of service of each agent. Never use on devices or networks where TLS inspection is prohibited.",
+    "riskBannerDismiss": "__MISSING__:Dismiss",
+    "serverCardTitle": "__MISSING__:AgentBridge Server",
+    "statusRunning": "__MISSING__:Running",
+    "statusStopped": "__MISSING__:Stopped",
+    "statusActive": "__MISSING__:Active",
+    "statusDnsOff": "__MISSING__:DNS off",
+    "statusSetupRequired": "__MISSING__:Setup required",
+    "statusInvestigating": "__MISSING__:Investigating",
+    "serverPort": "__MISSING__:Port",
+    "serverConns": "__MISSING__:Connections",
+    "serverIntercepted": "__MISSING__:Intercepted",
+    "serverLastStarted": "__MISSING__:Last started",
+    "startServer": "__MISSING__:Start",
+    "stopServer": "__MISSING__:Stop",
+    "restartServer": "__MISSING__:Restart",
+    "trustCert": "__MISSING__:Trust Cert",
+    "downloadCert": "__MISSING__:Download Cert",
+    "regenerateCert": "__MISSING__:Regenerate Cert",
+    "starting": "__MISSING__:Starting…",
+    "stopping": "__MISSING__:Stopping…",
+    "restarting": "__MISSING__:Restarting…",
+    "trusting": "__MISSING__:Trusting…",
+    "regenerating": "__MISSING__:Regenerating…",
+    "upstreamCaLabel": "__MISSING__:Upstream CA Certificate (corporate)",
+    "upstreamCaPlaceholder": "__MISSING__:/etc/ssl/certs/corp-ca.pem",
+    "upstreamCaTest": "__MISSING__:Test TLS",
+    "upstreamCaTestOk": "__MISSING__:TLS test passed",
+    "upstreamCaTestError": "__MISSING__:TLS test failed — check the path and CA file",
+    "bypassSectionTitle": "__MISSING__:Bypass List",
+    "bypassSectionDesc": "__MISSING__:Hosts matching these patterns are tunneled directly (no TLS decryption). Defaults include banks, .gov, and corporate SSO.",
+    "bypassDefaultsLabel": "__MISSING__:Default bypass patterns (read-only)",
+    "bypassUserLabel": "__MISSING__:Custom bypass patterns (one per line, glob or regex)",
+    "saveBypassList": "__MISSING__:Save bypass list",
+    "agentListTitle": "__MISSING__:IDE Agents",
+    "filterAll": "__MISSING__:All",
+    "filterActive": "__MISSING__:Active",
+    "filterSetupRequired": "__MISSING__:Setup required",
+    "filterInvestigating": "__MISSING__:Investigating",
+    "searchAgents": "__MISSING__:Search agents…",
+    "noAgentsMatch": "__MISSING__:No agents match the current filter",
+    "agentHosts": "__MISSING__:Intercepted hosts",
+    "certTrusted": "__MISSING__:Certificate trusted",
+    "certNotTrusted": "__MISSING__:Certificate not trusted",
+    "investigatingNotice": "__MISSING__:This agent is under investigation. Hosts and API surface are still being confirmed. Setup will be available once the upstream API is documented.",
+    "modelMappingsLabel": "__MISSING__:Model mappings",
+    "sourceModel": "__MISSING__:Source model (agent native)",
+    "targetModel": "__MISSING__:Target model (OmniRoute)",
+    "noMappings": "__MISSING__:No model mappings configured. Run setup wizard to auto-detect models.",
+    "selectModel": "__MISSING__:Select…",
+    "saveMappings": "__MISSING__:Save mappings",
+    "setupWizard": "__MISSING__:Setup wizard",
+    "startDns": "__MISSING__:Start DNS",
+    "stopDns": "__MISSING__:Stop DNS",
+    "toggling": "__MISSING__:Toggling…",
+    "viewTraffic": "__MISSING__:View traffic",
+    "emptyNoProvidersTitle": "__MISSING__:No providers configured yet",
+    "emptyNoProvidersBody": "__MISSING__:To use AgentBridge, first connect at least one provider. It will be the destination where IDE requests are routed.",
+    "emptyGoToProviders": "__MISSING__:Go to Providers",
+    "wizardTitle": "__MISSING__:Setup wizard",
+    "wizardSubtitle": "__MISSING__:3-step setup",
+    "wizardStep1Label": "__MISSING__:Verify",
+    "wizardStep2Label": "__MISSING__:DNS",
+    "wizardStep3Label": "__MISSING__:Mappings",
+    "wizardStep1Desc": "__MISSING__:Confirm the server is running and the certificate is installed.",
+    "wizardStep2Desc": "__MISSING__:The following entries will be added to /etc/hosts to redirect traffic through AgentBridge:",
+    "wizardStep3Desc": "__MISSING__:You can now configure model mappings in the agent card. Restart the IDE to apply changes.",
+    "wizardStep3Success": "__MISSING__:Agent is configured!",
+    "wizardServerCheck": "__MISSING__:AgentBridge server",
+    "wizardRunning": "__MISSING__:running",
+    "wizardNotRunning": "__MISSING__:not running",
+    "wizardCertCheck": "__MISSING__:Certificate",
+    "wizardTrusted": "__MISSING__:trusted",
+    "wizardNotTrusted": "__MISSING__:not yet trusted — use Trust Cert button",
+    "wizardTutorialTitle": "__MISSING__:Setup instructions:",
+    "wizardEnableDns": "__MISSING__:Add /etc/hosts entries",
+    "wizardDnsAlreadyEnabled": "__MISSING__:DNS already enabled for this agent",
+    "enablingDns": "__MISSING__:Enabling…",
+    "modelSelectorTitle": "__MISSING__:Select target model",
+    "modelSelectorSearch": "__MISSING__:Search models…",
+    "noModelsFound": "__MISSING__:No models found",
+    "quickLinks": "__MISSING__:Quick links",
+    "quickLinkProviders": "__MISSING__:Configure providers",
+    "quickLinkInspector": "__MISSING__:View traffic in Traffic Inspector",
+    "maintenanceTitle": "__MISSING__:Maintenance & Diagnostics",
+    "maintenanceSubtitle": "__MISSING__:Self-test the capture pipeline, undo leftover system state, and move your setup between machines.",
+    "orphanedStateWarning": "__MISSING__:A previous session left system state behind (DNS spoof, CA, or system proxy). Run Repair to clean it up.",
+    "diagnose": "__MISSING__:Diagnose",
+    "diagnosing": "__MISSING__:Diagnosing…",
+    "diagnoseHealthy": "__MISSING__:Capture pipeline is healthy.",
+    "diagnoseUnhealthy": "__MISSING__:Capture pipeline has problems:",
+    "repair": "__MISSING__:Repair",
+    "repairing": "__MISSING__:Repairing…",
+    "repairDone": "__MISSING__:Repaired: {items}",
+    "repairNothing": "__MISSING__:Nothing to repair — system state is clean.",
+    "removeCa": "__MISSING__:Remove CA",
+    "removeCaConfirm": "__MISSING__:Remove CA?",
+    "removeCaDone": "__MISSING__:MITM root CA removed from the OS trust store.",
+    "removing": "__MISSING__:Removing…",
+    "confirm": "__MISSING__:Confirm",
+    "exportConfig": "__MISSING__:Export config",
+    "exporting": "__MISSING__:Exporting…",
+    "importConfig": "__MISSING__:Import config",
+    "importing": "__MISSING__:Importing…",
+    "importInvalidJson": "__MISSING__:The selected file is not valid JSON.",
+    "importDone": "__MISSING__:Imported {bypass} bypass · {hosts} hosts · {agents} agents",
+    "save": "__MISSING__:Save",
+    "saving": "__MISSING__:Saving…",
+    "cancel": "__MISSING__:Cancel",
+    "back": "__MISSING__:Back",
+    "next": "__MISSING__:Next",
+    "done": "__MISSING__:Done",
+    "loading": "__MISSING__:Loading…",
+    "riskNoticeTitle": "__MISSING__:Risk acknowledgment",
+    "riskNoticeBody": "__MISSING__:AgentBridge will intercept HTTPS traffic from this agent by redirecting its API hosts via DNS. Only enable if you accept responsibility for compliance with the agent's terms of service and any applicable network policies.",
+    "pageMoved": {
+      "goNow": "__MISSING__:Go now",
+      "message": "__MISSING__:The MITM Proxy now lives under AgentBridge.",
+      "title": "__MISSING__:This page has moved"
+    }
+  },
+  "trafficInspector": {
+    "title": "__MISSING__:Traffic Inspector",
+    "subtitle": "__MISSING__:Monitor LLM calls and debug any application's HTTPS traffic",
+    "captureModesTitle": "__MISSING__:Capture Modes",
+    "agentBridgeMode": "__MISSING__:AgentBridge",
+    "agentBridgeModeDesc": "__MISSING__:Capture traffic from all connected IDE agents",
+    "customHostsMode": "__MISSING__:Custom Hosts",
+    "customHostsModeDesc": "__MISSING__:Add specific hosts to intercept",
+    "httpProxyMode": "__MISSING__:HTTP Proxy",
+    "httpProxyModeDesc": "__MISSING__:Use HTTP_PROXY environment variable",
+    "systemWideMode": "__MISSING__:System-wide",
+    "systemWideModeDesc": "__MISSING__:Intercept all system traffic (advanced)",
+    "tproxyMode": "__MISSING__:TPROXY Decrypt",
+    "tproxyModeUnavailable": "__MISSING__:TPROXY decrypt requires Linux + root + the native addon",
+    "filterBarTitle": "__MISSING__:Filters",
+    "profileLlmOnly": "__MISSING__:LLM only",
+    "profileCustom": "__MISSING__:Custom",
+    "profileAll": "__MISSING__:All",
+    "filterHost": "__MISSING__:Filter host…",
+    "filterAgent": "__MISSING__:Agent",
+    "filterStatus": "__MISSING__:Status",
+    "pauseBtn": "__MISSING__:Pause",
+    "resumeBtn": "__MISSING__:Resume",
+    "clearBtn": "__MISSING__:Clear",
+    "exportHar": "__MISSING__:Export .har",
+    "recordSession": "__MISSING__:REC",
+    "stopSession": "__MISSING__:Stop",
+    "liveBadge": "__MISSING__:live",
+    "offlineBadge": "__MISSING__:offline",
+    "noRequests": "__MISSING__:No requests captured yet.",
+    "noRequestsDesc": "__MISSING__:Make sure AgentBridge is running or enable another capture mode.",
+    "selectRequest": "__MISSING__:Select a request to inspect it.",
+    "tabConversation": "__MISSING__:Conversation",
+    "tabHeaders": "__MISSING__:Headers",
+    "tabRequest": "__MISSING__:Request",
+    "tabResponse": "__MISSING__:Response",
+    "tabTiming": "__MISSING__:Timing",
+    "tabLlm": "__MISSING__:LLM",
+    "tabStats": "__MISSING__:Stats",
+    "requestHeaders": "__MISSING__:Request Headers",
+    "responseHeaders": "__MISSING__:Response Headers",
+    "rawEvents": "__MISSING__:Raw events",
+    "mergedView": "__MISSING__:Merged view",
+    "noBody": "__MISSING__:No body.",
+    "streaming": "__MISSING__:streaming…",
+    "manageHosts": "__MISSING__:Manage hosts",
+    "copySnippet": "__MISSING__:Copy proxy snippet",
+    "addHost": "__MISSING__:Add",
+    "hostPlaceholder": "__MISSING__:api.openai.com",
+    "noHostsYet": "__MISSING__:No custom hosts added yet.",
+    "noSessionsYet": "__MISSING__:No sessions yet",
+    "allTraffic": "__MISSING__:All traffic (no session)",
+    "sessionsDropdown": "__MISSING__:Sessions",
+    "annotationPlaceholder": "__MISSING__:Add a note…",
+    "contextFingerprint": "__MISSING__:Context fingerprint",
+    "llmProvider": "__MISSING__:Detected provider",
+    "llmApiKind": "__MISSING__:API kind",
+    "llmModel": "__MISSING__:Model",
+    "llmMessages": "__MISSING__:Messages",
+    "llmStream": "__MISSING__:Stream",
+    "llmMappedTo": "__MISSING__:Mapped to",
+    "llmCostEstimate": "__MISSING__:Cost estimate",
+    "systemProxyExitWarning": "__MISSING__:System-wide proxy still active — leave page anyway?",
+    "customHostsTitle": "__MISSING__:Custom Hosts",
+    "loading": "__MISSING__:Loading…",
+    "copied": "__MISSING__:Copied!",
+    "copy": "__MISSING__:Copy",
+    "httpProxyTitle": "__MISSING__:HTTP Proxy Snippet — port {port}",
+    "notRecording": "__MISSING__:Not recording",
+    "anyStatus": "__MISSING__:Any status",
+    "liveOnly": "__MISSING__:Live",
+    "viewingRecordedSession": "__MISSING__:Viewing recorded session",
+    "backToLive": "__MISSING__:Back to live",
+    "untitledSession": "__MISSING__:Untitled session",
+    "contextHistory": "__MISSING__:Context History",
+    "modelResponse": "__MISSING__:Model Response",
+    "conversationNoMessages": "__MISSING__:No messages found in this request.",
+    "conversationNotAvailable": "__MISSING__:Conversation data not available. This may not be an LLM request or the body could not be parsed.",
+    "loadingCharts": "__MISSING__:Loading charts…",
+    "statsErrors": "__MISSING__:Errors",
+    "statsLatency": "__MISSING__:Latency (last 50 requests)",
+    "statsNoData": "__MISSING__:No requests yet. Start a session recording to capture data for stats.",
+    "statsStatusDistribution": "__MISSING__:Status distribution",
+    "statsSuccessful": "__MISSING__:Successful",
+    "statsTotalRequests": "__MISSING__:Total requests",
+    "timingProxyOverhead": "__MISSING__:Proxy overhead",
+    "timingUpstreamResponse": "__MISSING__:Upstream response",
+    "timingNoData": "__MISSING__:No timing data available.",
+    "timingTotalLatency": "__MISSING__:Total latency",
+    "timingTimestamp": "__MISSING__:Timestamp",
+    "timingMethod": "__MISSING__:Method",
+    "timingStatus": "__MISSING__:Status",
+    "timingRequestSize": "__MISSING__:Request size",
+    "timingResponseSize": "__MISSING__:Response size",
+    "pausedNewBadge": "__MISSING__:{count} new",
+    "clearContextFilter": "__MISSING__:clear"
+  },
+  "cliCommon": {
+    "concept": {
+      "code": {
+        "title": "__MISSING__:CLI Code",
+        "phrase": "__MISSING__:Code tools you point at OmniRoute",
+        "flow": "__MISSING__:You → CLI Code → OmniRoute → Provider",
+        "seeOther": "__MISSING__:See →"
+      },
+      "agent": {
+        "title": "__MISSING__:CLI Agents",
+        "phrase": "__MISSING__:Broad-purpose autonomous CLI agents you point at OmniRoute",
+        "flow": "__MISSING__:You → CLI Agent → OmniRoute → Provider",
+        "seeOther": "__MISSING__:See →"
+      },
+      "acp": {
+        "title": "__MISSING__:ACP Agents",
+        "phrase": "__MISSING__:CLIs that OmniRoute spawns as execution backend (reverse flow)",
+        "flow": "__MISSING__:Client → OmniRoute → spawn CLI (stdio/ACP) → response",
+        "seeOther": "__MISSING__:See →"
+      }
+    },
+    "comparison": {
+      "title": "__MISSING__:Understand the 3 CLI types in OmniRoute",
+      "thisPage": "__MISSING__:This page",
+      "open": "__MISSING__:Open →",
+      "code": {
+        "title": "__MISSING__:Code tool",
+        "desc": "__MISSING__:Points to Omni",
+        "flow": "__MISSING__:you → CLI → Omni → provider",
+        "examples": "__MISSING__:e.g.: claude, codex"
+      },
+      "agent": {
+        "title": "__MISSING__:Broad autonomous agent",
+        "desc": "__MISSING__:Points to Omni",
+        "flow": "__MISSING__:you → agent → Omni",
+        "examples": "__MISSING__:e.g.: hermes, goose"
+      },
+      "acp": {
+        "title": "__MISSING__:CLI used as backend by Omni",
+        "desc": "__MISSING__:Reverse execution",
+        "flow": "__MISSING__:Omni → spawn CLI → resp",
+        "examples": "__MISSING__:e.g.: claude, codex (ACP)"
+      }
+    },
+    "card": {
+      "detected": "__MISSING__:Detected",
+      "notDetected": "__MISSING__:Not detected",
+      "configured": "__MISSING__:Configured",
+      "notConfigured": "__MISSING__:Not configured",
+      "configure": "__MISSING__:Configure →",
+      "howToInstall": "__MISSING__:How to install →",
+      "manualConfig": "__MISSING__:Manual config",
+      "installGuide": "__MISSING__:Install guide",
+      "endpointLabel": "__MISSING__:Endpoint",
+      "baseUrlFull": "__MISSING__:Full Base URL",
+      "baseUrlPartial": "__MISSING__:Partial Base URL",
+      "refreshDetection": "__MISSING__:Refresh detection",
+      "alsoAcp": "__MISSING__:also ACP",
+      "connectProviderHint": "__MISSING__:Connect a provider in Providers"
+    },
+    "detail": {
+      "back": "__MISSING__:Back",
+      "apply": "__MISSING__:Save",
+      "reset": "__MISSING__:Clear",
+      "manualConfig": "__MISSING__:Manual configuration",
+      "vendor": "__MISSING__:Vendor",
+      "category": "__MISSING__:Type",
+      "detectionStatus": "__MISSING__:Detection",
+      "configStatus": "__MISSING__:Configuration",
+      "baseUrlLabel": "__MISSING__:Base URL",
+      "apiKeyLabel": "__MISSING__:API Key",
+      "modelMappingLabel": "__MISSING__:Model mapping",
+      "noActiveProviders": "__MISSING__:No active providers.",
+      "noActiveProvidersDesc": "__MISSING__:Go to Providers to connect at least 1 provider before configuring the CLI.",
+      "openProviders": "__MISSING__:Open Providers →"
+    }
+  },
+  "cliCode": {
+    "pageTitle": "__MISSING__:CLI Code's",
+    "pageSubtitle": "__MISSING__:Code tools pointing to OmniRoute",
+    "searchPlaceholder": "__MISSING__:Search CLI…",
+    "filterDetectionLabel": "__MISSING__:Detection",
+    "filterBaseUrlLabel": "__MISSING__:Base URL",
+    "detectionAll": "__MISSING__:All",
+    "detectionInstalled": "__MISSING__:Installed",
+    "detectionNotFound": "__MISSING__:Not found",
+    "baseUrlAll": "__MISSING__:All",
+    "baseUrlFull": "__MISSING__:Full",
+    "baseUrlPartial": "__MISSING__:Partial"
+  },
+  "cliAgents": {
+    "pageTitle": "__MISSING__:CLI Agents",
+    "pageSubtitle": "__MISSING__:Broad-purpose autonomous CLI agents",
+    "refreshDetection": "__MISSING__:Refresh detection",
+    "searchPlaceholder": "__MISSING__:Search agent…",
+    "detectionFilterLabel": "__MISSING__:Detection",
+    "detectionAll": "__MISSING__:All",
+    "detectionInstalled": "__MISSING__:Installed",
+    "detectionNotInstalled": "__MISSING__:Not installed",
+    "visibleCount": "__MISSING__:{count} visible",
+    "emptyState": "__MISSING__:No CLI agents found with the current filters."
+  },
+  "acpAgents": {
+    "pageTitle": "__MISSING__:ACP Agents",
+    "pageSubtitle": "__MISSING__:CLIs that OmniRoute spawns as execution backend",
+    "scanning": "__MISSING__:Detecting agents…",
+    "refresh": "__MISSING__:Refresh",
+    "setupGuideTitle": "__MISSING__:Setup guide",
+    "setupGuideDetectCliTitle": "__MISSING__:Detect CLI",
+    "setupGuideDetectCliDesc": "__MISSING__:Agents are identified by running the --version command in PATH.",
+    "setupGuideCustomAgentTitle": "__MISSING__:Add custom agent",
+    "setupGuideCustomAgentDesc": "__MISSING__:Fill in the form below to register a custom CLI agent.",
+    "setupGuideCommandMissingTitle": "__MISSING__:Command not found",
+    "setupGuideCommandMissingDesc": "__MISSING__:Check that the binary is in PATH.",
+    "fingerprintSettingsHint": "__MISSING__:Configure routing and fingerprints in",
+    "settingsRoutingLink": "__MISSING__:Settings → Routing",
+    "installed": "__MISSING__:Installed",
+    "notFound": "__MISSING__:Not found",
+    "builtIn": "__MISSING__:Built-in",
+    "custom": "__MISSING__:Custom",
+    "agentUseCaseHint": "__MISSING__:Available for spawn via ACP.",
+    "remove": "__MISSING__:Remove",
+    "addCustomAgent": "__MISSING__:Add custom agent",
+    "addCustomAgentDesc": "__MISSING__:Register a custom CLI agent to be spawned via ACP.",
+    "addAgent": "__MISSING__:Add agent",
+    "agentName": "__MISSING__:Name",
+    "agentNamePlaceholder": "__MISSING__:e.g.: My Agent",
+    "binaryName": "__MISSING__:Binary",
+    "binaryNamePlaceholder": "__MISSING__:e.g.: myagent",
+    "versionCommand": "__MISSING__:Version command",
+    "versionCommandPlaceholder": "__MISSING__:e.g.: myagent --version",
+    "spawnArgs": "__MISSING__:Spawn arguments",
+    "spawnArgsPlaceholder": "__MISSING__:e.g.: --quiet, --json",
+    "cliCodeRedirectCta": "__MISSING__:Open CLI Code"
+  },
+  "agentSkills": {
+    "pageTitle": "__MISSING__:Agent Skills",
+    "pageSubtitle": "__MISSING__:Teach your agent to operate OmniRoute — 22 API areas + 20 CLI families",
+    "conceptCard": {
+      "agent": {
+        "title": "__MISSING__:Agent Skills — Outbound",
+        "description": "__MISSING__:Agent Skills are machine-readable SKILL.md documents that external AI agents (Claude Code, Cursor, Copilot…) fetch from GitHub to learn how to operate OmniRoute via REST or CLI. They are read by the agent, not executed by OmniRoute.",
+        "crossLinkLabel": "__MISSING__:Understand the difference →"
+      },
+      "omni": {
+        "title": "__MISSING__:Omni Skills — Inbound",
+        "description": "__MISSING__:Omni Skills are sandbox tools that OmniRoute injects into the model's context on every request. They are executed by OmniRoute, not read by the agent.",
+        "crossLinkLabel": "__MISSING__:Understand the difference →"
+      },
+      "comparison": {
+        "colAgent": "__MISSING__:Agent Skills",
+        "colOmni": "__MISSING__:Omni Skills",
+        "whatIs": {
+          "label": "__MISSING__:What it is",
+          "agent": "__MISSING__:Machine-readable SKILL.md that teaches an external agent to operate OmniRoute",
+          "omni": "__MISSING__:Executable tools that OmniRoute injects as tools into LLM requests"
+        },
+        "direction": {
+          "label": "__MISSING__:Direction",
+          "agent": "__MISSING__:Outbound — external agent learns to control OmniRoute",
+          "omni": "__MISSING__:Inbound — OmniRoute gives tools to models passing through it"
+        },
+        "executor": {
+          "label": "__MISSING__:Executor",
+          "agent": "__MISSING__:External agent (reads markdown → acts via API/CLI)",
+          "omni": "__MISSING__:OmniRoute itself (intercepts tool_calls, Docker sandbox)"
+        },
+        "storage": {
+          "label": "__MISSING__:Storage",
+          "agent": "__MISSING__:Dynamic catalog (/api/agent-skills) → SKILL.md on GitHub",
+          "omni": "__MISSING__:SQLite (SkillsMP / skills.sh / local)"
+        },
+        "tagline": {
+          "label": "__MISSING__:Tagline",
+          "agent": "__MISSING__:Teach your agent to use OmniRoute",
+          "omni": "__MISSING__:Give executable tools to OmniRoute models"
+        }
+      }
+    },
+    "filters": {
+      "category": "__MISSING__:Category",
+      "area": "__MISSING__:Area",
+      "searchPlaceholder": "__MISSING__:Search skills…"
+    },
+    "categoryApi": "__MISSING__:API",
+    "categoryCli": "__MISSING__:CLI",
+    "categoryConfig": "__MISSING__:Config",
+    "filterAll": "__MISSING__:All",
+    "coverageLabel": "__MISSING__:Coverage",
+    "mcpUrl": "__MISSING__:MCP URL",
+    "a2aLink": "__MISSING__:A2A",
+    "copyUrl": "__MISSING__:Copy URL",
+    "viewOnGithub": "__MISSING__:View on GitHub",
+    "previewLoading": "__MISSING__:Loading skill documentation…",
+    "previewError": "__MISSING__:Failed to load skill documentation.",
+    "previewEmpty": "__MISSING__:Select a skill to preview its documentation.",
+    "generateButton": "__MISSING__:Generate missing skills",
+    "coverageBar": {
+      "complete": "__MISSING__:Complete",
+      "partial": "__MISSING__:Partial"
+    },
+    "noSkillsFound": "__MISSING__:No skills found matching your filters.",
+    "regenerateConfirm": "__MISSING__:This will regenerate all missing SKILL.md files. Continue?",
+    "regenerateRunning": "__MISSING__:Regenerating skills…",
+    "regenerateSuccess": "__MISSING__:Skills regenerated successfully.",
+    "regenerateError": "__MISSING__:Failed to regenerate skills."
+  },
+  "freeProviderRankingsPage": {
+    "title": "__MISSING__:Free Provider Rankings",
+    "subtitle": "__MISSING__:Best free providers ranked by model ELO scores from Arena AI leaderboards",
+    "loading": "__MISSING__:Loading rankings...",
+    "errorLoading": "__MISSING__:Failed to load rankings",
+    "emptyState": "__MISSING__:No rankings available yet. Arena ELO data syncs on startup (daily) — check back shortly, or trigger a manual sync. Disable Arena ELO Sync in Feature Flags or set ARENA_ELO_SYNC_ENABLED=false to opt out.",
+    "bestModel": "__MISSING__:Best",
+    "allCategories": "__MISSING__:All Categories",
+    "categoryDefault": "__MISSING__:Default",
+    "categoryCoding": "__MISSING__:Coding",
+    "categoryReview": "__MISSING__:Review",
+    "categoryDocumentation": "__MISSING__:Documentation",
+    "categoryDebugging": "__MISSING__:Debugging",
+    "colRank": "__MISSING__:Rank",
+    "colProvider": "__MISSING__:Provider",
+    "colTopModel": "__MISSING__:Top Model",
+    "colScore": "__MISSING__:Score",
+    "colAvgScore": "__MISSING__:Avg Score",
+    "colModels": "__MISSING__:Models",
+    "colType": "__MISSING__:Type"
   }
 }
diff --git a/src/i18n/messages/mr.json b/src/i18n/messages/mr.json
index 6470061897..59d4a845ce 100644
--- a/src/i18n/messages/mr.json
+++ b/src/i18n/messages/mr.json
@@ -393,6 +393,7 @@
     "cloudBenefitAccess": "Cloud Benefit Access",
     "maxRetries": "Max Retries",
     "queueTimeout": "Queue Timeout",
+    "queueDepth": "__MISSING__:Queue Depth",
     "addProvider": "Add Provider",
     "realtime": "Realtime",
     "totalTranslations": "Total Translations",
@@ -709,6 +710,7 @@
     "batchFilesListFilesTable": "फाईल्स",
     "batchPageLoadingMore": "अधिक लोड करत आहे...",
     "recommended": "__MISSING__:Recommended",
+    "understand": "__MISSING__:I understand",
     "batchConceptTitle": "Batch processing",
     "batchConceptSubtitle": "Process thousands of requests asynchronously at ~50% of the cost (24h window). Ideal for evaluations, classification, and embeddings.",
     "batchConceptHowItWorks": "How it works",
@@ -773,36 +775,13 @@
     "filesListUploadButton": "Upload",
     "filesListUsedByColumn": "Used by",
     "filesListUsedByNone": "None",
-    "filesListDelete": "Delete",
-    "filesListDownload": "Download",
-    "batchDetailActionCancel": "Cancel batch",
-    "batchDetailActionRetry": "Retry failed requests",
-    "batchDetailCancelling": "Cancelling…",
-    "batchDetailRetrying": "Preparing retry…",
-    "batchDetailCancelConfirm": "Cancel this batch? In-progress requests will stop.",
-    "batchActionCancelError": "Failed to cancel batch. Try again.",
-    "batchActionRetryError": "Failed to retry failed requests. Try again.",
-    "batchConceptRetentionNote": "Results and error files are retained for 30 days (Anthropic: 29 days)",
     "filesListUsedByRoleInput": "input",
     "filesListUsedByRoleOutput": "output",
     "filesListUsedByRoleError": "error",
-    "batchListProgressPartial": "(partial)",
     "filesListSizeColumn": "Size",
+    "batchListProgressPartial": "(partial)",
     "batchListProviderColumn": "Provider",
     "batchListProviderUnknown": "—",
-    "batchListBatchCreated": "Batch {id} created — refreshing list…",
-    "batchListBatchCreatedDismiss": "Dismiss",
-    "batchListRefreshing": "Refreshing…",
-    "batchListRefresh": "Refresh",
-    "uploadFileModalRemove": "Remove",
-    "uploadFileModalUploading": "Uploading…",
-    "wizardInputReading": "Reading file…",
-    "wizardInputReady": "Ready",
-    "wizardInputLargeFileLabel": "Large file — sampling validation",
-    "wizardInputCsvJsonlReady": "JSONL generated — ready to validate.",
-    "wizardInputLargeFileWarning": "Large file detected — validation runs by sampling (first 5 MB + last 100 KB). Full validation happens server-side.",
-    "wizardCostWindow24h": "24h completion window",
-    "wizardValidationFieldsOk": "required fields valid",
     "batchListProviderOther": "Other",
     "batchListTitle": "Batches",
     "batchListCount": "{count} batches",
@@ -839,8 +818,33 @@
     "wizardCostWindow": "Window",
     "wizardDestinationSelectProvider": "Select a provider…",
     "wizardDestinationSelectModel": "Select a model…",
-    "wizardDestinationConnectProvider": "Connect a provider"
+    "wizardDestinationConnectProvider": "Connect a provider",
+    "batchListBatchCreated": "Batch {id} created — refreshing list…",
+    "batchListBatchCreatedDismiss": "Dismiss",
+    "batchListRefreshing": "Refreshing…",
+    "batchListRefresh": "Refresh",
+    "uploadFileModalRemove": "Remove",
+    "uploadFileModalUploading": "Uploading…",
+    "wizardInputReading": "Reading file…",
+    "wizardInputReady": "Ready",
+    "wizardInputLargeFileLabel": "Large file — sampling validation",
+    "wizardInputCsvJsonlReady": "JSONL generated — ready to validate.",
+    "wizardInputLargeFileWarning": "Large file detected — validation runs by sampling (first 5 MB + last 100 KB). Full validation happens server-side.",
+    "wizardCostWindow24h": "24h completion window",
+    "wizardValidationFieldsOk": "required fields valid",
+    "filesListDelete": "Delete",
+    "filesListDownload": "Download",
+    "batchDetailActionCancel": "Cancel batch",
+    "batchDetailActionRetry": "Retry failed requests",
+    "batchDetailCancelling": "Cancelling…",
+    "batchDetailRetrying": "Preparing retry…",
+    "batchDetailCancelConfirm": "Cancel this batch? In-progress requests will stop.",
+    "batchActionCancelError": "Failed to cancel batch. Try again.",
+    "batchActionRetryError": "Failed to retry failed requests. Try again.",
+    "batchConceptRetentionNote": "Results and error files are retained for 30 days (Anthropic: 29 days)"
   },
+  "featureFlagOmnirouteEmergencyFallbackDescription": "__MISSING__:Route budget-exhausted requests to the emergency free fallback provider/model.",
+  "featureFlagArenaEloSyncEnabledDescription": "__MISSING__:Enable periodic Arena AI leaderboard ELO sync for model intelligence rankings.",
   "sidebar": {
     "home": "Home",
     "dashboard": "Dashboard",
@@ -968,6 +972,7 @@
     "aiFeaturesSection": "AI Features",
     "mcp": "MCP",
     "a2a": "A2A",
+    "plugins": "__MISSING__:Plugins",
     "apiEndpoints": "API Endpoints",
     "batchFiles": "Files",
     "analyticsEvals": "Evals",
@@ -976,6 +981,10 @@
     "analyticsComboHealth": "Combo Health",
     "analyticsCompression": "Compression",
     "costsBudget": "Budget",
+    "costsFreeTiers": "__MISSING__:Free-Tier Budget",
+    "costsFreeTiersSubtitle": "__MISSING__:Monthly free-token allowances",
+    "freeProviderRankings": "__MISSING__:Free Provider Rankings",
+    "freeProviderRankingsSubtitle": "__MISSING__:Best free providers ranked by model ELO scores",
     "costsQuotaShare": "Quota Sharing",
     "costsPricing": "Pricing",
     "logsProxy": "Proxy Logs",
@@ -987,10 +996,12 @@
     "settingsAppearance": "Appearance",
     "settingsAi": "AI Settings",
     "settingsSecurity": "Security",
+    "settingsAccessTokens": "__MISSING__:Access Tokens",
     "settingsFeatureFlags": "वैशिष्ट्य ध्वज",
     "settingsAuthz": "__MISSING__:Authz",
     "settingsRouting": "Routing",
     "settingsResilience": "Resilience",
+    "modelLockout": "__MISSING__:Model Lockout",
     "settingsAdvanced": "Advanced",
     "omniProxySection": "OmniProxy",
     "quotaTracker": "Provider Quota",
@@ -1036,6 +1047,8 @@
     "analyticsCompressionSubtitle": "Token savings stats",
     "analyticsSearchSubtitle": "Search tool analytics",
     "analyticsEvalsSubtitle": "Eval suite results",
+    "providerStats": "__MISSING__:Provider Stats",
+    "providerStatsSubtitle": "__MISSING__:Latency and performance metrics",
     "logsSubtitle": "Application logs",
     "logsProxySubtitle": "Proxy traffic logs",
     "consoleLogsSubtitle": "Console output",
@@ -1055,6 +1068,7 @@
     "agentSkillsSubtitle": "A2A skill registry",
     "mcpSubtitle": "MCP server controls",
     "a2aSubtitle": "A2A protocol server",
+    "pluginsSubtitle": "__MISSING__:Plugin marketplace & installs",
     "mediaSubtitle": "Cached media files",
     "batchFilesSubtitle": "Batch input/output files",
     "settingsSubtitle": "All settings",
@@ -1065,13 +1079,41 @@
     "settingsResilienceSubtitle": "Retries and breakers",
     "settingsAdvancedSubtitle": "Power user options",
     "settingsSecuritySubtitle": "Auth and encryption",
+    "settingsAccessTokensSubtitle": "__MISSING__:Scoped CLI tokens for remote mode",
     "settingsFeatureFlagsSubtitle": "सिस्टम क्षमता टॉगल करा",
     "settingsSidebar": "Sidebar",
     "settingsSidebarSubtitle": "Customize sidebar layout",
     "settingsAuthzSubtitle": "__MISSING__:Route inventory and bypass policy",
     "docsSubtitle": "Documentation",
     "issuesSubtitle": "Report a bug",
-    "changelogSubtitle": "Release notes"
+    "changelogSubtitle": "Release notes",
+    "costsQuotaPlans": "__MISSING__:Plans & Quotas",
+    "costsQuotaPlansSubtitle": "__MISSING__:Configure plans by provider",
+    "activity": "__MISSING__:Activity",
+    "activitySubtitle": "__MISSING__:Friendly feed of recent events",
+    "logsGroup": "__MISSING__:Logs",
+    "systemGroup": "__MISSING__:System",
+    "costsOverview": "__MISSING__:Overview",
+    "costsOverviewSubtitle": "__MISSING__:Consolidated cost analysis",
+    "agentBridge": "__MISSING__:Agent Bridge",
+    "agentBridgeSubtitle": "__MISSING__:Intercept IDE agent traffic",
+    "trafficInspector": "__MISSING__:Traffic Inspector",
+    "trafficInspectorSubtitle": "__MISSING__:Monitor LLM calls + debug any HTTPS traffic",
+    "cliCode": "__MISSING__:CLI Code",
+    "cliCodeSubtitle": "__MISSING__:Code tools pointing to OmniRoute",
+    "cliAgents": "__MISSING__:CLI Agents",
+    "cliAgentsSubtitle": "__MISSING__:Autonomous CLI agents",
+    "acpAgents": "__MISSING__:ACP Agents",
+    "acpAgentsSubtitle": "__MISSING__:CLIs spawned by OmniRoute",
+    "skipToContent": "__MISSING__:Skip to content",
+    "unpinSection": "__MISSING__:Unpin section",
+    "pinSectionOpen": "__MISSING__:Pin section open",
+    "reloadPage": "__MISSING__:Reload Page",
+    "dragReorderSection": "__MISSING__:Drag to reorder section",
+    "dragReorderItem": "__MISSING__:Drag to reorder",
+    "cannotHide": "__MISSING__:This item cannot be hidden",
+    "alwaysVisible": "__MISSING__:Always visible",
+    "groupSeparatorLabel": "__MISSING__:Separator"
   },
   "webhooks": {
     "title": "वेबहुक",
@@ -1272,7 +1314,47 @@
     "a2aEvents": "कार्यक्रम",
     "a2aArtifacts": "कलाकृती",
     "a2aNoTasks": "कोणतीही A2A कार्ये रेकॉर्ड केलेली नाहीत.",
-    "a2aLoadingTasks": "A2A कार्ये लोड करत आहे..."
+    "a2aLoadingTasks": "A2A कार्ये लोड करत आहे...",
+    "actor": "__MISSING__:Actor",
+    "actorPlaceholder": "__MISSING__:Filter by actor",
+    "eventTypes": {
+      "apiKey.activate": "__MISSING__:API Key Activated",
+      "apiKey.ban": "__MISSING__:API Key Banned",
+      "apiKey.deactivate": "__MISSING__:API Key Deactivated",
+      "apiKey.regenerate": "__MISSING__:API Key Regenerated",
+      "apiKey.scopes.grant": "__MISSING__:API Key Scopes Granted",
+      "apiKey.scopes.revoke": "__MISSING__:API Key Scopes Revoked",
+      "apiKey.scopes.update": "__MISSING__:API Key Scopes Updated",
+      "apiKey.unban": "__MISSING__:API Key Unbanned",
+      "auth.login.error": "__MISSING__:Login Error",
+      "auth.login.failed": "__MISSING__:Login Failed",
+      "auth.login.locked": "__MISSING__:Login Locked",
+      "auth.login.misconfigured": "__MISSING__:Login Misconfigured",
+      "auth.login.setup_required": "__MISSING__:Login Setup Required",
+      "auth.login.success": "__MISSING__:Login Success",
+      "auth.logout.success": "__MISSING__:Logout Success",
+      "compliance.cleanup": "__MISSING__:Compliance Cleanup",
+      "provider.credentials.applied": "__MISSING__:Provider Credentials Applied",
+      "provider.credentials.batch_revoked": "__MISSING__:Provider Credentials Batch Revoked",
+      "provider.credentials.bulk_created": "__MISSING__:Provider Credentials Bulk Created",
+      "provider.credentials.bulk_imported": "__MISSING__:Provider Credentials Bulk Imported",
+      "provider.credentials.created": "__MISSING__:Provider Credentials Created",
+      "provider.credentials.imported": "__MISSING__:Provider Credentials Imported",
+      "provider.credentials.revoked": "__MISSING__:Provider Credentials Revoked",
+      "provider.credentials.updated": "__MISSING__:Provider Credentials Updated",
+      "provider.validation.ssrf_blocked": "__MISSING__:Provider SSRF Blocked",
+      "quota.plan.updated": "__MISSING__:Quota Plan Updated",
+      "quota.pool.created": "__MISSING__:Quota Pool Created",
+      "quota.pool.deleted": "__MISSING__:Quota Pool Deleted",
+      "quota.pool.updated": "__MISSING__:Quota Pool Updated",
+      "quota.store.driver_changed": "__MISSING__:Quota Store Driver Changed",
+      "server.start": "__MISSING__:Server Start",
+      "service.reveal_api_key": "__MISSING__:Service API Key Revealed",
+      "settings.update": "__MISSING__:Settings Updated",
+      "settings.update_failed": "__MISSING__:Settings Update Failed",
+      "sync.token.created": "__MISSING__:Sync Token Created",
+      "sync.token.revoked": "__MISSING__:Sync Token Revoked"
+    }
   },
   "themesPage": {
     "title": "Themes",
@@ -1381,7 +1463,8 @@
     "settingsResilienceDescription": "Circuit breaker, retry, and fallback configuration",
     "settingsAdvancedDescription": "Advanced payload rules, request limits, and proxy API settings",
     "mitmProxyDescription": "Configure MITM proxy settings for traffic inspection and debugging",
-    "oneProxyDescription": "Configure 1Proxy settings for advanced proxy chaining"
+    "oneProxyDescription": "Configure 1Proxy settings for advanced proxy chaining",
+    "omniSkillsDescription": "__MISSING__:Install and manage sandbox skills for automated prompt and tool execution"
   },
   "home": {
     "quickStart": "Quick Start",
@@ -1612,16 +1695,24 @@
     "ownUsageVisibilityDesc": "या कीला स्वतःचा USD वापर, बजेट टक्केवारी आणि टोकन एकूण पाहण्यासाठी status endpoint कॉल करू द्या.",
     "sharedAccountQuotaVisibility": "शेअर केलेला खाते कोटा",
     "sharedAccountQuotaVisibilityDesc": "एक स्पष्ट कनेक्शन कॉन्फिगर केलेले असताना या कीला शेअर केलेला upstream खाते कोटा पाहू द्या.",
+    "localUsageCommand": "__MISSING__:Allow local usage command",
+    "localUsageCommandDesc": "__MISSING__:Allows this API key to use @@om-usage to retrieve cached usage and quota information without calling an upstream provider.",
+    "localUsageCommandBadge": "__MISSING__:Usage cmd",
     "keyCreated": "API Key Created",
     "keyCreatedSuccess": "Key created successfully!",
     "keyCreatedNote": "Copy and store this key now — it won't be shown again.",
     "done": "Done",
     "savePermissions": "Save Permissions",
-    "endpointRestrictions": "__MISSING__:Allowed Endpoints",
-    "allEndpointsAllowed": "__MISSING__:This key can access all API endpoints.",
-    "endpointsRestricted": "__MISSING__:Restricted to {count} endpoint{count, plural, one {} other {s}}.",
+    "endpointRestrictions": "Allowed Endpoints",
+    "allEndpointsAllowed": "This key can access all API endpoints.",
+    "endpointsRestricted": "Restricted to {count} endpoint{count, plural, one {} other {s}}.",
     "autoResolve": "Auto-Resolve",
     "autoResolveDesc": "Auto-resolve ambiguous model names to native provider for this API key.",
+    "streamDefaultMode": "__MISSING__:Stream Default Compatibility",
+    "streamDefaultModeDesc": "__MISSING__:Controls omitted `stream` flags for this key. JSON mode returns non-streaming responses unless the client explicitly requests SSE.",
+    "streamDefaultLegacy": "__MISSING__:Legacy",
+    "streamDefaultJson": "__MISSING__:JSON Compatible",
+    "streamDefaultBadge": "__MISSING__:JSON stream default",
     "keyActive": "Key Active",
     "keyActiveDesc": "Enable or disable this API key. Disabled keys are immediately rejected with 403.",
     "accessSchedule": "Access Schedule",
@@ -1667,6 +1758,7 @@
     "keyOnlyAvailableAtCreation": "Full key available only at creation time — copy it when you first create the key",
     "modelsCount": "{count, plural, one {# model} other {# models}}",
     "lastUsedOn": "Last: {date}",
+    "viewCostsFor": "__MISSING__:View costs for {name}",
     "editPermissions": "Edit permissions",
     "deleteKey": "Delete key",
     "regenerateKey": "की पुन्हा निर्माण करा",
@@ -1708,9 +1800,12 @@
     "shownOf": "__MISSING__:{shown} of {total} shown",
     "emptyFilterTitle": "__MISSING__:No keys match your filters",
     "emptyFilterClear": "__MISSING__:Clear filters",
-    "endpointRestrictions": "Allowed Endpoints",
-    "allEndpointsAllowed": "This key can access all API endpoints.",
-    "endpointsRestricted": "Restricted to {count} endpoint{count, plural, one {} other {s}}."
+    "disableNonPublicModels": "__MISSING__:Disable Non-Public Models",
+    "disableNonPublicModelsDesc": "__MISSING__:Reject requests for models that are not discovered or not marked as public in the provider catalog",
+    "normalKeysSection": "__MISSING__:Normal keys",
+    "quotaKeysSection": "__MISSING__:Quota keys",
+    "quotaPill": "__MISSING__:QUOTA",
+    "quotaModeOnly": "__MISSING__:qtSd-only"
   },
   "auditLog": {
     "title": "Audit Log",
@@ -1845,6 +1940,8 @@
     "freeQuota": "Free quota/mo",
     "scrapeUrl": "URL to scrape",
     "scrapeUrlPlaceholder": "https://example.com",
+    "scrapeUrlRequired": "__MISSING__:URL is required",
+    "scrapeUrlInvalid": "__MISSING__:Invalid URL — it must start with http:// or https://",
     "scrapeExtract": "Extract",
     "scrapeExtracting": "Extracting…",
     "scrapeFullPage": "Full page",
@@ -1858,6 +1955,8 @@
     "scrapeMetadata": "Metadata",
     "scrapeProvider": "Provider",
     "scrapeSize": "Size",
+    "scrapeEmptyState": "__MISSING__:Enter a URL to extract its content",
+    "scrapeProvidersAvailable": "__MISSING__:Available providers: Firecrawl, Jina Reader, Tavily.",
     "compareRun": "Compare",
     "compareRunning": "Comparing…",
     "autoProvider": "Auto (cheapest)",
@@ -2245,6 +2344,8 @@
     "leastLatency": "Least Latency",
     "comboName": "Combo Name",
     "comboNamePlaceholder": "my-combo",
+    "comboDescription": "__MISSING__:Description",
+    "comboDescriptionPlaceholder": "__MISSING__:Optional note describing this combo",
     "deleteConfirm": "Delete this combo?",
     "noCombosYet": "No combos yet",
     "comboCreated": "Combo created successfully",
@@ -2284,6 +2385,8 @@
     "resetAwareDesc": "शिल्लक कोटा 5h आणि साप्ताहिक रीसेट करा, नंतर समान स्कोअर राउंड-रॉबिन",
     "strictRandom": "Strict Random",
     "strictRandomDesc": "Shuffle deck — uses each model once before reshuffling",
+    "fusion": "__MISSING__:Fusion",
+    "fusionDesc": "__MISSING__:Fans the prompt to every panel model in parallel, then a judge model synthesizes one final answer",
     "models": "Models",
     "autoBalance": "Auto-balance",
     "advancedSettings": "Advanced Settings",
@@ -2982,14 +3085,19 @@
     "ngrokStarted": "एनग्रोक बोगदा सुरू झाला",
     "ngrokStopped": "ngrok बोगदा थांबला",
     "ngrokRequestFailed": "एनग्रोक बोगदा अपडेट करण्यात अयशस्वी",
-    "tokenSaverSubtitle": "प्रत्येक विनंतीवर कमी टोकन खर्च करा.",
-    "tokenSaverToolOutput": "साधन आउटपुट",
-    "tokenSaverLlmOutput": "एलएलएम आउटपुट",
-    "tokenSaverInputCompression": "इनपुट कॉम्प्रेशन",
     "apiEndpointsCatalogUnavailable": "API कॅटलॉग अनुपलब्ध",
     "apiEndpointsSearchPlaceholder": "अंत्यबिंदू शोधा...",
     "apiEndpointsRequiresAuth": "प्रमाणीकरण आवश्यक आहे",
     "apiEndpointsNoMatch": "कोणतेही एंडपॉइंट तुमच्या फिल्टरशी जुळत नाहीत",
+    "vscodeAliasTitle": "__MISSING__:VS Code Token Alias",
+    "vscodeAliasDescriptionReady": "__MISSING__:Ready-to-paste compatibility URLs using the /api/v1/vscode/TOKEN/... endpoint.",
+    "vscodeAliasDescriptionError": "__MISSING__:Showing placeholder URLs because CLI keys could not be loaded in this session.",
+    "vscodeAliasDescriptionLoading": "__MISSING__:Loading CLI keys. Placeholder URLs are shown until a key is available.",
+    "vscodeAliasDescriptionPlaceholder": "__MISSING__:Showing placeholder URLs. Create or activate an API key in CLI Tools to replace TOKEN.",
+    "vscodeAliasManage": "__MISSING__:CLI Tools",
+    "vscodeAliasBaseLabel": "__MISSING__:VS Code base",
+    "vscodeAliasModelsLabel": "__MISSING__:VS Code models",
+    "vscodeAliasChatLabel": "__MISSING__:VS Code chat",
     "localServer": "स्थानिक सर्व्हर",
     "cloudOmniroute": "मेघ OmniRoute",
     "copyUrl": "URL कॉपी करा",
@@ -3002,7 +3110,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
@@ -3178,42 +3289,187 @@
     "a2aStep3": "__MISSING__:Track and cancel tasks with {code1} and {code2}."
   },
   "memory": {
-    "title": "Memory Management",
-    "description": "View and manage stored memory entries",
-    "memories": "Memories",
-    "totalEntries": "Total Entries",
-    "tokensUsed": "Tokens Used",
-    "hitRate": "Hit Rate",
-    "loading": "Loading memories...",
-    "noMemories": "No memories found",
-    "search": "Search memories...",
-    "allTypes": "All Types",
-    "export": "Export",
-    "import": "Import",
-    "addMemory": "Add Memory",
-    "type": "Type",
-    "key": "Key",
-    "content": "Content",
-    "created": "Created",
-    "actions": "Actions",
-    "delete": "Delete",
-    "factual": "Factual",
-    "episodic": "Episodic",
-    "procedural": "Procedural",
-    "semantic": "Semantic",
     "a": "A",
-    "pipelineOk": "पाइपलाइन ठीक आहे ({latencyMs}ms)",
-    "pipelineError": "पाइपलाइन त्रुटी",
-    "healthUnknown": "आरोग्य माहीत नाही",
-    "checkingHealth": "तपासत आहे...",
-    "checkHealth": "आरोग्य तपासा",
-    "pageInfo": "पृष्ठ {page} पैकी {totalPages} ({total} एकूण)",
-    "previous": "मागील",
-    "next": "पुढे",
+    "actions": "Actions",
+    "addMemory": "Add Memory",
+    "allTypes": "All Types",
     "cancel": "रद्द करा",
-    "save": "जतन करा",
+    "checkHealth": "आरोग्य तपासा",
+    "checkingHealth": "तपासत आहे...",
+    "compactOld": "__MISSING__:Compact old",
+    "concept": {
+      "title": "__MISSING__:Conversational Memory",
+      "description": "__MISSING__:OmniRoute learns from every conversation, remembering facts, episodes, procedures, and semantic concepts that make responses more accurate and context-aware.",
+      "howWorksToggle": "__MISSING__:How it works",
+      "howWorksContent": "__MISSING__:1. Automatic extraction: at the end of each response, facts and episodes are detected and saved automatically.\n2. Retrieval: before each response, the most relevant memories are searched via FTS5 (exact), vector (semantic), or hybrid RRF.\n3. Injection: relevant memories are injected into the assistant context to improve response quality.\n4. Management: use this page to view, edit, export, and compact old memories."
+    },
+    "content": "Content",
+    "contentPlaceholder": "लक्षात ठेवण्यासाठी मूल्य किंवा JSON सामग्री",
+    "created": "Created",
+    "delete": "Delete",
+    "deleteConfirmDesc": "__MISSING__:This action cannot be undone. The memory will be permanently removed.",
+    "deleteConfirmTitle": "__MISSING__:Delete memory?",
+    "description": "View and manage stored memory entries",
+    "editMemory": "__MISSING__:Edit memory",
+    "editModal": {
+      "title": "__MISSING__:Edit Memory",
+      "metadataLabel": "__MISSING__:Metadata (JSON)",
+      "metadataInvalid": "__MISSING__:Invalid JSON",
+      "saveFailed": "__MISSING__:Failed to save memory"
+    },
+    "embedding": {
+      "autoLabel": "__MISSING__:Automatic",
+      "autoDesc": "__MISSING__:Uses best available: remote provider > static > transformers",
+      "remoteLabel": "__MISSING__:Remote provider",
+      "remoteDesc": "__MISSING__:Uses embedding via provider API (requires API key)",
+      "staticLabel": "__MISSING__:Static local (potion)",
+      "staticDesc": "__MISSING__:Local embedding without WASM or external dependencies",
+      "transformersLabel": "__MISSING__:Transformers.js (MiniLM)",
+      "transformersDesc": "__MISSING__:Local embedding via @huggingface/transformers (~400MB RAM)",
+      "providerModelLabel": "__MISSING__:Provider / Model",
+      "noRemoteProviders": "__MISSING__:No providers with configured API key",
+      "selectProviderModel": "__MISSING__:Select a model",
+      "staticEnabledLabel": "__MISSING__:Enable Static Potion",
+      "staticEnabledDesc": "__MISSING__:Download and use potion-base-8M model locally",
+      "transformersEnabledLabel": "__MISSING__:Enable Transformers.js",
+      "transformersEnabledDesc": "__MISSING__:Opt-in for local MiniLM (~400MB RAM, ~3s cold start)",
+      "transformersWarning": "__MISSING__:Requires ~400MB RAM and ~3s cold start on the first semantic query."
+    },
+    "emptyState": {
+      "title": "__MISSING__:No memories yet",
+      "description": "__MISSING__:Memories are created automatically from conversations. You can also add them manually using the button above."
+    },
+    "engine": {
+      "statusTitle": "__MISSING__:Engine Status",
+      "embeddingTitle": "__MISSING__:Embedding Source",
+      "rerankTitle": "__MISSING__:Rerank (optional)",
+      "reindexNow": "__MISSING__:Reindex now",
+      "reindexStarted": "__MISSING__:Reindexing started ({pending} pending)",
+      "reindexFailed": "__MISSING__:Failed to start reindexing",
+      "keywordLabel": "__MISSING__:Keyword (FTS5)",
+      "keywordReason": "__MISSING__:Keyword search always available",
+      "embeddingLabel": "__MISSING__:Embedding",
+      "vectorStoreLabel": "__MISSING__:Vector Store",
+      "qdrantLabel": "__MISSING__:Qdrant",
+      "rerankLabel": "__MISSING__:Rerank",
+      "qdrantDisabled": "__MISSING__:Disabled",
+      "qdrantOk": "__MISSING__:Healthy ({latencyMs}ms)",
+      "qdrantError": "__MISSING__:Connection error",
+      "needsReindex": "__MISSING__:{count} memory(ies) need reindexing",
+      "configureCta": "__MISSING__:Configure",
+      "vectorStoreInstallHint": "__MISSING__:To enable vector search: npm install sqlite-vec (needs native Node.js, not WASM), then restart."
+    },
+    "episodic": "Episodic",
+    "export": "Export",
+    "factual": "Factual",
+    "healthUnknown": "आरोग्य माहीत नाही",
+    "hitRate": "Hit Rate",
+    "import": "Import",
+    "importError": "__MISSING__:Failed to import file",
+    "importResult": "__MISSING__:{imported} imported, {skipped} skipped",
+    "key": "Key",
     "keyPlaceholder": "उदा. user.preferences.theme",
-    "contentPlaceholder": "लक्षात ठेवण्यासाठी मूल्य किंवा JSON सामग्री"
+    "loading": "Loading memories...",
+    "memories": "Memories",
+    "next": "पुढे",
+    "noMemories": "No memories found",
+    "pageInfo": "पृष्ठ {page} पैकी {totalPages} ({total} एकूण)",
+    "pipelineError": "पाइपलाइन त्रुटी",
+    "pipelineOk": "पाइपलाइन ठीक आहे ({latencyMs}ms)",
+    "playground": {
+      "infoTitle": "__MISSING__:Memory Playground",
+      "infoDesc": "__MISSING__:Simulate what would be retrieved for a given query. No memories are modified — read-only preview.",
+      "queryLabel": "__MISSING__:Test query",
+      "queryPlaceholder": "__MISSING__:Type a question or test phrase...",
+      "strategyLabel": "__MISSING__:Strategy",
+      "strategyExact": "__MISSING__:Exact (FTS5)",
+      "strategySemantic": "__MISSING__:Semantic (vector)",
+      "strategyHybrid": "__MISSING__:Hybrid (RRF)",
+      "budgetLabel": "__MISSING__:Budget (tokens)",
+      "simulate": "__MISSING__:Simulate",
+      "resultsTitle": "__MISSING__:{count} result(s)",
+      "resolutionTitle": "__MISSING__:Search resolution",
+      "resolutionEmbedding": "__MISSING__:Embedding",
+      "resolutionStore": "__MISSING__:Vector store",
+      "resolutionStrategy": "__MISSING__:Strategy used",
+      "rerankApplied": "__MISSING__:Rerank applied",
+      "fallback": "__MISSING__:Fallback",
+      "noResults": "__MISSING__:No memories found for this query.",
+      "tokensUsed": "__MISSING__:tokens used",
+      "none": "__MISSING__:none",
+      "errorFetch": "__MISSING__:Failed to fetch preview"
+    },
+    "previous": "मागील",
+    "procedural": "Procedural",
+    "qdrant": {
+      "title": "__MISSING__:Qdrant (Vector Store Tier 2)",
+      "description": "__MISSING__:Optional Qdrant integration for scalable semantic search",
+      "enableLabel": "__MISSING__:Enable Qdrant",
+      "enableDesc": "__MISSING__:When enabled, Qdrant is used as the primary vector store",
+      "testConnection": "__MISSING__:Test connection",
+      "testing": "__MISSING__:Testing...",
+      "statusActive": "__MISSING__:Active",
+      "statusError": "__MISSING__:Error",
+      "statusDisabled": "__MISSING__:Disabled",
+      "healthOk": "__MISSING__:Connection OK ({latencyMs}ms)",
+      "healthError": "__MISSING__:Connection error",
+      "saved": "__MISSING__:Settings saved",
+      "saveError": "__MISSING__:Failed to save",
+      "portLabel": "__MISSING__:Port",
+      "embeddingModelLabel": "__MISSING__:Embedding Model",
+      "optional": "__MISSING__:optional",
+      "apiKeyKeepPlaceholder": "__MISSING__:Leave blank to keep current key",
+      "apiKeyOptional": "__MISSING__:Leave blank if not using authentication",
+      "removeApiKey": "__MISSING__:Remove",
+      "quickSelectModel": "__MISSING__:Quick select",
+      "searchTestTitle": "__MISSING__:Semantic search test",
+      "searchPlaceholder": "__MISSING__:Type a test query...",
+      "searching": "__MISSING__:Searching...",
+      "search": "__MISSING__:Search",
+      "cleanupTitle": "__MISSING__:Clean up old points",
+      "cleanupDesc": "__MISSING__:Remove Qdrant points for expired memories (retention period).",
+      "cleaning": "__MISSING__:Cleaning...",
+      "cleanNow": "__MISSING__:Clean now",
+      "cleanupSuccess": "__MISSING__:{count} point(s) removed",
+      "cleanupFailed": "__MISSING__:Cleanup failed"
+    },
+    "rerank": {
+      "enableLabel": "__MISSING__:Enable Rerank",
+      "enableDesc": "__MISSING__:Reorders results with a reranking model after search",
+      "warning": "__MISSING__:Rerank adds +200-500ms latency and additional cost per request. Use sparingly.",
+      "providerModelLabel": "__MISSING__:Rerank Provider / Model",
+      "noProviderWithKey": "__MISSING__:No provider with configured API key. Configure a provider to use rerank.",
+      "selectProviderModel": "__MISSING__:Select a provider/model"
+    },
+    "save": "जतन करा",
+    "saving": "__MISSING__:Saving...",
+    "search": "Search memories...",
+    "semantic": "Semantic",
+    "summarize": {
+      "title": "__MISSING__:Compact old memories",
+      "noCandidates": "__MISSING__:No memories eligible for compaction (criteria: >30 days old).",
+      "candidatesDesc": "__MISSING__:{count} memories will be compacted into summaries. This action cannot be undone.",
+      "confirm": "__MISSING__:Compact now"
+    },
+    "tabs": {
+      "memories": "__MISSING__:Memories",
+      "playground": "__MISSING__:Playground",
+      "engine": "__MISSING__:Engine"
+    },
+    "title": "Memory Management",
+    "tokensUsed": "Tokens Used",
+    "tooltip": {
+      "totalEntries": "__MISSING__:Total memories stored for this API key",
+      "tokensUsed": "__MISSING__:Estimated total tokens occupied by active memories",
+      "hitRate": "__MISSING__:Read-by-ID cache hit rate (not semantic recall accuracy)",
+      "factual": "__MISSING__:Objective, permanent facts from user context",
+      "episodic": "__MISSING__:Events and experiences from conversation history",
+      "procedural": "__MISSING__:Procedures, workflows, and instructions the assistant should follow",
+      "semantic": "__MISSING__:Concepts, preferences, and domain knowledge"
+    },
+    "totalEntries": "Total Entries",
+    "type": "Type",
+    "memoryEnabled": "__MISSING__:Memory enabled"
   },
   "skills": {
     "title": "Skills",
@@ -3544,6 +3800,14 @@
     "export": "Export",
     "exporting": "Exporting...",
     "exportFailed": "Export failed",
+    "cleanHistoryButton": "__MISSING__:Clean history",
+    "cleanHistoryTitle": "__MISSING__:Clean log history?",
+    "cleanHistoryMessage": "__MISSING__:This permanently clears all request log rows, legacy detail rows, and local artifact files under DATA_DIR/call_logs. The live page will refresh after cleanup.",
+    "cleanHistoryConfirm": "__MISSING__:Clean history",
+    "cleanHistoryCancel": "__MISSING__:Cancel",
+    "cleanHistorySuccess": "__MISSING__:Cleaned {deleted} log entries, {deletedArtifacts} artifacts, and {deletedDetailedLogs} legacy detail rows.",
+    "cleanHistoryEmpty": "__MISSING__:No request log history was found.",
+    "cleanHistoryFailed": "__MISSING__:Failed to clean log history.",
     "timeRange": "Time Range",
     "lastNHours": "Last {hours}",
     "defaultRange": "default",
@@ -3551,10 +3815,14 @@
       "fetchFailed": "Failed to fetch logs",
       "copyFailed": "Failed to copy log entry",
       "copyLogEntry": "Copy log entry"
-    }
+    },
+    "compressionLogTitle": "__MISSING__:Compression Log",
+    "compressionLogEmpty": "__MISSING__:No compressed requests yet. Compression stats will appear here when requests are processed with compression enabled.",
+    "tokens": "__MISSING__:tokens"
   },
   "onboarding": {
     "welcome": "Welcome",
+    "tiers": "__MISSING__:Tiers",
     "security": "Security",
     "test": "Test",
     "ready": "Ready!",
@@ -3616,6 +3884,7 @@
   },
   "providers": {
     "title": "Providers",
+    "Account Deactivated": "__MISSING__:Account Deactivated",
     "allProviders": "सर्व प्रदाते",
     "audioProviders": "ऑडिओ प्रदाता",
     "showFreeOnly": "फक्त मोफत",
@@ -3623,6 +3892,33 @@
     "addFirstProvider": "तुमचा पहिला प्रदाता जोडा",
     "addFirstProviderDesc": "OmniRoute द्वारे विनंती राउटिंग सुरू करण्यासाठी AI प्रदात्याशी कनेक्ट करा. तुम्ही मोफत प्रदाता, API की किंवा OAuth खाती वापरू शकता.",
     "learnMore": "अधिक जाणून घ्या",
+    "adaptaTutorial": {
+      "title": "__MISSING__:How to connect Adapta Web",
+      "introPrefix": "__MISSING__:Adapta authenticates through Clerk. The token",
+      "introSuffix": "__MISSING__:is a long-lived JWT that lets OmniRoute refresh sessions automatically.",
+      "or": "__MISSING__:or",
+      "step1Title": "__MISSING__:Open Adapta chat",
+      "step1DescPrefix": "__MISSING__:Open",
+      "step1DescSuffix": "__MISSING__:and sign in with your Gold or Business account.",
+      "step2Title": "__MISSING__:Open DevTools",
+      "step2DescPrefix": "__MISSING__:Press",
+      "step2DescSuffix": "__MISSING__:to open Developer Tools.",
+      "step3Title": "__MISSING__:Go to Application → Cookies",
+      "step3DescPrefix": "__MISSING__:In the",
+      "step3DescMiddle": "__MISSING__:expand",
+      "step3DescSuffix": "__MISSING__:and click",
+      "step4Title": "__MISSING__:Copy the cookie value for",
+      "step4DescPrefix": "__MISSING__:Find the cookie named",
+      "step4DescMiddle": "__MISSING__:in the list. Click it and copy the content from the",
+      "step4DescSuffix": "__MISSING__:column. It starts with",
+      "step5Title": "__MISSING__:Paste it here and save",
+      "step5DescPrefix": "__MISSING__:Click",
+      "step5DescMiddle": "__MISSING__:paste the",
+      "step5DescSuffix": "__MISSING__:value into the API Key field, then save. OmniRoute will refresh the session automatically.",
+      "tipLabel": "__MISSING__:Tip:",
+      "tipPrefix": "__MISSING__:The",
+      "tipSuffix": "__MISSING__:cookie is long-lived, usually for months. You only need to renew it if you sign out or Adapta invalidates the session."
+    },
     "editProvider": "Edit Provider",
     "deleteProvider": "Delete Provider",
     "noProviders": "No providers configured",
@@ -3648,13 +3944,38 @@
     "apiKeyProviders": "API Key Providers",
     "compatibleProviders": "API Key Compatible Providers",
     "testAll": "Test All",
+    "distributeProxies": "__MISSING__:Distribute Proxies",
+    "distributing": "__MISSING__:Distributing...",
+    "selectedCount": "__MISSING__:{count, plural, one {# selected} other {# selected}}",
+    "accountsCount": "__MISSING__:{count, plural, one {# account} other {# accounts}}",
     "testAllOAuth": "Test all OAuth connections",
     "testAllFree": "Test all Free connections",
     "testAllApiKey": "Test all API Key connections",
     "testAllCompatible": "Test all Compatible connections",
+    "testAllModels": "__MISSING__:Test all models",
+    "testAllModelsConfirm": "__MISSING__:Test all visible models? Failed models will be hidden if auto-hide is enabled.",
+    "testingAllModels": "__MISSING__:Testing {done}/{total}...",
+    "testAllResults": "__MISSING__:{ok} of {total} models working",
+    "noModelsToTest": "__MISSING__:No models match the current filter",
+    "showAllModels": "__MISSING__:All",
+    "showVisibleOnly": "__MISSING__:Visible only",
+    "freeFilterAll": "__MISSING__:All",
+    "freeFilterFreeOnly": "__MISSING__:Free only",
+    "freeFilterPaidOnly": "__MISSING__:Paid only",
+    "sortFreeFirst": "__MISSING__:Free first",
+    "showHiddenOnly": "__MISSING__:Hidden only",
+    "filterByVisibility": "__MISSING__:Filter by visibility",
+    "autoHideFailed": "__MISSING__:Auto-hide failed models",
+    "autoHideFailedHint": "__MISSING__:When enabled, Test all hides non-transient failures from public catalogs such as /v1/models. Single-model tests never auto-hide.",
     "connected": "{count} Connected",
     "errorCount": "{count} Error ({code})",
     "errorCountNoCode": "{count} Error",
+    "testAllCompleted": "__MISSING__:Tested {total} models: {ok} OK, {failed} failed",
+    "modelAutoHidden": "__MISSING__:Model {model} auto-hidden (test failed)",
+    "filterAll": "__MISSING__:All",
+    "filterVisible": "__MISSING__:Visible only",
+    "filterHidden": "__MISSING__:Hidden only",
+    "modelsHiddenCount": "__MISSING__:{count} hidden",
     "warningCount": "{count} चेतावणी",
     "noConnections": "No connections",
     "expiredBadge": "Expired",
@@ -3764,7 +4085,16 @@
     "batchUpdateNone": "__MISSING__:No connections were updated (they may no longer exist)",
     "batchRetestLimit": "__MISSING__:Retest up to {max} connections at a time",
     "noConnectionsToTest": "__MISSING__:No matching connections to test",
+    "batchDeleteConfirmTitle": "__MISSING__:Delete connections",
+    "batchDeleteConfirmButton": "__MISSING__:Delete",
+    "filterActive": "__MISSING__:Active",
+    "filterError": "__MISSING__:Error",
+    "filterBanned": "__MISSING__:Banned",
+    "filterCreditsExhausted": "__MISSING__:Credits Exhausted",
+    "noFilteredConnections": "__MISSING__:No connections match the current filter.",
     "failedSetAlias": "Failed to set alias",
+    "setAliasSuccess": "__MISSING__:Alias {alias} set",
+    "deleteAliasSuccess": "__MISSING__:Alias {alias} deleted",
     "failedSaveConnection": "Failed to save connection",
     "failedSaveConnectionRetry": "Failed to save connection. Please try again.",
     "failedRetestConnection": "Failed to retest connection",
@@ -3798,6 +4128,9 @@
     "connectionCount": "{count} connection(s)",
     "fetchingModels": "Fetching available models...",
     "failedFetchModels": "Failed to fetch models",
+    "noFreeModelsFound": "__MISSING__:No free models found for this provider — nothing imported.",
+    "fetchModelsSuccess": "__MISSING__:Found {count} new models",
+    "fetchModelsFailed": "__MISSING__:Could not auto-fetch models (you can retry from settings)",
     "noModelsFound": "No models found",
     "importFailed": "Import failed",
     "noNewModelsAdded": "No new models were added.",
@@ -3806,6 +4139,10 @@
     "importingModelsTitle": "Importing Models",
     "copyModel": "Copy model",
     "filterModels": "Filter models...",
+    "testAllRateLimited": "__MISSING__:Rate limit reached, stopped early",
+    "hideFailedAuto": "__MISSING__:Auto-hide failed models",
+    "selectAllModels": "Select all",
+    "hideAllModels": "__MISSING__:Hide all",
     "modelsActive": "Active",
     "showModel": "Show model",
     "hideModel": "Hide model",
@@ -3814,6 +4151,9 @@
     "rateLimitUnprotected": "Unprotected",
     "enableRateLimitProtection": "Click to enable rate limit protection",
     "disableRateLimitProtection": "Click to disable rate limit protection",
+    "testAllProgress": "__MISSING__:Tested {done}/{total}",
+    "testAllFailedHidden": "__MISSING__:{count} failed models hidden",
+    "testAllDone": "__MISSING__:All models tested",
     "productionKey": "Production Key",
     "enterNewApiKey": "Enter new API key",
     "codexApplyModalTitle": "स्थानिक कोडेक्सवर अर्ज करा",
@@ -3889,10 +4229,20 @@
     "errorTypeNetworkError": "Network error",
     "errorTypeTestUnsupported": "Test unsupported",
     "errorTypeUpstreamError": "Upstream error",
+    "errorTypeCreditsExhausted": "__MISSING__:No credits",
+    "errorTypeBanned": "__MISSING__:403 Banned",
     "proxySourceGlobal": "Global",
     "proxySourceProvider": "Provider",
     "proxySourceKey": "Key",
     "proxyConfiguredBySource": "Proxy ({source}): {host}",
+    "proxyOn": "__MISSING__:Proxy On",
+    "proxyOff": "__MISSING__:Direct (bypass proxy)",
+    "proxyEnabledTitle": "__MISSING__:Proxy is enabled for this connection",
+    "proxyDisabledTitle": "__MISSING__:Direct connection — bypasses every proxy (including the global proxy) for this connection",
+    "perKeyProxyOn": "__MISSING__:Per-key",
+    "perKeyProxyOff": "__MISSING__:Connection",
+    "perKeyProxyEnabledTitle": "__MISSING__:Per-key proxy assignment enabled for this provider",
+    "perKeyProxyDisabledTitle": "__MISSING__:Per-key proxy assignment disabled for this provider",
     "autoPriority": "Auto: {priority}",
     "proxy": "Proxy",
     "retestAuthentication": "Retest authentication",
@@ -3920,6 +4270,12 @@
     "compatProtocolOpenAI": "OpenAI Chat Completions",
     "compatProtocolOpenAIResponses": "OpenAI Responses API",
     "compatProtocolClaude": "Anthropic Messages",
+    "targetFormatLabel": "__MISSING__:Target Format",
+    "targetFormatHint": "__MISSING__:Override the upstream wire format. Use 'Anthropic Messages' to route OpenAI-compatible providers (e.g. opencode-go) through the /v1/messages endpoint.",
+    "targetFormatAuto": "__MISSING__:Default (auto)",
+    "targetFormatGemini": "__MISSING__:Gemini",
+    "targetFormatGeminiCli": "__MISSING__:Gemini CLI",
+    "targetFormatAntigravity": "__MISSING__:Antigravity",
     "compatUpstreamHeadersLabel": "Extra upstream headers",
     "compatUpstreamHeadersHint": "High-privilege setting — same trust level as editing provider API credentials; only trusted admins should use it. Merged after OmniRoute adds auth from the provider API key. If a custom header uses the same name as an existing one (e.g. Authorization), your value fully replaces the auto-generated header (including the Bearer token) — the upstream only sees what you typed, not the key from settings. Misconfiguration can cause 401 or broken upstream auth. One row per header (e.g. extra Authentication for some gateways). Hover or focus the value to preview. Saves on blur, outside click, or closing this panel.",
     "compatUpstreamHeaderName": "Header name",
@@ -3929,6 +4285,8 @@
     "compatBadgeUpstreamHeaders": "Headers",
     "perModelQuotaLabel": "Per-Model Quota",
     "perModelQuotaDescription": "When enabled, 429/404 errors only lock the specific model, not the entire connection. Use for providers with per-model rate limits (e.g., ModelScope).",
+    "importFreeModelsOnlyLabel": "__MISSING__:Import only free models",
+    "importFreeModelsOnlyHint": "__MISSING__:When enabled, only this provider's free models are imported. Paid models are skipped.",
     "perModelQuotaToggle": "Per-Model Quota Toggle",
     "modelId": "Model ID",
     "customModelPlaceholder": "e.g. gpt-4.5-turbo",
@@ -3964,7 +4322,6 @@
     "email": "Email",
     "healthCheckMinutes": "Health Check (min)",
     "healthCheckHint": "Proactive token refresh interval. 0 = disabled.",
-    "selectAllModels": "Select all",
     "deselectAllModels": "Deselect all",
     "modelsActiveCount": "{active}/{total} active",
     "noModelsMatch": "No models match \"{filter}\"",
@@ -3976,6 +4333,9 @@
     "editCompatibleTitle": "Edit {type} Compatible",
     "compatibleBaseUrlHint": "Root URL of your {type}-compatible API. Use Advanced Settings for custom endpoint paths.",
     "apiKeyForCheck": "API Key (for Check)",
+    "testModelIdLabel": "__MISSING__:Model ID (optional)",
+    "testModelIdPlaceholder": "__MISSING__:e.g. my-model-id",
+    "testModelIdHint": "__MISSING__:If the provider lacks a /models endpoint, enter a model ID to validate via /chat/completions instead.",
     "compatibleProdPlaceholder": "{type} Compatible (Prod)",
     "tokenRefreshed": "Token refreshed successfully",
     "tokenRefreshFailed": "Token refresh failed",
@@ -4069,6 +4429,19 @@
     "codexAuthApplyFailed": "Failed to apply Codex auth.json locally",
     "codexAuthExported": "Codex auth.json exported",
     "codexAuthExportFailed": "Failed to export Codex auth.json",
+    "codexCliGuideButton": "__MISSING__:Codex CLI Guide",
+    "codexCliGuideTitle": "__MISSING__:Codex CLI Guide",
+    "codexCliGuideLoading": "__MISSING__:Loading guide...",
+    "codexCliGuideLoadFailed": "__MISSING__:Could not load the guide.",
+    "codexExternalLinkButton": "__MISSING__:External Codex link",
+    "codexExternalLinkModalTitle": "__MISSING__:External Codex link",
+    "codexExternalLinkModalDescription": "__MISSING__:Share this single-use link with the person who will authenticate the Codex account. They open it in their own browser, complete the OpenAI login, and the connection is registered here. The link expires in 15 minutes.",
+    "codexExternalLinkGenerating": "__MISSING__:Generating link...",
+    "codexExternalLinkWaiting": "__MISSING__:Waiting for browser authentication. This window refreshes automatically.",
+    "codexExternalLinkCreateFailed": "__MISSING__:Failed to generate the link.",
+    "codexExternalLinkNetworkError": "__MISSING__:Could not contact the server.",
+    "codexExternalLinkConnected": "__MISSING__:Codex account connected through the external link.",
+    "codexExternalLinkExpired": "__MISSING__:The link expired before completion.",
     "importCodexAuth": "आयात प्रमाणीकरण",
     "codexImportModalTitle": "कोडेक्स प्रमाणीकरण आयात करा",
     "codexImportTabSingle": "अविवाहित",
@@ -4146,6 +4519,8 @@
     "t3ChatWebCookiePlaceholder": "convex-session-id=abc123...",
     "blockClaudeExtraUsageDescription": "Block Claude Extra Usage Description",
     "blockClaudeExtraUsageLabel": "Block Claude Extra Usage Label",
+    "disableCoolingDescription": "__MISSING__:Skip the transient cooldown so this connection stays eligible even after recoverable errors (terminal states like banned/expired still apply).",
+    "disableCoolingLabel": "__MISSING__:Disable cooldown for this connection",
     "bulkPasteAdded": "{count, plural, one {1 key added} other {# keys added}}",
     "bulkPasteDuplicatesIgnored": "{count, plural, one {1 duplicate skipped} other {# duplicates skipped}}",
     "bulkPasteHint": "Paste one API key per line. Empty lines are ignored and duplicate keys are skipped.",
@@ -4243,6 +4618,17 @@
     "personalAccessTokenLabel": "Personal Access Token Label",
     "qoderPatHint": "Qoder Pat Hint",
     "qoderPatPlaceholder": "Qoder Pat Placeholder",
+    "rateLimitOverridesSection": "__MISSING__:Rate Limit Overrides",
+    "rateLimitOverridesMaxConcurrentHint": "__MISSING__:Max concurrent requests override for this connection. Overrides the account-level cap.",
+    "rateLimitOverridesMaxConcurrentLabel": "__MISSING__:Max Concurrent (Rate Limit)",
+    "rateLimitOverridesMinTimeHint": "__MISSING__:Minimum time (ms) between requests. Overrides the default rate limiter delay.",
+    "rateLimitOverridesMinTimeLabel": "__MISSING__:Min Interval (ms)",
+    "rateLimitOverridesRpmHint": "__MISSING__:Max requests per minute for this connection. Overrides the provider default.",
+    "rateLimitOverridesRpmLabel": "__MISSING__:RPM (Requests/min)",
+    "rateLimitOverridesTpdHint": "__MISSING__:Max tokens per day for this connection. Overrides the provider default.",
+    "rateLimitOverridesTpdLabel": "__MISSING__:TPD (Tokens/day)",
+    "rateLimitOverridesTpmHint": "__MISSING__:Max tokens per minute for this connection. Overrides the provider default.",
+    "rateLimitOverridesTpmLabel": "__MISSING__:TPM (Tokens/min)",
     "refreshOauthTokenTitle": "Refresh Oauth Token Title",
     "regionHint": "Region Hint",
     "regionLabel": "Region Label",
@@ -4257,6 +4643,7 @@
     "searchProvider": "Search Provider",
     "searchProviderDesc": "Search Provider Desc",
     "searchProviders": "Search Providers",
+    "searchByModel": "__MISSING__:Search by model…",
     "searchProvidersHeading": "Search Providers Heading",
     "searxngBaseUrlHint": "Searxng Base Url Hint",
     "searxngInfo": "Searxng Info",
@@ -4422,7 +4809,21 @@
     "webNoAuthGuideBody": "{provider} ला API की किंवा कुकीची आवश्यकता नाही. विनामूल्य वेब एंडपॉइंट वापरण्यासाठी कनेक्शन जतन करा.",
     "webSessionCredentialValidationFailed": "सत्र क्रेडेंशियल प्रमाणीकरण अयशस्वी झाले. पुन्हा साइन इन करा, नवीन क्रेडेंशियल कॉपी करा आणि पुन्हा प्रयत्न करा.",
     "checkCookie": "कुकी तपासा",
-    "checkWebToken": "टोकन तपासा"
+    "checkWebToken": "टोकन तपासा",
+    "huggingchatLabel": "__MISSING__:HuggingChat (Free)",
+    "huggingchatDesc": "__MISSING__:Free LLM chat via huggingface.co/chat",
+    "phindLabel": "__MISSING__:Phind (Free)",
+    "phindDesc": "__MISSING__:Free dev-focused AI chat",
+    "poeWebLabel": "__MISSING__:Poe Web",
+    "poeWebDesc": "__MISSING__:Multi-model chat via poe.com",
+    "veniceWebLabel": "__MISSING__:Venice Web",
+    "veniceWebDesc": "__MISSING__:Privacy-focused AI chat",
+    "v0VercelWebLabel": "__MISSING__:v0 Vercel Web",
+    "v0VercelWebDesc": "__MISSING__:AI code generation via v0.dev",
+    "kimiWebLabel": "__MISSING__:Kimi Web",
+    "kimiWebDesc": "__MISSING__:Chinese market AI chat via kimi.moonshot.cn",
+    "doubaoWebLabel": "__MISSING__:Doubao Web",
+    "doubaoWebDesc": "__MISSING__:ByteDance AI chat via doubao.com"
   },
   "settings": {
     "title": "Settings",
@@ -4528,6 +4929,7 @@
     "memoryDesc": "Persistent cross-session conversational memory",
     "memoryEnabled": "Enable Memory",
     "memoryEnabledDesc": "When enabled, OmniRoute will inject relevant past context.",
+    "memoryTokenCostWarning": "__MISSING__:Heads up: with memory enabled, OmniRoute injects up to {tokens} tokens of retrieved context into every chat request — this increases token usage and cost. To skip injection for a specific request, send the \"x-omniroute-no-memory: true\" header.",
     "maxTokens": "Max Tokens",
     "retentionDays": "Retention",
     "recent": "Recent",
@@ -4566,6 +4968,15 @@
     "modelsDevInfoOrder": "User Override → models.dev → LiteLLM → Hardcoded Default",
     "systemTheme": "System Theme",
     "debugToggle": "Enable Debug Mode",
+    "homePinProviderQuotaToHome": "Pin Information to Home Page",
+    "homeProviderQuotaLimits": "Provider Quota Limits",
+    "homeProviderQuotaLimitsDesc": "Pin the Provider Quota status container (with Refresh All button) to the top of the Home page.",
+    "homeQuickStart": "Quick Start",
+    "homeQuickStartDesc": "Show the Quick Start panel on the Home page.",
+    "homeProviderTopology": "Provider Topology",
+    "homeProviderTopologyDesc": "Show the Provider Topology on the Home page.",
+    "accountEmailVisibility": "__MISSING__:Account email visibility",
+    "accountEmailVisibilityDesc": "__MISSING__:Show full account emails across providers, combos, logs, quota, and playground screens. Turn this off to mask them by default.",
     "sidebarVisibilityToggle": "Show Sidebar Items",
     "enableCache": "Enable Cache",
     "cacheTTL": "Cache TTL",
@@ -4599,11 +5010,17 @@
     "autoDisableDescription": "Permanently mark provider connections as deactivated if they return specific terminal ban signals (e.g. HTTP 403 'verify your account'). This removes them from the combo rotation.",
     "autoDisableThreshold": "Ban Threshold",
     "autoDisableThresholdDesc": "Consecutive ban signals required before permanent deactivation.",
+    "customBannedSignals": "__MISSING__:Banned Keywords",
+    "customBannedSignalsDesc": "__MISSING__:Additional keywords that trigger permanent account ban detection. Built-in keywords always apply.",
+    "customBannedSignalsPlaceholder": "__MISSING__:e.g. api key revoked",
+    "noCustomBannedSignals": "__MISSING__:No custom keywords. Only built-in keywords are active.",
     "resilienceStructureTitle": "Resilience Structure",
     "resilienceStructureDesc": "हे पृष्ठ फक्त वर्तन कॉन्फिगर करते. थेट ब्रेकर स्थिती आरोग्य पृष्ठावर दर्शविली आहे. कॉम्बो-विशिष्ट पुन्हा प्रयत्न आणि राऊंड-रॉबिन स्लॉट नियंत्रण कॉम्बो सेटिंग्जवर राहतील.",
     "enableThinking": "Enable Thinking",
     "maxThinkingTokens": "Max Thinking Tokens",
     "enableProxy": "Enable Proxy",
+    "perKeyProxyEnabled": "__MISSING__:Enable per-key proxy assignment",
+    "perKeyProxyEnabledDesc": "__MISSING__:When enabled, each provider connection can use its own proxy assignment",
     "proxyUrl": "Proxy URL",
     "pricingRates": "Pricing Rates Format",
     "currentPricing": "Current Pricing Overview",
@@ -4683,6 +5100,13 @@
     "globalProxy": "Global Proxy",
     "globalProxyDesc": "Configure a global outbound proxy for all API calls. Individual providers, combos, and keys can override this.",
     "noGlobalProxy": "No global proxy configured",
+    "proxyPool": "__MISSING__:Proxy Pool",
+    "freePool": "__MISSING__:Free Pool",
+    "proxyDocumentation": "__MISSING__:Proxy Documentation",
+    "proxyGlobalConfigTab": "__MISSING__:Global Config",
+    "proxyPoolTab": "__MISSING__:Proxy Pool",
+    "freePoolTab": "__MISSING__:Free Pool",
+    "proxyDocumentationTab": "__MISSING__:Documentation",
     "bulkHealthcheck": "Bulk Healthcheck",
     "bulkHealthcheckDesc": "Test all configured proxies against a target URL to find which ones work.",
     "healthcheckTesting": "Testing...",
@@ -4695,6 +5119,51 @@
     "healthcheckStatus": "Status",
     "healthcheckProxyUrl": "Proxy URL",
     "healthcheckLatency": "Latency",
+    "proxyDocumentationScopeTitle": "__MISSING__:Proxy scope resolution",
+    "proxyDocumentationScopeDescBefore": "__MISSING__:OmniRoute resolves the outbound proxy in priority order: ",
+    "proxyDocumentationScopeOrder": "__MISSING__:combo → account → provider → global",
+    "proxyDocumentationScopeDescAfter": "__MISSING__:. The most specific scope wins.",
+    "proxyDocumentationAddTitle": "__MISSING__:Adding a custom proxy",
+    "proxyDocumentationAddDescBefore": "__MISSING__:Go to the ",
+    "proxyDocumentationAddDescMiddle": "__MISSING__: tab → click ",
+    "proxyDocumentationAddCta": "__MISSING__:+ Add proxy",
+    "proxyDocumentationAddDescAfter": "__MISSING__:. Fill in type (http/https/socks5), host, and port. Optionally assign it to a scope.",
+    "proxyDocumentationBulkTitle": "__MISSING__:Bulk import format",
+    "proxyDocumentationBulkDesc": "__MISSING__:Pipe-delimited fields:",
+    "proxyDocumentationSocks5DescBefore": "__MISSING__:SOCKS5 proxies are disabled by default. Set",
+    "proxyDocumentationFreePoolDesc": "__MISSING__:The Free Pool tab aggregates proxies from 1proxy, Proxifly, and IPLocate. Use ⊕ to test and promote a proxy to your registry. Only proxies that pass the connectivity test are added.",
+    "proxyDocumentationVercelRelayDescBefore": "__MISSING__:The Vercel Relay is an outbound edge relay — not an inbound tunnel. Deploying one sends LLM API calls through Vercel's dynamic IPs, bypassing datacenter geo-blocks and rate limits. The relay is protected by a generated secret header",
+    "proxyDocumentationVercelRelayDescAfter": "__MISSING__:Your Vercel token is used only during deploy and is never stored.",
+    "vercelRelayTokenRequired": "__MISSING__:Token is required",
+    "vercelRelayDeployFailed": "__MISSING__:Deploy failed",
+    "vercelRelayTokenHint": "__MISSING__:Token is used only during deploy — never stored.",
+    "denoRelayTokenRequired": "__MISSING__:Deno Deploy token is required",
+    "denoRelayOrgDomainRequired": "__MISSING__:Organization domain is required",
+    "denoRelayDeployFailed": "__MISSING__:Deno Deploy failed",
+    "denoRelayTokenHint": "__MISSING__:Organization token (prefix ddo_) from console.deno.com → Organization → Settings → Organization Tokens. Used once for deploy and never stored.",
+    "denoRelayOrgDomainHint": "__MISSING__:Your Deno Deploy organization's default domain (e.g. acme.deno.net). The relay will be reachable at https://<app-name>.<org-slug>.deno.net.",
+    "proxyFreePoolFilterProtocol": "__MISSING__:Filter by protocol",
+    "proxyFreePoolProtocol": "__MISSING__:Protocol",
+    "proxyFreePoolCountryPlaceholder": "__MISSING__:Country (e.g. US)",
+    "proxyFreePoolFilterCountry": "__MISSING__:Filter by country",
+    "proxyFreePoolMinQualityPlaceholder": "__MISSING__:Min quality",
+    "proxyFreePoolMinQualityLabel": "__MISSING__:Minimum quality score",
+    "proxyFreePoolSyncAll": "__MISSING__:Sync All",
+    "proxyFreePoolTotal": "__MISSING__:Total",
+    "proxyFreePoolInPool": "__MISSING__:In pool",
+    "proxyFreePoolAvgQuality": "__MISSING__:Avg quality",
+    "proxyFreePoolSelected": "__MISSING__:{count} selected",
+    "proxyFreePoolAddSelected": "__MISSING__:Add selected to pool",
+    "proxyFreePoolAddVisible": "__MISSING__:Add all visible to pool",
+    "proxyFreePoolSource": "__MISSING__:Source",
+    "proxyFreePoolHostPort": "__MISSING__:Host:Port",
+    "proxyFreePoolType": "__MISSING__:Type",
+    "proxyFreePoolCountry": "__MISSING__:Country",
+    "proxyFreePoolQuality": "__MISSING__:Quality",
+    "proxyFreePoolLatency": "__MISSING__:Latency",
+    "proxyFreePoolEmpty": "__MISSING__:No proxies found. Click Sync All to fetch from sources.",
+    "close": "__MISSING__:Close",
+    "cancel": "__MISSING__:Cancel",
     "globalLabel": "Global",
     "configure": "Configure",
     "globalSystemPrompt": "Global System Prompt",
@@ -4951,6 +5420,7 @@
     "systemStorage": "System & Storage",
     "allDataLocal": "All data stored locally on your machine",
     "databasePath": "Database Path",
+    "export": "__MISSING__:Export",
     "exportDatabase": "Export Database",
     "exportAll": "Export All (.tar.gz)",
     "importDatabase": "Import Database",
@@ -5038,6 +5508,11 @@
     "adaptiveVolumeRoutingDesc": "Scale connections dynamically based on payload volume and throughput pressure.",
     "lkgpToggleTitle": "Last Known Good Provider (LKGP)",
     "lkgpToggleDesc": "When enabled, the router remembers which provider last served a successful response and tries it first on subsequent requests.",
+    "echoRequestedModelTitle": "__MISSING__:Echo requested model name in responses",
+    "echoRequestedModelDesc": "__MISSING__:When enabled, the response `model` field echoes the alias or combo name the client requested instead of the upstream model name. Fixes strict clients (e.g. Claude Desktop) that reject a response whose model does not match the request.",
+    "webSearchRouteTitle": "__MISSING__:Web search routing",
+    "webSearchRouteDesc": "__MISSING__:When a request includes a native web_search tool, route the whole request to this model instead of the default — useful for providers that don't implement Anthropic's web_search server tool. Leave blank to disable.",
+    "webSearchRoutePlaceholder": "__MISSING__:e.g. openrouter,anthropic/claude-3.5-sonnet",
     "clearLkgpCache": "Clear LKGP Cache",
     "lkgpCacheCleared": "LKGP cache cleared successfully",
     "lkgpCacheClearFailed": "Failed to clear LKGP cache",
@@ -5102,6 +5577,16 @@
     "clearSyncedPricing": "Clear Synced Pricing",
     "compressionTitle": "Prompt Compression",
     "compressionDesc": "Reduce token usage by compressing prompts before sending to providers",
+    "tokenSaverTitle": "__MISSING__:Token Saver",
+    "tokenSaverSubtitle": "__MISSING__:Spend fewer tokens on every request.",
+    "tokenSaverToolOutput": "__MISSING__:Tool output",
+    "tokenSaverToolOutputDesc": "__MISSING__:Clean git, grep, ls, tree, and log output before it reaches the provider.",
+    "tokenSaverLlmOutput": "__MISSING__:LLM output",
+    "tokenSaverLlmOutputDesc": "__MISSING__:Inject terse response instructions without rewriting provider output.",
+    "tokenSaverInputCompression": "__MISSING__:Input compression",
+    "tokenSaverInputCompressionDesc": "__MISSING__:Rewrite eligible chat history while preserving code, URLs, and intent.",
+    "tokenSaverFineTunePrefix": "__MISSING__:Fine-tune each engine on",
+    "tokenSaverFineTuneSuffix": "__MISSING__:or combine engines per request on",
     "compressionMode": "Compression Mode",
     "compressionModeOff": "Off",
     "compressionModeOffDesc": "No compression applied",
@@ -5121,6 +5606,11 @@
     "compressionUltraMinScore": "किमान स्कोअर थ्रेशोल्ड",
     "compressionUltraSlmFallback": "आक्रमक कडे फॉलबॅक",
     "compressionUltraModelPath": "SLM मॉडेल पथ",
+    "compressionUltraEngine": "__MISSING__:Ultra tier",
+    "compressionUltraEngineHeuristic": "__MISSING__:Heuristic (Tier-A, default)",
+    "compressionUltraEngineSlm": "__MISSING__:SLM (LLMLingua-2, opt-in)",
+    "compressionUltraSlmHint": "__MISSING__:SLM downloads a small ONNX model on first use (cold-start) and transparently falls back to the heuristic on timeout or if unavailable.",
+    "compressionUltraSlmPrewarm": "__MISSING__:Pre-warm SLM model on enable",
     "compressionSummarizerEnabled": "सारांश सक्षम करा",
     "compressionMaxTokensPerMessage": "प्रति संदेश कमाल टोकन",
     "compressionMinSavings": "किमान बचत थ्रेशोल्ड",
@@ -5308,13 +5798,22 @@
     "resilienceNo": "नाही",
     "resilienceDefault": "Default",
     "storageDatabaseBackupRetention": "डेटाबेस बॅकअप धारणा",
+    "storageDatabaseBackups": "__MISSING__:Database backups",
     "storagePurgeData": "डेटा शुद्ध करा",
+    "storagePurgeDataDesc": "__MISSING__:Immediately delete all records without applying retention checks. Use with caution.",
+    "storageRetentionCleanup": "__MISSING__:Retention Settings",
+    "storageRetentionCleanupDesc": "__MISSING__:Configure operational record retention and database backup cleanup.",
+    "retentionCallDays": "__MISSING__:Call {count}d",
+    "retentionAppDays": "__MISSING__:App {count}d",
+    "retentionRows": "__MISSING__:{count} rows",
     "retentionQuotaSnapshots": "कोटा स्नॅपशॉट (दिवस)",
+    "retentionCompressionAnalytics": "__MISSING__:Compression Analytics (days)",
     "retentionMcpAudit": "MCP ऑडिट (दिवस)",
     "retentionA2aEvents": "A2A कार्यक्रम (दिवस)",
     "retentionCallLogs": "कॉल लॉग (दिवस)",
     "retentionUsageHistory": "वापर इतिहास (दिवस)",
     "retentionMemoryEntries": "मेमरी एंट्री (दिवस)",
+    "saveRetentionSettings": "__MISSING__:Save retention settings",
     "storageAutoVacuumMode": "ऑटो व्हॅक्यूम मोड",
     "storageScheduledVacuum": "अनुसूचित व्हॅक्यूम",
     "storageVacuumHour": "व्हॅक्यूम तास (0-23)",
@@ -5328,10 +5827,16 @@
     "storageIntegrityOk": "✓ ठीक आहे",
     "storageIntegrityError": "✗ त्रुटी",
     "storageUsageTokenBuffer": "वापर टोकन बफर",
+    "storageUsageTokenBufferDesc": "__MISSING__:Extra tokens added to reported usage to account for system prompt overhead.",
+    "storageUsageTokenBufferHint": "__MISSING__:Set to 0 to report raw provider token counts. Default: 2000.",
+    "storageUsageTokenBufferCurrent": "__MISSING__:Current: {value}",
     "compressionSettingsAutoTriggerMode": "ऑटो ट्रिगर मोड",
     "compressionSettingsMcpDescriptionCompression": "MCP वर्णन कॉम्प्रेशन",
+    "mcpAccessibilityTitle": "__MISSING__:MCP accessibility output",
     "compressionSettingsCavemanIntensity": "केव्हमनची तीव्रता",
     "compressionSettingsCavemanOutputMode": "केव्हमॅन आउटपुट मोड",
+    "compressionSettingsOutputStyles": "__MISSING__:Output styles",
+    "compressionStylesTileTitle": "__MISSING__:Output styles",
     "compressionSettingsOutputIntensity": "आउटपुट तीव्रता",
     "compressionSettingsAutoClarityBypass": "स्वयं स्पष्टता बायपास",
     "resilienceWaitForCooldown": "कूलडाउनची प्रतीक्षा करा",
@@ -5347,6 +5852,9 @@
     "cliproxyapiUrl": "CLIProxyAPI URL",
     "cliproxyapiStatus": "CLIProxyAPI स्थिती",
     "cliproxyapiNotDetected": "आढळले नाही",
+    "cliproxyapiImportAuthTitle": "__MISSING__:Import accounts from CLIProxyAPI",
+    "cliproxyapiImportAuthDesc": "__MISSING__:Import the OAuth accounts CLIProxyAPI already saved in ~/.cli-proxy-api/ as OmniRoute connections, so you don't have to log in to each account again. Supported account types (Gemini, Codex, Claude, Antigravity, Qwen, Kimi) are imported; others are skipped.",
+    "cliproxyapiImportAuthButton": "__MISSING__:Import accounts",
     "payloadRulesTitle": "पेलोड नियम",
     "payloadRulesDesc": "__MISSING__:Configure request payload mutations by model and protocol. Changes are persisted in settings and hot reloaded into the runtime immediately after save.",
     "payloadRuleDefaultTitle": "__MISSING__:default",
@@ -5379,6 +5887,14 @@
     "maxResponseTokensDesc": "__MISSING__:Maximum total tokens allowed in a single response.",
     "modelCooldownsTitle": "कूलडाउनमधील मॉडेल",
     "modelCooldownsEmpty": "सध्या कूलडाउनमध्ये कोणतेही मॉडेल नाहीत.",
+    "responsesStateTitle": "__MISSING__:Responses State",
+    "responsesStateDesc": "__MISSING__:Control how OmniRoute forwards previous_response_id.",
+    "responsesStateModeLabel": "__MISSING__:previous_response_id handling",
+    "responsesStateModeAuto": "__MISSING__:Auto",
+    "responsesStateModeStrip": "__MISSING__:Strip",
+    "responsesStateModePreserve": "__MISSING__:Preserve",
+    "responsesStateHint": "__MISSING__:Auto strips previous_response_id unless a connection explicitly enables OpenAI Responses storage. Strip is safest for stateless clients such as VS Code Custom Endpoint; context then depends on the client sending full history.",
+    "responsesStateSaveError": "__MISSING__:Failed to update Responses state setting",
     "codexFastTierTitle": "कोडेक्स फास्ट टियर",
     "codexFastTierDesc": "OpenAI कोडेक्स विनंत्यांसाठी जागतिक स्तरावर service_tier=प्राधान्य इंजेक्ट करा.",
     "codexFastTierHint": "सक्षम केल्यावर, OmniRoute आधीपासून टियर निर्दिष्ट करत नसलेल्या कनेक्शनसाठी आउटबाउंड कोडेक्स विनंत्यांना service_tier=priority जोडते. प्राधान्य श्रेणीसाठी OpenAI Enterprise API की किंवा ChatGPT-auth Codex पथ आवश्यक आहे; इतर प्रमुख प्रकारांना OpenAI कडून टियर-संबंधित त्रुटी प्राप्त होईल. कोडेक्स प्रदाता पृष्ठावरील प्रति-कनेक्शन सेटिंग्ज प्राधान्य घेतात.",
@@ -5485,6 +6001,15 @@
     "resilienceEnableServerWaitDesc": "सक्षम केल्यावर, OmniRoute प्रथम कूलडाउन कालबाह्य होण्याची प्रतीक्षा करते आणि स्वयंचलितपणे पुन्हा प्रयत्न करते.",
     "resilienceMaxAttempts": "जास्तीत जास्त प्रयत्न",
     "resilienceMaxWaitPerAttempt": "प्रति प्रयत्न कमाल प्रतीक्षा",
+    "resilienceProviderCooldownTitle": "__MISSING__:Provider Cooldown",
+    "resilienceProviderCooldownScope": "__MISSING__:All combo requests",
+    "resilienceProviderCooldownTrigger": "__MISSING__:When a provider/connection fails",
+    "resilienceProviderCooldownEffect": "__MISSING__:Skips the failed provider for a cooldown period before retrying",
+    "resilienceProviderCooldownDesc": "__MISSING__:Prevents subsequent requests from re-walking the same failing providers. Cooldown scales exponentially with consecutive failures.",
+    "resilienceProviderCooldownEnabled": "__MISSING__:Enable global provider cooldown",
+    "resilienceProviderCooldownEnabledDesc": "__MISSING__:When enabled, failed providers are tracked globally and skipped for a cooldown period.",
+    "resilienceProviderCooldownMin": "__MISSING__:Minimum cooldown",
+    "resilienceProviderCooldownMax": "__MISSING__:Maximum cooldown",
     "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
     "forcedFingerprintBadge": "Required",
     "codexSessionAffinityTitle": "कोडेक्स सत्र आत्मीयता",
@@ -5506,13 +6031,45 @@
     "vercelRelayFreeTierNote": "__MISSING__:Relays are lightweight proxy endpoints deployed on Vercel's free tier to bypass local network/region limitations.",
     "vercelRelayDeploying": "__MISSING__:Deploying...",
     "vercelRelayDeploy": "__MISSING__:Deploy",
-    "homePinProviderQuotaToHome": "Pin Information to Home Page",
-    "homeProviderQuotaLimits": "Provider Quota Limits",
-    "homeProviderQuotaLimitsDesc": "Pin the Provider Quota status container (with Refresh All button) to the top of the Home page.",
-    "homeQuickStart": "Quick Start",
-    "homeQuickStartDesc": "Show the Quick Start panel on the Home page.",
-    "homeProviderTopology": "Provider Topology",
-    "homeProviderTopologyDesc": "Show the Provider Topology on the Home page."
+    "deployRelayButton": "__MISSING__:Deploy Relay",
+    "denoRelayButton": "__MISSING__:Deploy Deno Relay",
+    "denoRelayModalTitle": "__MISSING__:Deploy Deno Relay",
+    "denoRelayWarning": "__MISSING__:Warning: A Deno Deploy organization token is required. This token will only be used to create the relay app and will never be stored by OmniRoute.",
+    "denoRelayTokenLabel": "__MISSING__:Deno Deploy Organization Token",
+    "denoRelayOrgDomainLabel": "__MISSING__:Organization Domain",
+    "denoRelayProjectNameLabel": "__MISSING__:Deno App Name",
+    "denoRelayFreeTierNote": "__MISSING__:Deno Deploy v2 runs on a global edge network. Free tier: 1M requests & 100GiB outbound traffic per month, no per-request CPU limits, up to 20 active apps & 50 custom domains.",
+    "denoRelayDeploying": "__MISSING__:Deploying...",
+    "denoRelayDeploy": "__MISSING__:Deploy",
+    "cloudflareRelaySuccess": "__MISSING__:Cloudflare Relay deployed successfully",
+    "cloudflareRelayButton": "__MISSING__:Deploy Cloudflare Relay",
+    "cloudflareRelayModalTitle": "__MISSING__:Deploy Cloudflare Worker Relay",
+    "cloudflareRelayWarning": "__MISSING__:Deploys a Cloudflare Worker that proxies LLM requests through Cloudflare's edge network — masking the host IP behind dynamic Cloudflare addresses. The Worker enforces a one-time auth secret so the public workers.dev URL cannot be reused as an open relay.",
+    "cloudflareRelayTokenHowto": "__MISSING__:Create the API token under My Profile -> API Tokens -> Create Token -> Custom Token -> Account / Workers Scripts / Edit.",
+    "cloudflareRelayAccountIdLabel": "__MISSING__:Cloudflare Account ID",
+    "cloudflareRelayAccountIdHint": "__MISSING__:Found on the right side of the Cloudflare dashboard overview page.",
+    "cloudflareRelayApiTokenLabel": "__MISSING__:Cloudflare API Token",
+    "cloudflareRelayApiTokenHint": "__MISSING__:Requires 'Workers Scripts: Edit' permission. The token is used only at deploy time and is never stored.",
+    "cloudflareRelayProjectNameLabel": "__MISSING__:Worker Name",
+    "cloudflareRelayFreeTierNote": "__MISSING__:Free tier: 100,000 requests/day per Cloudflare account.",
+    "cloudflareRelayDeploying": "__MISSING__:Deploying...",
+    "cloudflareRelayDeploy": "__MISSING__:Deploy",
+    "cloudflareRelayCredsRequired": "__MISSING__:Account ID and API Token are required",
+    "cloudflareRelayDeployFailed": "__MISSING__:Deploy failed",
+    "modelLockout": "__MISSING__:Model Lockout",
+    "modelLockoutPageDescription": "__MISSING__:Configure which HTTP error codes trigger per-model lockout and control the cooldown behavior.",
+    "modelLockoutEnabled": "__MISSING__:Enable Model Lockout",
+    "modelLockoutEnabledDescription": "__MISSING__:When enabled, models that fail with configured error codes are temporarily locked to prevent retry loops.",
+    "modelLockoutErrorCodes": "__MISSING__:Error Codes",
+    "modelLockoutErrorCodesDescription": "__MISSING__:HTTP status codes that trigger model lockout. Type a code and click Add, or select from suggestions.",
+    "modelLockoutBaseCooldown": "__MISSING__:Base Cooldown (ms)",
+    "modelLockoutBaseCooldownDescription": "__MISSING__:Initial cooldown duration in milliseconds before a model can be retried.",
+    "modelLockoutMaxCooldown": "__MISSING__:Max Cooldown (ms)",
+    "modelLockoutMaxCooldownDescription": "__MISSING__:Maximum cooldown duration in milliseconds. Prevents excessively long lockouts.",
+    "modelLockoutExponentialBackoff": "__MISSING__:Exponential Backoff",
+    "modelLockoutExponentialBackoffDescription": "__MISSING__:When enabled, each consecutive failure increases the cooldown duration exponentially.",
+    "modelLockoutMaxBackoffSteps": "__MISSING__:Max Backoff Steps",
+    "modelLockoutMaxBackoffStepsDescription": "__MISSING__:Maximum number of backoff steps before the cooldown stops growing. The Max Cooldown cap is reached first in most configurations, making this a safety ceiling for when Max Cooldown is raised."
   },
   "contextRtk": {
     "title": "RTK Engine",
@@ -5563,7 +6120,21 @@
     "searchFilters": "फिल्टर शोधा...",
     "tooltipDedup": "वारंवार ओळी काढण्यासाठी किती आक्रमकपणे.",
     "tooltipMaxChars": "प्रति आउटपुट ब्लॉक कमाल वर्ण.",
-    "tooltipMaxLines": "कमांड आउटपुटमधून ठेवण्यासाठी कमाल रेषा. जादा कापला जातो."
+    "tooltipMaxLines": "कमांड आउटपुटमधून ठेवण्यासाठी कमाल रेषा. जादा कापला जातो.",
+    "learnDiscoverTitle": "__MISSING__:Learn & Discover filters",
+    "learnDiscoverDesc": "__MISSING__:Mine your captured command output (Raw Output retention must be on) to suggest new RTK filters. Suggestions only — you review and save them.",
+    "discoverHeading": "__MISSING__:Discover repeated noise",
+    "discoverButton": "__MISSING__:Scan samples",
+    "discoverScanning": "__MISSING__:Scanning…",
+    "discoverEmpty": "__MISSING__:No repeated noise found. Enable Raw Output retention and run a few commands first.",
+    "discoverSamples": "__MISSING__:{count} sample(s) scanned",
+    "discoverHits": "__MISSING__:{hits}× across samples",
+    "learnHeading": "__MISSING__:Learn a filter for a command",
+    "learnCommandPlaceholder": "__MISSING__:e.g. npm install",
+    "learnButton": "__MISSING__:Suggest filter",
+    "learnEmpty": "__MISSING__:No suggestion yet. Type a command you have run and scan.",
+    "learnSamplesUsed": "__MISSING__:Learned from {count} matching sample(s)",
+    "suggestionError": "__MISSING__:Could not load suggestions. Check management auth and try again."
   },
   "contextCombos": {
     "title": "Compression Combos",
@@ -5853,7 +6424,80 @@
     "routeConnectionLabel": "जोडणी",
     "scenarioVision": "दृष्टी (प्रतिमा समजणे)",
     "scenarioSchemaCoercion": "स्कीमा जबरदस्ती (संरचित आउटपुट)",
-    "techniques": "तंत्र:"
+    "techniques": "तंत्र:",
+    "friendlyTitle": "__MISSING__:Translator",
+    "friendlySubtitle": "__MISSING__:Use your existing app with any provider — without rewriting code.",
+    "conceptHeadline": "__MISSING__:Your app speaks one API's \"language\". The Translator converts it to use another provider.",
+    "conceptDiagramAppLabel": "__MISSING__:Your app",
+    "conceptDiagramSourceLabel": "__MISSING__:Source format",
+    "conceptDiagramHubLabel": "__MISSING__:OpenAI (hub)",
+    "conceptDiagramTargetLabel": "__MISSING__:Target provider",
+    "conceptDiagramExampleApp": "__MISSING__:e.g. Anthropic SDK",
+    "conceptDiagramExampleSource": "__MISSING__:claude",
+    "conceptDiagramExampleTarget": "__MISSING__:Gemini",
+    "conceptHowItWorksToggle": "__MISSING__:How it works",
+    "conceptHowItWorksBody": "__MISSING__:Your app sends a request in its own format. The Translator detects the format, converts it through OpenAI as an intermediate hub (or directly when a direct translator is available), sends it to the chosen provider, and returns the response converted back to your app's format.",
+    "tabTranslate": "__MISSING__:Translate",
+    "tabMonitor": "__MISSING__:Monitor",
+    "tabTranslateAriaLabel": "__MISSING__:Go to the Translate tab",
+    "tabMonitorAriaLabel": "__MISSING__:Go to the Monitor tab",
+    "simpleAppUsesLabel": "__MISSING__:My app uses",
+    "simpleAppUsesHint": "__MISSING__:The API format your app speaks (e.g. Anthropic SDK = claude).",
+    "simpleSendToLabel": "__MISSING__:Send to",
+    "simpleSendToHint": "__MISSING__:Where to actually send the request (a provider connected in OmniRoute).",
+    "simpleStartWithLabel": "__MISSING__:Start with",
+    "simpleStartWithExamplePlaceholder": "__MISSING__:Select a ready-made example",
+    "simpleStartWithCustomOption": "__MISSING__:Paste your request (advanced)",
+    "simpleModeLabel": "__MISSING__:Mode",
+    "simpleModePreview": "__MISSING__:Preview translation only",
+    "simpleModeSend": "__MISSING__:Send and see response",
+    "simpleAdvancedToggle": "__MISSING__:Advanced",
+    "simpleInputPanelTitle": "__MISSING__:Input",
+    "simpleInputPanelHint": "__MISSING__:Free-text message or ready-made example",
+    "simpleResultPanelTitle": "__MISSING__:Translation + Response",
+    "narratedDetected": "__MISSING__:✓ Detected: {format}",
+    "narratedTranslating": "__MISSING__:Translating to {target}...",
+    "narratedSending": "__MISSING__:Sending to {target}...",
+    "narratedSuccess": "__MISSING__:→ translated to {target} · response in {latency}ms",
+    "narratedError": "__MISSING__:Failed: {reason}",
+    "narratedSeeTranslatedJson": "__MISSING__:see translated JSON",
+    "narratedSeePipeline": "__MISSING__:see pipeline",
+    "advancedSectionTitle": "__MISSING__:Advanced",
+    "advancedSectionSubtitle": "__MISSING__:Raw JSON, pipeline and technical tools. Everything here is the same as the old tabs — just reorganized.",
+    "advancedRawJsonTitle": "__MISSING__:Raw JSON (auto-detect + Monaco)",
+    "advancedRawJsonSubtitle": "__MISSING__:Paste a JSON request; the format is detected automatically.",
+    "advancedPipelineTitle": "__MISSING__:OpenAI intermediate pipeline",
+    "advancedPipelineSubtitle": "__MISSING__:Visualize each translation step (hub-and-spoke).",
+    "advancedStreamTransformTitle": "__MISSING__:Stream Transformer (Chat → Responses SSE)",
+    "advancedStreamTransformSubtitle": "__MISSING__:Converts Chat Completions SSE into Responses API.",
+    "advancedTestBenchTitle": "__MISSING__:Test Bench (8 scenarios)",
+    "advancedTestBenchSubtitle": "__MISSING__:Runs all scenarios and reports pass/fail + compatibility %.",
+    "advancedCompressionTitle": "__MISSING__:Compression Preview",
+    "advancedCompressionSubtitle": "__MISSING__:Estimate token savings across different compression modes.",
+    "monitorOriginHint": "__MISSING__:Events generated by Translate or the main pipeline appear here in real time.",
+    "monitorEmptyCta": "__MISSING__:Go to the Translate tab and send a request — it will appear here.",
+    "monitorOpenTranslateButton": "__MISSING__:Go to Translate",
+    "pipelineStepClientRequest": "__MISSING__:Client Request",
+    "pipelineStepClientRequestDesc": "__MISSING__:Request received in client format",
+    "pipelineStepFormatDetected": "__MISSING__:Format Detected",
+    "pipelineStepFormatDetectedDesc": "__MISSING__:Auto-detected source format",
+    "pipelineStepOpenAIIntermediate": "__MISSING__:OpenAI Intermediate",
+    "pipelineStepOpenAIIntermediateDesc": "__MISSING__:Translated to OpenAI hub format",
+    "pipelineStepProviderFormat": "__MISSING__:Provider Format",
+    "pipelineStepProviderFormatDesc": "__MISSING__:Translated to provider target format",
+    "pipelineStepProviderResponse": "__MISSING__:Provider Response",
+    "pipelineStepProviderResponseDesc": "__MISSING__:Streaming response from provider",
+    "conceptDiagramArrow1": "__MISSING__:speaks",
+    "conceptDiagramArrow2": "__MISSING__:translates",
+    "conceptDiagramArrow3": "__MISSING__:converts",
+    "conceptDiagramExampleHub": "__MISSING__:OpenAI",
+    "conceptDiagramHubTooltip": "__MISSING__:Intermediate hub used by the translator to convert between formats that don't have a direct mapping.",
+    "conceptDiagramSourceTooltip": "__MISSING__:The API format your app speaks (e.g., Anthropic SDK = claude).",
+    "conceptDiagramTargetTooltip": "__MISSING__:The provider where the request will actually be sent.",
+    "compressionEmptyHint": "__MISSING__:Fill in the input field on the Translate tab (Simple Controls or Raw JSON) to enable the preview.",
+    "compressionModeLabel": "__MISSING__:Compression mode",
+    "compressionPreviewButton": "__MISSING__:Preview Compression",
+    "compressionPreviewing": "__MISSING__:Previewing…"
   },
   "usage": {
     "title": "Usage",
@@ -6010,6 +6654,8 @@
     "notApplicable": "N/A",
     "rawPlanWithValue": "Raw plan: {plan}",
     "noPlanFromProvider": "No plan from provider",
+    "tokenExpiresIn": "__MISSING__:Token expires in {time}",
+    "tokenExpired": "__MISSING__:Token expired",
     "noQuotaData": "No quota data",
     "cardExpand": "__MISSING__:Expand",
     "cardCollapse": "__MISSING__:Collapse",
@@ -6159,6 +6805,11 @@
     "quotaCutoffsButtonDefault": "डीफॉल्ट",
     "quotaCutoffsButtonHelp": "या खात्यासाठी किमान उर्वरित कोटा कटऑफ संपादित करा.",
     "quotaCutoffsButtonDisabled": "या खात्यासाठी अद्याप कोणतीही कोटा विंडो उपलब्ध नाही.",
+    "deactivateAccount": "__MISSING__:Deactivate account (stop routing)",
+    "activateAccount": "__MISSING__:Activate account (resume routing)",
+    "accountActivated": "__MISSING__:Account activated",
+    "accountDeactivated": "__MISSING__:Account deactivated",
+    "toggleActiveFailed": "__MISSING__:Failed to update account status",
     "quotaCutoffsTitle": "{name} ({provider}) साठी कोटा कटऑफ",
     "quotaCutoffsExplainer": "जेथे हे खाते प्रत्येक कोटा विंडोसाठी निवडणे थांबवते तेथे किमान उर्वरित कोटा टक्केवारी ओव्हरराइड करा. प्रदाता डीफॉल्ट इनहेरिट करण्यासाठी रिक्त सोडा.",
     "quotaCutoffsDefaultHint": "डीफॉल्ट मिनिटे शिल्लक: {default}%",
@@ -6179,6 +6830,7 @@
     "budgetColDailyLim": "दैनिक लिम",
     "budgetColMonthlyLim": "मासिक लिम",
     "budgetColUsedPct": "वापरलेले %",
+    "percentUsed": "__MISSING__:{pct}% used",
     "budgetLoading": "लोड करत आहे...",
     "budgetNoKeysMatch": "कोणत्याही की फिल्टरशी जुळत नाहीत",
     "budgetLinearExtrapolation": "रेखीय एक्सट्रापोलेशन",
@@ -7124,6 +7776,11 @@
     "modalEditTitle": "Edit Proxy",
     "labelName": "Name",
     "labelType": "Type",
+    "labelFamily": "__MISSING__:IP family",
+    "familyAuto": "__MISSING__:Auto (dual-stack)",
+    "familyIpv4": "__MISSING__:IPv4 only",
+    "familyIpv6": "__MISSING__:IPv6 only",
+    "familyHint": "__MISSING__:Egress address family. Auto keeps dual-stack; IPv4/IPv6 pin this proxy to that family (prevents a v4 leak under an IPv6-only proxy).",
     "labelHost": "Host",
     "labelPort": "Port",
     "labelUsername": "Username",
@@ -7266,7 +7923,16 @@
     "improveConfirm": "Improve",
     "exportCode": "Export code",
     "exportCodeTitle": "Export Code",
+    "exportShort": "__MISSING__:Export",
     "noStateToExport": "No playground state available to export.",
+    "closeExportModal": "__MISSING__:Close export modal",
+    "close": "__MISSING__:Close",
+    "exportRealKeyWarning": "__MISSING__:Security warning: export blocked — a real API key was detected in the output. Please reset your API key and try again.",
+    "placeholderHintPrefix": "__MISSING__:Replace",
+    "placeholderHintSuffix": "__MISSING__:with your actual API key, or set it as an environment variable.",
+    "copyLangCode": "__MISSING__:Copy {language} code",
+    "loadingPresets": "__MISSING__:Loading…",
+    "loadPresetPlaceholder": "__MISSING__:Load preset…",
     "copyCode": "Copy",
     "copiedCode": "Copied!",
     "addModel": "+ Add model",
@@ -7291,7 +7957,27 @@
     "invalidJson": "Invalid JSON",
     "running": "Running…",
     "runLabel": "Run",
-    "enterToolResult": "Enter tool result…"
+    "enterToolResult": "Enter tool result…",
+    "build": {
+      "step1Label": "__MISSING__:What to test?",
+      "step2Label": "__MISSING__:Configure",
+      "step3Label": "__MISSING__:Run",
+      "step1Title": "__MISSING__:What do you want to test?",
+      "step1Subtitle": "__MISSING__:Choose the capability you want to explore in this session.",
+      "step2Title": "__MISSING__:Configure",
+      "step2Subtitle": "__MISSING__:Set up the tools or JSON schema that will be used in the request.",
+      "step3Title": "__MISSING__:Run",
+      "modeToolsTitle": "__MISSING__:Tools",
+      "modeToolsDesc": "__MISSING__:Test function calling — define tools and see how the model invokes them.",
+      "modeJsonTitle": "__MISSING__:JSON",
+      "modeJsonDesc": "__MISSING__:Test structured output — constrain the response to a JSON schema.",
+      "modeBothTitle": "__MISSING__:Tools + JSON",
+      "modeBothDesc": "__MISSING__:Combine function calling and structured output in a single request.",
+      "backButton": "__MISSING__:Back",
+      "nextButton": "__MISSING__:Next",
+      "runButton": "__MISSING__:Run",
+      "promptPlaceholder": "__MISSING__:Enter your message… (Enter to send, Shift+Enter for newline)"
+    }
   },
   "miniPlayground": {
     "endpoint": "__MISSING__:Endpoint",
@@ -7395,7 +8081,9 @@
     "loadingLogs": "Loading logs...",
     "noLogs": "No logs yet. Make some API calls to see them here.",
     "noMatchingLogs": "No logs matching current filters.",
-    "callLogsInfo": "Call logs are also saved as JSON files to {dataDir} and rotated based on {retentionDays} and {maxEntries}."
+    "callLogsInfo": "Call logs are also saved as JSON files to {dataDir} and rotated based on {retentionDays} and {maxEntries}.",
+    "loadMore": "__MISSING__:Load More",
+    "loadingMore": "__MISSING__:Loading more..."
   },
   "proxyLogger": {
     "filterAll": "All",
@@ -7432,7 +8120,8 @@
     "loadingProxyLogs": "Loading proxy logs...",
     "noProxyLogs": "No proxy logs yet. Configure proxies and make API calls to see them here.",
     "noMatchingLogs": "No logs match the current filters.",
-    "tlsFingerprint": "Chrome 124 TLS Fingerprint"
+    "tlsFingerprint": "Chrome 124 TLS Fingerprint",
+    "colPublicIp": "__MISSING__:Public IP"
   },
   "endpointOptions": {
     "speech": "Speech",
@@ -7572,7 +8261,86 @@
     "betaConfigSavedSuffix": "(अद्याप सर्व्हरवर टिकून नाही). प्रति-विनंती कॅप अंमलबजावणी अद्याप प्रॉक्सी पाइपलाइनमध्ये वायर्ड केलेली नाही. ही स्क्रीन तुम्हाला कोटा विभाजनाची रचना आणि कल्पना करू देते; वास्तविक अंमलबजावणी DB चिकाटी आणि अपस्ट्रीम कॉल इंटरसेप्शनसह भविष्यातील पुनरावृत्तीमध्ये उतरेल.",
     "policyLabel": "धोरण:",
     "resetIn": "मध्ये रीसेट करा",
-    "quotaTotal": "एकूण"
+    "quotaTotal": "एकूण",
+    "kpiAvgUtilization": "__MISSING__:Avg utilization",
+    "kpiBorrowingNow": "__MISSING__:Borrowing now",
+    "conceptTitle": "__MISSING__:How Quota Share works",
+    "conceptIntro": "__MISSING__:Quota Share divides a provider's quota among multiple API keys using work-conserving fair-share: each key receives a proportional slice but can borrow from the free balance without exceeding the global cap.",
+    "conceptFairShare": "__MISSING__:Fair-share: each key receives quota proportional to its configured weight",
+    "conceptBorrowing": "__MISSING__:Borrowing: keys can consume free balance from others without breaching the cap",
+    "conceptGlobalCap": "__MISSING__:Hard global cap: the provider's absolute limit is never exceeded",
+    "conceptWindows": "__MISSING__:Windows: 5h, hourly, daily, weekly, monthly — each tracked independently",
+    "conceptKeyHowTitle": "__MISSING__:Enabling a key for quota",
+    "conceptKeyHowDesc": "__MISSING__:Create the key normally in API Keys — it appears in the wizard's key step automatically. Tick Exclusive there to make it quota-only. No separate enable step.",
+    "conceptExclusiveTitle": "__MISSING__:What \"Exclusive\" does",
+    "conceptExclusiveDesc": "__MISSING__:An exclusive key only sees/uses the pool's quotaShared-* models — every other model is hidden from its /v1/models and blocked.",
+    "burnRateTitle": "__MISSING__:Burn rate",
+    "burnRateExhaustsIn": "__MISSING__:Exhausts in",
+    "dimensionResetIn": "__MISSING__:Resets in",
+    "realConsumedColumn": "__MISSING__:Consumed",
+    "deficitColumn": "__MISSING__:Deficit",
+    "borrowingIndicator": "__MISSING__:borrowing",
+    "migratedFromLocalStorageNotice": "__MISSING__:Pools successfully migrated from localStorage.",
+    "policyCapAbsoluteLabel": "__MISSING__:Absolute cap",
+    "policyCapAbsolutePlaceholder": "__MISSING__:Numeric limit (optional)",
+    "multiDimensionLabel": "__MISSING__:Multi-dimension",
+    "stackedBarTitle": "__MISSING__:Slices by API key",
+    "usedSuffix": "__MISSING__:used {percent}%",
+    "wizardTitle": "__MISSING__:New quota pool",
+    "editPoolTitle": "__MISSING__:Edit pool",
+    "saveChanges": "__MISSING__:Save changes",
+    "wizardStep1Label": "__MISSING__:Account",
+    "wizardStep2Label": "__MISSING__:Limit",
+    "wizardStep3Label": "__MISSING__:Keys",
+    "wizardStep1Title": "__MISSING__:Choose provider connection",
+    "wizardStep1Subtitle": "__MISSING__:Select the provider account this pool will share quota for, set a name and default policy.",
+    "wizardStep2Title": "__MISSING__:Configure quota dimensions",
+    "wizardStep2Subtitle": "__MISSING__:Define the quota plan dimensions (unit, window, limit) for the chosen connection. Leave unchanged to keep current settings.",
+    "wizardStep3Title": "__MISSING__:Allocate API keys",
+    "wizardStep3Subtitle": "__MISSING__:Assign API keys to this pool with weight % allocations and optional caps.",
+    "wizardPoolNameLabel": "__MISSING__:Pool name",
+    "wizardPoolNamePlaceholder": "__MISSING__:My quota pool",
+    "wizardNext": "__MISSING__:Next",
+    "wizardBack": "__MISSING__:Back",
+    "wizardCreatePool": "__MISSING__:Create pool",
+    "wizardDimensionsEditedNotice": "__MISSING__:Dimensions edited — will be saved as a manual override when the pool is created.",
+    "wizardExclusiveLabel": "__MISSING__:Exclusive quota",
+    "wizardExclusiveHint": "__MISSING__:When enabled, these API keys will only be allowed to use this pool's virtual models (allowedQuotas reconciliation is applied on save).",
+    "wizardPreviewLabel": "__MISSING__:Virtual model names preview",
+    "wizardConnectionsLabel": "__MISSING__:Provider connections",
+    "wizardPrimaryBadge": "__MISSING__:primary",
+    "wizardAdditionalConnectionsNote": "__MISSING__:Additional connections use their catalog default limits (editable later).",
+    "wizardSingleProviderNote": "__MISSING__:A pool uses a single provider",
+    "wizardPreviewMoreModels": "__MISSING__:+{count} more",
+    "accountQuotaTitle": "__MISSING__:Account quota",
+    "accountQuotaNone": "__MISSING__:—",
+    "logTitle": "__MISSING__:Usage log",
+    "logEmpty": "__MISSING__:No usage yet",
+    "groupLabel": "__MISSING__:Group",
+    "newGroup": "__MISSING__:New group",
+    "renameGroup": "__MISSING__:Rename group",
+    "groupSelectHint": "__MISSING__:Filter pools by group",
+    "groupAllocationNote": "__MISSING__:Allocations apply to all pools in this group via the shared quota layer.",
+    "groupNamePrompt": "__MISSING__:Enter group name",
+    "wizardGroupLabel": "__MISSING__:Group",
+    "allGroups": "__MISSING__:All groups",
+    "endpointsTitle": "__MISSING__:Available endpoints",
+    "endpointsHint": "__MISSING__:Call these virtual models with any allocated key — routing + quota are handled per group.",
+    "previewForKey": "__MISSING__:Preview for key",
+    "previewKeyNone": "__MISSING__:(all endpoints)",
+    "endpointsBaseUrl": "__MISSING__:Base URL",
+    "endpointsCollapse": "__MISSING__:Collapse",
+    "endpointsExpand": "__MISSING__:Expand",
+    "endpointsAnthropicNote": "__MISSING__:Anthropic-native",
+    "endpointsResponsesNote": "__MISSING__:OpenAI Responses — codex/github",
+    "endpointsWsNote": "__MISSING__:WebSocket — codex only",
+    "betaText": "__MISSING__:Quota Share is functional but bugs are expected. Found one? Please report it.",
+    "betaReportLink": "__MISSING__:Report an issue",
+    "deleteGroup": "__MISSING__:Delete group",
+    "deleteGroupConfirm": "__MISSING__:Delete this group? Its pools must be reassigned or removed first.",
+    "deleteGroupHasPools": "__MISSING__:This group still has pools — reassign or delete them first.",
+    "ungroupedTitle": "__MISSING__:Ungrouped",
+    "ungroupedHint": "__MISSING__:These pools are not assigned to a known group. Edit a pool to move it into a real group."
   },
   "plugins": {
     "title": "Plugins",
@@ -7608,6 +8376,571 @@
     "status": "Status",
     "enabled": "Enabled",
     "disabled": "Disabled",
+    "installedTab": "__MISSING__:Installed",
+    "marketplaceTab": "__MISSING__:Marketplace",
+    "marketplaceUrlLabel": "__MISSING__:Custom Marketplace URL",
+    "marketplaceUrlPlaceholder": "__MISSING__:Leave empty for official Omniroute registry",
+    "saveMarketplaceUrl": "__MISSING__:Save & Reload",
+    "marketplaceUrlSaved": "__MISSING__:Marketplace URL updated",
+    "marketplaceEmpty": "__MISSING__:No plugins found in marketplace.",
+    "verified": "__MISSING__:Verified",
+    "install": "__MISSING__:Install",
+    "installedFromMarketplace": "__MISSING__:Plugin {name} installed!",
     "hooks": "Hooks"
+  },
+  "quotaPlans": {
+    "title": "__MISSING__:Plans & Quotas",
+    "description": "__MISSING__:Configure quota plans per provider — dimensions (%, requests, tokens, $) and time windows",
+    "providerLabel": "__MISSING__:Provider / Connection",
+    "detectedPlanLabel": "__MISSING__:Detected plan",
+    "manualPlanLabel": "__MISSING__:Manual override",
+    "unconfiguredLabel": "__MISSING__:Not configured — manual required",
+    "dimensionLabel": "__MISSING__:Dimensions",
+    "addDimension": "__MISSING__:Add dimension",
+    "removeDimension": "__MISSING__:Remove",
+    "limitLabel": "__MISSING__:Limit",
+    "unitOptions": {
+      "percent": "__MISSING__:%",
+      "requests": "__MISSING__:requests",
+      "tokens": "__MISSING__:tokens",
+      "usd": "__MISSING__:USD ($)"
+    },
+    "windowOptions": {
+      "5h": "__MISSING__:5 hours",
+      "hourly": "__MISSING__:Hourly",
+      "daily": "__MISSING__:Daily",
+      "weekly": "__MISSING__:Weekly",
+      "monthly": "__MISSING__:Monthly"
+    },
+    "useCatalogButton": "__MISSING__:Use catalog",
+    "saveOverrideButton": "__MISSING__:Save override",
+    "revertToCatalogButton": "__MISSING__:Revert to catalog",
+    "unknownProviderNotice": "__MISSING__:Select a provider on the left to configure its quota plan.",
+    "catalogTitle": "__MISSING__:Known catalog",
+    "catalogDescription": "__MISSING__:Automatically detected plans for the following providers:"
+  },
+  "activity": {
+    "title": "__MISSING__:Activity",
+    "description": "__MISSING__:Recent events feed",
+    "emptyTitle": "__MISSING__:No activity yet",
+    "emptyDescription": "__MISSING__:When you add providers, create combos, or rotate keys, events will appear here.",
+    "todayHeader": "__MISSING__:Today",
+    "yesterdayHeader": "__MISSING__:Yesterday",
+    "filterAll": "__MISSING__:All",
+    "filterProviders": "__MISSING__:Providers",
+    "filterCombos": "__MISSING__:Combos",
+    "filterApiKeys": "__MISSING__:API Keys",
+    "filterSettings": "__MISSING__:Settings",
+    "filterQuota": "__MISSING__:Quota",
+    "filterAuth": "__MISSING__:Auth",
+    "filterSystem": "__MISSING__:System",
+    "relative": {
+      "justNow": "__MISSING__:just now",
+      "minutesAgo": "__MISSING__:{n} min ago",
+      "hoursAgo": "__MISSING__:{n} h ago",
+      "yesterday": "__MISSING__:yesterday",
+      "daysAgo": "__MISSING__:{n} days ago"
+    },
+    "eventVerb": {
+      "providerAdded": "__MISSING__:{actor} added provider {target}",
+      "providerRemoved": "__MISSING__:{actor} removed provider {target}",
+      "providerTested": "__MISSING__:{actor} tested provider {target}",
+      "comboCreated": "__MISSING__:{actor} created combo {target}",
+      "comboUpdated": "__MISSING__:{actor} updated combo {target}",
+      "comboDeleted": "__MISSING__:{actor} removed combo {target}",
+      "apiKeyCreated": "__MISSING__:{actor} created API key {target}",
+      "apiKeyRevoked": "__MISSING__:{actor} revoked API key {target}",
+      "apiKeyRotated": "__MISSING__:{actor} rotated API key {target}",
+      "budgetThreshold": "__MISSING__:Budget threshold reached for {target}",
+      "settingUpdated": "__MISSING__:{actor} updated setting {target}",
+      "authLogin": "__MISSING__:{actor} signed in",
+      "authLogout": "__MISSING__:{actor} signed out",
+      "cloudAgentSession": "__MISSING__:Cloud agent session started for {target}",
+      "mcpToolRegistered": "__MISSING__:MCP tool {target} registered",
+      "webhookCreated": "__MISSING__:{actor} created webhook {target}",
+      "webhookDeleted": "__MISSING__:{actor} removed webhook {target}",
+      "quotaPoolCreated": "__MISSING__:{actor} created quota pool {target}",
+      "quotaPoolUpdated": "__MISSING__:{actor} updated quota pool {target}",
+      "quotaPoolDeleted": "__MISSING__:{actor} removed quota pool {target}",
+      "quotaPlanUpdated": "__MISSING__:{actor} updated quota plan {target}",
+      "quotaStoreDriverChanged": "__MISSING__:QuotaStore driver changed",
+      "updateApplied": "__MISSING__:Update {target} applied",
+      "deployCompleted": "__MISSING__:Deploy completed",
+      "skillInstalled": "__MISSING__:{actor} installed skill {target}",
+      "skillRemoved": "__MISSING__:{actor} removed skill {target}",
+      "providerCredentialsCreated": "__MISSING__:{actor} created credentials for {target}",
+      "providerCredentialsApplied": "__MISSING__:Credentials for {target} applied",
+      "providerCredentialsUpdated": "__MISSING__:{actor} updated credentials for {target}",
+      "providerCredentialsRevoked": "__MISSING__:{actor} revoked credentials for {target}",
+      "providerCredentialsBatchRevoked": "__MISSING__:{actor} batch-revoked credentials",
+      "providerCredentialsBatchUpdated": "__MISSING__:{actor} batch-updated credentials",
+      "providerCredentialsBulkCreated": "__MISSING__:{actor} bulk-created credentials",
+      "providerCredentialsBulkImported": "__MISSING__:{actor} bulk-imported credentials",
+      "providerCredentialsImported": "__MISSING__:{actor} imported credentials",
+      "providerSsrfBlocked": "__MISSING__:SSRF attempt blocked for {target}",
+      "authLoginSuccess": "__MISSING__:{actor} signed in",
+      "authLoginError": "__MISSING__:Login error for {actor}",
+      "authLoginFailed": "__MISSING__:Login failed for {actor}",
+      "authLoginLocked": "__MISSING__:{actor} locked out after too many attempts",
+      "authLoginMisconfigured": "__MISSING__:Auth configuration invalid",
+      "authLoginSetupRequired": "__MISSING__:Auth setup required",
+      "authLogoutSuccess": "__MISSING__:{actor} signed out",
+      "syncTokenCreated": "__MISSING__:{actor} created sync token",
+      "syncTokenRevoked": "__MISSING__:{actor} revoked sync token",
+      "settingsUpdate": "__MISSING__:{actor} updated settings",
+      "settingsUpdateFailed": "__MISSING__:Settings update failed",
+      "serviceRevealApiKey": "__MISSING__:{actor} revealed API key for {target}",
+      "genericEvent": "__MISSING__:{actor} {target}"
+    }
+  },
+  "agentBridge": {
+    "title": "__MISSING__:AgentBridge",
+    "subtitle": "__MISSING__:Use IDE agents with OmniRoute models — no config required",
+    "riskBannerTitle": "__MISSING__:Use at your own risk",
+    "riskBannerBody": "__MISSING__:AgentBridge intercepts HTTPS traffic from IDE agents. By activating it you accept responsibility for compliance with the terms of service of each agent. Never use on devices or networks where TLS inspection is prohibited.",
+    "riskBannerDismiss": "__MISSING__:Dismiss",
+    "serverCardTitle": "__MISSING__:AgentBridge Server",
+    "statusRunning": "__MISSING__:Running",
+    "statusStopped": "__MISSING__:Stopped",
+    "statusActive": "__MISSING__:Active",
+    "statusDnsOff": "__MISSING__:DNS off",
+    "statusSetupRequired": "__MISSING__:Setup required",
+    "statusInvestigating": "__MISSING__:Investigating",
+    "serverPort": "__MISSING__:Port",
+    "serverConns": "__MISSING__:Connections",
+    "serverIntercepted": "__MISSING__:Intercepted",
+    "serverLastStarted": "__MISSING__:Last started",
+    "startServer": "__MISSING__:Start",
+    "stopServer": "__MISSING__:Stop",
+    "restartServer": "__MISSING__:Restart",
+    "trustCert": "__MISSING__:Trust Cert",
+    "downloadCert": "__MISSING__:Download Cert",
+    "regenerateCert": "__MISSING__:Regenerate Cert",
+    "starting": "__MISSING__:Starting…",
+    "stopping": "__MISSING__:Stopping…",
+    "restarting": "__MISSING__:Restarting…",
+    "trusting": "__MISSING__:Trusting…",
+    "regenerating": "__MISSING__:Regenerating…",
+    "upstreamCaLabel": "__MISSING__:Upstream CA Certificate (corporate)",
+    "upstreamCaPlaceholder": "__MISSING__:/etc/ssl/certs/corp-ca.pem",
+    "upstreamCaTest": "__MISSING__:Test TLS",
+    "upstreamCaTestOk": "__MISSING__:TLS test passed",
+    "upstreamCaTestError": "__MISSING__:TLS test failed — check the path and CA file",
+    "bypassSectionTitle": "__MISSING__:Bypass List",
+    "bypassSectionDesc": "__MISSING__:Hosts matching these patterns are tunneled directly (no TLS decryption). Defaults include banks, .gov, and corporate SSO.",
+    "bypassDefaultsLabel": "__MISSING__:Default bypass patterns (read-only)",
+    "bypassUserLabel": "__MISSING__:Custom bypass patterns (one per line, glob or regex)",
+    "saveBypassList": "__MISSING__:Save bypass list",
+    "agentListTitle": "__MISSING__:IDE Agents",
+    "filterAll": "__MISSING__:All",
+    "filterActive": "__MISSING__:Active",
+    "filterSetupRequired": "__MISSING__:Setup required",
+    "filterInvestigating": "__MISSING__:Investigating",
+    "searchAgents": "__MISSING__:Search agents…",
+    "noAgentsMatch": "__MISSING__:No agents match the current filter",
+    "agentHosts": "__MISSING__:Intercepted hosts",
+    "certTrusted": "__MISSING__:Certificate trusted",
+    "certNotTrusted": "__MISSING__:Certificate not trusted",
+    "investigatingNotice": "__MISSING__:This agent is under investigation. Hosts and API surface are still being confirmed. Setup will be available once the upstream API is documented.",
+    "modelMappingsLabel": "__MISSING__:Model mappings",
+    "sourceModel": "__MISSING__:Source model (agent native)",
+    "targetModel": "__MISSING__:Target model (OmniRoute)",
+    "noMappings": "__MISSING__:No model mappings configured. Run setup wizard to auto-detect models.",
+    "selectModel": "__MISSING__:Select…",
+    "saveMappings": "__MISSING__:Save mappings",
+    "setupWizard": "__MISSING__:Setup wizard",
+    "startDns": "__MISSING__:Start DNS",
+    "stopDns": "__MISSING__:Stop DNS",
+    "toggling": "__MISSING__:Toggling…",
+    "viewTraffic": "__MISSING__:View traffic",
+    "emptyNoProvidersTitle": "__MISSING__:No providers configured yet",
+    "emptyNoProvidersBody": "__MISSING__:To use AgentBridge, first connect at least one provider. It will be the destination where IDE requests are routed.",
+    "emptyGoToProviders": "__MISSING__:Go to Providers",
+    "wizardTitle": "__MISSING__:Setup wizard",
+    "wizardSubtitle": "__MISSING__:3-step setup",
+    "wizardStep1Label": "__MISSING__:Verify",
+    "wizardStep2Label": "__MISSING__:DNS",
+    "wizardStep3Label": "__MISSING__:Mappings",
+    "wizardStep1Desc": "__MISSING__:Confirm the server is running and the certificate is installed.",
+    "wizardStep2Desc": "__MISSING__:The following entries will be added to /etc/hosts to redirect traffic through AgentBridge:",
+    "wizardStep3Desc": "__MISSING__:You can now configure model mappings in the agent card. Restart the IDE to apply changes.",
+    "wizardStep3Success": "__MISSING__:Agent is configured!",
+    "wizardServerCheck": "__MISSING__:AgentBridge server",
+    "wizardRunning": "__MISSING__:running",
+    "wizardNotRunning": "__MISSING__:not running",
+    "wizardCertCheck": "__MISSING__:Certificate",
+    "wizardTrusted": "__MISSING__:trusted",
+    "wizardNotTrusted": "__MISSING__:not yet trusted — use Trust Cert button",
+    "wizardTutorialTitle": "__MISSING__:Setup instructions:",
+    "wizardEnableDns": "__MISSING__:Add /etc/hosts entries",
+    "wizardDnsAlreadyEnabled": "__MISSING__:DNS already enabled for this agent",
+    "enablingDns": "__MISSING__:Enabling…",
+    "modelSelectorTitle": "__MISSING__:Select target model",
+    "modelSelectorSearch": "__MISSING__:Search models…",
+    "noModelsFound": "__MISSING__:No models found",
+    "quickLinks": "__MISSING__:Quick links",
+    "quickLinkProviders": "__MISSING__:Configure providers",
+    "quickLinkInspector": "__MISSING__:View traffic in Traffic Inspector",
+    "maintenanceTitle": "__MISSING__:Maintenance & Diagnostics",
+    "maintenanceSubtitle": "__MISSING__:Self-test the capture pipeline, undo leftover system state, and move your setup between machines.",
+    "orphanedStateWarning": "__MISSING__:A previous session left system state behind (DNS spoof, CA, or system proxy). Run Repair to clean it up.",
+    "diagnose": "__MISSING__:Diagnose",
+    "diagnosing": "__MISSING__:Diagnosing…",
+    "diagnoseHealthy": "__MISSING__:Capture pipeline is healthy.",
+    "diagnoseUnhealthy": "__MISSING__:Capture pipeline has problems:",
+    "repair": "__MISSING__:Repair",
+    "repairing": "__MISSING__:Repairing…",
+    "repairDone": "__MISSING__:Repaired: {items}",
+    "repairNothing": "__MISSING__:Nothing to repair — system state is clean.",
+    "removeCa": "__MISSING__:Remove CA",
+    "removeCaConfirm": "__MISSING__:Remove CA?",
+    "removeCaDone": "__MISSING__:MITM root CA removed from the OS trust store.",
+    "removing": "__MISSING__:Removing…",
+    "confirm": "__MISSING__:Confirm",
+    "exportConfig": "__MISSING__:Export config",
+    "exporting": "__MISSING__:Exporting…",
+    "importConfig": "__MISSING__:Import config",
+    "importing": "__MISSING__:Importing…",
+    "importInvalidJson": "__MISSING__:The selected file is not valid JSON.",
+    "importDone": "__MISSING__:Imported {bypass} bypass · {hosts} hosts · {agents} agents",
+    "save": "__MISSING__:Save",
+    "saving": "__MISSING__:Saving…",
+    "cancel": "__MISSING__:Cancel",
+    "back": "__MISSING__:Back",
+    "next": "__MISSING__:Next",
+    "done": "__MISSING__:Done",
+    "loading": "__MISSING__:Loading…",
+    "riskNoticeTitle": "__MISSING__:Risk acknowledgment",
+    "riskNoticeBody": "__MISSING__:AgentBridge will intercept HTTPS traffic from this agent by redirecting its API hosts via DNS. Only enable if you accept responsibility for compliance with the agent's terms of service and any applicable network policies.",
+    "pageMoved": {
+      "goNow": "__MISSING__:Go now",
+      "message": "__MISSING__:The MITM Proxy now lives under AgentBridge.",
+      "title": "__MISSING__:This page has moved"
+    }
+  },
+  "trafficInspector": {
+    "title": "__MISSING__:Traffic Inspector",
+    "subtitle": "__MISSING__:Monitor LLM calls and debug any application's HTTPS traffic",
+    "captureModesTitle": "__MISSING__:Capture Modes",
+    "agentBridgeMode": "__MISSING__:AgentBridge",
+    "agentBridgeModeDesc": "__MISSING__:Capture traffic from all connected IDE agents",
+    "customHostsMode": "__MISSING__:Custom Hosts",
+    "customHostsModeDesc": "__MISSING__:Add specific hosts to intercept",
+    "httpProxyMode": "__MISSING__:HTTP Proxy",
+    "httpProxyModeDesc": "__MISSING__:Use HTTP_PROXY environment variable",
+    "systemWideMode": "__MISSING__:System-wide",
+    "systemWideModeDesc": "__MISSING__:Intercept all system traffic (advanced)",
+    "tproxyMode": "__MISSING__:TPROXY Decrypt",
+    "tproxyModeUnavailable": "__MISSING__:TPROXY decrypt requires Linux + root + the native addon",
+    "filterBarTitle": "__MISSING__:Filters",
+    "profileLlmOnly": "__MISSING__:LLM only",
+    "profileCustom": "__MISSING__:Custom",
+    "profileAll": "__MISSING__:All",
+    "filterHost": "__MISSING__:Filter host…",
+    "filterAgent": "__MISSING__:Agent",
+    "filterStatus": "__MISSING__:Status",
+    "pauseBtn": "__MISSING__:Pause",
+    "resumeBtn": "__MISSING__:Resume",
+    "clearBtn": "__MISSING__:Clear",
+    "exportHar": "__MISSING__:Export .har",
+    "recordSession": "__MISSING__:REC",
+    "stopSession": "__MISSING__:Stop",
+    "liveBadge": "__MISSING__:live",
+    "offlineBadge": "__MISSING__:offline",
+    "noRequests": "__MISSING__:No requests captured yet.",
+    "noRequestsDesc": "__MISSING__:Make sure AgentBridge is running or enable another capture mode.",
+    "selectRequest": "__MISSING__:Select a request to inspect it.",
+    "tabConversation": "__MISSING__:Conversation",
+    "tabHeaders": "__MISSING__:Headers",
+    "tabRequest": "__MISSING__:Request",
+    "tabResponse": "__MISSING__:Response",
+    "tabTiming": "__MISSING__:Timing",
+    "tabLlm": "__MISSING__:LLM",
+    "tabStats": "__MISSING__:Stats",
+    "requestHeaders": "__MISSING__:Request Headers",
+    "responseHeaders": "__MISSING__:Response Headers",
+    "rawEvents": "__MISSING__:Raw events",
+    "mergedView": "__MISSING__:Merged view",
+    "noBody": "__MISSING__:No body.",
+    "streaming": "__MISSING__:streaming…",
+    "manageHosts": "__MISSING__:Manage hosts",
+    "copySnippet": "__MISSING__:Copy proxy snippet",
+    "addHost": "__MISSING__:Add",
+    "hostPlaceholder": "__MISSING__:api.openai.com",
+    "noHostsYet": "__MISSING__:No custom hosts added yet.",
+    "noSessionsYet": "__MISSING__:No sessions yet",
+    "allTraffic": "__MISSING__:All traffic (no session)",
+    "sessionsDropdown": "__MISSING__:Sessions",
+    "annotationPlaceholder": "__MISSING__:Add a note…",
+    "contextFingerprint": "__MISSING__:Context fingerprint",
+    "llmProvider": "__MISSING__:Detected provider",
+    "llmApiKind": "__MISSING__:API kind",
+    "llmModel": "__MISSING__:Model",
+    "llmMessages": "__MISSING__:Messages",
+    "llmStream": "__MISSING__:Stream",
+    "llmMappedTo": "__MISSING__:Mapped to",
+    "llmCostEstimate": "__MISSING__:Cost estimate",
+    "systemProxyExitWarning": "__MISSING__:System-wide proxy still active — leave page anyway?",
+    "customHostsTitle": "__MISSING__:Custom Hosts",
+    "loading": "__MISSING__:Loading…",
+    "copied": "__MISSING__:Copied!",
+    "copy": "__MISSING__:Copy",
+    "httpProxyTitle": "__MISSING__:HTTP Proxy Snippet — port {port}",
+    "notRecording": "__MISSING__:Not recording",
+    "anyStatus": "__MISSING__:Any status",
+    "liveOnly": "__MISSING__:Live",
+    "viewingRecordedSession": "__MISSING__:Viewing recorded session",
+    "backToLive": "__MISSING__:Back to live",
+    "untitledSession": "__MISSING__:Untitled session",
+    "contextHistory": "__MISSING__:Context History",
+    "modelResponse": "__MISSING__:Model Response",
+    "conversationNoMessages": "__MISSING__:No messages found in this request.",
+    "conversationNotAvailable": "__MISSING__:Conversation data not available. This may not be an LLM request or the body could not be parsed.",
+    "loadingCharts": "__MISSING__:Loading charts…",
+    "statsErrors": "__MISSING__:Errors",
+    "statsLatency": "__MISSING__:Latency (last 50 requests)",
+    "statsNoData": "__MISSING__:No requests yet. Start a session recording to capture data for stats.",
+    "statsStatusDistribution": "__MISSING__:Status distribution",
+    "statsSuccessful": "__MISSING__:Successful",
+    "statsTotalRequests": "__MISSING__:Total requests",
+    "timingProxyOverhead": "__MISSING__:Proxy overhead",
+    "timingUpstreamResponse": "__MISSING__:Upstream response",
+    "timingNoData": "__MISSING__:No timing data available.",
+    "timingTotalLatency": "__MISSING__:Total latency",
+    "timingTimestamp": "__MISSING__:Timestamp",
+    "timingMethod": "__MISSING__:Method",
+    "timingStatus": "__MISSING__:Status",
+    "timingRequestSize": "__MISSING__:Request size",
+    "timingResponseSize": "__MISSING__:Response size",
+    "pausedNewBadge": "__MISSING__:{count} new",
+    "clearContextFilter": "__MISSING__:clear"
+  },
+  "cliCommon": {
+    "concept": {
+      "code": {
+        "title": "__MISSING__:CLI Code",
+        "phrase": "__MISSING__:Code tools you point at OmniRoute",
+        "flow": "__MISSING__:You → CLI Code → OmniRoute → Provider",
+        "seeOther": "__MISSING__:See →"
+      },
+      "agent": {
+        "title": "__MISSING__:CLI Agents",
+        "phrase": "__MISSING__:Broad-purpose autonomous CLI agents you point at OmniRoute",
+        "flow": "__MISSING__:You → CLI Agent → OmniRoute → Provider",
+        "seeOther": "__MISSING__:See →"
+      },
+      "acp": {
+        "title": "__MISSING__:ACP Agents",
+        "phrase": "__MISSING__:CLIs that OmniRoute spawns as execution backend (reverse flow)",
+        "flow": "__MISSING__:Client → OmniRoute → spawn CLI (stdio/ACP) → response",
+        "seeOther": "__MISSING__:See →"
+      }
+    },
+    "comparison": {
+      "title": "__MISSING__:Understand the 3 CLI types in OmniRoute",
+      "thisPage": "__MISSING__:This page",
+      "open": "__MISSING__:Open →",
+      "code": {
+        "title": "__MISSING__:Code tool",
+        "desc": "__MISSING__:Points to Omni",
+        "flow": "__MISSING__:you → CLI → Omni → provider",
+        "examples": "__MISSING__:e.g.: claude, codex"
+      },
+      "agent": {
+        "title": "__MISSING__:Broad autonomous agent",
+        "desc": "__MISSING__:Points to Omni",
+        "flow": "__MISSING__:you → agent → Omni",
+        "examples": "__MISSING__:e.g.: hermes, goose"
+      },
+      "acp": {
+        "title": "__MISSING__:CLI used as backend by Omni",
+        "desc": "__MISSING__:Reverse execution",
+        "flow": "__MISSING__:Omni → spawn CLI → resp",
+        "examples": "__MISSING__:e.g.: claude, codex (ACP)"
+      }
+    },
+    "card": {
+      "detected": "__MISSING__:Detected",
+      "notDetected": "__MISSING__:Not detected",
+      "configured": "__MISSING__:Configured",
+      "notConfigured": "__MISSING__:Not configured",
+      "configure": "__MISSING__:Configure →",
+      "howToInstall": "__MISSING__:How to install →",
+      "manualConfig": "__MISSING__:Manual config",
+      "installGuide": "__MISSING__:Install guide",
+      "endpointLabel": "__MISSING__:Endpoint",
+      "baseUrlFull": "__MISSING__:Full Base URL",
+      "baseUrlPartial": "__MISSING__:Partial Base URL",
+      "refreshDetection": "__MISSING__:Refresh detection",
+      "alsoAcp": "__MISSING__:also ACP",
+      "connectProviderHint": "__MISSING__:Connect a provider in Providers"
+    },
+    "detail": {
+      "back": "__MISSING__:Back",
+      "apply": "__MISSING__:Save",
+      "reset": "__MISSING__:Clear",
+      "manualConfig": "__MISSING__:Manual configuration",
+      "vendor": "__MISSING__:Vendor",
+      "category": "__MISSING__:Type",
+      "detectionStatus": "__MISSING__:Detection",
+      "configStatus": "__MISSING__:Configuration",
+      "baseUrlLabel": "__MISSING__:Base URL",
+      "apiKeyLabel": "__MISSING__:API Key",
+      "modelMappingLabel": "__MISSING__:Model mapping",
+      "noActiveProviders": "__MISSING__:No active providers.",
+      "noActiveProvidersDesc": "__MISSING__:Go to Providers to connect at least 1 provider before configuring the CLI.",
+      "openProviders": "__MISSING__:Open Providers →"
+    }
+  },
+  "cliCode": {
+    "pageTitle": "__MISSING__:CLI Code's",
+    "pageSubtitle": "__MISSING__:Code tools pointing to OmniRoute",
+    "searchPlaceholder": "__MISSING__:Search CLI…",
+    "filterDetectionLabel": "__MISSING__:Detection",
+    "filterBaseUrlLabel": "__MISSING__:Base URL",
+    "detectionAll": "__MISSING__:All",
+    "detectionInstalled": "__MISSING__:Installed",
+    "detectionNotFound": "__MISSING__:Not found",
+    "baseUrlAll": "__MISSING__:All",
+    "baseUrlFull": "__MISSING__:Full",
+    "baseUrlPartial": "__MISSING__:Partial"
+  },
+  "cliAgents": {
+    "pageTitle": "__MISSING__:CLI Agents",
+    "pageSubtitle": "__MISSING__:Broad-purpose autonomous CLI agents",
+    "refreshDetection": "__MISSING__:Refresh detection",
+    "searchPlaceholder": "__MISSING__:Search agent…",
+    "detectionFilterLabel": "__MISSING__:Detection",
+    "detectionAll": "__MISSING__:All",
+    "detectionInstalled": "__MISSING__:Installed",
+    "detectionNotInstalled": "__MISSING__:Not installed",
+    "visibleCount": "__MISSING__:{count} visible",
+    "emptyState": "__MISSING__:No CLI agents found with the current filters."
+  },
+  "acpAgents": {
+    "pageTitle": "__MISSING__:ACP Agents",
+    "pageSubtitle": "__MISSING__:CLIs that OmniRoute spawns as execution backend",
+    "scanning": "__MISSING__:Detecting agents…",
+    "refresh": "__MISSING__:Refresh",
+    "setupGuideTitle": "__MISSING__:Setup guide",
+    "setupGuideDetectCliTitle": "__MISSING__:Detect CLI",
+    "setupGuideDetectCliDesc": "__MISSING__:Agents are identified by running the --version command in PATH.",
+    "setupGuideCustomAgentTitle": "__MISSING__:Add custom agent",
+    "setupGuideCustomAgentDesc": "__MISSING__:Fill in the form below to register a custom CLI agent.",
+    "setupGuideCommandMissingTitle": "__MISSING__:Command not found",
+    "setupGuideCommandMissingDesc": "__MISSING__:Check that the binary is in PATH.",
+    "fingerprintSettingsHint": "__MISSING__:Configure routing and fingerprints in",
+    "settingsRoutingLink": "__MISSING__:Settings → Routing",
+    "installed": "__MISSING__:Installed",
+    "notFound": "__MISSING__:Not found",
+    "builtIn": "__MISSING__:Built-in",
+    "custom": "__MISSING__:Custom",
+    "agentUseCaseHint": "__MISSING__:Available for spawn via ACP.",
+    "remove": "__MISSING__:Remove",
+    "addCustomAgent": "__MISSING__:Add custom agent",
+    "addCustomAgentDesc": "__MISSING__:Register a custom CLI agent to be spawned via ACP.",
+    "addAgent": "__MISSING__:Add agent",
+    "agentName": "__MISSING__:Name",
+    "agentNamePlaceholder": "__MISSING__:e.g.: My Agent",
+    "binaryName": "__MISSING__:Binary",
+    "binaryNamePlaceholder": "__MISSING__:e.g.: myagent",
+    "versionCommand": "__MISSING__:Version command",
+    "versionCommandPlaceholder": "__MISSING__:e.g.: myagent --version",
+    "spawnArgs": "__MISSING__:Spawn arguments",
+    "spawnArgsPlaceholder": "__MISSING__:e.g.: --quiet, --json",
+    "cliCodeRedirectCta": "__MISSING__:Open CLI Code"
+  },
+  "agentSkills": {
+    "pageTitle": "__MISSING__:Agent Skills",
+    "pageSubtitle": "__MISSING__:Teach your agent to operate OmniRoute — 22 API areas + 20 CLI families",
+    "conceptCard": {
+      "agent": {
+        "title": "__MISSING__:Agent Skills — Outbound",
+        "description": "__MISSING__:Agent Skills are machine-readable SKILL.md documents that external AI agents (Claude Code, Cursor, Copilot…) fetch from GitHub to learn how to operate OmniRoute via REST or CLI. They are read by the agent, not executed by OmniRoute.",
+        "crossLinkLabel": "__MISSING__:Understand the difference →"
+      },
+      "omni": {
+        "title": "__MISSING__:Omni Skills — Inbound",
+        "description": "__MISSING__:Omni Skills are sandbox tools that OmniRoute injects into the model's context on every request. They are executed by OmniRoute, not read by the agent.",
+        "crossLinkLabel": "__MISSING__:Understand the difference →"
+      },
+      "comparison": {
+        "colAgent": "__MISSING__:Agent Skills",
+        "colOmni": "__MISSING__:Omni Skills",
+        "whatIs": {
+          "label": "__MISSING__:What it is",
+          "agent": "__MISSING__:Machine-readable SKILL.md that teaches an external agent to operate OmniRoute",
+          "omni": "__MISSING__:Executable tools that OmniRoute injects as tools into LLM requests"
+        },
+        "direction": {
+          "label": "__MISSING__:Direction",
+          "agent": "__MISSING__:Outbound — external agent learns to control OmniRoute",
+          "omni": "__MISSING__:Inbound — OmniRoute gives tools to models passing through it"
+        },
+        "executor": {
+          "label": "__MISSING__:Executor",
+          "agent": "__MISSING__:External agent (reads markdown → acts via API/CLI)",
+          "omni": "__MISSING__:OmniRoute itself (intercepts tool_calls, Docker sandbox)"
+        },
+        "storage": {
+          "label": "__MISSING__:Storage",
+          "agent": "__MISSING__:Dynamic catalog (/api/agent-skills) → SKILL.md on GitHub",
+          "omni": "__MISSING__:SQLite (SkillsMP / skills.sh / local)"
+        },
+        "tagline": {
+          "label": "__MISSING__:Tagline",
+          "agent": "__MISSING__:Teach your agent to use OmniRoute",
+          "omni": "__MISSING__:Give executable tools to OmniRoute models"
+        }
+      }
+    },
+    "filters": {
+      "category": "__MISSING__:Category",
+      "area": "__MISSING__:Area",
+      "searchPlaceholder": "__MISSING__:Search skills…"
+    },
+    "categoryApi": "__MISSING__:API",
+    "categoryCli": "__MISSING__:CLI",
+    "categoryConfig": "__MISSING__:Config",
+    "filterAll": "__MISSING__:All",
+    "coverageLabel": "__MISSING__:Coverage",
+    "mcpUrl": "__MISSING__:MCP URL",
+    "a2aLink": "__MISSING__:A2A",
+    "copyUrl": "__MISSING__:Copy URL",
+    "viewOnGithub": "__MISSING__:View on GitHub",
+    "previewLoading": "__MISSING__:Loading skill documentation…",
+    "previewError": "__MISSING__:Failed to load skill documentation.",
+    "previewEmpty": "__MISSING__:Select a skill to preview its documentation.",
+    "generateButton": "__MISSING__:Generate missing skills",
+    "coverageBar": {
+      "complete": "__MISSING__:Complete",
+      "partial": "__MISSING__:Partial"
+    },
+    "noSkillsFound": "__MISSING__:No skills found matching your filters.",
+    "regenerateConfirm": "__MISSING__:This will regenerate all missing SKILL.md files. Continue?",
+    "regenerateRunning": "__MISSING__:Regenerating skills…",
+    "regenerateSuccess": "__MISSING__:Skills regenerated successfully.",
+    "regenerateError": "__MISSING__:Failed to regenerate skills."
+  },
+  "freeProviderRankingsPage": {
+    "title": "__MISSING__:Free Provider Rankings",
+    "subtitle": "__MISSING__:Best free providers ranked by model ELO scores from Arena AI leaderboards",
+    "loading": "__MISSING__:Loading rankings...",
+    "errorLoading": "__MISSING__:Failed to load rankings",
+    "emptyState": "__MISSING__:No rankings available yet. Arena ELO data syncs on startup (daily) — check back shortly, or trigger a manual sync. Disable Arena ELO Sync in Feature Flags or set ARENA_ELO_SYNC_ENABLED=false to opt out.",
+    "bestModel": "__MISSING__:Best",
+    "allCategories": "__MISSING__:All Categories",
+    "categoryDefault": "__MISSING__:Default",
+    "categoryCoding": "__MISSING__:Coding",
+    "categoryReview": "__MISSING__:Review",
+    "categoryDocumentation": "__MISSING__:Documentation",
+    "categoryDebugging": "__MISSING__:Debugging",
+    "colRank": "__MISSING__:Rank",
+    "colProvider": "__MISSING__:Provider",
+    "colTopModel": "__MISSING__:Top Model",
+    "colScore": "__MISSING__:Score",
+    "colAvgScore": "__MISSING__:Avg Score",
+    "colModels": "__MISSING__:Models",
+    "colType": "__MISSING__:Type"
   }
 }
diff --git a/src/i18n/messages/ms.json b/src/i18n/messages/ms.json
index 7e0e020fb0..13eb7853ce 100644
--- a/src/i18n/messages/ms.json
+++ b/src/i18n/messages/ms.json
@@ -393,6 +393,7 @@
     "cloudBenefitAccess": "Cloud Benefit Access",
     "maxRetries": "Max Retries",
     "queueTimeout": "Queue Timeout",
+    "queueDepth": "__MISSING__:Queue Depth",
     "addProvider": "Add Provider",
     "realtime": "Realtime",
     "totalTranslations": "Total Translations",
@@ -709,6 +710,7 @@
     "batchFilesListFilesTable": "Fail",
     "batchPageLoadingMore": "Memuatkan lagi…",
     "recommended": "__MISSING__:Recommended",
+    "understand": "__MISSING__:I understand",
     "batchConceptTitle": "Batch processing",
     "batchConceptSubtitle": "Process thousands of requests asynchronously at ~50% of the cost (24h window). Ideal for evaluations, classification, and embeddings.",
     "batchConceptHowItWorks": "How it works",
@@ -773,36 +775,13 @@
     "filesListUploadButton": "Upload",
     "filesListUsedByColumn": "Used by",
     "filesListUsedByNone": "None",
-    "filesListDelete": "Delete",
-    "filesListDownload": "Download",
-    "batchDetailActionCancel": "Cancel batch",
-    "batchDetailActionRetry": "Retry failed requests",
-    "batchDetailCancelling": "Cancelling…",
-    "batchDetailRetrying": "Preparing retry…",
-    "batchDetailCancelConfirm": "Cancel this batch? In-progress requests will stop.",
-    "batchActionCancelError": "Failed to cancel batch. Try again.",
-    "batchActionRetryError": "Failed to retry failed requests. Try again.",
-    "batchConceptRetentionNote": "Results and error files are retained for 30 days (Anthropic: 29 days)",
     "filesListUsedByRoleInput": "input",
     "filesListUsedByRoleOutput": "output",
     "filesListUsedByRoleError": "error",
-    "batchListProgressPartial": "(partial)",
     "filesListSizeColumn": "Size",
+    "batchListProgressPartial": "(partial)",
     "batchListProviderColumn": "Provider",
     "batchListProviderUnknown": "—",
-    "batchListBatchCreated": "Batch {id} created — refreshing list…",
-    "batchListBatchCreatedDismiss": "Dismiss",
-    "batchListRefreshing": "Refreshing…",
-    "batchListRefresh": "Refresh",
-    "uploadFileModalRemove": "Remove",
-    "uploadFileModalUploading": "Uploading…",
-    "wizardInputReading": "Reading file…",
-    "wizardInputReady": "Ready",
-    "wizardInputLargeFileLabel": "Large file — sampling validation",
-    "wizardInputCsvJsonlReady": "JSONL generated — ready to validate.",
-    "wizardInputLargeFileWarning": "Large file detected — validation runs by sampling (first 5 MB + last 100 KB). Full validation happens server-side.",
-    "wizardCostWindow24h": "24h completion window",
-    "wizardValidationFieldsOk": "required fields valid",
     "batchListProviderOther": "Other",
     "batchListTitle": "Batches",
     "batchListCount": "{count} batches",
@@ -839,8 +818,33 @@
     "wizardCostWindow": "Window",
     "wizardDestinationSelectProvider": "Select a provider…",
     "wizardDestinationSelectModel": "Select a model…",
-    "wizardDestinationConnectProvider": "Connect a provider"
+    "wizardDestinationConnectProvider": "Connect a provider",
+    "batchListBatchCreated": "Batch {id} created — refreshing list…",
+    "batchListBatchCreatedDismiss": "Dismiss",
+    "batchListRefreshing": "Refreshing…",
+    "batchListRefresh": "Refresh",
+    "uploadFileModalRemove": "Remove",
+    "uploadFileModalUploading": "Uploading…",
+    "wizardInputReading": "Reading file…",
+    "wizardInputReady": "Ready",
+    "wizardInputLargeFileLabel": "Large file — sampling validation",
+    "wizardInputCsvJsonlReady": "JSONL generated — ready to validate.",
+    "wizardInputLargeFileWarning": "Large file detected — validation runs by sampling (first 5 MB + last 100 KB). Full validation happens server-side.",
+    "wizardCostWindow24h": "24h completion window",
+    "wizardValidationFieldsOk": "required fields valid",
+    "filesListDelete": "Delete",
+    "filesListDownload": "Download",
+    "batchDetailActionCancel": "Cancel batch",
+    "batchDetailActionRetry": "Retry failed requests",
+    "batchDetailCancelling": "Cancelling…",
+    "batchDetailRetrying": "Preparing retry…",
+    "batchDetailCancelConfirm": "Cancel this batch? In-progress requests will stop.",
+    "batchActionCancelError": "Failed to cancel batch. Try again.",
+    "batchActionRetryError": "Failed to retry failed requests. Try again.",
+    "batchConceptRetentionNote": "Results and error files are retained for 30 days (Anthropic: 29 days)"
   },
+  "featureFlagOmnirouteEmergencyFallbackDescription": "__MISSING__:Route budget-exhausted requests to the emergency free fallback provider/model.",
+  "featureFlagArenaEloSyncEnabledDescription": "__MISSING__:Enable periodic Arena AI leaderboard ELO sync for model intelligence rankings.",
   "sidebar": {
     "home": "Rumah",
     "dashboard": "Papan pemuka",
@@ -968,6 +972,7 @@
     "aiFeaturesSection": "AI Features",
     "mcp": "MCP",
     "a2a": "A2A",
+    "plugins": "__MISSING__:Plugins",
     "apiEndpoints": "API Endpoints",
     "batchFiles": "Files",
     "analyticsEvals": "Evals",
@@ -976,6 +981,10 @@
     "analyticsComboHealth": "Combo Health",
     "analyticsCompression": "Compression",
     "costsBudget": "Budget",
+    "costsFreeTiers": "__MISSING__:Free-Tier Budget",
+    "costsFreeTiersSubtitle": "__MISSING__:Monthly free-token allowances",
+    "freeProviderRankings": "__MISSING__:Free Provider Rankings",
+    "freeProviderRankingsSubtitle": "__MISSING__:Best free providers ranked by model ELO scores",
     "costsQuotaShare": "Quota Sharing",
     "costsPricing": "Pricing",
     "logsProxy": "Proxy Logs",
@@ -987,10 +996,12 @@
     "settingsAppearance": "Appearance",
     "settingsAi": "AI Settings",
     "settingsSecurity": "Security",
+    "settingsAccessTokens": "__MISSING__:Access Tokens",
     "settingsFeatureFlags": "Bendera Ciri",
     "settingsAuthz": "__MISSING__:Authz",
     "settingsRouting": "Routing",
     "settingsResilience": "Resilience",
+    "modelLockout": "__MISSING__:Model Lockout",
     "settingsAdvanced": "Advanced",
     "omniProxySection": "OmniProxy",
     "quotaTracker": "Provider Quota",
@@ -1036,6 +1047,8 @@
     "analyticsCompressionSubtitle": "Token savings stats",
     "analyticsSearchSubtitle": "Search tool analytics",
     "analyticsEvalsSubtitle": "Eval suite results",
+    "providerStats": "__MISSING__:Provider Stats",
+    "providerStatsSubtitle": "__MISSING__:Latency and performance metrics",
     "logsSubtitle": "Application logs",
     "logsProxySubtitle": "Proxy traffic logs",
     "consoleLogsSubtitle": "Console output",
@@ -1055,6 +1068,7 @@
     "agentSkillsSubtitle": "A2A skill registry",
     "mcpSubtitle": "MCP server controls",
     "a2aSubtitle": "A2A protocol server",
+    "pluginsSubtitle": "__MISSING__:Plugin marketplace & installs",
     "mediaSubtitle": "Cached media files",
     "batchFilesSubtitle": "Batch input/output files",
     "settingsSubtitle": "All settings",
@@ -1065,13 +1079,41 @@
     "settingsResilienceSubtitle": "Retries and breakers",
     "settingsAdvancedSubtitle": "Power user options",
     "settingsSecuritySubtitle": "Auth and encryption",
+    "settingsAccessTokensSubtitle": "__MISSING__:Scoped CLI tokens for remote mode",
     "settingsFeatureFlagsSubtitle": "Togol keupayaan sistem",
     "settingsSidebar": "Sidebar",
     "settingsSidebarSubtitle": "Customize sidebar layout",
     "settingsAuthzSubtitle": "__MISSING__:Route inventory and bypass policy",
     "docsSubtitle": "Documentation",
     "issuesSubtitle": "Report a bug",
-    "changelogSubtitle": "Release notes"
+    "changelogSubtitle": "Release notes",
+    "costsQuotaPlans": "__MISSING__:Plans & Quotas",
+    "costsQuotaPlansSubtitle": "__MISSING__:Configure plans by provider",
+    "activity": "__MISSING__:Activity",
+    "activitySubtitle": "__MISSING__:Friendly feed of recent events",
+    "logsGroup": "__MISSING__:Logs",
+    "systemGroup": "__MISSING__:System",
+    "costsOverview": "__MISSING__:Overview",
+    "costsOverviewSubtitle": "__MISSING__:Consolidated cost analysis",
+    "agentBridge": "__MISSING__:Agent Bridge",
+    "agentBridgeSubtitle": "__MISSING__:Intercept IDE agent traffic",
+    "trafficInspector": "__MISSING__:Traffic Inspector",
+    "trafficInspectorSubtitle": "__MISSING__:Monitor LLM calls + debug any HTTPS traffic",
+    "cliCode": "__MISSING__:CLI Code",
+    "cliCodeSubtitle": "__MISSING__:Code tools pointing to OmniRoute",
+    "cliAgents": "__MISSING__:CLI Agents",
+    "cliAgentsSubtitle": "__MISSING__:Autonomous CLI agents",
+    "acpAgents": "__MISSING__:ACP Agents",
+    "acpAgentsSubtitle": "__MISSING__:CLIs spawned by OmniRoute",
+    "skipToContent": "__MISSING__:Skip to content",
+    "unpinSection": "__MISSING__:Unpin section",
+    "pinSectionOpen": "__MISSING__:Pin section open",
+    "reloadPage": "__MISSING__:Reload Page",
+    "dragReorderSection": "__MISSING__:Drag to reorder section",
+    "dragReorderItem": "__MISSING__:Drag to reorder",
+    "cannotHide": "__MISSING__:This item cannot be hidden",
+    "alwaysVisible": "__MISSING__:Always visible",
+    "groupSeparatorLabel": "__MISSING__:Separator"
   },
   "webhooks": {
     "title": "Webhooks",
@@ -1272,7 +1314,47 @@
     "a2aEvents": "Peristiwa",
     "a2aArtifacts": "Artifak",
     "a2aNoTasks": "Tiada tugas A2A direkodkan.",
-    "a2aLoadingTasks": "Memuatkan tugas A2A..."
+    "a2aLoadingTasks": "Memuatkan tugas A2A...",
+    "actor": "__MISSING__:Actor",
+    "actorPlaceholder": "__MISSING__:Filter by actor",
+    "eventTypes": {
+      "apiKey.activate": "__MISSING__:API Key Activated",
+      "apiKey.ban": "__MISSING__:API Key Banned",
+      "apiKey.deactivate": "__MISSING__:API Key Deactivated",
+      "apiKey.regenerate": "__MISSING__:API Key Regenerated",
+      "apiKey.scopes.grant": "__MISSING__:API Key Scopes Granted",
+      "apiKey.scopes.revoke": "__MISSING__:API Key Scopes Revoked",
+      "apiKey.scopes.update": "__MISSING__:API Key Scopes Updated",
+      "apiKey.unban": "__MISSING__:API Key Unbanned",
+      "auth.login.error": "__MISSING__:Login Error",
+      "auth.login.failed": "__MISSING__:Login Failed",
+      "auth.login.locked": "__MISSING__:Login Locked",
+      "auth.login.misconfigured": "__MISSING__:Login Misconfigured",
+      "auth.login.setup_required": "__MISSING__:Login Setup Required",
+      "auth.login.success": "__MISSING__:Login Success",
+      "auth.logout.success": "__MISSING__:Logout Success",
+      "compliance.cleanup": "__MISSING__:Compliance Cleanup",
+      "provider.credentials.applied": "__MISSING__:Provider Credentials Applied",
+      "provider.credentials.batch_revoked": "__MISSING__:Provider Credentials Batch Revoked",
+      "provider.credentials.bulk_created": "__MISSING__:Provider Credentials Bulk Created",
+      "provider.credentials.bulk_imported": "__MISSING__:Provider Credentials Bulk Imported",
+      "provider.credentials.created": "__MISSING__:Provider Credentials Created",
+      "provider.credentials.imported": "__MISSING__:Provider Credentials Imported",
+      "provider.credentials.revoked": "__MISSING__:Provider Credentials Revoked",
+      "provider.credentials.updated": "__MISSING__:Provider Credentials Updated",
+      "provider.validation.ssrf_blocked": "__MISSING__:Provider SSRF Blocked",
+      "quota.plan.updated": "__MISSING__:Quota Plan Updated",
+      "quota.pool.created": "__MISSING__:Quota Pool Created",
+      "quota.pool.deleted": "__MISSING__:Quota Pool Deleted",
+      "quota.pool.updated": "__MISSING__:Quota Pool Updated",
+      "quota.store.driver_changed": "__MISSING__:Quota Store Driver Changed",
+      "server.start": "__MISSING__:Server Start",
+      "service.reveal_api_key": "__MISSING__:Service API Key Revealed",
+      "settings.update": "__MISSING__:Settings Updated",
+      "settings.update_failed": "__MISSING__:Settings Update Failed",
+      "sync.token.created": "__MISSING__:Sync Token Created",
+      "sync.token.revoked": "__MISSING__:Sync Token Revoked"
+    }
   },
   "themesPage": {
     "title": "Themes",
@@ -1381,7 +1463,8 @@
     "settingsResilienceDescription": "Circuit breaker, retry, and fallback configuration",
     "settingsAdvancedDescription": "Advanced payload rules, request limits, and proxy API settings",
     "mitmProxyDescription": "Configure MITM proxy settings for traffic inspection and debugging",
-    "oneProxyDescription": "Configure 1Proxy settings for advanced proxy chaining"
+    "oneProxyDescription": "Configure 1Proxy settings for advanced proxy chaining",
+    "omniSkillsDescription": "__MISSING__:Install and manage sandbox skills for automated prompt and tool execution"
   },
   "home": {
     "quickStart": "Mula Pantas",
@@ -1612,16 +1695,24 @@
     "ownUsageVisibilityDesc": "Benarkan kunci ini memanggil endpoint statusnya untuk melihat penggunaan USD, peratus bajet dan jumlah tokennya sendiri.",
     "sharedAccountQuotaVisibility": "Kuota akaun kongsi",
     "sharedAccountQuotaVisibilityDesc": "Benarkan kunci ini melihat kuota akaun upstream kongsi apabila satu sambungan eksplisit dikonfigurasi.",
+    "localUsageCommand": "__MISSING__:Allow local usage command",
+    "localUsageCommandDesc": "__MISSING__:Allows this API key to use @@om-usage to retrieve cached usage and quota information without calling an upstream provider.",
+    "localUsageCommandBadge": "__MISSING__:Usage cmd",
     "keyCreated": "Kunci API Dicipta",
     "keyCreatedSuccess": "Kunci berjaya dibuat!",
     "keyCreatedNote": "Salin dan simpan kunci ini sekarang — ia tidak akan ditunjukkan lagi.",
     "done": "Selesai",
     "savePermissions": "Simpan Kebenaran",
-    "endpointRestrictions": "__MISSING__:Allowed Endpoints",
-    "allEndpointsAllowed": "__MISSING__:This key can access all API endpoints.",
-    "endpointsRestricted": "__MISSING__:Restricted to {count} endpoint{count, plural, one {} other {s}}.",
+    "endpointRestrictions": "Allowed Endpoints",
+    "allEndpointsAllowed": "This key can access all API endpoints.",
+    "endpointsRestricted": "Restricted to {count} endpoint{count, plural, one {} other {s}}.",
     "autoResolve": "Auto-Resolve",
     "autoResolveDesc": "Auto-resolve ambiguous model names to native provider for this API key.",
+    "streamDefaultMode": "__MISSING__:Stream Default Compatibility",
+    "streamDefaultModeDesc": "__MISSING__:Controls omitted `stream` flags for this key. JSON mode returns non-streaming responses unless the client explicitly requests SSE.",
+    "streamDefaultLegacy": "__MISSING__:Legacy",
+    "streamDefaultJson": "__MISSING__:JSON Compatible",
+    "streamDefaultBadge": "__MISSING__:JSON stream default",
     "keyActive": "Key Active",
     "keyActiveDesc": "Enable or disable this API key. Disabled keys are immediately rejected with 403.",
     "accessSchedule": "Access Schedule",
@@ -1667,6 +1758,7 @@
     "keyOnlyAvailableAtCreation": "Full key available only at creation time — copy it when you first create the key",
     "modelsCount": "{count, plural, one {# model} other {# models}}",
     "lastUsedOn": "Terakhir: {date}",
+    "viewCostsFor": "__MISSING__:View costs for {name}",
     "editPermissions": "Edit kebenaran",
     "deleteKey": "Padam kunci",
     "regenerateKey": "Menjana semula kunci",
@@ -1708,9 +1800,12 @@
     "shownOf": "__MISSING__:{shown} of {total} shown",
     "emptyFilterTitle": "__MISSING__:No keys match your filters",
     "emptyFilterClear": "__MISSING__:Clear filters",
-    "endpointRestrictions": "Allowed Endpoints",
-    "allEndpointsAllowed": "This key can access all API endpoints.",
-    "endpointsRestricted": "Restricted to {count} endpoint{count, plural, one {} other {s}}."
+    "disableNonPublicModels": "__MISSING__:Disable Non-Public Models",
+    "disableNonPublicModelsDesc": "__MISSING__:Reject requests for models that are not discovered or not marked as public in the provider catalog",
+    "normalKeysSection": "__MISSING__:Normal keys",
+    "quotaKeysSection": "__MISSING__:Quota keys",
+    "quotaPill": "__MISSING__:QUOTA",
+    "quotaModeOnly": "__MISSING__:qtSd-only"
   },
   "auditLog": {
     "title": "Log Audit",
@@ -1845,6 +1940,8 @@
     "freeQuota": "Free quota/mo",
     "scrapeUrl": "URL to scrape",
     "scrapeUrlPlaceholder": "https://example.com",
+    "scrapeUrlRequired": "__MISSING__:URL is required",
+    "scrapeUrlInvalid": "__MISSING__:Invalid URL — it must start with http:// or https://",
     "scrapeExtract": "Extract",
     "scrapeExtracting": "Extracting…",
     "scrapeFullPage": "Full page",
@@ -1858,6 +1955,8 @@
     "scrapeMetadata": "Metadata",
     "scrapeProvider": "Provider",
     "scrapeSize": "Size",
+    "scrapeEmptyState": "__MISSING__:Enter a URL to extract its content",
+    "scrapeProvidersAvailable": "__MISSING__:Available providers: Firecrawl, Jina Reader, Tavily.",
     "compareRun": "Compare",
     "compareRunning": "Comparing…",
     "autoProvider": "Auto (cheapest)",
@@ -2245,6 +2344,8 @@
     "leastLatency": "Kependaman Terkecil",
     "comboName": "Nama Kombo",
     "comboNamePlaceholder": "kombo saya",
+    "comboDescription": "__MISSING__:Description",
+    "comboDescriptionPlaceholder": "__MISSING__:Optional note describing this combo",
     "deleteConfirm": "Padamkan kombo ini?",
     "noCombosYet": "Tiada kombo lagi",
     "comboCreated": "Kombo berjaya dibuat",
@@ -2284,6 +2385,8 @@
     "resetAwareDesc": "Baki baki kuota dengan tetapan semula 5j dan mingguan, kemudian round-robin markah yang serupa",
     "strictRandom": "Strict Random",
     "strictRandomDesc": "Shuffle deck — uses each model once before reshuffling",
+    "fusion": "__MISSING__:Fusion",
+    "fusionDesc": "__MISSING__:Fans the prompt to every panel model in parallel, then a judge model synthesizes one final answer",
     "models": "model",
     "autoBalance": "Imbangan automatik",
     "advancedSettings": "Tetapan Lanjutan",
@@ -2982,14 +3085,19 @@
     "ngrokStarted": "terowong ngrok bermula",
     "ngrokStopped": "terowong ngrok berhenti",
     "ngrokRequestFailed": "Gagal mengemas kini terowong ngrok",
-    "tokenSaverSubtitle": "Kurangkan belanja token pada setiap permintaan.",
-    "tokenSaverToolOutput": "Keluaran alat",
-    "tokenSaverLlmOutput": "Keluaran LLM",
-    "tokenSaverInputCompression": "Mampatan input",
     "apiEndpointsCatalogUnavailable": "Katalog API tidak tersedia",
     "apiEndpointsSearchPlaceholder": "Cari titik akhir...",
     "apiEndpointsRequiresAuth": "Memerlukan pengesahan",
     "apiEndpointsNoMatch": "Tiada titik akhir yang sepadan dengan penapis anda",
+    "vscodeAliasTitle": "__MISSING__:VS Code Token Alias",
+    "vscodeAliasDescriptionReady": "__MISSING__:Ready-to-paste compatibility URLs using the /api/v1/vscode/TOKEN/... endpoint.",
+    "vscodeAliasDescriptionError": "__MISSING__:Showing placeholder URLs because CLI keys could not be loaded in this session.",
+    "vscodeAliasDescriptionLoading": "__MISSING__:Loading CLI keys. Placeholder URLs are shown until a key is available.",
+    "vscodeAliasDescriptionPlaceholder": "__MISSING__:Showing placeholder URLs. Create or activate an API key in CLI Tools to replace TOKEN.",
+    "vscodeAliasManage": "__MISSING__:CLI Tools",
+    "vscodeAliasBaseLabel": "__MISSING__:VS Code base",
+    "vscodeAliasModelsLabel": "__MISSING__:VS Code models",
+    "vscodeAliasChatLabel": "__MISSING__:VS Code chat",
     "localServer": "Pelayan Tempatan",
     "cloudOmniroute": "Cloud OmniRoute",
     "copyUrl": "Salin URL",
@@ -3002,7 +3110,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
@@ -3178,42 +3289,187 @@
     "a2aStep3": "__MISSING__:Track and cancel tasks with {code1} and {code2}."
   },
   "memory": {
-    "title": "Memory Management",
-    "description": "View and manage stored memory entries",
-    "memories": "Memories",
-    "totalEntries": "Total Entries",
-    "tokensUsed": "Tokens Used",
-    "hitRate": "Hit Rate",
-    "loading": "Loading memories...",
-    "noMemories": "No memories found",
-    "search": "Search memories...",
-    "allTypes": "All Types",
-    "export": "Export",
-    "import": "Import",
-    "addMemory": "Add Memory",
-    "type": "Type",
-    "key": "Key",
-    "content": "Content",
-    "created": "Created",
-    "actions": "Actions",
-    "delete": "Delete",
-    "factual": "Factual",
-    "episodic": "Episodic",
-    "procedural": "Procedural",
-    "semantic": "Semantic",
     "a": "A",
-    "pipelineOk": "Saluran paip OK ({latencyMs}ms)",
-    "pipelineError": "Ralat saluran paip",
-    "healthUnknown": "Kesihatan tidak diketahui",
-    "checkingHealth": "Menyemak…",
-    "checkHealth": "Periksa kesihatan",
-    "pageInfo": "Halaman {page} daripada {totalPages} ({total} jumlah)",
-    "previous": "Sebelumnya",
-    "next": "Seterusnya",
+    "actions": "Actions",
+    "addMemory": "Add Memory",
+    "allTypes": "All Types",
     "cancel": "Batal",
-    "save": "Jimat",
+    "checkHealth": "Periksa kesihatan",
+    "checkingHealth": "Menyemak…",
+    "compactOld": "__MISSING__:Compact old",
+    "concept": {
+      "title": "__MISSING__:Conversational Memory",
+      "description": "__MISSING__:OmniRoute learns from every conversation, remembering facts, episodes, procedures, and semantic concepts that make responses more accurate and context-aware.",
+      "howWorksToggle": "__MISSING__:How it works",
+      "howWorksContent": "__MISSING__:1. Automatic extraction: at the end of each response, facts and episodes are detected and saved automatically.\n2. Retrieval: before each response, the most relevant memories are searched via FTS5 (exact), vector (semantic), or hybrid RRF.\n3. Injection: relevant memories are injected into the assistant context to improve response quality.\n4. Management: use this page to view, edit, export, and compact old memories."
+    },
+    "content": "Content",
+    "contentPlaceholder": "Nilai atau kandungan JSON untuk diingati",
+    "created": "Created",
+    "delete": "Delete",
+    "deleteConfirmDesc": "__MISSING__:This action cannot be undone. The memory will be permanently removed.",
+    "deleteConfirmTitle": "__MISSING__:Delete memory?",
+    "description": "View and manage stored memory entries",
+    "editMemory": "__MISSING__:Edit memory",
+    "editModal": {
+      "title": "__MISSING__:Edit Memory",
+      "metadataLabel": "__MISSING__:Metadata (JSON)",
+      "metadataInvalid": "__MISSING__:Invalid JSON",
+      "saveFailed": "__MISSING__:Failed to save memory"
+    },
+    "embedding": {
+      "autoLabel": "__MISSING__:Automatic",
+      "autoDesc": "__MISSING__:Uses best available: remote provider > static > transformers",
+      "remoteLabel": "__MISSING__:Remote provider",
+      "remoteDesc": "__MISSING__:Uses embedding via provider API (requires API key)",
+      "staticLabel": "__MISSING__:Static local (potion)",
+      "staticDesc": "__MISSING__:Local embedding without WASM or external dependencies",
+      "transformersLabel": "__MISSING__:Transformers.js (MiniLM)",
+      "transformersDesc": "__MISSING__:Local embedding via @huggingface/transformers (~400MB RAM)",
+      "providerModelLabel": "__MISSING__:Provider / Model",
+      "noRemoteProviders": "__MISSING__:No providers with configured API key",
+      "selectProviderModel": "__MISSING__:Select a model",
+      "staticEnabledLabel": "__MISSING__:Enable Static Potion",
+      "staticEnabledDesc": "__MISSING__:Download and use potion-base-8M model locally",
+      "transformersEnabledLabel": "__MISSING__:Enable Transformers.js",
+      "transformersEnabledDesc": "__MISSING__:Opt-in for local MiniLM (~400MB RAM, ~3s cold start)",
+      "transformersWarning": "__MISSING__:Requires ~400MB RAM and ~3s cold start on the first semantic query."
+    },
+    "emptyState": {
+      "title": "__MISSING__:No memories yet",
+      "description": "__MISSING__:Memories are created automatically from conversations. You can also add them manually using the button above."
+    },
+    "engine": {
+      "statusTitle": "__MISSING__:Engine Status",
+      "embeddingTitle": "__MISSING__:Embedding Source",
+      "rerankTitle": "__MISSING__:Rerank (optional)",
+      "reindexNow": "__MISSING__:Reindex now",
+      "reindexStarted": "__MISSING__:Reindexing started ({pending} pending)",
+      "reindexFailed": "__MISSING__:Failed to start reindexing",
+      "keywordLabel": "__MISSING__:Keyword (FTS5)",
+      "keywordReason": "__MISSING__:Keyword search always available",
+      "embeddingLabel": "__MISSING__:Embedding",
+      "vectorStoreLabel": "__MISSING__:Vector Store",
+      "qdrantLabel": "__MISSING__:Qdrant",
+      "rerankLabel": "__MISSING__:Rerank",
+      "qdrantDisabled": "__MISSING__:Disabled",
+      "qdrantOk": "__MISSING__:Healthy ({latencyMs}ms)",
+      "qdrantError": "__MISSING__:Connection error",
+      "needsReindex": "__MISSING__:{count} memory(ies) need reindexing",
+      "configureCta": "__MISSING__:Configure",
+      "vectorStoreInstallHint": "__MISSING__:To enable vector search: npm install sqlite-vec (needs native Node.js, not WASM), then restart."
+    },
+    "episodic": "Episodic",
+    "export": "Export",
+    "factual": "Factual",
+    "healthUnknown": "Kesihatan tidak diketahui",
+    "hitRate": "Hit Rate",
+    "import": "Import",
+    "importError": "__MISSING__:Failed to import file",
+    "importResult": "__MISSING__:{imported} imported, {skipped} skipped",
+    "key": "Key",
     "keyPlaceholder": "cth. pengguna.keutamaan.tema",
-    "contentPlaceholder": "Nilai atau kandungan JSON untuk diingati"
+    "loading": "Loading memories...",
+    "memories": "Memories",
+    "next": "Seterusnya",
+    "noMemories": "No memories found",
+    "pageInfo": "Halaman {page} daripada {totalPages} ({total} jumlah)",
+    "pipelineError": "Ralat saluran paip",
+    "pipelineOk": "Saluran paip OK ({latencyMs}ms)",
+    "playground": {
+      "infoTitle": "__MISSING__:Memory Playground",
+      "infoDesc": "__MISSING__:Simulate what would be retrieved for a given query. No memories are modified — read-only preview.",
+      "queryLabel": "__MISSING__:Test query",
+      "queryPlaceholder": "__MISSING__:Type a question or test phrase...",
+      "strategyLabel": "__MISSING__:Strategy",
+      "strategyExact": "__MISSING__:Exact (FTS5)",
+      "strategySemantic": "__MISSING__:Semantic (vector)",
+      "strategyHybrid": "__MISSING__:Hybrid (RRF)",
+      "budgetLabel": "__MISSING__:Budget (tokens)",
+      "simulate": "__MISSING__:Simulate",
+      "resultsTitle": "__MISSING__:{count} result(s)",
+      "resolutionTitle": "__MISSING__:Search resolution",
+      "resolutionEmbedding": "__MISSING__:Embedding",
+      "resolutionStore": "__MISSING__:Vector store",
+      "resolutionStrategy": "__MISSING__:Strategy used",
+      "rerankApplied": "__MISSING__:Rerank applied",
+      "fallback": "__MISSING__:Fallback",
+      "noResults": "__MISSING__:No memories found for this query.",
+      "tokensUsed": "__MISSING__:tokens used",
+      "none": "__MISSING__:none",
+      "errorFetch": "__MISSING__:Failed to fetch preview"
+    },
+    "previous": "Sebelumnya",
+    "procedural": "Procedural",
+    "qdrant": {
+      "title": "__MISSING__:Qdrant (Vector Store Tier 2)",
+      "description": "__MISSING__:Optional Qdrant integration for scalable semantic search",
+      "enableLabel": "__MISSING__:Enable Qdrant",
+      "enableDesc": "__MISSING__:When enabled, Qdrant is used as the primary vector store",
+      "testConnection": "__MISSING__:Test connection",
+      "testing": "__MISSING__:Testing...",
+      "statusActive": "__MISSING__:Active",
+      "statusError": "__MISSING__:Error",
+      "statusDisabled": "__MISSING__:Disabled",
+      "healthOk": "__MISSING__:Connection OK ({latencyMs}ms)",
+      "healthError": "__MISSING__:Connection error",
+      "saved": "__MISSING__:Settings saved",
+      "saveError": "__MISSING__:Failed to save",
+      "portLabel": "__MISSING__:Port",
+      "embeddingModelLabel": "__MISSING__:Embedding Model",
+      "optional": "__MISSING__:optional",
+      "apiKeyKeepPlaceholder": "__MISSING__:Leave blank to keep current key",
+      "apiKeyOptional": "__MISSING__:Leave blank if not using authentication",
+      "removeApiKey": "__MISSING__:Remove",
+      "quickSelectModel": "__MISSING__:Quick select",
+      "searchTestTitle": "__MISSING__:Semantic search test",
+      "searchPlaceholder": "__MISSING__:Type a test query...",
+      "searching": "__MISSING__:Searching...",
+      "search": "__MISSING__:Search",
+      "cleanupTitle": "__MISSING__:Clean up old points",
+      "cleanupDesc": "__MISSING__:Remove Qdrant points for expired memories (retention period).",
+      "cleaning": "__MISSING__:Cleaning...",
+      "cleanNow": "__MISSING__:Clean now",
+      "cleanupSuccess": "__MISSING__:{count} point(s) removed",
+      "cleanupFailed": "__MISSING__:Cleanup failed"
+    },
+    "rerank": {
+      "enableLabel": "__MISSING__:Enable Rerank",
+      "enableDesc": "__MISSING__:Reorders results with a reranking model after search",
+      "warning": "__MISSING__:Rerank adds +200-500ms latency and additional cost per request. Use sparingly.",
+      "providerModelLabel": "__MISSING__:Rerank Provider / Model",
+      "noProviderWithKey": "__MISSING__:No provider with configured API key. Configure a provider to use rerank.",
+      "selectProviderModel": "__MISSING__:Select a provider/model"
+    },
+    "save": "Jimat",
+    "saving": "__MISSING__:Saving...",
+    "search": "Search memories...",
+    "semantic": "Semantic",
+    "summarize": {
+      "title": "__MISSING__:Compact old memories",
+      "noCandidates": "__MISSING__:No memories eligible for compaction (criteria: >30 days old).",
+      "candidatesDesc": "__MISSING__:{count} memories will be compacted into summaries. This action cannot be undone.",
+      "confirm": "__MISSING__:Compact now"
+    },
+    "tabs": {
+      "memories": "__MISSING__:Memories",
+      "playground": "__MISSING__:Playground",
+      "engine": "__MISSING__:Engine"
+    },
+    "title": "Memory Management",
+    "tokensUsed": "Tokens Used",
+    "tooltip": {
+      "totalEntries": "__MISSING__:Total memories stored for this API key",
+      "tokensUsed": "__MISSING__:Estimated total tokens occupied by active memories",
+      "hitRate": "__MISSING__:Read-by-ID cache hit rate (not semantic recall accuracy)",
+      "factual": "__MISSING__:Objective, permanent facts from user context",
+      "episodic": "__MISSING__:Events and experiences from conversation history",
+      "procedural": "__MISSING__:Procedures, workflows, and instructions the assistant should follow",
+      "semantic": "__MISSING__:Concepts, preferences, and domain knowledge"
+    },
+    "totalEntries": "Total Entries",
+    "type": "Type",
+    "memoryEnabled": "__MISSING__:Memory enabled"
   },
   "skills": {
     "title": "Skills",
@@ -3544,6 +3800,14 @@
     "export": "Export",
     "exporting": "Exporting...",
     "exportFailed": "Export failed",
+    "cleanHistoryButton": "__MISSING__:Clean history",
+    "cleanHistoryTitle": "__MISSING__:Clean log history?",
+    "cleanHistoryMessage": "__MISSING__:This permanently clears all request log rows, legacy detail rows, and local artifact files under DATA_DIR/call_logs. The live page will refresh after cleanup.",
+    "cleanHistoryConfirm": "__MISSING__:Clean history",
+    "cleanHistoryCancel": "__MISSING__:Cancel",
+    "cleanHistorySuccess": "__MISSING__:Cleaned {deleted} log entries, {deletedArtifacts} artifacts, and {deletedDetailedLogs} legacy detail rows.",
+    "cleanHistoryEmpty": "__MISSING__:No request log history was found.",
+    "cleanHistoryFailed": "__MISSING__:Failed to clean log history.",
     "timeRange": "Time Range",
     "lastNHours": "Last {hours}",
     "defaultRange": "default",
@@ -3551,10 +3815,14 @@
       "fetchFailed": "Failed to fetch logs",
       "copyFailed": "Failed to copy log entry",
       "copyLogEntry": "Copy log entry"
-    }
+    },
+    "compressionLogTitle": "__MISSING__:Compression Log",
+    "compressionLogEmpty": "__MISSING__:No compressed requests yet. Compression stats will appear here when requests are processed with compression enabled.",
+    "tokens": "__MISSING__:tokens"
   },
   "onboarding": {
     "welcome": "Selamat datang",
+    "tiers": "__MISSING__:Tiers",
     "security": "Keselamatan",
     "test": "Ujian",
     "ready": "sedia!",
@@ -3616,6 +3884,7 @@
   },
   "providers": {
     "title": "Pembekal",
+    "Account Deactivated": "__MISSING__:Account Deactivated",
     "allProviders": "Semua Penyedia",
     "audioProviders": "Pembekal Audio",
     "showFreeOnly": "Percuma sahaja",
@@ -3623,6 +3892,33 @@
     "addFirstProvider": "Tambahkan pembekal pertama anda",
     "addFirstProviderDesc": "Sambungkan pembekal AI untuk memulakan penghalaan permintaan melalui OmniRoute. Anda boleh menggunakan pembekal percuma, kunci API atau akaun OAuth.",
     "learnMore": "Ketahui lebih lanjut",
+    "adaptaTutorial": {
+      "title": "__MISSING__:How to connect Adapta Web",
+      "introPrefix": "__MISSING__:Adapta authenticates through Clerk. The token",
+      "introSuffix": "__MISSING__:is a long-lived JWT that lets OmniRoute refresh sessions automatically.",
+      "or": "__MISSING__:or",
+      "step1Title": "__MISSING__:Open Adapta chat",
+      "step1DescPrefix": "__MISSING__:Open",
+      "step1DescSuffix": "__MISSING__:and sign in with your Gold or Business account.",
+      "step2Title": "__MISSING__:Open DevTools",
+      "step2DescPrefix": "__MISSING__:Press",
+      "step2DescSuffix": "__MISSING__:to open Developer Tools.",
+      "step3Title": "__MISSING__:Go to Application → Cookies",
+      "step3DescPrefix": "__MISSING__:In the",
+      "step3DescMiddle": "__MISSING__:expand",
+      "step3DescSuffix": "__MISSING__:and click",
+      "step4Title": "__MISSING__:Copy the cookie value for",
+      "step4DescPrefix": "__MISSING__:Find the cookie named",
+      "step4DescMiddle": "__MISSING__:in the list. Click it and copy the content from the",
+      "step4DescSuffix": "__MISSING__:column. It starts with",
+      "step5Title": "__MISSING__:Paste it here and save",
+      "step5DescPrefix": "__MISSING__:Click",
+      "step5DescMiddle": "__MISSING__:paste the",
+      "step5DescSuffix": "__MISSING__:value into the API Key field, then save. OmniRoute will refresh the session automatically.",
+      "tipLabel": "__MISSING__:Tip:",
+      "tipPrefix": "__MISSING__:The",
+      "tipSuffix": "__MISSING__:cookie is long-lived, usually for months. You only need to renew it if you sign out or Adapta invalidates the session."
+    },
     "editProvider": "Edit Pembekal",
     "deleteProvider": "Padamkan Pembekal",
     "noProviders": "Tiada pembekal dikonfigurasikan",
@@ -3648,13 +3944,38 @@
     "apiKeyProviders": "Pembekal Kunci API",
     "compatibleProviders": "Pembekal Serasi Kunci API",
     "testAll": "Uji Semua",
+    "distributeProxies": "__MISSING__:Distribute Proxies",
+    "distributing": "__MISSING__:Distributing...",
+    "selectedCount": "__MISSING__:{count, plural, one {# selected} other {# selected}}",
+    "accountsCount": "__MISSING__:{count, plural, one {# account} other {# accounts}}",
     "testAllOAuth": "Uji semua sambungan OAuth",
     "testAllFree": "Uji semua sambungan Percuma",
     "testAllApiKey": "Uji semua sambungan Kunci API",
     "testAllCompatible": "Uji semua sambungan yang Serasi",
+    "testAllModels": "__MISSING__:Test all models",
+    "testAllModelsConfirm": "__MISSING__:Test all visible models? Failed models will be hidden if auto-hide is enabled.",
+    "testingAllModels": "__MISSING__:Testing {done}/{total}...",
+    "testAllResults": "__MISSING__:{ok} of {total} models working",
+    "noModelsToTest": "__MISSING__:No models match the current filter",
+    "showAllModels": "__MISSING__:All",
+    "showVisibleOnly": "__MISSING__:Visible only",
+    "freeFilterAll": "__MISSING__:All",
+    "freeFilterFreeOnly": "__MISSING__:Free only",
+    "freeFilterPaidOnly": "__MISSING__:Paid only",
+    "sortFreeFirst": "__MISSING__:Free first",
+    "showHiddenOnly": "__MISSING__:Hidden only",
+    "filterByVisibility": "__MISSING__:Filter by visibility",
+    "autoHideFailed": "__MISSING__:Auto-hide failed models",
+    "autoHideFailedHint": "__MISSING__:When enabled, Test all hides non-transient failures from public catalogs such as /v1/models. Single-model tests never auto-hide.",
     "connected": "{count} Disambungkan",
     "errorCount": "{count} Ralat ({code})",
     "errorCountNoCode": "{count} Ralat",
+    "testAllCompleted": "__MISSING__:Tested {total} models: {ok} OK, {failed} failed",
+    "modelAutoHidden": "__MISSING__:Model {model} auto-hidden (test failed)",
+    "filterAll": "__MISSING__:All",
+    "filterVisible": "__MISSING__:Visible only",
+    "filterHidden": "__MISSING__:Hidden only",
+    "modelsHiddenCount": "__MISSING__:{count} hidden",
     "warningCount": "{count} Amaran",
     "noConnections": "Tiada sambungan",
     "expiredBadge": "Expired",
@@ -3764,7 +4085,16 @@
     "batchUpdateNone": "__MISSING__:No connections were updated (they may no longer exist)",
     "batchRetestLimit": "__MISSING__:Retest up to {max} connections at a time",
     "noConnectionsToTest": "__MISSING__:No matching connections to test",
+    "batchDeleteConfirmTitle": "__MISSING__:Delete connections",
+    "batchDeleteConfirmButton": "__MISSING__:Delete",
+    "filterActive": "__MISSING__:Active",
+    "filterError": "__MISSING__:Error",
+    "filterBanned": "__MISSING__:Banned",
+    "filterCreditsExhausted": "__MISSING__:Credits Exhausted",
+    "noFilteredConnections": "__MISSING__:No connections match the current filter.",
     "failedSetAlias": "Gagal menetapkan alias",
+    "setAliasSuccess": "__MISSING__:Alias {alias} set",
+    "deleteAliasSuccess": "__MISSING__:Alias {alias} deleted",
     "failedSaveConnection": "Gagal menyimpan sambungan",
     "failedSaveConnectionRetry": "Gagal menyimpan sambungan. Sila cuba lagi.",
     "failedRetestConnection": "Gagal menguji semula sambungan",
@@ -3798,6 +4128,9 @@
     "connectionCount": "{count} sambungan",
     "fetchingModels": "Mengambil model yang tersedia...",
     "failedFetchModels": "Gagal mengambil model",
+    "noFreeModelsFound": "__MISSING__:No free models found for this provider — nothing imported.",
+    "fetchModelsSuccess": "__MISSING__:Found {count} new models",
+    "fetchModelsFailed": "__MISSING__:Could not auto-fetch models (you can retry from settings)",
     "noModelsFound": "Tiada model ditemui",
     "importFailed": "Import gagal",
     "noNewModelsAdded": "Tiada model baharu ditambahkan.",
@@ -3806,6 +4139,10 @@
     "importingModelsTitle": "Mengimport Model",
     "copyModel": "Salin model",
     "filterModels": "Tapis model…",
+    "testAllRateLimited": "__MISSING__:Rate limit reached, stopped early",
+    "hideFailedAuto": "__MISSING__:Auto-hide failed models",
+    "selectAllModels": "Select all",
+    "hideAllModels": "__MISSING__:Hide all",
     "modelsActive": "aktif",
     "showModel": "Tunjukkan model",
     "hideModel": "Sembunyikan model",
@@ -3814,6 +4151,9 @@
     "rateLimitUnprotected": "Tidak dilindungi",
     "enableRateLimitProtection": "Klik untuk mendayakan perlindungan had kadar",
     "disableRateLimitProtection": "Klik untuk melumpuhkan perlindungan had kadar",
+    "testAllProgress": "__MISSING__:Tested {done}/{total}",
+    "testAllFailedHidden": "__MISSING__:{count} failed models hidden",
+    "testAllDone": "__MISSING__:All models tested",
     "productionKey": "Kunci Pengeluaran",
     "enterNewApiKey": "Masukkan kunci API baharu",
     "codexApplyModalTitle": "Mohon kepada Local Codex",
@@ -3889,10 +4229,20 @@
     "errorTypeNetworkError": "Ralat rangkaian",
     "errorTypeTestUnsupported": "Ujian tidak disokong",
     "errorTypeUpstreamError": "Ralat huluan",
+    "errorTypeCreditsExhausted": "__MISSING__:No credits",
+    "errorTypeBanned": "__MISSING__:403 Banned",
     "proxySourceGlobal": "Global",
     "proxySourceProvider": "Pembekal",
     "proxySourceKey": "kunci",
     "proxyConfiguredBySource": "Proksi ({source}): {host}",
+    "proxyOn": "__MISSING__:Proxy On",
+    "proxyOff": "__MISSING__:Direct (bypass proxy)",
+    "proxyEnabledTitle": "__MISSING__:Proxy is enabled for this connection",
+    "proxyDisabledTitle": "__MISSING__:Direct connection — bypasses every proxy (including the global proxy) for this connection",
+    "perKeyProxyOn": "__MISSING__:Per-key",
+    "perKeyProxyOff": "__MISSING__:Connection",
+    "perKeyProxyEnabledTitle": "__MISSING__:Per-key proxy assignment enabled for this provider",
+    "perKeyProxyDisabledTitle": "__MISSING__:Per-key proxy assignment disabled for this provider",
     "autoPriority": "Auto: {priority}",
     "proxy": "proksi",
     "retestAuthentication": "Uji semula pengesahan",
@@ -3920,6 +4270,12 @@
     "compatProtocolOpenAI": "OpenAI Chat Completions",
     "compatProtocolOpenAIResponses": "OpenAI Responses API",
     "compatProtocolClaude": "Anthropic Messages",
+    "targetFormatLabel": "__MISSING__:Target Format",
+    "targetFormatHint": "__MISSING__:Override the upstream wire format. Use 'Anthropic Messages' to route OpenAI-compatible providers (e.g. opencode-go) through the /v1/messages endpoint.",
+    "targetFormatAuto": "__MISSING__:Default (auto)",
+    "targetFormatGemini": "__MISSING__:Gemini",
+    "targetFormatGeminiCli": "__MISSING__:Gemini CLI",
+    "targetFormatAntigravity": "__MISSING__:Antigravity",
     "compatUpstreamHeadersLabel": "Extra upstream headers",
     "compatUpstreamHeadersHint": "High-privilege setting — same trust level as editing provider API credentials; only trusted admins should use it. Merged after OmniRoute adds auth from the provider API key. If a custom header uses the same name as an existing one (e.g. Authorization), your value fully replaces the auto-generated header (including the Bearer token) — the upstream only sees what you typed, not the key from settings. Misconfiguration can cause 401 or broken upstream auth. One row per header (e.g. extra Authentication for some gateways). Hover or focus the value to preview. Saves on blur, outside click, or closing this panel.",
     "compatUpstreamHeaderName": "Header name",
@@ -3929,6 +4285,8 @@
     "compatBadgeUpstreamHeaders": "Headers",
     "perModelQuotaLabel": "Per Model Quota Label",
     "perModelQuotaDescription": "Per Model Quota Description",
+    "importFreeModelsOnlyLabel": "__MISSING__:Import only free models",
+    "importFreeModelsOnlyHint": "__MISSING__:When enabled, only this provider's free models are imported. Paid models are skipped.",
     "perModelQuotaToggle": "Togol Kuota Per-Model",
     "modelId": "ID model",
     "customModelPlaceholder": "cth. gpt-4.5-turbo",
@@ -3964,7 +4322,6 @@
     "email": "E-mel",
     "healthCheckMinutes": "Pemeriksaan Kesihatan (min)",
     "healthCheckHint": "Selang penyegaran token proaktif. 0 = kurang upaya.",
-    "selectAllModels": "Select all",
     "deselectAllModels": "Deselect all",
     "modelsActiveCount": "{active}/{total} active",
     "noModelsMatch": "No models match \"{filter}\"",
@@ -3976,6 +4333,9 @@
     "editCompatibleTitle": "Edit {type} Serasi",
     "compatibleBaseUrlHint": "Root URL of your {type}-compatible API. Use Advanced Settings for custom endpoint paths.",
     "apiKeyForCheck": "Kunci API (untuk Semakan)",
+    "testModelIdLabel": "__MISSING__:Model ID (optional)",
+    "testModelIdPlaceholder": "__MISSING__:e.g. my-model-id",
+    "testModelIdHint": "__MISSING__:If the provider lacks a /models endpoint, enter a model ID to validate via /chat/completions instead.",
     "compatibleProdPlaceholder": "{type} Serasi (Prod)",
     "tokenRefreshed": "Token refreshed successfully",
     "tokenRefreshFailed": "Token refresh failed",
@@ -4069,6 +4429,19 @@
     "codexAuthApplyFailed": "Failed to apply Codex auth.json locally",
     "codexAuthExported": "Codex auth.json exported",
     "codexAuthExportFailed": "Failed to export Codex auth.json",
+    "codexCliGuideButton": "__MISSING__:Codex CLI Guide",
+    "codexCliGuideTitle": "__MISSING__:Codex CLI Guide",
+    "codexCliGuideLoading": "__MISSING__:Loading guide...",
+    "codexCliGuideLoadFailed": "__MISSING__:Could not load the guide.",
+    "codexExternalLinkButton": "__MISSING__:External Codex link",
+    "codexExternalLinkModalTitle": "__MISSING__:External Codex link",
+    "codexExternalLinkModalDescription": "__MISSING__:Share this single-use link with the person who will authenticate the Codex account. They open it in their own browser, complete the OpenAI login, and the connection is registered here. The link expires in 15 minutes.",
+    "codexExternalLinkGenerating": "__MISSING__:Generating link...",
+    "codexExternalLinkWaiting": "__MISSING__:Waiting for browser authentication. This window refreshes automatically.",
+    "codexExternalLinkCreateFailed": "__MISSING__:Failed to generate the link.",
+    "codexExternalLinkNetworkError": "__MISSING__:Could not contact the server.",
+    "codexExternalLinkConnected": "__MISSING__:Codex account connected through the external link.",
+    "codexExternalLinkExpired": "__MISSING__:The link expired before completion.",
     "importCodexAuth": "Import pengesahan",
     "codexImportModalTitle": "Import Codex Auth",
     "codexImportTabSingle": "Bujang",
@@ -4146,6 +4519,8 @@
     "t3ChatWebCookiePlaceholder": "cembung-session-id=abc123...",
     "blockClaudeExtraUsageDescription": "Block Claude Extra Usage Description",
     "blockClaudeExtraUsageLabel": "Block Claude Extra Usage Label",
+    "disableCoolingDescription": "__MISSING__:Skip the transient cooldown so this connection stays eligible even after recoverable errors (terminal states like banned/expired still apply).",
+    "disableCoolingLabel": "__MISSING__:Disable cooldown for this connection",
     "bulkPasteAdded": "{count, plural, one {1 key added} other {# keys added}}",
     "bulkPasteDuplicatesIgnored": "{count, plural, one {1 duplicate skipped} other {# duplicates skipped}}",
     "bulkPasteHint": "Paste one API key per line. Empty lines are ignored and duplicate keys are skipped.",
@@ -4243,6 +4618,17 @@
     "personalAccessTokenLabel": "Personal Access Token Label",
     "qoderPatHint": "Qoder Pat Hint",
     "qoderPatPlaceholder": "Qoder Pat Placeholder",
+    "rateLimitOverridesSection": "__MISSING__:Rate Limit Overrides",
+    "rateLimitOverridesMaxConcurrentHint": "__MISSING__:Max concurrent requests override for this connection. Overrides the account-level cap.",
+    "rateLimitOverridesMaxConcurrentLabel": "__MISSING__:Max Concurrent (Rate Limit)",
+    "rateLimitOverridesMinTimeHint": "__MISSING__:Minimum time (ms) between requests. Overrides the default rate limiter delay.",
+    "rateLimitOverridesMinTimeLabel": "__MISSING__:Min Interval (ms)",
+    "rateLimitOverridesRpmHint": "__MISSING__:Max requests per minute for this connection. Overrides the provider default.",
+    "rateLimitOverridesRpmLabel": "__MISSING__:RPM (Requests/min)",
+    "rateLimitOverridesTpdHint": "__MISSING__:Max tokens per day for this connection. Overrides the provider default.",
+    "rateLimitOverridesTpdLabel": "__MISSING__:TPD (Tokens/day)",
+    "rateLimitOverridesTpmHint": "__MISSING__:Max tokens per minute for this connection. Overrides the provider default.",
+    "rateLimitOverridesTpmLabel": "__MISSING__:TPM (Tokens/min)",
     "refreshOauthTokenTitle": "Refresh Oauth Token Title",
     "regionHint": "Region Hint",
     "regionLabel": "Region Label",
@@ -4257,6 +4643,7 @@
     "searchProvider": "Search Provider",
     "searchProviderDesc": "Search Provider Desc",
     "searchProviders": "Cari pembekal...",
+    "searchByModel": "__MISSING__:Search by model…",
     "searchProvidersHeading": "Search Providers Heading",
     "searxngBaseUrlHint": "Searxng Base Url Hint",
     "searxngInfo": "Searxng Info",
@@ -4422,7 +4809,21 @@
     "webNoAuthGuideBody": "{provider} tidak memerlukan kunci API atau kuki. Simpan sambungan untuk menggunakan titik akhir web percumanya.",
     "webSessionCredentialValidationFailed": "Pengesahan kelayakan sesi gagal. Log masuk sekali lagi, salin bukti kelayakan baharu dan cuba lagi.",
     "checkCookie": "Semak kuki",
-    "checkWebToken": "Semak token"
+    "checkWebToken": "Semak token",
+    "huggingchatLabel": "__MISSING__:HuggingChat (Free)",
+    "huggingchatDesc": "__MISSING__:Free LLM chat via huggingface.co/chat",
+    "phindLabel": "__MISSING__:Phind (Free)",
+    "phindDesc": "__MISSING__:Free dev-focused AI chat",
+    "poeWebLabel": "__MISSING__:Poe Web",
+    "poeWebDesc": "__MISSING__:Multi-model chat via poe.com",
+    "veniceWebLabel": "__MISSING__:Venice Web",
+    "veniceWebDesc": "__MISSING__:Privacy-focused AI chat",
+    "v0VercelWebLabel": "__MISSING__:v0 Vercel Web",
+    "v0VercelWebDesc": "__MISSING__:AI code generation via v0.dev",
+    "kimiWebLabel": "__MISSING__:Kimi Web",
+    "kimiWebDesc": "__MISSING__:Chinese market AI chat via kimi.moonshot.cn",
+    "doubaoWebLabel": "__MISSING__:Doubao Web",
+    "doubaoWebDesc": "__MISSING__:ByteDance AI chat via doubao.com"
   },
   "settings": {
     "title": "tetapan",
@@ -4528,6 +4929,7 @@
     "memoryDesc": "Persistent cross-session conversational memory",
     "memoryEnabled": "Enable Memory",
     "memoryEnabledDesc": "When enabled, OmniRoute will inject relevant past context.",
+    "memoryTokenCostWarning": "__MISSING__:Heads up: with memory enabled, OmniRoute injects up to {tokens} tokens of retrieved context into every chat request — this increases token usage and cost. To skip injection for a specific request, send the \"x-omniroute-no-memory: true\" header.",
     "maxTokens": "Max Tokens",
     "retentionDays": "Retention",
     "recent": "Recent",
@@ -4566,6 +4968,15 @@
     "modelsDevInfoOrder": "User Override → models.dev → LiteLLM → Hardcoded Default",
     "systemTheme": "Tema Sistem",
     "debugToggle": "Enable Debug Mode",
+    "homePinProviderQuotaToHome": "Pin Information to Home Page",
+    "homeProviderQuotaLimits": "Provider Quota Limits",
+    "homeProviderQuotaLimitsDesc": "Pin the Provider Quota status container (with Refresh All button) to the top of the Home page.",
+    "homeQuickStart": "Quick Start",
+    "homeQuickStartDesc": "Show the Quick Start panel on the Home page.",
+    "homeProviderTopology": "Provider Topology",
+    "homeProviderTopologyDesc": "Show the Provider Topology on the Home page.",
+    "accountEmailVisibility": "__MISSING__:Account email visibility",
+    "accountEmailVisibilityDesc": "__MISSING__:Show full account emails across providers, combos, logs, quota, and playground screens. Turn this off to mask them by default.",
     "sidebarVisibilityToggle": "Show Sidebar Items",
     "enableCache": "Dayakan Cache",
     "cacheTTL": "Cache TTL",
@@ -4599,11 +5010,17 @@
     "autoDisableDescription": "Permanently mark provider connections as deactivated if they return specific terminal ban signals (e.g. HTTP 403 'verify your account'). This removes them from the combo rotation.",
     "autoDisableThreshold": "Ban Threshold",
     "autoDisableThresholdDesc": "Consecutive ban signals required before permanent deactivation.",
+    "customBannedSignals": "__MISSING__:Banned Keywords",
+    "customBannedSignalsDesc": "__MISSING__:Additional keywords that trigger permanent account ban detection. Built-in keywords always apply.",
+    "customBannedSignalsPlaceholder": "__MISSING__:e.g. api key revoked",
+    "noCustomBannedSignals": "__MISSING__:No custom keywords. Only built-in keywords are active.",
     "resilienceStructureTitle": "Resilience Structure",
     "resilienceStructureDesc": "Halaman ini hanya mengkonfigurasi tingkah laku. Keadaan pemutus langsung ditunjukkan pada halaman Kesihatan. Percubaan semula khusus kombo dan kawalan slot round-robin kekal pada tetapan kombo.",
     "enableThinking": "Dayakan Berfikir",
     "maxThinkingTokens": "Token Pemikiran Maks",
     "enableProxy": "Dayakan Proksi",
+    "perKeyProxyEnabled": "__MISSING__:Enable per-key proxy assignment",
+    "perKeyProxyEnabledDesc": "__MISSING__:When enabled, each provider connection can use its own proxy assignment",
     "proxyUrl": "URL proksi",
     "pricingRates": "Format Kadar Harga",
     "currentPricing": "Gambaran Keseluruhan Harga Semasa",
@@ -4683,6 +5100,13 @@
     "globalProxy": "Proksi Global",
     "globalProxyDesc": "Konfigurasikan proksi keluar global untuk semua panggilan API. Pembekal individu, kombo dan kunci boleh mengatasi perkara ini.",
     "noGlobalProxy": "Tiada proksi global dikonfigurasikan",
+    "proxyPool": "__MISSING__:Proxy Pool",
+    "freePool": "__MISSING__:Free Pool",
+    "proxyDocumentation": "__MISSING__:Proxy Documentation",
+    "proxyGlobalConfigTab": "__MISSING__:Global Config",
+    "proxyPoolTab": "__MISSING__:Proxy Pool",
+    "freePoolTab": "__MISSING__:Free Pool",
+    "proxyDocumentationTab": "__MISSING__:Documentation",
     "bulkHealthcheck": "Bulk Healthcheck",
     "bulkHealthcheckDesc": "Test all configured proxies against a target URL to find which ones work.",
     "healthcheckTesting": "Testing...",
@@ -4695,6 +5119,51 @@
     "healthcheckStatus": "Status",
     "healthcheckProxyUrl": "Proxy URL",
     "healthcheckLatency": "Latency",
+    "proxyDocumentationScopeTitle": "__MISSING__:Proxy scope resolution",
+    "proxyDocumentationScopeDescBefore": "__MISSING__:OmniRoute resolves the outbound proxy in priority order: ",
+    "proxyDocumentationScopeOrder": "__MISSING__:combo → account → provider → global",
+    "proxyDocumentationScopeDescAfter": "__MISSING__:. The most specific scope wins.",
+    "proxyDocumentationAddTitle": "__MISSING__:Adding a custom proxy",
+    "proxyDocumentationAddDescBefore": "__MISSING__:Go to the ",
+    "proxyDocumentationAddDescMiddle": "__MISSING__: tab → click ",
+    "proxyDocumentationAddCta": "__MISSING__:+ Add proxy",
+    "proxyDocumentationAddDescAfter": "__MISSING__:. Fill in type (http/https/socks5), host, and port. Optionally assign it to a scope.",
+    "proxyDocumentationBulkTitle": "__MISSING__:Bulk import format",
+    "proxyDocumentationBulkDesc": "__MISSING__:Pipe-delimited fields:",
+    "proxyDocumentationSocks5DescBefore": "__MISSING__:SOCKS5 proxies are disabled by default. Set",
+    "proxyDocumentationFreePoolDesc": "__MISSING__:The Free Pool tab aggregates proxies from 1proxy, Proxifly, and IPLocate. Use ⊕ to test and promote a proxy to your registry. Only proxies that pass the connectivity test are added.",
+    "proxyDocumentationVercelRelayDescBefore": "__MISSING__:The Vercel Relay is an outbound edge relay — not an inbound tunnel. Deploying one sends LLM API calls through Vercel's dynamic IPs, bypassing datacenter geo-blocks and rate limits. The relay is protected by a generated secret header",
+    "proxyDocumentationVercelRelayDescAfter": "__MISSING__:Your Vercel token is used only during deploy and is never stored.",
+    "vercelRelayTokenRequired": "__MISSING__:Token is required",
+    "vercelRelayDeployFailed": "__MISSING__:Deploy failed",
+    "vercelRelayTokenHint": "__MISSING__:Token is used only during deploy — never stored.",
+    "denoRelayTokenRequired": "__MISSING__:Deno Deploy token is required",
+    "denoRelayOrgDomainRequired": "__MISSING__:Organization domain is required",
+    "denoRelayDeployFailed": "__MISSING__:Deno Deploy failed",
+    "denoRelayTokenHint": "__MISSING__:Organization token (prefix ddo_) from console.deno.com → Organization → Settings → Organization Tokens. Used once for deploy and never stored.",
+    "denoRelayOrgDomainHint": "__MISSING__:Your Deno Deploy organization's default domain (e.g. acme.deno.net). The relay will be reachable at https://<app-name>.<org-slug>.deno.net.",
+    "proxyFreePoolFilterProtocol": "__MISSING__:Filter by protocol",
+    "proxyFreePoolProtocol": "__MISSING__:Protocol",
+    "proxyFreePoolCountryPlaceholder": "__MISSING__:Country (e.g. US)",
+    "proxyFreePoolFilterCountry": "__MISSING__:Filter by country",
+    "proxyFreePoolMinQualityPlaceholder": "__MISSING__:Min quality",
+    "proxyFreePoolMinQualityLabel": "__MISSING__:Minimum quality score",
+    "proxyFreePoolSyncAll": "__MISSING__:Sync All",
+    "proxyFreePoolTotal": "__MISSING__:Total",
+    "proxyFreePoolInPool": "__MISSING__:In pool",
+    "proxyFreePoolAvgQuality": "__MISSING__:Avg quality",
+    "proxyFreePoolSelected": "__MISSING__:{count} selected",
+    "proxyFreePoolAddSelected": "__MISSING__:Add selected to pool",
+    "proxyFreePoolAddVisible": "__MISSING__:Add all visible to pool",
+    "proxyFreePoolSource": "__MISSING__:Source",
+    "proxyFreePoolHostPort": "__MISSING__:Host:Port",
+    "proxyFreePoolType": "__MISSING__:Type",
+    "proxyFreePoolCountry": "__MISSING__:Country",
+    "proxyFreePoolQuality": "__MISSING__:Quality",
+    "proxyFreePoolLatency": "__MISSING__:Latency",
+    "proxyFreePoolEmpty": "__MISSING__:No proxies found. Click Sync All to fetch from sources.",
+    "close": "__MISSING__:Close",
+    "cancel": "__MISSING__:Cancel",
     "globalLabel": "Global",
     "configure": "Konfigurasikan",
     "globalSystemPrompt": "Gesaan Sistem Global",
@@ -4951,6 +5420,7 @@
     "systemStorage": "Sistem & Storan",
     "allDataLocal": "Semua data disimpan secara setempat pada mesin anda",
     "databasePath": "Laluan Pangkalan Data",
+    "export": "__MISSING__:Export",
     "exportDatabase": "Eksport Pangkalan Data",
     "exportAll": "Eksport Semua (.tar.gz)",
     "importDatabase": "Import Pangkalan Data",
@@ -5038,6 +5508,11 @@
     "adaptiveVolumeRoutingDesc": "Scale connections dynamically based on payload volume and throughput pressure.",
     "lkgpToggleTitle": "Last Known Good Provider (LKGP)",
     "lkgpToggleDesc": "When enabled, the router remembers which provider last served a successful response and tries it first on subsequent requests.",
+    "echoRequestedModelTitle": "__MISSING__:Echo requested model name in responses",
+    "echoRequestedModelDesc": "__MISSING__:When enabled, the response `model` field echoes the alias or combo name the client requested instead of the upstream model name. Fixes strict clients (e.g. Claude Desktop) that reject a response whose model does not match the request.",
+    "webSearchRouteTitle": "__MISSING__:Web search routing",
+    "webSearchRouteDesc": "__MISSING__:When a request includes a native web_search tool, route the whole request to this model instead of the default — useful for providers that don't implement Anthropic's web_search server tool. Leave blank to disable.",
+    "webSearchRoutePlaceholder": "__MISSING__:e.g. openrouter,anthropic/claude-3.5-sonnet",
     "clearLkgpCache": "Clear LKGP Cache",
     "lkgpCacheCleared": "LKGP cache cleared successfully",
     "lkgpCacheClearFailed": "Failed to clear LKGP cache",
@@ -5102,6 +5577,16 @@
     "clearSyncedPricing": "Clear Synced Pricing",
     "compressionTitle": "Prompt Compression",
     "compressionDesc": "Reduce token usage by compressing prompts before sending to providers",
+    "tokenSaverTitle": "__MISSING__:Token Saver",
+    "tokenSaverSubtitle": "__MISSING__:Spend fewer tokens on every request.",
+    "tokenSaverToolOutput": "__MISSING__:Tool output",
+    "tokenSaverToolOutputDesc": "__MISSING__:Clean git, grep, ls, tree, and log output before it reaches the provider.",
+    "tokenSaverLlmOutput": "__MISSING__:LLM output",
+    "tokenSaverLlmOutputDesc": "__MISSING__:Inject terse response instructions without rewriting provider output.",
+    "tokenSaverInputCompression": "__MISSING__:Input compression",
+    "tokenSaverInputCompressionDesc": "__MISSING__:Rewrite eligible chat history while preserving code, URLs, and intent.",
+    "tokenSaverFineTunePrefix": "__MISSING__:Fine-tune each engine on",
+    "tokenSaverFineTuneSuffix": "__MISSING__:or combine engines per request on",
     "compressionMode": "Compression Mode",
     "compressionModeOff": "Off",
     "compressionModeOffDesc": "No compression applied",
@@ -5121,6 +5606,11 @@
     "compressionUltraMinScore": "Ambang Skor Minimum",
     "compressionUltraSlmFallback": "Berundur kepada Agresif",
     "compressionUltraModelPath": "Laluan Model SLM",
+    "compressionUltraEngine": "__MISSING__:Ultra tier",
+    "compressionUltraEngineHeuristic": "__MISSING__:Heuristic (Tier-A, default)",
+    "compressionUltraEngineSlm": "__MISSING__:SLM (LLMLingua-2, opt-in)",
+    "compressionUltraSlmHint": "__MISSING__:SLM downloads a small ONNX model on first use (cold-start) and transparently falls back to the heuristic on timeout or if unavailable.",
+    "compressionUltraSlmPrewarm": "__MISSING__:Pre-warm SLM model on enable",
     "compressionSummarizerEnabled": "Dayakan Summarizer",
     "compressionMaxTokensPerMessage": "Token Maks Setiap Mesej",
     "compressionMinSavings": "Ambang Simpanan Min",
@@ -5308,13 +5798,22 @@
     "resilienceNo": "Tidak",
     "resilienceDefault": "Default",
     "storageDatabaseBackupRetention": "Pengekalan sandaran pangkalan data",
+    "storageDatabaseBackups": "__MISSING__:Database backups",
     "storagePurgeData": "Bersihkan Data",
+    "storagePurgeDataDesc": "__MISSING__:Immediately delete all records without applying retention checks. Use with caution.",
+    "storageRetentionCleanup": "__MISSING__:Retention Settings",
+    "storageRetentionCleanupDesc": "__MISSING__:Configure operational record retention and database backup cleanup.",
+    "retentionCallDays": "__MISSING__:Call {count}d",
+    "retentionAppDays": "__MISSING__:App {count}d",
+    "retentionRows": "__MISSING__:{count} rows",
     "retentionQuotaSnapshots": "Syot Kilat Kuota (hari)",
+    "retentionCompressionAnalytics": "__MISSING__:Compression Analytics (days)",
     "retentionMcpAudit": "Audit MCP (hari)",
     "retentionA2aEvents": "Acara A2A (hari)",
     "retentionCallLogs": "Log Panggilan (hari)",
     "retentionUsageHistory": "Sejarah Penggunaan (hari)",
     "retentionMemoryEntries": "Entri Memori (hari)",
+    "saveRetentionSettings": "__MISSING__:Save retention settings",
     "storageAutoVacuumMode": "Mod Auto Vakum",
     "storageScheduledVacuum": "Vakum Berjadual",
     "storageVacuumHour": "Jam Vakum (0-23)",
@@ -5328,10 +5827,16 @@
     "storageIntegrityOk": "✓ OK",
     "storageIntegrityError": "✗ Ralat",
     "storageUsageTokenBuffer": "Penampan Token Penggunaan",
+    "storageUsageTokenBufferDesc": "__MISSING__:Extra tokens added to reported usage to account for system prompt overhead.",
+    "storageUsageTokenBufferHint": "__MISSING__:Set to 0 to report raw provider token counts. Default: 2000.",
+    "storageUsageTokenBufferCurrent": "__MISSING__:Current: {value}",
     "compressionSettingsAutoTriggerMode": "Mod pencetus automatik",
     "compressionSettingsMcpDescriptionCompression": "Mampatan perihalan MCP",
+    "mcpAccessibilityTitle": "__MISSING__:MCP accessibility output",
     "compressionSettingsCavemanIntensity": "Keamatan manusia gua",
     "compressionSettingsCavemanOutputMode": "Mod keluaran manusia gua",
+    "compressionSettingsOutputStyles": "__MISSING__:Output styles",
+    "compressionStylesTileTitle": "__MISSING__:Output styles",
     "compressionSettingsOutputIntensity": "Keamatan output",
     "compressionSettingsAutoClarityBypass": "Pintasan kejelasan automatik",
     "resilienceWaitForCooldown": "Tunggu Cooldown",
@@ -5347,6 +5852,9 @@
     "cliproxyapiUrl": "URL CLIProxyAPI",
     "cliproxyapiStatus": "Status CLIProxyAPI",
     "cliproxyapiNotDetected": "Tidak dikesan",
+    "cliproxyapiImportAuthTitle": "__MISSING__:Import accounts from CLIProxyAPI",
+    "cliproxyapiImportAuthDesc": "__MISSING__:Import the OAuth accounts CLIProxyAPI already saved in ~/.cli-proxy-api/ as OmniRoute connections, so you don't have to log in to each account again. Supported account types (Gemini, Codex, Claude, Antigravity, Qwen, Kimi) are imported; others are skipped.",
+    "cliproxyapiImportAuthButton": "__MISSING__:Import accounts",
     "payloadRulesTitle": "Peraturan Muatan",
     "payloadRulesDesc": "__MISSING__:Configure request payload mutations by model and protocol. Changes are persisted in settings and hot reloaded into the runtime immediately after save.",
     "payloadRuleDefaultTitle": "__MISSING__:default",
@@ -5379,6 +5887,14 @@
     "maxResponseTokensDesc": "__MISSING__:Maximum total tokens allowed in a single response.",
     "modelCooldownsTitle": "Model dalam cooldown",
     "modelCooldownsEmpty": "Tiada model dalam cooldown sekarang.",
+    "responsesStateTitle": "__MISSING__:Responses State",
+    "responsesStateDesc": "__MISSING__:Control how OmniRoute forwards previous_response_id.",
+    "responsesStateModeLabel": "__MISSING__:previous_response_id handling",
+    "responsesStateModeAuto": "__MISSING__:Auto",
+    "responsesStateModeStrip": "__MISSING__:Strip",
+    "responsesStateModePreserve": "__MISSING__:Preserve",
+    "responsesStateHint": "__MISSING__:Auto strips previous_response_id unless a connection explicitly enables OpenAI Responses storage. Strip is safest for stateless clients such as VS Code Custom Endpoint; context then depends on the client sending full history.",
+    "responsesStateSaveError": "__MISSING__:Failed to update Responses state setting",
     "codexFastTierTitle": "Peringkat Cepat Codex",
     "codexFastTierDesc": "Suntikan service_tier=keutamaan secara global untuk permintaan OpenAI Codex.",
     "codexFastTierHint": "Apabila didayakan, OmniRoute menambah service_tier=priority kepada permintaan Codex keluar untuk sambungan yang belum menentukan peringkat. Peringkat keutamaan memerlukan kunci API OpenAI Enterprise atau laluan ChatGPT-auth Codex; jenis kunci lain akan menerima ralat berkaitan peringkat daripada OpenAI. Tetapan per sambungan pada halaman penyedia Codex diutamakan.",
@@ -5485,6 +6001,15 @@
     "resilienceEnableServerWaitDesc": "Apabila didayakan, OmniRoute menunggu sehingga tempoh bertenang pertama tamat tempoh dan cuba semula secara automatik.",
     "resilienceMaxAttempts": "Percubaan maksimum",
     "resilienceMaxWaitPerAttempt": "Penantian maksimum setiap percubaan",
+    "resilienceProviderCooldownTitle": "__MISSING__:Provider Cooldown",
+    "resilienceProviderCooldownScope": "__MISSING__:All combo requests",
+    "resilienceProviderCooldownTrigger": "__MISSING__:When a provider/connection fails",
+    "resilienceProviderCooldownEffect": "__MISSING__:Skips the failed provider for a cooldown period before retrying",
+    "resilienceProviderCooldownDesc": "__MISSING__:Prevents subsequent requests from re-walking the same failing providers. Cooldown scales exponentially with consecutive failures.",
+    "resilienceProviderCooldownEnabled": "__MISSING__:Enable global provider cooldown",
+    "resilienceProviderCooldownEnabledDesc": "__MISSING__:When enabled, failed providers are tracked globally and skipped for a cooldown period.",
+    "resilienceProviderCooldownMin": "__MISSING__:Minimum cooldown",
+    "resilienceProviderCooldownMax": "__MISSING__:Maximum cooldown",
     "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
     "forcedFingerprintBadge": "Required",
     "codexSessionAffinityTitle": "Perkaitan sesi Codex",
@@ -5506,13 +6031,45 @@
     "vercelRelayFreeTierNote": "__MISSING__:Relays are lightweight proxy endpoints deployed on Vercel's free tier to bypass local network/region limitations.",
     "vercelRelayDeploying": "__MISSING__:Deploying...",
     "vercelRelayDeploy": "__MISSING__:Deploy",
-    "homePinProviderQuotaToHome": "Pin Information to Home Page",
-    "homeProviderQuotaLimits": "Provider Quota Limits",
-    "homeProviderQuotaLimitsDesc": "Pin the Provider Quota status container (with Refresh All button) to the top of the Home page.",
-    "homeQuickStart": "Quick Start",
-    "homeQuickStartDesc": "Show the Quick Start panel on the Home page.",
-    "homeProviderTopology": "Provider Topology",
-    "homeProviderTopologyDesc": "Show the Provider Topology on the Home page."
+    "deployRelayButton": "__MISSING__:Deploy Relay",
+    "denoRelayButton": "__MISSING__:Deploy Deno Relay",
+    "denoRelayModalTitle": "__MISSING__:Deploy Deno Relay",
+    "denoRelayWarning": "__MISSING__:Warning: A Deno Deploy organization token is required. This token will only be used to create the relay app and will never be stored by OmniRoute.",
+    "denoRelayTokenLabel": "__MISSING__:Deno Deploy Organization Token",
+    "denoRelayOrgDomainLabel": "__MISSING__:Organization Domain",
+    "denoRelayProjectNameLabel": "__MISSING__:Deno App Name",
+    "denoRelayFreeTierNote": "__MISSING__:Deno Deploy v2 runs on a global edge network. Free tier: 1M requests & 100GiB outbound traffic per month, no per-request CPU limits, up to 20 active apps & 50 custom domains.",
+    "denoRelayDeploying": "__MISSING__:Deploying...",
+    "denoRelayDeploy": "__MISSING__:Deploy",
+    "cloudflareRelaySuccess": "__MISSING__:Cloudflare Relay deployed successfully",
+    "cloudflareRelayButton": "__MISSING__:Deploy Cloudflare Relay",
+    "cloudflareRelayModalTitle": "__MISSING__:Deploy Cloudflare Worker Relay",
+    "cloudflareRelayWarning": "__MISSING__:Deploys a Cloudflare Worker that proxies LLM requests through Cloudflare's edge network — masking the host IP behind dynamic Cloudflare addresses. The Worker enforces a one-time auth secret so the public workers.dev URL cannot be reused as an open relay.",
+    "cloudflareRelayTokenHowto": "__MISSING__:Create the API token under My Profile -> API Tokens -> Create Token -> Custom Token -> Account / Workers Scripts / Edit.",
+    "cloudflareRelayAccountIdLabel": "__MISSING__:Cloudflare Account ID",
+    "cloudflareRelayAccountIdHint": "__MISSING__:Found on the right side of the Cloudflare dashboard overview page.",
+    "cloudflareRelayApiTokenLabel": "__MISSING__:Cloudflare API Token",
+    "cloudflareRelayApiTokenHint": "__MISSING__:Requires 'Workers Scripts: Edit' permission. The token is used only at deploy time and is never stored.",
+    "cloudflareRelayProjectNameLabel": "__MISSING__:Worker Name",
+    "cloudflareRelayFreeTierNote": "__MISSING__:Free tier: 100,000 requests/day per Cloudflare account.",
+    "cloudflareRelayDeploying": "__MISSING__:Deploying...",
+    "cloudflareRelayDeploy": "__MISSING__:Deploy",
+    "cloudflareRelayCredsRequired": "__MISSING__:Account ID and API Token are required",
+    "cloudflareRelayDeployFailed": "__MISSING__:Deploy failed",
+    "modelLockout": "__MISSING__:Model Lockout",
+    "modelLockoutPageDescription": "__MISSING__:Configure which HTTP error codes trigger per-model lockout and control the cooldown behavior.",
+    "modelLockoutEnabled": "__MISSING__:Enable Model Lockout",
+    "modelLockoutEnabledDescription": "__MISSING__:When enabled, models that fail with configured error codes are temporarily locked to prevent retry loops.",
+    "modelLockoutErrorCodes": "__MISSING__:Error Codes",
+    "modelLockoutErrorCodesDescription": "__MISSING__:HTTP status codes that trigger model lockout. Type a code and click Add, or select from suggestions.",
+    "modelLockoutBaseCooldown": "__MISSING__:Base Cooldown (ms)",
+    "modelLockoutBaseCooldownDescription": "__MISSING__:Initial cooldown duration in milliseconds before a model can be retried.",
+    "modelLockoutMaxCooldown": "__MISSING__:Max Cooldown (ms)",
+    "modelLockoutMaxCooldownDescription": "__MISSING__:Maximum cooldown duration in milliseconds. Prevents excessively long lockouts.",
+    "modelLockoutExponentialBackoff": "__MISSING__:Exponential Backoff",
+    "modelLockoutExponentialBackoffDescription": "__MISSING__:When enabled, each consecutive failure increases the cooldown duration exponentially.",
+    "modelLockoutMaxBackoffSteps": "__MISSING__:Max Backoff Steps",
+    "modelLockoutMaxBackoffStepsDescription": "__MISSING__:Maximum number of backoff steps before the cooldown stops growing. The Max Cooldown cap is reached first in most configurations, making this a safety ceiling for when Max Cooldown is raised."
   },
   "contextRtk": {
     "title": "RTK Engine",
@@ -5563,7 +6120,21 @@
     "searchFilters": "Cari penapis...",
     "tooltipDedup": "Betapa agresifnya untuk mengalih keluar baris berulang.",
     "tooltipMaxChars": "Aksara maksimum bagi setiap blok output.",
-    "tooltipMaxLines": "Baris maksimum untuk disimpan daripada output arahan. Lebihan dipotong."
+    "tooltipMaxLines": "Baris maksimum untuk disimpan daripada output arahan. Lebihan dipotong.",
+    "learnDiscoverTitle": "__MISSING__:Learn & Discover filters",
+    "learnDiscoverDesc": "__MISSING__:Mine your captured command output (Raw Output retention must be on) to suggest new RTK filters. Suggestions only — you review and save them.",
+    "discoverHeading": "__MISSING__:Discover repeated noise",
+    "discoverButton": "__MISSING__:Scan samples",
+    "discoverScanning": "__MISSING__:Scanning…",
+    "discoverEmpty": "__MISSING__:No repeated noise found. Enable Raw Output retention and run a few commands first.",
+    "discoverSamples": "__MISSING__:{count} sample(s) scanned",
+    "discoverHits": "__MISSING__:{hits}× across samples",
+    "learnHeading": "__MISSING__:Learn a filter for a command",
+    "learnCommandPlaceholder": "__MISSING__:e.g. npm install",
+    "learnButton": "__MISSING__:Suggest filter",
+    "learnEmpty": "__MISSING__:No suggestion yet. Type a command you have run and scan.",
+    "learnSamplesUsed": "__MISSING__:Learned from {count} matching sample(s)",
+    "suggestionError": "__MISSING__:Could not load suggestions. Check management auth and try again."
   },
   "contextCombos": {
     "title": "Compression Combos",
@@ -5853,7 +6424,80 @@
     "routeConnectionLabel": "Sambungan",
     "scenarioVision": "Penglihatan (pemahaman imej)",
     "scenarioSchemaCoercion": "Paksaan skema (output berstruktur)",
-    "techniques": "Teknik:"
+    "techniques": "Teknik:",
+    "friendlyTitle": "__MISSING__:Translator",
+    "friendlySubtitle": "__MISSING__:Use your existing app with any provider — without rewriting code.",
+    "conceptHeadline": "__MISSING__:Your app speaks one API's \"language\". The Translator converts it to use another provider.",
+    "conceptDiagramAppLabel": "__MISSING__:Your app",
+    "conceptDiagramSourceLabel": "__MISSING__:Source format",
+    "conceptDiagramHubLabel": "__MISSING__:OpenAI (hub)",
+    "conceptDiagramTargetLabel": "__MISSING__:Target provider",
+    "conceptDiagramExampleApp": "__MISSING__:e.g. Anthropic SDK",
+    "conceptDiagramExampleSource": "__MISSING__:claude",
+    "conceptDiagramExampleTarget": "__MISSING__:Gemini",
+    "conceptHowItWorksToggle": "__MISSING__:How it works",
+    "conceptHowItWorksBody": "__MISSING__:Your app sends a request in its own format. The Translator detects the format, converts it through OpenAI as an intermediate hub (or directly when a direct translator is available), sends it to the chosen provider, and returns the response converted back to your app's format.",
+    "tabTranslate": "__MISSING__:Translate",
+    "tabMonitor": "__MISSING__:Monitor",
+    "tabTranslateAriaLabel": "__MISSING__:Go to the Translate tab",
+    "tabMonitorAriaLabel": "__MISSING__:Go to the Monitor tab",
+    "simpleAppUsesLabel": "__MISSING__:My app uses",
+    "simpleAppUsesHint": "__MISSING__:The API format your app speaks (e.g. Anthropic SDK = claude).",
+    "simpleSendToLabel": "__MISSING__:Send to",
+    "simpleSendToHint": "__MISSING__:Where to actually send the request (a provider connected in OmniRoute).",
+    "simpleStartWithLabel": "__MISSING__:Start with",
+    "simpleStartWithExamplePlaceholder": "__MISSING__:Select a ready-made example",
+    "simpleStartWithCustomOption": "__MISSING__:Paste your request (advanced)",
+    "simpleModeLabel": "__MISSING__:Mode",
+    "simpleModePreview": "__MISSING__:Preview translation only",
+    "simpleModeSend": "__MISSING__:Send and see response",
+    "simpleAdvancedToggle": "__MISSING__:Advanced",
+    "simpleInputPanelTitle": "__MISSING__:Input",
+    "simpleInputPanelHint": "__MISSING__:Free-text message or ready-made example",
+    "simpleResultPanelTitle": "__MISSING__:Translation + Response",
+    "narratedDetected": "__MISSING__:✓ Detected: {format}",
+    "narratedTranslating": "__MISSING__:Translating to {target}...",
+    "narratedSending": "__MISSING__:Sending to {target}...",
+    "narratedSuccess": "__MISSING__:→ translated to {target} · response in {latency}ms",
+    "narratedError": "__MISSING__:Failed: {reason}",
+    "narratedSeeTranslatedJson": "__MISSING__:see translated JSON",
+    "narratedSeePipeline": "__MISSING__:see pipeline",
+    "advancedSectionTitle": "__MISSING__:Advanced",
+    "advancedSectionSubtitle": "__MISSING__:Raw JSON, pipeline and technical tools. Everything here is the same as the old tabs — just reorganized.",
+    "advancedRawJsonTitle": "__MISSING__:Raw JSON (auto-detect + Monaco)",
+    "advancedRawJsonSubtitle": "__MISSING__:Paste a JSON request; the format is detected automatically.",
+    "advancedPipelineTitle": "__MISSING__:OpenAI intermediate pipeline",
+    "advancedPipelineSubtitle": "__MISSING__:Visualize each translation step (hub-and-spoke).",
+    "advancedStreamTransformTitle": "__MISSING__:Stream Transformer (Chat → Responses SSE)",
+    "advancedStreamTransformSubtitle": "__MISSING__:Converts Chat Completions SSE into Responses API.",
+    "advancedTestBenchTitle": "__MISSING__:Test Bench (8 scenarios)",
+    "advancedTestBenchSubtitle": "__MISSING__:Runs all scenarios and reports pass/fail + compatibility %.",
+    "advancedCompressionTitle": "__MISSING__:Compression Preview",
+    "advancedCompressionSubtitle": "__MISSING__:Estimate token savings across different compression modes.",
+    "monitorOriginHint": "__MISSING__:Events generated by Translate or the main pipeline appear here in real time.",
+    "monitorEmptyCta": "__MISSING__:Go to the Translate tab and send a request — it will appear here.",
+    "monitorOpenTranslateButton": "__MISSING__:Go to Translate",
+    "pipelineStepClientRequest": "__MISSING__:Client Request",
+    "pipelineStepClientRequestDesc": "__MISSING__:Request received in client format",
+    "pipelineStepFormatDetected": "__MISSING__:Format Detected",
+    "pipelineStepFormatDetectedDesc": "__MISSING__:Auto-detected source format",
+    "pipelineStepOpenAIIntermediate": "__MISSING__:OpenAI Intermediate",
+    "pipelineStepOpenAIIntermediateDesc": "__MISSING__:Translated to OpenAI hub format",
+    "pipelineStepProviderFormat": "__MISSING__:Provider Format",
+    "pipelineStepProviderFormatDesc": "__MISSING__:Translated to provider target format",
+    "pipelineStepProviderResponse": "__MISSING__:Provider Response",
+    "pipelineStepProviderResponseDesc": "__MISSING__:Streaming response from provider",
+    "conceptDiagramArrow1": "__MISSING__:speaks",
+    "conceptDiagramArrow2": "__MISSING__:translates",
+    "conceptDiagramArrow3": "__MISSING__:converts",
+    "conceptDiagramExampleHub": "__MISSING__:OpenAI",
+    "conceptDiagramHubTooltip": "__MISSING__:Intermediate hub used by the translator to convert between formats that don't have a direct mapping.",
+    "conceptDiagramSourceTooltip": "__MISSING__:The API format your app speaks (e.g., Anthropic SDK = claude).",
+    "conceptDiagramTargetTooltip": "__MISSING__:The provider where the request will actually be sent.",
+    "compressionEmptyHint": "__MISSING__:Fill in the input field on the Translate tab (Simple Controls or Raw JSON) to enable the preview.",
+    "compressionModeLabel": "__MISSING__:Compression mode",
+    "compressionPreviewButton": "__MISSING__:Preview Compression",
+    "compressionPreviewing": "__MISSING__:Previewing…"
   },
   "usage": {
     "title": "Penggunaan",
@@ -6010,6 +6654,8 @@
     "notApplicable": "T/A",
     "rawPlanWithValue": "Pelan mentah: {plan}",
     "noPlanFromProvider": "Tiada pelan daripada pembekal",
+    "tokenExpiresIn": "__MISSING__:Token expires in {time}",
+    "tokenExpired": "__MISSING__:Token expired",
     "noQuotaData": "Tiada data kuota",
     "cardExpand": "__MISSING__:Expand",
     "cardCollapse": "__MISSING__:Collapse",
@@ -6159,6 +6805,11 @@
     "quotaCutoffsButtonDefault": "Lalai",
     "quotaCutoffsButtonHelp": "Edit baki kuota minimum untuk akaun ini.",
     "quotaCutoffsButtonDisabled": "Tiada tetingkap kuota tersedia untuk akaun ini lagi.",
+    "deactivateAccount": "__MISSING__:Deactivate account (stop routing)",
+    "activateAccount": "__MISSING__:Activate account (resume routing)",
+    "accountActivated": "__MISSING__:Account activated",
+    "accountDeactivated": "__MISSING__:Account deactivated",
+    "toggleActiveFailed": "__MISSING__:Failed to update account status",
     "quotaCutoffsTitle": "Potongan kuota untuk {name} ({provider})",
     "quotaCutoffsExplainer": "Gantikan peratusan kuota minimum yang tinggal di mana akaun ini berhenti dipilih untuk setiap tetingkap kuota. Biarkan kosong untuk mewarisi lalai pembekal.",
     "quotaCutoffsDefaultHint": "Baki min lalai: {default}%",
@@ -6179,6 +6830,7 @@
     "budgetColDailyLim": "Lim harian",
     "budgetColMonthlyLim": "Lim bulanan",
     "budgetColUsedPct": "% terpakai",
+    "percentUsed": "__MISSING__:{pct}% used",
     "budgetLoading": "Memuatkan…",
     "budgetNoKeysMatch": "Tiada kunci sepadan dengan penapis",
     "budgetLinearExtrapolation": "ekstrapolasi linear",
@@ -7124,6 +7776,11 @@
     "modalEditTitle": "Modal Edit Title",
     "labelName": "Label Name",
     "labelType": "taip",
+    "labelFamily": "__MISSING__:IP family",
+    "familyAuto": "__MISSING__:Auto (dual-stack)",
+    "familyIpv4": "__MISSING__:IPv4 only",
+    "familyIpv6": "__MISSING__:IPv6 only",
+    "familyHint": "__MISSING__:Egress address family. Auto keeps dual-stack; IPv4/IPv6 pin this proxy to that family (prevents a v4 leak under an IPv6-only proxy).",
     "labelHost": "hos",
     "labelPort": "Pelabuhan",
     "labelUsername": "Nama pengguna",
@@ -7266,7 +7923,16 @@
     "improveConfirm": "Improve",
     "exportCode": "Export code",
     "exportCodeTitle": "Export Code",
+    "exportShort": "__MISSING__:Export",
     "noStateToExport": "No playground state available to export.",
+    "closeExportModal": "__MISSING__:Close export modal",
+    "close": "__MISSING__:Close",
+    "exportRealKeyWarning": "__MISSING__:Security warning: export blocked — a real API key was detected in the output. Please reset your API key and try again.",
+    "placeholderHintPrefix": "__MISSING__:Replace",
+    "placeholderHintSuffix": "__MISSING__:with your actual API key, or set it as an environment variable.",
+    "copyLangCode": "__MISSING__:Copy {language} code",
+    "loadingPresets": "__MISSING__:Loading…",
+    "loadPresetPlaceholder": "__MISSING__:Load preset…",
     "copyCode": "Copy",
     "copiedCode": "Copied!",
     "addModel": "+ Add model",
@@ -7291,7 +7957,27 @@
     "invalidJson": "Invalid JSON",
     "running": "Running…",
     "runLabel": "Run",
-    "enterToolResult": "Enter tool result…"
+    "enterToolResult": "Enter tool result…",
+    "build": {
+      "step1Label": "__MISSING__:What to test?",
+      "step2Label": "__MISSING__:Configure",
+      "step3Label": "__MISSING__:Run",
+      "step1Title": "__MISSING__:What do you want to test?",
+      "step1Subtitle": "__MISSING__:Choose the capability you want to explore in this session.",
+      "step2Title": "__MISSING__:Configure",
+      "step2Subtitle": "__MISSING__:Set up the tools or JSON schema that will be used in the request.",
+      "step3Title": "__MISSING__:Run",
+      "modeToolsTitle": "__MISSING__:Tools",
+      "modeToolsDesc": "__MISSING__:Test function calling — define tools and see how the model invokes them.",
+      "modeJsonTitle": "__MISSING__:JSON",
+      "modeJsonDesc": "__MISSING__:Test structured output — constrain the response to a JSON schema.",
+      "modeBothTitle": "__MISSING__:Tools + JSON",
+      "modeBothDesc": "__MISSING__:Combine function calling and structured output in a single request.",
+      "backButton": "__MISSING__:Back",
+      "nextButton": "__MISSING__:Next",
+      "runButton": "__MISSING__:Run",
+      "promptPlaceholder": "__MISSING__:Enter your message… (Enter to send, Shift+Enter for newline)"
+    }
   },
   "miniPlayground": {
     "endpoint": "__MISSING__:Endpoint",
@@ -7395,7 +8081,9 @@
     "loadingLogs": "Loading logs...",
     "noLogs": "No logs yet. Make some API calls to see them here.",
     "noMatchingLogs": "No logs matching current filters.",
-    "callLogsInfo": "Call logs are also saved as JSON files to {dataDir} and rotated based on {retentionDays} and {maxEntries}."
+    "callLogsInfo": "Call logs are also saved as JSON files to {dataDir} and rotated based on {retentionDays} and {maxEntries}.",
+    "loadMore": "__MISSING__:Load More",
+    "loadingMore": "__MISSING__:Loading more..."
   },
   "proxyLogger": {
     "filterAll": "All",
@@ -7432,7 +8120,8 @@
     "loadingProxyLogs": "Loading proxy logs...",
     "noProxyLogs": "No proxy logs yet. Configure proxies and make API calls to see them here.",
     "noMatchingLogs": "No logs match the current filters.",
-    "tlsFingerprint": "Chrome 124 TLS Fingerprint"
+    "tlsFingerprint": "Chrome 124 TLS Fingerprint",
+    "colPublicIp": "__MISSING__:Public IP"
   },
   "endpointOptions": {
     "speech": "Speech",
@@ -7572,7 +8261,86 @@
     "betaConfigSavedSuffix": "(belum berterusan pada pelayan). Penguatkuasaan had setiap permintaan belum disambungkan ke saluran paip proksi. Skrin ini membolehkan anda mereka bentuk dan menggambarkan pembahagian kuota; penguatkuasaan sebenar akan tiba dalam lelaran masa depan dengan kegigihan DB dan pemintasan panggilan huluan.",
     "policyLabel": "Dasar:",
     "resetIn": "set semula masuk",
-    "quotaTotal": "jumlah"
+    "quotaTotal": "jumlah",
+    "kpiAvgUtilization": "__MISSING__:Avg utilization",
+    "kpiBorrowingNow": "__MISSING__:Borrowing now",
+    "conceptTitle": "__MISSING__:How Quota Share works",
+    "conceptIntro": "__MISSING__:Quota Share divides a provider's quota among multiple API keys using work-conserving fair-share: each key receives a proportional slice but can borrow from the free balance without exceeding the global cap.",
+    "conceptFairShare": "__MISSING__:Fair-share: each key receives quota proportional to its configured weight",
+    "conceptBorrowing": "__MISSING__:Borrowing: keys can consume free balance from others without breaching the cap",
+    "conceptGlobalCap": "__MISSING__:Hard global cap: the provider's absolute limit is never exceeded",
+    "conceptWindows": "__MISSING__:Windows: 5h, hourly, daily, weekly, monthly — each tracked independently",
+    "conceptKeyHowTitle": "__MISSING__:Enabling a key for quota",
+    "conceptKeyHowDesc": "__MISSING__:Create the key normally in API Keys — it appears in the wizard's key step automatically. Tick Exclusive there to make it quota-only. No separate enable step.",
+    "conceptExclusiveTitle": "__MISSING__:What \"Exclusive\" does",
+    "conceptExclusiveDesc": "__MISSING__:An exclusive key only sees/uses the pool's quotaShared-* models — every other model is hidden from its /v1/models and blocked.",
+    "burnRateTitle": "__MISSING__:Burn rate",
+    "burnRateExhaustsIn": "__MISSING__:Exhausts in",
+    "dimensionResetIn": "__MISSING__:Resets in",
+    "realConsumedColumn": "__MISSING__:Consumed",
+    "deficitColumn": "__MISSING__:Deficit",
+    "borrowingIndicator": "__MISSING__:borrowing",
+    "migratedFromLocalStorageNotice": "__MISSING__:Pools successfully migrated from localStorage.",
+    "policyCapAbsoluteLabel": "__MISSING__:Absolute cap",
+    "policyCapAbsolutePlaceholder": "__MISSING__:Numeric limit (optional)",
+    "multiDimensionLabel": "__MISSING__:Multi-dimension",
+    "stackedBarTitle": "__MISSING__:Slices by API key",
+    "usedSuffix": "__MISSING__:used {percent}%",
+    "wizardTitle": "__MISSING__:New quota pool",
+    "editPoolTitle": "__MISSING__:Edit pool",
+    "saveChanges": "__MISSING__:Save changes",
+    "wizardStep1Label": "__MISSING__:Account",
+    "wizardStep2Label": "__MISSING__:Limit",
+    "wizardStep3Label": "__MISSING__:Keys",
+    "wizardStep1Title": "__MISSING__:Choose provider connection",
+    "wizardStep1Subtitle": "__MISSING__:Select the provider account this pool will share quota for, set a name and default policy.",
+    "wizardStep2Title": "__MISSING__:Configure quota dimensions",
+    "wizardStep2Subtitle": "__MISSING__:Define the quota plan dimensions (unit, window, limit) for the chosen connection. Leave unchanged to keep current settings.",
+    "wizardStep3Title": "__MISSING__:Allocate API keys",
+    "wizardStep3Subtitle": "__MISSING__:Assign API keys to this pool with weight % allocations and optional caps.",
+    "wizardPoolNameLabel": "__MISSING__:Pool name",
+    "wizardPoolNamePlaceholder": "__MISSING__:My quota pool",
+    "wizardNext": "__MISSING__:Next",
+    "wizardBack": "__MISSING__:Back",
+    "wizardCreatePool": "__MISSING__:Create pool",
+    "wizardDimensionsEditedNotice": "__MISSING__:Dimensions edited — will be saved as a manual override when the pool is created.",
+    "wizardExclusiveLabel": "__MISSING__:Exclusive quota",
+    "wizardExclusiveHint": "__MISSING__:When enabled, these API keys will only be allowed to use this pool's virtual models (allowedQuotas reconciliation is applied on save).",
+    "wizardPreviewLabel": "__MISSING__:Virtual model names preview",
+    "wizardConnectionsLabel": "__MISSING__:Provider connections",
+    "wizardPrimaryBadge": "__MISSING__:primary",
+    "wizardAdditionalConnectionsNote": "__MISSING__:Additional connections use their catalog default limits (editable later).",
+    "wizardSingleProviderNote": "__MISSING__:A pool uses a single provider",
+    "wizardPreviewMoreModels": "__MISSING__:+{count} more",
+    "accountQuotaTitle": "__MISSING__:Account quota",
+    "accountQuotaNone": "__MISSING__:—",
+    "logTitle": "__MISSING__:Usage log",
+    "logEmpty": "__MISSING__:No usage yet",
+    "groupLabel": "__MISSING__:Group",
+    "newGroup": "__MISSING__:New group",
+    "renameGroup": "__MISSING__:Rename group",
+    "groupSelectHint": "__MISSING__:Filter pools by group",
+    "groupAllocationNote": "__MISSING__:Allocations apply to all pools in this group via the shared quota layer.",
+    "groupNamePrompt": "__MISSING__:Enter group name",
+    "wizardGroupLabel": "__MISSING__:Group",
+    "allGroups": "__MISSING__:All groups",
+    "endpointsTitle": "__MISSING__:Available endpoints",
+    "endpointsHint": "__MISSING__:Call these virtual models with any allocated key — routing + quota are handled per group.",
+    "previewForKey": "__MISSING__:Preview for key",
+    "previewKeyNone": "__MISSING__:(all endpoints)",
+    "endpointsBaseUrl": "__MISSING__:Base URL",
+    "endpointsCollapse": "__MISSING__:Collapse",
+    "endpointsExpand": "__MISSING__:Expand",
+    "endpointsAnthropicNote": "__MISSING__:Anthropic-native",
+    "endpointsResponsesNote": "__MISSING__:OpenAI Responses — codex/github",
+    "endpointsWsNote": "__MISSING__:WebSocket — codex only",
+    "betaText": "__MISSING__:Quota Share is functional but bugs are expected. Found one? Please report it.",
+    "betaReportLink": "__MISSING__:Report an issue",
+    "deleteGroup": "__MISSING__:Delete group",
+    "deleteGroupConfirm": "__MISSING__:Delete this group? Its pools must be reassigned or removed first.",
+    "deleteGroupHasPools": "__MISSING__:This group still has pools — reassign or delete them first.",
+    "ungroupedTitle": "__MISSING__:Ungrouped",
+    "ungroupedHint": "__MISSING__:These pools are not assigned to a known group. Edit a pool to move it into a real group."
   },
   "plugins": {
     "title": "Plugins",
@@ -7608,6 +8376,571 @@
     "status": "Status",
     "enabled": "Enabled",
     "disabled": "Disabled",
+    "installedTab": "__MISSING__:Installed",
+    "marketplaceTab": "__MISSING__:Marketplace",
+    "marketplaceUrlLabel": "__MISSING__:Custom Marketplace URL",
+    "marketplaceUrlPlaceholder": "__MISSING__:Leave empty for official Omniroute registry",
+    "saveMarketplaceUrl": "__MISSING__:Save & Reload",
+    "marketplaceUrlSaved": "__MISSING__:Marketplace URL updated",
+    "marketplaceEmpty": "__MISSING__:No plugins found in marketplace.",
+    "verified": "__MISSING__:Verified",
+    "install": "__MISSING__:Install",
+    "installedFromMarketplace": "__MISSING__:Plugin {name} installed!",
     "hooks": "Hooks"
+  },
+  "quotaPlans": {
+    "title": "__MISSING__:Plans & Quotas",
+    "description": "__MISSING__:Configure quota plans per provider — dimensions (%, requests, tokens, $) and time windows",
+    "providerLabel": "__MISSING__:Provider / Connection",
+    "detectedPlanLabel": "__MISSING__:Detected plan",
+    "manualPlanLabel": "__MISSING__:Manual override",
+    "unconfiguredLabel": "__MISSING__:Not configured — manual required",
+    "dimensionLabel": "__MISSING__:Dimensions",
+    "addDimension": "__MISSING__:Add dimension",
+    "removeDimension": "__MISSING__:Remove",
+    "limitLabel": "__MISSING__:Limit",
+    "unitOptions": {
+      "percent": "__MISSING__:%",
+      "requests": "__MISSING__:requests",
+      "tokens": "__MISSING__:tokens",
+      "usd": "__MISSING__:USD ($)"
+    },
+    "windowOptions": {
+      "5h": "__MISSING__:5 hours",
+      "hourly": "__MISSING__:Hourly",
+      "daily": "__MISSING__:Daily",
+      "weekly": "__MISSING__:Weekly",
+      "monthly": "__MISSING__:Monthly"
+    },
+    "useCatalogButton": "__MISSING__:Use catalog",
+    "saveOverrideButton": "__MISSING__:Save override",
+    "revertToCatalogButton": "__MISSING__:Revert to catalog",
+    "unknownProviderNotice": "__MISSING__:Select a provider on the left to configure its quota plan.",
+    "catalogTitle": "__MISSING__:Known catalog",
+    "catalogDescription": "__MISSING__:Automatically detected plans for the following providers:"
+  },
+  "activity": {
+    "title": "__MISSING__:Activity",
+    "description": "__MISSING__:Recent events feed",
+    "emptyTitle": "__MISSING__:No activity yet",
+    "emptyDescription": "__MISSING__:When you add providers, create combos, or rotate keys, events will appear here.",
+    "todayHeader": "__MISSING__:Today",
+    "yesterdayHeader": "__MISSING__:Yesterday",
+    "filterAll": "__MISSING__:All",
+    "filterProviders": "__MISSING__:Providers",
+    "filterCombos": "__MISSING__:Combos",
+    "filterApiKeys": "__MISSING__:API Keys",
+    "filterSettings": "__MISSING__:Settings",
+    "filterQuota": "__MISSING__:Quota",
+    "filterAuth": "__MISSING__:Auth",
+    "filterSystem": "__MISSING__:System",
+    "relative": {
+      "justNow": "__MISSING__:just now",
+      "minutesAgo": "__MISSING__:{n} min ago",
+      "hoursAgo": "__MISSING__:{n} h ago",
+      "yesterday": "__MISSING__:yesterday",
+      "daysAgo": "__MISSING__:{n} days ago"
+    },
+    "eventVerb": {
+      "providerAdded": "__MISSING__:{actor} added provider {target}",
+      "providerRemoved": "__MISSING__:{actor} removed provider {target}",
+      "providerTested": "__MISSING__:{actor} tested provider {target}",
+      "comboCreated": "__MISSING__:{actor} created combo {target}",
+      "comboUpdated": "__MISSING__:{actor} updated combo {target}",
+      "comboDeleted": "__MISSING__:{actor} removed combo {target}",
+      "apiKeyCreated": "__MISSING__:{actor} created API key {target}",
+      "apiKeyRevoked": "__MISSING__:{actor} revoked API key {target}",
+      "apiKeyRotated": "__MISSING__:{actor} rotated API key {target}",
+      "budgetThreshold": "__MISSING__:Budget threshold reached for {target}",
+      "settingUpdated": "__MISSING__:{actor} updated setting {target}",
+      "authLogin": "__MISSING__:{actor} signed in",
+      "authLogout": "__MISSING__:{actor} signed out",
+      "cloudAgentSession": "__MISSING__:Cloud agent session started for {target}",
+      "mcpToolRegistered": "__MISSING__:MCP tool {target} registered",
+      "webhookCreated": "__MISSING__:{actor} created webhook {target}",
+      "webhookDeleted": "__MISSING__:{actor} removed webhook {target}",
+      "quotaPoolCreated": "__MISSING__:{actor} created quota pool {target}",
+      "quotaPoolUpdated": "__MISSING__:{actor} updated quota pool {target}",
+      "quotaPoolDeleted": "__MISSING__:{actor} removed quota pool {target}",
+      "quotaPlanUpdated": "__MISSING__:{actor} updated quota plan {target}",
+      "quotaStoreDriverChanged": "__MISSING__:QuotaStore driver changed",
+      "updateApplied": "__MISSING__:Update {target} applied",
+      "deployCompleted": "__MISSING__:Deploy completed",
+      "skillInstalled": "__MISSING__:{actor} installed skill {target}",
+      "skillRemoved": "__MISSING__:{actor} removed skill {target}",
+      "providerCredentialsCreated": "__MISSING__:{actor} created credentials for {target}",
+      "providerCredentialsApplied": "__MISSING__:Credentials for {target} applied",
+      "providerCredentialsUpdated": "__MISSING__:{actor} updated credentials for {target}",
+      "providerCredentialsRevoked": "__MISSING__:{actor} revoked credentials for {target}",
+      "providerCredentialsBatchRevoked": "__MISSING__:{actor} batch-revoked credentials",
+      "providerCredentialsBatchUpdated": "__MISSING__:{actor} batch-updated credentials",
+      "providerCredentialsBulkCreated": "__MISSING__:{actor} bulk-created credentials",
+      "providerCredentialsBulkImported": "__MISSING__:{actor} bulk-imported credentials",
+      "providerCredentialsImported": "__MISSING__:{actor} imported credentials",
+      "providerSsrfBlocked": "__MISSING__:SSRF attempt blocked for {target}",
+      "authLoginSuccess": "__MISSING__:{actor} signed in",
+      "authLoginError": "__MISSING__:Login error for {actor}",
+      "authLoginFailed": "__MISSING__:Login failed for {actor}",
+      "authLoginLocked": "__MISSING__:{actor} locked out after too many attempts",
+      "authLoginMisconfigured": "__MISSING__:Auth configuration invalid",
+      "authLoginSetupRequired": "__MISSING__:Auth setup required",
+      "authLogoutSuccess": "__MISSING__:{actor} signed out",
+      "syncTokenCreated": "__MISSING__:{actor} created sync token",
+      "syncTokenRevoked": "__MISSING__:{actor} revoked sync token",
+      "settingsUpdate": "__MISSING__:{actor} updated settings",
+      "settingsUpdateFailed": "__MISSING__:Settings update failed",
+      "serviceRevealApiKey": "__MISSING__:{actor} revealed API key for {target}",
+      "genericEvent": "__MISSING__:{actor} {target}"
+    }
+  },
+  "agentBridge": {
+    "title": "__MISSING__:AgentBridge",
+    "subtitle": "__MISSING__:Use IDE agents with OmniRoute models — no config required",
+    "riskBannerTitle": "__MISSING__:Use at your own risk",
+    "riskBannerBody": "__MISSING__:AgentBridge intercepts HTTPS traffic from IDE agents. By activating it you accept responsibility for compliance with the terms of service of each agent. Never use on devices or networks where TLS inspection is prohibited.",
+    "riskBannerDismiss": "__MISSING__:Dismiss",
+    "serverCardTitle": "__MISSING__:AgentBridge Server",
+    "statusRunning": "__MISSING__:Running",
+    "statusStopped": "__MISSING__:Stopped",
+    "statusActive": "__MISSING__:Active",
+    "statusDnsOff": "__MISSING__:DNS off",
+    "statusSetupRequired": "__MISSING__:Setup required",
+    "statusInvestigating": "__MISSING__:Investigating",
+    "serverPort": "__MISSING__:Port",
+    "serverConns": "__MISSING__:Connections",
+    "serverIntercepted": "__MISSING__:Intercepted",
+    "serverLastStarted": "__MISSING__:Last started",
+    "startServer": "__MISSING__:Start",
+    "stopServer": "__MISSING__:Stop",
+    "restartServer": "__MISSING__:Restart",
+    "trustCert": "__MISSING__:Trust Cert",
+    "downloadCert": "__MISSING__:Download Cert",
+    "regenerateCert": "__MISSING__:Regenerate Cert",
+    "starting": "__MISSING__:Starting…",
+    "stopping": "__MISSING__:Stopping…",
+    "restarting": "__MISSING__:Restarting…",
+    "trusting": "__MISSING__:Trusting…",
+    "regenerating": "__MISSING__:Regenerating…",
+    "upstreamCaLabel": "__MISSING__:Upstream CA Certificate (corporate)",
+    "upstreamCaPlaceholder": "__MISSING__:/etc/ssl/certs/corp-ca.pem",
+    "upstreamCaTest": "__MISSING__:Test TLS",
+    "upstreamCaTestOk": "__MISSING__:TLS test passed",
+    "upstreamCaTestError": "__MISSING__:TLS test failed — check the path and CA file",
+    "bypassSectionTitle": "__MISSING__:Bypass List",
+    "bypassSectionDesc": "__MISSING__:Hosts matching these patterns are tunneled directly (no TLS decryption). Defaults include banks, .gov, and corporate SSO.",
+    "bypassDefaultsLabel": "__MISSING__:Default bypass patterns (read-only)",
+    "bypassUserLabel": "__MISSING__:Custom bypass patterns (one per line, glob or regex)",
+    "saveBypassList": "__MISSING__:Save bypass list",
+    "agentListTitle": "__MISSING__:IDE Agents",
+    "filterAll": "__MISSING__:All",
+    "filterActive": "__MISSING__:Active",
+    "filterSetupRequired": "__MISSING__:Setup required",
+    "filterInvestigating": "__MISSING__:Investigating",
+    "searchAgents": "__MISSING__:Search agents…",
+    "noAgentsMatch": "__MISSING__:No agents match the current filter",
+    "agentHosts": "__MISSING__:Intercepted hosts",
+    "certTrusted": "__MISSING__:Certificate trusted",
+    "certNotTrusted": "__MISSING__:Certificate not trusted",
+    "investigatingNotice": "__MISSING__:This agent is under investigation. Hosts and API surface are still being confirmed. Setup will be available once the upstream API is documented.",
+    "modelMappingsLabel": "__MISSING__:Model mappings",
+    "sourceModel": "__MISSING__:Source model (agent native)",
+    "targetModel": "__MISSING__:Target model (OmniRoute)",
+    "noMappings": "__MISSING__:No model mappings configured. Run setup wizard to auto-detect models.",
+    "selectModel": "__MISSING__:Select…",
+    "saveMappings": "__MISSING__:Save mappings",
+    "setupWizard": "__MISSING__:Setup wizard",
+    "startDns": "__MISSING__:Start DNS",
+    "stopDns": "__MISSING__:Stop DNS",
+    "toggling": "__MISSING__:Toggling…",
+    "viewTraffic": "__MISSING__:View traffic",
+    "emptyNoProvidersTitle": "__MISSING__:No providers configured yet",
+    "emptyNoProvidersBody": "__MISSING__:To use AgentBridge, first connect at least one provider. It will be the destination where IDE requests are routed.",
+    "emptyGoToProviders": "__MISSING__:Go to Providers",
+    "wizardTitle": "__MISSING__:Setup wizard",
+    "wizardSubtitle": "__MISSING__:3-step setup",
+    "wizardStep1Label": "__MISSING__:Verify",
+    "wizardStep2Label": "__MISSING__:DNS",
+    "wizardStep3Label": "__MISSING__:Mappings",
+    "wizardStep1Desc": "__MISSING__:Confirm the server is running and the certificate is installed.",
+    "wizardStep2Desc": "__MISSING__:The following entries will be added to /etc/hosts to redirect traffic through AgentBridge:",
+    "wizardStep3Desc": "__MISSING__:You can now configure model mappings in the agent card. Restart the IDE to apply changes.",
+    "wizardStep3Success": "__MISSING__:Agent is configured!",
+    "wizardServerCheck": "__MISSING__:AgentBridge server",
+    "wizardRunning": "__MISSING__:running",
+    "wizardNotRunning": "__MISSING__:not running",
+    "wizardCertCheck": "__MISSING__:Certificate",
+    "wizardTrusted": "__MISSING__:trusted",
+    "wizardNotTrusted": "__MISSING__:not yet trusted — use Trust Cert button",
+    "wizardTutorialTitle": "__MISSING__:Setup instructions:",
+    "wizardEnableDns": "__MISSING__:Add /etc/hosts entries",
+    "wizardDnsAlreadyEnabled": "__MISSING__:DNS already enabled for this agent",
+    "enablingDns": "__MISSING__:Enabling…",
+    "modelSelectorTitle": "__MISSING__:Select target model",
+    "modelSelectorSearch": "__MISSING__:Search models…",
+    "noModelsFound": "__MISSING__:No models found",
+    "quickLinks": "__MISSING__:Quick links",
+    "quickLinkProviders": "__MISSING__:Configure providers",
+    "quickLinkInspector": "__MISSING__:View traffic in Traffic Inspector",
+    "maintenanceTitle": "__MISSING__:Maintenance & Diagnostics",
+    "maintenanceSubtitle": "__MISSING__:Self-test the capture pipeline, undo leftover system state, and move your setup between machines.",
+    "orphanedStateWarning": "__MISSING__:A previous session left system state behind (DNS spoof, CA, or system proxy). Run Repair to clean it up.",
+    "diagnose": "__MISSING__:Diagnose",
+    "diagnosing": "__MISSING__:Diagnosing…",
+    "diagnoseHealthy": "__MISSING__:Capture pipeline is healthy.",
+    "diagnoseUnhealthy": "__MISSING__:Capture pipeline has problems:",
+    "repair": "__MISSING__:Repair",
+    "repairing": "__MISSING__:Repairing…",
+    "repairDone": "__MISSING__:Repaired: {items}",
+    "repairNothing": "__MISSING__:Nothing to repair — system state is clean.",
+    "removeCa": "__MISSING__:Remove CA",
+    "removeCaConfirm": "__MISSING__:Remove CA?",
+    "removeCaDone": "__MISSING__:MITM root CA removed from the OS trust store.",
+    "removing": "__MISSING__:Removing…",
+    "confirm": "__MISSING__:Confirm",
+    "exportConfig": "__MISSING__:Export config",
+    "exporting": "__MISSING__:Exporting…",
+    "importConfig": "__MISSING__:Import config",
+    "importing": "__MISSING__:Importing…",
+    "importInvalidJson": "__MISSING__:The selected file is not valid JSON.",
+    "importDone": "__MISSING__:Imported {bypass} bypass · {hosts} hosts · {agents} agents",
+    "save": "__MISSING__:Save",
+    "saving": "__MISSING__:Saving…",
+    "cancel": "__MISSING__:Cancel",
+    "back": "__MISSING__:Back",
+    "next": "__MISSING__:Next",
+    "done": "__MISSING__:Done",
+    "loading": "__MISSING__:Loading…",
+    "riskNoticeTitle": "__MISSING__:Risk acknowledgment",
+    "riskNoticeBody": "__MISSING__:AgentBridge will intercept HTTPS traffic from this agent by redirecting its API hosts via DNS. Only enable if you accept responsibility for compliance with the agent's terms of service and any applicable network policies.",
+    "pageMoved": {
+      "goNow": "__MISSING__:Go now",
+      "message": "__MISSING__:The MITM Proxy now lives under AgentBridge.",
+      "title": "__MISSING__:This page has moved"
+    }
+  },
+  "trafficInspector": {
+    "title": "__MISSING__:Traffic Inspector",
+    "subtitle": "__MISSING__:Monitor LLM calls and debug any application's HTTPS traffic",
+    "captureModesTitle": "__MISSING__:Capture Modes",
+    "agentBridgeMode": "__MISSING__:AgentBridge",
+    "agentBridgeModeDesc": "__MISSING__:Capture traffic from all connected IDE agents",
+    "customHostsMode": "__MISSING__:Custom Hosts",
+    "customHostsModeDesc": "__MISSING__:Add specific hosts to intercept",
+    "httpProxyMode": "__MISSING__:HTTP Proxy",
+    "httpProxyModeDesc": "__MISSING__:Use HTTP_PROXY environment variable",
+    "systemWideMode": "__MISSING__:System-wide",
+    "systemWideModeDesc": "__MISSING__:Intercept all system traffic (advanced)",
+    "tproxyMode": "__MISSING__:TPROXY Decrypt",
+    "tproxyModeUnavailable": "__MISSING__:TPROXY decrypt requires Linux + root + the native addon",
+    "filterBarTitle": "__MISSING__:Filters",
+    "profileLlmOnly": "__MISSING__:LLM only",
+    "profileCustom": "__MISSING__:Custom",
+    "profileAll": "__MISSING__:All",
+    "filterHost": "__MISSING__:Filter host…",
+    "filterAgent": "__MISSING__:Agent",
+    "filterStatus": "__MISSING__:Status",
+    "pauseBtn": "__MISSING__:Pause",
+    "resumeBtn": "__MISSING__:Resume",
+    "clearBtn": "__MISSING__:Clear",
+    "exportHar": "__MISSING__:Export .har",
+    "recordSession": "__MISSING__:REC",
+    "stopSession": "__MISSING__:Stop",
+    "liveBadge": "__MISSING__:live",
+    "offlineBadge": "__MISSING__:offline",
+    "noRequests": "__MISSING__:No requests captured yet.",
+    "noRequestsDesc": "__MISSING__:Make sure AgentBridge is running or enable another capture mode.",
+    "selectRequest": "__MISSING__:Select a request to inspect it.",
+    "tabConversation": "__MISSING__:Conversation",
+    "tabHeaders": "__MISSING__:Headers",
+    "tabRequest": "__MISSING__:Request",
+    "tabResponse": "__MISSING__:Response",
+    "tabTiming": "__MISSING__:Timing",
+    "tabLlm": "__MISSING__:LLM",
+    "tabStats": "__MISSING__:Stats",
+    "requestHeaders": "__MISSING__:Request Headers",
+    "responseHeaders": "__MISSING__:Response Headers",
+    "rawEvents": "__MISSING__:Raw events",
+    "mergedView": "__MISSING__:Merged view",
+    "noBody": "__MISSING__:No body.",
+    "streaming": "__MISSING__:streaming…",
+    "manageHosts": "__MISSING__:Manage hosts",
+    "copySnippet": "__MISSING__:Copy proxy snippet",
+    "addHost": "__MISSING__:Add",
+    "hostPlaceholder": "__MISSING__:api.openai.com",
+    "noHostsYet": "__MISSING__:No custom hosts added yet.",
+    "noSessionsYet": "__MISSING__:No sessions yet",
+    "allTraffic": "__MISSING__:All traffic (no session)",
+    "sessionsDropdown": "__MISSING__:Sessions",
+    "annotationPlaceholder": "__MISSING__:Add a note…",
+    "contextFingerprint": "__MISSING__:Context fingerprint",
+    "llmProvider": "__MISSING__:Detected provider",
+    "llmApiKind": "__MISSING__:API kind",
+    "llmModel": "__MISSING__:Model",
+    "llmMessages": "__MISSING__:Messages",
+    "llmStream": "__MISSING__:Stream",
+    "llmMappedTo": "__MISSING__:Mapped to",
+    "llmCostEstimate": "__MISSING__:Cost estimate",
+    "systemProxyExitWarning": "__MISSING__:System-wide proxy still active — leave page anyway?",
+    "customHostsTitle": "__MISSING__:Custom Hosts",
+    "loading": "__MISSING__:Loading…",
+    "copied": "__MISSING__:Copied!",
+    "copy": "__MISSING__:Copy",
+    "httpProxyTitle": "__MISSING__:HTTP Proxy Snippet — port {port}",
+    "notRecording": "__MISSING__:Not recording",
+    "anyStatus": "__MISSING__:Any status",
+    "liveOnly": "__MISSING__:Live",
+    "viewingRecordedSession": "__MISSING__:Viewing recorded session",
+    "backToLive": "__MISSING__:Back to live",
+    "untitledSession": "__MISSING__:Untitled session",
+    "contextHistory": "__MISSING__:Context History",
+    "modelResponse": "__MISSING__:Model Response",
+    "conversationNoMessages": "__MISSING__:No messages found in this request.",
+    "conversationNotAvailable": "__MISSING__:Conversation data not available. This may not be an LLM request or the body could not be parsed.",
+    "loadingCharts": "__MISSING__:Loading charts…",
+    "statsErrors": "__MISSING__:Errors",
+    "statsLatency": "__MISSING__:Latency (last 50 requests)",
+    "statsNoData": "__MISSING__:No requests yet. Start a session recording to capture data for stats.",
+    "statsStatusDistribution": "__MISSING__:Status distribution",
+    "statsSuccessful": "__MISSING__:Successful",
+    "statsTotalRequests": "__MISSING__:Total requests",
+    "timingProxyOverhead": "__MISSING__:Proxy overhead",
+    "timingUpstreamResponse": "__MISSING__:Upstream response",
+    "timingNoData": "__MISSING__:No timing data available.",
+    "timingTotalLatency": "__MISSING__:Total latency",
+    "timingTimestamp": "__MISSING__:Timestamp",
+    "timingMethod": "__MISSING__:Method",
+    "timingStatus": "__MISSING__:Status",
+    "timingRequestSize": "__MISSING__:Request size",
+    "timingResponseSize": "__MISSING__:Response size",
+    "pausedNewBadge": "__MISSING__:{count} new",
+    "clearContextFilter": "__MISSING__:clear"
+  },
+  "cliCommon": {
+    "concept": {
+      "code": {
+        "title": "__MISSING__:CLI Code",
+        "phrase": "__MISSING__:Code tools you point at OmniRoute",
+        "flow": "__MISSING__:You → CLI Code → OmniRoute → Provider",
+        "seeOther": "__MISSING__:See →"
+      },
+      "agent": {
+        "title": "__MISSING__:CLI Agents",
+        "phrase": "__MISSING__:Broad-purpose autonomous CLI agents you point at OmniRoute",
+        "flow": "__MISSING__:You → CLI Agent → OmniRoute → Provider",
+        "seeOther": "__MISSING__:See →"
+      },
+      "acp": {
+        "title": "__MISSING__:ACP Agents",
+        "phrase": "__MISSING__:CLIs that OmniRoute spawns as execution backend (reverse flow)",
+        "flow": "__MISSING__:Client → OmniRoute → spawn CLI (stdio/ACP) → response",
+        "seeOther": "__MISSING__:See →"
+      }
+    },
+    "comparison": {
+      "title": "__MISSING__:Understand the 3 CLI types in OmniRoute",
+      "thisPage": "__MISSING__:This page",
+      "open": "__MISSING__:Open →",
+      "code": {
+        "title": "__MISSING__:Code tool",
+        "desc": "__MISSING__:Points to Omni",
+        "flow": "__MISSING__:you → CLI → Omni → provider",
+        "examples": "__MISSING__:e.g.: claude, codex"
+      },
+      "agent": {
+        "title": "__MISSING__:Broad autonomous agent",
+        "desc": "__MISSING__:Points to Omni",
+        "flow": "__MISSING__:you → agent → Omni",
+        "examples": "__MISSING__:e.g.: hermes, goose"
+      },
+      "acp": {
+        "title": "__MISSING__:CLI used as backend by Omni",
+        "desc": "__MISSING__:Reverse execution",
+        "flow": "__MISSING__:Omni → spawn CLI → resp",
+        "examples": "__MISSING__:e.g.: claude, codex (ACP)"
+      }
+    },
+    "card": {
+      "detected": "__MISSING__:Detected",
+      "notDetected": "__MISSING__:Not detected",
+      "configured": "__MISSING__:Configured",
+      "notConfigured": "__MISSING__:Not configured",
+      "configure": "__MISSING__:Configure →",
+      "howToInstall": "__MISSING__:How to install →",
+      "manualConfig": "__MISSING__:Manual config",
+      "installGuide": "__MISSING__:Install guide",
+      "endpointLabel": "__MISSING__:Endpoint",
+      "baseUrlFull": "__MISSING__:Full Base URL",
+      "baseUrlPartial": "__MISSING__:Partial Base URL",
+      "refreshDetection": "__MISSING__:Refresh detection",
+      "alsoAcp": "__MISSING__:also ACP",
+      "connectProviderHint": "__MISSING__:Connect a provider in Providers"
+    },
+    "detail": {
+      "back": "__MISSING__:Back",
+      "apply": "__MISSING__:Save",
+      "reset": "__MISSING__:Clear",
+      "manualConfig": "__MISSING__:Manual configuration",
+      "vendor": "__MISSING__:Vendor",
+      "category": "__MISSING__:Type",
+      "detectionStatus": "__MISSING__:Detection",
+      "configStatus": "__MISSING__:Configuration",
+      "baseUrlLabel": "__MISSING__:Base URL",
+      "apiKeyLabel": "__MISSING__:API Key",
+      "modelMappingLabel": "__MISSING__:Model mapping",
+      "noActiveProviders": "__MISSING__:No active providers.",
+      "noActiveProvidersDesc": "__MISSING__:Go to Providers to connect at least 1 provider before configuring the CLI.",
+      "openProviders": "__MISSING__:Open Providers →"
+    }
+  },
+  "cliCode": {
+    "pageTitle": "__MISSING__:CLI Code's",
+    "pageSubtitle": "__MISSING__:Code tools pointing to OmniRoute",
+    "searchPlaceholder": "__MISSING__:Search CLI…",
+    "filterDetectionLabel": "__MISSING__:Detection",
+    "filterBaseUrlLabel": "__MISSING__:Base URL",
+    "detectionAll": "__MISSING__:All",
+    "detectionInstalled": "__MISSING__:Installed",
+    "detectionNotFound": "__MISSING__:Not found",
+    "baseUrlAll": "__MISSING__:All",
+    "baseUrlFull": "__MISSING__:Full",
+    "baseUrlPartial": "__MISSING__:Partial"
+  },
+  "cliAgents": {
+    "pageTitle": "__MISSING__:CLI Agents",
+    "pageSubtitle": "__MISSING__:Broad-purpose autonomous CLI agents",
+    "refreshDetection": "__MISSING__:Refresh detection",
+    "searchPlaceholder": "__MISSING__:Search agent…",
+    "detectionFilterLabel": "__MISSING__:Detection",
+    "detectionAll": "__MISSING__:All",
+    "detectionInstalled": "__MISSING__:Installed",
+    "detectionNotInstalled": "__MISSING__:Not installed",
+    "visibleCount": "__MISSING__:{count} visible",
+    "emptyState": "__MISSING__:No CLI agents found with the current filters."
+  },
+  "acpAgents": {
+    "pageTitle": "__MISSING__:ACP Agents",
+    "pageSubtitle": "__MISSING__:CLIs that OmniRoute spawns as execution backend",
+    "scanning": "__MISSING__:Detecting agents…",
+    "refresh": "__MISSING__:Refresh",
+    "setupGuideTitle": "__MISSING__:Setup guide",
+    "setupGuideDetectCliTitle": "__MISSING__:Detect CLI",
+    "setupGuideDetectCliDesc": "__MISSING__:Agents are identified by running the --version command in PATH.",
+    "setupGuideCustomAgentTitle": "__MISSING__:Add custom agent",
+    "setupGuideCustomAgentDesc": "__MISSING__:Fill in the form below to register a custom CLI agent.",
+    "setupGuideCommandMissingTitle": "__MISSING__:Command not found",
+    "setupGuideCommandMissingDesc": "__MISSING__:Check that the binary is in PATH.",
+    "fingerprintSettingsHint": "__MISSING__:Configure routing and fingerprints in",
+    "settingsRoutingLink": "__MISSING__:Settings → Routing",
+    "installed": "__MISSING__:Installed",
+    "notFound": "__MISSING__:Not found",
+    "builtIn": "__MISSING__:Built-in",
+    "custom": "__MISSING__:Custom",
+    "agentUseCaseHint": "__MISSING__:Available for spawn via ACP.",
+    "remove": "__MISSING__:Remove",
+    "addCustomAgent": "__MISSING__:Add custom agent",
+    "addCustomAgentDesc": "__MISSING__:Register a custom CLI agent to be spawned via ACP.",
+    "addAgent": "__MISSING__:Add agent",
+    "agentName": "__MISSING__:Name",
+    "agentNamePlaceholder": "__MISSING__:e.g.: My Agent",
+    "binaryName": "__MISSING__:Binary",
+    "binaryNamePlaceholder": "__MISSING__:e.g.: myagent",
+    "versionCommand": "__MISSING__:Version command",
+    "versionCommandPlaceholder": "__MISSING__:e.g.: myagent --version",
+    "spawnArgs": "__MISSING__:Spawn arguments",
+    "spawnArgsPlaceholder": "__MISSING__:e.g.: --quiet, --json",
+    "cliCodeRedirectCta": "__MISSING__:Open CLI Code"
+  },
+  "agentSkills": {
+    "pageTitle": "__MISSING__:Agent Skills",
+    "pageSubtitle": "__MISSING__:Teach your agent to operate OmniRoute — 22 API areas + 20 CLI families",
+    "conceptCard": {
+      "agent": {
+        "title": "__MISSING__:Agent Skills — Outbound",
+        "description": "__MISSING__:Agent Skills are machine-readable SKILL.md documents that external AI agents (Claude Code, Cursor, Copilot…) fetch from GitHub to learn how to operate OmniRoute via REST or CLI. They are read by the agent, not executed by OmniRoute.",
+        "crossLinkLabel": "__MISSING__:Understand the difference →"
+      },
+      "omni": {
+        "title": "__MISSING__:Omni Skills — Inbound",
+        "description": "__MISSING__:Omni Skills are sandbox tools that OmniRoute injects into the model's context on every request. They are executed by OmniRoute, not read by the agent.",
+        "crossLinkLabel": "__MISSING__:Understand the difference →"
+      },
+      "comparison": {
+        "colAgent": "__MISSING__:Agent Skills",
+        "colOmni": "__MISSING__:Omni Skills",
+        "whatIs": {
+          "label": "__MISSING__:What it is",
+          "agent": "__MISSING__:Machine-readable SKILL.md that teaches an external agent to operate OmniRoute",
+          "omni": "__MISSING__:Executable tools that OmniRoute injects as tools into LLM requests"
+        },
+        "direction": {
+          "label": "__MISSING__:Direction",
+          "agent": "__MISSING__:Outbound — external agent learns to control OmniRoute",
+          "omni": "__MISSING__:Inbound — OmniRoute gives tools to models passing through it"
+        },
+        "executor": {
+          "label": "__MISSING__:Executor",
+          "agent": "__MISSING__:External agent (reads markdown → acts via API/CLI)",
+          "omni": "__MISSING__:OmniRoute itself (intercepts tool_calls, Docker sandbox)"
+        },
+        "storage": {
+          "label": "__MISSING__:Storage",
+          "agent": "__MISSING__:Dynamic catalog (/api/agent-skills) → SKILL.md on GitHub",
+          "omni": "__MISSING__:SQLite (SkillsMP / skills.sh / local)"
+        },
+        "tagline": {
+          "label": "__MISSING__:Tagline",
+          "agent": "__MISSING__:Teach your agent to use OmniRoute",
+          "omni": "__MISSING__:Give executable tools to OmniRoute models"
+        }
+      }
+    },
+    "filters": {
+      "category": "__MISSING__:Category",
+      "area": "__MISSING__:Area",
+      "searchPlaceholder": "__MISSING__:Search skills…"
+    },
+    "categoryApi": "__MISSING__:API",
+    "categoryCli": "__MISSING__:CLI",
+    "categoryConfig": "__MISSING__:Config",
+    "filterAll": "__MISSING__:All",
+    "coverageLabel": "__MISSING__:Coverage",
+    "mcpUrl": "__MISSING__:MCP URL",
+    "a2aLink": "__MISSING__:A2A",
+    "copyUrl": "__MISSING__:Copy URL",
+    "viewOnGithub": "__MISSING__:View on GitHub",
+    "previewLoading": "__MISSING__:Loading skill documentation…",
+    "previewError": "__MISSING__:Failed to load skill documentation.",
+    "previewEmpty": "__MISSING__:Select a skill to preview its documentation.",
+    "generateButton": "__MISSING__:Generate missing skills",
+    "coverageBar": {
+      "complete": "__MISSING__:Complete",
+      "partial": "__MISSING__:Partial"
+    },
+    "noSkillsFound": "__MISSING__:No skills found matching your filters.",
+    "regenerateConfirm": "__MISSING__:This will regenerate all missing SKILL.md files. Continue?",
+    "regenerateRunning": "__MISSING__:Regenerating skills…",
+    "regenerateSuccess": "__MISSING__:Skills regenerated successfully.",
+    "regenerateError": "__MISSING__:Failed to regenerate skills."
+  },
+  "freeProviderRankingsPage": {
+    "title": "__MISSING__:Free Provider Rankings",
+    "subtitle": "__MISSING__:Best free providers ranked by model ELO scores from Arena AI leaderboards",
+    "loading": "__MISSING__:Loading rankings...",
+    "errorLoading": "__MISSING__:Failed to load rankings",
+    "emptyState": "__MISSING__:No rankings available yet. Arena ELO data syncs on startup (daily) — check back shortly, or trigger a manual sync. Disable Arena ELO Sync in Feature Flags or set ARENA_ELO_SYNC_ENABLED=false to opt out.",
+    "bestModel": "__MISSING__:Best",
+    "allCategories": "__MISSING__:All Categories",
+    "categoryDefault": "__MISSING__:Default",
+    "categoryCoding": "__MISSING__:Coding",
+    "categoryReview": "__MISSING__:Review",
+    "categoryDocumentation": "__MISSING__:Documentation",
+    "categoryDebugging": "__MISSING__:Debugging",
+    "colRank": "__MISSING__:Rank",
+    "colProvider": "__MISSING__:Provider",
+    "colTopModel": "__MISSING__:Top Model",
+    "colScore": "__MISSING__:Score",
+    "colAvgScore": "__MISSING__:Avg Score",
+    "colModels": "__MISSING__:Models",
+    "colType": "__MISSING__:Type"
   }
 }
diff --git a/src/i18n/messages/nl.json b/src/i18n/messages/nl.json
index 559b02cad3..6e519cddad 100644
--- a/src/i18n/messages/nl.json
+++ b/src/i18n/messages/nl.json
@@ -393,6 +393,7 @@
     "cloudBenefitAccess": "Cloud Benefit Access",
     "maxRetries": "Max Retries",
     "queueTimeout": "Queue Timeout",
+    "queueDepth": "__MISSING__:Queue Depth",
     "addProvider": "Add Provider",
     "realtime": "Realtime",
     "totalTranslations": "Total Translations",
@@ -709,6 +710,7 @@
     "batchFilesListFilesTable": "Bestanden",
     "batchPageLoadingMore": "Meer laden…",
     "recommended": "__MISSING__:Recommended",
+    "understand": "__MISSING__:I understand",
     "batchConceptTitle": "Batch processing",
     "batchConceptSubtitle": "Process thousands of requests asynchronously at ~50% of the cost (24h window). Ideal for evaluations, classification, and embeddings.",
     "batchConceptHowItWorks": "How it works",
@@ -773,36 +775,13 @@
     "filesListUploadButton": "Upload",
     "filesListUsedByColumn": "Used by",
     "filesListUsedByNone": "None",
-    "filesListDelete": "Delete",
-    "filesListDownload": "Download",
-    "batchDetailActionCancel": "Cancel batch",
-    "batchDetailActionRetry": "Retry failed requests",
-    "batchDetailCancelling": "Cancelling…",
-    "batchDetailRetrying": "Preparing retry…",
-    "batchDetailCancelConfirm": "Cancel this batch? In-progress requests will stop.",
-    "batchActionCancelError": "Failed to cancel batch. Try again.",
-    "batchActionRetryError": "Failed to retry failed requests. Try again.",
-    "batchConceptRetentionNote": "Results and error files are retained for 30 days (Anthropic: 29 days)",
     "filesListUsedByRoleInput": "input",
     "filesListUsedByRoleOutput": "output",
     "filesListUsedByRoleError": "error",
-    "batchListProgressPartial": "(partial)",
     "filesListSizeColumn": "Size",
+    "batchListProgressPartial": "(partial)",
     "batchListProviderColumn": "Provider",
     "batchListProviderUnknown": "—",
-    "batchListBatchCreated": "Batch {id} created — refreshing list…",
-    "batchListBatchCreatedDismiss": "Dismiss",
-    "batchListRefreshing": "Refreshing…",
-    "batchListRefresh": "Refresh",
-    "uploadFileModalRemove": "Remove",
-    "uploadFileModalUploading": "Uploading…",
-    "wizardInputReading": "Reading file…",
-    "wizardInputReady": "Ready",
-    "wizardInputLargeFileLabel": "Large file — sampling validation",
-    "wizardInputCsvJsonlReady": "JSONL generated — ready to validate.",
-    "wizardInputLargeFileWarning": "Large file detected — validation runs by sampling (first 5 MB + last 100 KB). Full validation happens server-side.",
-    "wizardCostWindow24h": "24h completion window",
-    "wizardValidationFieldsOk": "required fields valid",
     "batchListProviderOther": "Other",
     "batchListTitle": "Batches",
     "batchListCount": "{count} batches",
@@ -839,8 +818,33 @@
     "wizardCostWindow": "Window",
     "wizardDestinationSelectProvider": "Select a provider…",
     "wizardDestinationSelectModel": "Select a model…",
-    "wizardDestinationConnectProvider": "Connect a provider"
+    "wizardDestinationConnectProvider": "Connect a provider",
+    "batchListBatchCreated": "Batch {id} created — refreshing list…",
+    "batchListBatchCreatedDismiss": "Dismiss",
+    "batchListRefreshing": "Refreshing…",
+    "batchListRefresh": "Refresh",
+    "uploadFileModalRemove": "Remove",
+    "uploadFileModalUploading": "Uploading…",
+    "wizardInputReading": "Reading file…",
+    "wizardInputReady": "Ready",
+    "wizardInputLargeFileLabel": "Large file — sampling validation",
+    "wizardInputCsvJsonlReady": "JSONL generated — ready to validate.",
+    "wizardInputLargeFileWarning": "Large file detected — validation runs by sampling (first 5 MB + last 100 KB). Full validation happens server-side.",
+    "wizardCostWindow24h": "24h completion window",
+    "wizardValidationFieldsOk": "required fields valid",
+    "filesListDelete": "Delete",
+    "filesListDownload": "Download",
+    "batchDetailActionCancel": "Cancel batch",
+    "batchDetailActionRetry": "Retry failed requests",
+    "batchDetailCancelling": "Cancelling…",
+    "batchDetailRetrying": "Preparing retry…",
+    "batchDetailCancelConfirm": "Cancel this batch? In-progress requests will stop.",
+    "batchActionCancelError": "Failed to cancel batch. Try again.",
+    "batchActionRetryError": "Failed to retry failed requests. Try again.",
+    "batchConceptRetentionNote": "Results and error files are retained for 30 days (Anthropic: 29 days)"
   },
+  "featureFlagOmnirouteEmergencyFallbackDescription": "__MISSING__:Route budget-exhausted requests to the emergency free fallback provider/model.",
+  "featureFlagArenaEloSyncEnabledDescription": "__MISSING__:Enable periodic Arena AI leaderboard ELO sync for model intelligence rankings.",
   "sidebar": {
     "home": "Thuis",
     "dashboard": "Dashboard",
@@ -968,6 +972,7 @@
     "aiFeaturesSection": "AI Features",
     "mcp": "MCP",
     "a2a": "A2A",
+    "plugins": "__MISSING__:Plugins",
     "apiEndpoints": "API Endpoints",
     "batchFiles": "Files",
     "analyticsEvals": "Evals",
@@ -976,6 +981,10 @@
     "analyticsComboHealth": "Combo Health",
     "analyticsCompression": "Compression",
     "costsBudget": "Budget",
+    "costsFreeTiers": "__MISSING__:Free-Tier Budget",
+    "costsFreeTiersSubtitle": "__MISSING__:Monthly free-token allowances",
+    "freeProviderRankings": "__MISSING__:Free Provider Rankings",
+    "freeProviderRankingsSubtitle": "__MISSING__:Best free providers ranked by model ELO scores",
     "costsQuotaShare": "Quota Sharing",
     "costsPricing": "Pricing",
     "logsProxy": "Proxy Logs",
@@ -987,10 +996,12 @@
     "settingsAppearance": "Appearance",
     "settingsAi": "AI Settings",
     "settingsSecurity": "Security",
+    "settingsAccessTokens": "__MISSING__:Access Tokens",
     "settingsFeatureFlags": "Functievlaggen",
     "settingsAuthz": "__MISSING__:Authz",
     "settingsRouting": "Routing",
     "settingsResilience": "Resilience",
+    "modelLockout": "__MISSING__:Model Lockout",
     "settingsAdvanced": "Advanced",
     "omniProxySection": "OmniProxy",
     "quotaTracker": "Provider Quota",
@@ -1036,6 +1047,8 @@
     "analyticsCompressionSubtitle": "Token savings stats",
     "analyticsSearchSubtitle": "Search tool analytics",
     "analyticsEvalsSubtitle": "Eval suite results",
+    "providerStats": "__MISSING__:Provider Stats",
+    "providerStatsSubtitle": "__MISSING__:Latency and performance metrics",
     "logsSubtitle": "Application logs",
     "logsProxySubtitle": "Proxy traffic logs",
     "consoleLogsSubtitle": "Console output",
@@ -1055,6 +1068,7 @@
     "agentSkillsSubtitle": "A2A skill registry",
     "mcpSubtitle": "MCP server controls",
     "a2aSubtitle": "A2A protocol server",
+    "pluginsSubtitle": "__MISSING__:Plugin marketplace & installs",
     "mediaSubtitle": "Cached media files",
     "batchFilesSubtitle": "Batch input/output files",
     "settingsSubtitle": "All settings",
@@ -1065,13 +1079,41 @@
     "settingsResilienceSubtitle": "Retries and breakers",
     "settingsAdvancedSubtitle": "Power user options",
     "settingsSecuritySubtitle": "Auth and encryption",
+    "settingsAccessTokensSubtitle": "__MISSING__:Scoped CLI tokens for remote mode",
     "settingsFeatureFlagsSubtitle": "Schakel systeemmogelijkheden in",
     "settingsSidebar": "Sidebar",
     "settingsSidebarSubtitle": "Customize sidebar layout",
     "settingsAuthzSubtitle": "__MISSING__:Route inventory and bypass policy",
     "docsSubtitle": "Documentation",
     "issuesSubtitle": "Report a bug",
-    "changelogSubtitle": "Release notes"
+    "changelogSubtitle": "Release notes",
+    "costsQuotaPlans": "__MISSING__:Plans & Quotas",
+    "costsQuotaPlansSubtitle": "__MISSING__:Configure plans by provider",
+    "activity": "__MISSING__:Activity",
+    "activitySubtitle": "__MISSING__:Friendly feed of recent events",
+    "logsGroup": "__MISSING__:Logs",
+    "systemGroup": "__MISSING__:System",
+    "costsOverview": "__MISSING__:Overview",
+    "costsOverviewSubtitle": "__MISSING__:Consolidated cost analysis",
+    "agentBridge": "__MISSING__:Agent Bridge",
+    "agentBridgeSubtitle": "__MISSING__:Intercept IDE agent traffic",
+    "trafficInspector": "__MISSING__:Traffic Inspector",
+    "trafficInspectorSubtitle": "__MISSING__:Monitor LLM calls + debug any HTTPS traffic",
+    "cliCode": "__MISSING__:CLI Code",
+    "cliCodeSubtitle": "__MISSING__:Code tools pointing to OmniRoute",
+    "cliAgents": "__MISSING__:CLI Agents",
+    "cliAgentsSubtitle": "__MISSING__:Autonomous CLI agents",
+    "acpAgents": "__MISSING__:ACP Agents",
+    "acpAgentsSubtitle": "__MISSING__:CLIs spawned by OmniRoute",
+    "skipToContent": "__MISSING__:Skip to content",
+    "unpinSection": "__MISSING__:Unpin section",
+    "pinSectionOpen": "__MISSING__:Pin section open",
+    "reloadPage": "__MISSING__:Reload Page",
+    "dragReorderSection": "__MISSING__:Drag to reorder section",
+    "dragReorderItem": "__MISSING__:Drag to reorder",
+    "cannotHide": "__MISSING__:This item cannot be hidden",
+    "alwaysVisible": "__MISSING__:Always visible",
+    "groupSeparatorLabel": "__MISSING__:Separator"
   },
   "webhooks": {
     "title": "Webhaken",
@@ -1272,7 +1314,47 @@
     "a2aEvents": "Evenementen",
     "a2aArtifacts": "Artefacten",
     "a2aNoTasks": "Geen A2A-taken geregistreerd.",
-    "a2aLoadingTasks": "A2A-taken laden..."
+    "a2aLoadingTasks": "A2A-taken laden...",
+    "actor": "__MISSING__:Actor",
+    "actorPlaceholder": "__MISSING__:Filter by actor",
+    "eventTypes": {
+      "apiKey.activate": "__MISSING__:API Key Activated",
+      "apiKey.ban": "__MISSING__:API Key Banned",
+      "apiKey.deactivate": "__MISSING__:API Key Deactivated",
+      "apiKey.regenerate": "__MISSING__:API Key Regenerated",
+      "apiKey.scopes.grant": "__MISSING__:API Key Scopes Granted",
+      "apiKey.scopes.revoke": "__MISSING__:API Key Scopes Revoked",
+      "apiKey.scopes.update": "__MISSING__:API Key Scopes Updated",
+      "apiKey.unban": "__MISSING__:API Key Unbanned",
+      "auth.login.error": "__MISSING__:Login Error",
+      "auth.login.failed": "__MISSING__:Login Failed",
+      "auth.login.locked": "__MISSING__:Login Locked",
+      "auth.login.misconfigured": "__MISSING__:Login Misconfigured",
+      "auth.login.setup_required": "__MISSING__:Login Setup Required",
+      "auth.login.success": "__MISSING__:Login Success",
+      "auth.logout.success": "__MISSING__:Logout Success",
+      "compliance.cleanup": "__MISSING__:Compliance Cleanup",
+      "provider.credentials.applied": "__MISSING__:Provider Credentials Applied",
+      "provider.credentials.batch_revoked": "__MISSING__:Provider Credentials Batch Revoked",
+      "provider.credentials.bulk_created": "__MISSING__:Provider Credentials Bulk Created",
+      "provider.credentials.bulk_imported": "__MISSING__:Provider Credentials Bulk Imported",
+      "provider.credentials.created": "__MISSING__:Provider Credentials Created",
+      "provider.credentials.imported": "__MISSING__:Provider Credentials Imported",
+      "provider.credentials.revoked": "__MISSING__:Provider Credentials Revoked",
+      "provider.credentials.updated": "__MISSING__:Provider Credentials Updated",
+      "provider.validation.ssrf_blocked": "__MISSING__:Provider SSRF Blocked",
+      "quota.plan.updated": "__MISSING__:Quota Plan Updated",
+      "quota.pool.created": "__MISSING__:Quota Pool Created",
+      "quota.pool.deleted": "__MISSING__:Quota Pool Deleted",
+      "quota.pool.updated": "__MISSING__:Quota Pool Updated",
+      "quota.store.driver_changed": "__MISSING__:Quota Store Driver Changed",
+      "server.start": "__MISSING__:Server Start",
+      "service.reveal_api_key": "__MISSING__:Service API Key Revealed",
+      "settings.update": "__MISSING__:Settings Updated",
+      "settings.update_failed": "__MISSING__:Settings Update Failed",
+      "sync.token.created": "__MISSING__:Sync Token Created",
+      "sync.token.revoked": "__MISSING__:Sync Token Revoked"
+    }
   },
   "themesPage": {
     "title": "Themes",
@@ -1381,7 +1463,8 @@
     "settingsResilienceDescription": "Circuit breaker, retry, and fallback configuration",
     "settingsAdvancedDescription": "Advanced payload rules, request limits, and proxy API settings",
     "mitmProxyDescription": "Configure MITM proxy settings for traffic inspection and debugging",
-    "oneProxyDescription": "Configure 1Proxy settings for advanced proxy chaining"
+    "oneProxyDescription": "Configure 1Proxy settings for advanced proxy chaining",
+    "omniSkillsDescription": "__MISSING__:Install and manage sandbox skills for automated prompt and tool execution"
   },
   "home": {
     "quickStart": "Snel beginnen",
@@ -1612,16 +1695,24 @@
     "ownUsageVisibilityDesc": "Sta deze sleutel toe het eigen statusendpoint aan te roepen voor eigen USD-gebruik, budgetpercentage en token-totalen.",
     "sharedAccountQuotaVisibility": "Gedeeld accountquotum",
     "sharedAccountQuotaVisibilityDesc": "Sta deze sleutel toe het gedeelde upstream-accountquotum te zien wanneer één expliciete verbinding is geconfigureerd.",
+    "localUsageCommand": "__MISSING__:Allow local usage command",
+    "localUsageCommandDesc": "__MISSING__:Allows this API key to use @@om-usage to retrieve cached usage and quota information without calling an upstream provider.",
+    "localUsageCommandBadge": "__MISSING__:Usage cmd",
     "keyCreated": "API-sleutel gemaakt",
     "keyCreatedSuccess": "Sleutel succesvol aangemaakt!",
     "keyCreatedNote": "Kopieer en bewaar deze sleutel nu. Deze wordt niet meer weergegeven.",
     "done": "Klaar",
     "savePermissions": "Bewaar machtigingen",
-    "endpointRestrictions": "__MISSING__:Allowed Endpoints",
-    "allEndpointsAllowed": "__MISSING__:This key can access all API endpoints.",
-    "endpointsRestricted": "__MISSING__:Restricted to {count} endpoint{count, plural, one {} other {s}}.",
+    "endpointRestrictions": "Allowed Endpoints",
+    "allEndpointsAllowed": "This key can access all API endpoints.",
+    "endpointsRestricted": "Restricted to {count} endpoint{count, plural, one {} other {s}}.",
     "autoResolve": "Auto-Resolve",
     "autoResolveDesc": "Auto-resolve ambiguous model names to native provider for this API key.",
+    "streamDefaultMode": "__MISSING__:Stream Default Compatibility",
+    "streamDefaultModeDesc": "__MISSING__:Controls omitted `stream` flags for this key. JSON mode returns non-streaming responses unless the client explicitly requests SSE.",
+    "streamDefaultLegacy": "__MISSING__:Legacy",
+    "streamDefaultJson": "__MISSING__:JSON Compatible",
+    "streamDefaultBadge": "__MISSING__:JSON stream default",
     "keyActive": "Key Active",
     "keyActiveDesc": "Enable or disable this API key. Disabled keys are immediately rejected with 403.",
     "accessSchedule": "Access Schedule",
@@ -1667,6 +1758,7 @@
     "keyOnlyAvailableAtCreation": "Full key available only at creation time — copy it when you first create the key",
     "modelsCount": "{count, plural, one {# model} other {# models}}",
     "lastUsedOn": "Laatste: {date}",
+    "viewCostsFor": "__MISSING__:View costs for {name}",
     "editPermissions": "Machtigingen bewerken",
     "deleteKey": "Sleutel verwijderen",
     "regenerateKey": "Sleutel opnieuw genereren",
@@ -1708,9 +1800,12 @@
     "shownOf": "__MISSING__:{shown} of {total} shown",
     "emptyFilterTitle": "__MISSING__:No keys match your filters",
     "emptyFilterClear": "__MISSING__:Clear filters",
-    "endpointRestrictions": "Allowed Endpoints",
-    "allEndpointsAllowed": "This key can access all API endpoints.",
-    "endpointsRestricted": "Restricted to {count} endpoint{count, plural, one {} other {s}}."
+    "disableNonPublicModels": "__MISSING__:Disable Non-Public Models",
+    "disableNonPublicModelsDesc": "__MISSING__:Reject requests for models that are not discovered or not marked as public in the provider catalog",
+    "normalKeysSection": "__MISSING__:Normal keys",
+    "quotaKeysSection": "__MISSING__:Quota keys",
+    "quotaPill": "__MISSING__:QUOTA",
+    "quotaModeOnly": "__MISSING__:qtSd-only"
   },
   "auditLog": {
     "title": "Auditlogboek",
@@ -1845,6 +1940,8 @@
     "freeQuota": "Free quota/mo",
     "scrapeUrl": "URL to scrape",
     "scrapeUrlPlaceholder": "https://example.com",
+    "scrapeUrlRequired": "__MISSING__:URL is required",
+    "scrapeUrlInvalid": "__MISSING__:Invalid URL — it must start with http:// or https://",
     "scrapeExtract": "Extract",
     "scrapeExtracting": "Extracting…",
     "scrapeFullPage": "Full page",
@@ -1858,6 +1955,8 @@
     "scrapeMetadata": "Metadata",
     "scrapeProvider": "Provider",
     "scrapeSize": "Size",
+    "scrapeEmptyState": "__MISSING__:Enter a URL to extract its content",
+    "scrapeProvidersAvailable": "__MISSING__:Available providers: Firecrawl, Jina Reader, Tavily.",
     "compareRun": "Compare",
     "compareRunning": "Comparing…",
     "autoProvider": "Auto (cheapest)",
@@ -2245,6 +2344,8 @@
     "leastLatency": "Minste latentie",
     "comboName": "Combinatienaam",
     "comboNamePlaceholder": "mijn-combo",
+    "comboDescription": "__MISSING__:Description",
+    "comboDescriptionPlaceholder": "__MISSING__:Optional note describing this combo",
     "deleteConfirm": "Deze combinatie verwijderen?",
     "noCombosYet": "Nog geen combo's",
     "comboCreated": "Combinatie is succesvol aangemaakt",
@@ -2284,6 +2385,8 @@
     "resetAwareDesc": "Brengt het resterende quotum in evenwicht met 5 uur en wekelijkse resets, waarna vergelijkbare scores worden afgerond",
     "strictRandom": "Strict Random",
     "strictRandomDesc": "Shuffle deck — uses each model once before reshuffling",
+    "fusion": "__MISSING__:Fusion",
+    "fusionDesc": "__MISSING__:Fans the prompt to every panel model in parallel, then a judge model synthesizes one final answer",
     "models": "Modellen",
     "autoBalance": "Automatische balans",
     "advancedSettings": "Geavanceerde instellingen",
@@ -2982,14 +3085,19 @@
     "ngrokStarted": "ngrok-tunnel begonnen",
     "ngrokStopped": "ngrok-tunnel gestopt",
     "ngrokRequestFailed": "Kan de ngrok-tunnel niet updaten",
-    "tokenSaverSubtitle": "Geef bij elk verzoek minder tokens uit.",
-    "tokenSaverToolOutput": "Gereedschapsuitvoer",
-    "tokenSaverLlmOutput": "LLM-uitvoer",
-    "tokenSaverInputCompression": "Invoercompressie",
     "apiEndpointsCatalogUnavailable": "API-catalogus niet beschikbaar",
     "apiEndpointsSearchPlaceholder": "Eindpunten zoeken...",
     "apiEndpointsRequiresAuth": "Vereist autorisatie",
     "apiEndpointsNoMatch": "Er zijn geen eindpunten die overeenkomen met uw filter",
+    "vscodeAliasTitle": "__MISSING__:VS Code Token Alias",
+    "vscodeAliasDescriptionReady": "__MISSING__:Ready-to-paste compatibility URLs using the /api/v1/vscode/TOKEN/... endpoint.",
+    "vscodeAliasDescriptionError": "__MISSING__:Showing placeholder URLs because CLI keys could not be loaded in this session.",
+    "vscodeAliasDescriptionLoading": "__MISSING__:Loading CLI keys. Placeholder URLs are shown until a key is available.",
+    "vscodeAliasDescriptionPlaceholder": "__MISSING__:Showing placeholder URLs. Create or activate an API key in CLI Tools to replace TOKEN.",
+    "vscodeAliasManage": "__MISSING__:CLI Tools",
+    "vscodeAliasBaseLabel": "__MISSING__:VS Code base",
+    "vscodeAliasModelsLabel": "__MISSING__:VS Code models",
+    "vscodeAliasChatLabel": "__MISSING__:VS Code chat",
     "localServer": "Lokale server",
     "cloudOmniroute": "Cloud OmniRoute",
     "copyUrl": "Kopieer URL",
@@ -3002,7 +3110,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
@@ -3178,42 +3289,187 @@
     "a2aStep3": "__MISSING__:Track and cancel tasks with {code1} and {code2}."
   },
   "memory": {
-    "title": "Memory Management",
-    "description": "View and manage stored memory entries",
-    "memories": "Memories",
-    "totalEntries": "Total Entries",
-    "tokensUsed": "Tokens Used",
-    "hitRate": "Hit Rate",
-    "loading": "Loading memories...",
-    "noMemories": "No memories found",
-    "search": "Search memories...",
-    "allTypes": "All Types",
-    "export": "Export",
-    "import": "Import",
-    "addMemory": "Add Memory",
-    "type": "Type",
-    "key": "Key",
-    "content": "Content",
-    "created": "Created",
-    "actions": "Actions",
-    "delete": "Delete",
-    "factual": "Factual",
-    "episodic": "Episodic",
-    "procedural": "Procedural",
-    "semantic": "Semantic",
     "a": "A",
-    "pipelineOk": "Pijplijn OK ({latencyMs}ms)",
-    "pipelineError": "Pijplijnfout",
-    "healthUnknown": "Gezondheid onbekend",
-    "checkingHealth": "Controleren…",
-    "checkHealth": "Controleer de gezondheid",
-    "pageInfo": "Pagina {page} van {totalPages} ({total} totaal)",
-    "previous": "Vorige",
-    "next": "Volgende",
+    "actions": "Actions",
+    "addMemory": "Add Memory",
+    "allTypes": "All Types",
     "cancel": "Annuleer",
-    "save": "Opslaan",
+    "checkHealth": "Controleer de gezondheid",
+    "checkingHealth": "Controleren…",
+    "compactOld": "__MISSING__:Compact old",
+    "concept": {
+      "title": "__MISSING__:Conversational Memory",
+      "description": "__MISSING__:OmniRoute learns from every conversation, remembering facts, episodes, procedures, and semantic concepts that make responses more accurate and context-aware.",
+      "howWorksToggle": "__MISSING__:How it works",
+      "howWorksContent": "__MISSING__:1. Automatic extraction: at the end of each response, facts and episodes are detected and saved automatically.\n2. Retrieval: before each response, the most relevant memories are searched via FTS5 (exact), vector (semantic), or hybrid RRF.\n3. Injection: relevant memories are injected into the assistant context to improve response quality.\n4. Management: use this page to view, edit, export, and compact old memories."
+    },
+    "content": "Content",
+    "contentPlaceholder": "Waarde- of JSON-inhoud om te onthouden",
+    "created": "Created",
+    "delete": "Delete",
+    "deleteConfirmDesc": "__MISSING__:This action cannot be undone. The memory will be permanently removed.",
+    "deleteConfirmTitle": "__MISSING__:Delete memory?",
+    "description": "View and manage stored memory entries",
+    "editMemory": "__MISSING__:Edit memory",
+    "editModal": {
+      "title": "__MISSING__:Edit Memory",
+      "metadataLabel": "__MISSING__:Metadata (JSON)",
+      "metadataInvalid": "__MISSING__:Invalid JSON",
+      "saveFailed": "__MISSING__:Failed to save memory"
+    },
+    "embedding": {
+      "autoLabel": "__MISSING__:Automatic",
+      "autoDesc": "__MISSING__:Uses best available: remote provider > static > transformers",
+      "remoteLabel": "__MISSING__:Remote provider",
+      "remoteDesc": "__MISSING__:Uses embedding via provider API (requires API key)",
+      "staticLabel": "__MISSING__:Static local (potion)",
+      "staticDesc": "__MISSING__:Local embedding without WASM or external dependencies",
+      "transformersLabel": "__MISSING__:Transformers.js (MiniLM)",
+      "transformersDesc": "__MISSING__:Local embedding via @huggingface/transformers (~400MB RAM)",
+      "providerModelLabel": "__MISSING__:Provider / Model",
+      "noRemoteProviders": "__MISSING__:No providers with configured API key",
+      "selectProviderModel": "__MISSING__:Select a model",
+      "staticEnabledLabel": "__MISSING__:Enable Static Potion",
+      "staticEnabledDesc": "__MISSING__:Download and use potion-base-8M model locally",
+      "transformersEnabledLabel": "__MISSING__:Enable Transformers.js",
+      "transformersEnabledDesc": "__MISSING__:Opt-in for local MiniLM (~400MB RAM, ~3s cold start)",
+      "transformersWarning": "__MISSING__:Requires ~400MB RAM and ~3s cold start on the first semantic query."
+    },
+    "emptyState": {
+      "title": "__MISSING__:No memories yet",
+      "description": "__MISSING__:Memories are created automatically from conversations. You can also add them manually using the button above."
+    },
+    "engine": {
+      "statusTitle": "__MISSING__:Engine Status",
+      "embeddingTitle": "__MISSING__:Embedding Source",
+      "rerankTitle": "__MISSING__:Rerank (optional)",
+      "reindexNow": "__MISSING__:Reindex now",
+      "reindexStarted": "__MISSING__:Reindexing started ({pending} pending)",
+      "reindexFailed": "__MISSING__:Failed to start reindexing",
+      "keywordLabel": "__MISSING__:Keyword (FTS5)",
+      "keywordReason": "__MISSING__:Keyword search always available",
+      "embeddingLabel": "__MISSING__:Embedding",
+      "vectorStoreLabel": "__MISSING__:Vector Store",
+      "qdrantLabel": "__MISSING__:Qdrant",
+      "rerankLabel": "__MISSING__:Rerank",
+      "qdrantDisabled": "__MISSING__:Disabled",
+      "qdrantOk": "__MISSING__:Healthy ({latencyMs}ms)",
+      "qdrantError": "__MISSING__:Connection error",
+      "needsReindex": "__MISSING__:{count} memory(ies) need reindexing",
+      "configureCta": "__MISSING__:Configure",
+      "vectorStoreInstallHint": "__MISSING__:To enable vector search: npm install sqlite-vec (needs native Node.js, not WASM), then restart."
+    },
+    "episodic": "Episodic",
+    "export": "Export",
+    "factual": "Factual",
+    "healthUnknown": "Gezondheid onbekend",
+    "hitRate": "Hit Rate",
+    "import": "Import",
+    "importError": "__MISSING__:Failed to import file",
+    "importResult": "__MISSING__:{imported} imported, {skipped} skipped",
+    "key": "Key",
     "keyPlaceholder": "bijv. gebruikersvoorkeuren.thema",
-    "contentPlaceholder": "Waarde- of JSON-inhoud om te onthouden"
+    "loading": "Loading memories...",
+    "memories": "Memories",
+    "next": "Volgende",
+    "noMemories": "No memories found",
+    "pageInfo": "Pagina {page} van {totalPages} ({total} totaal)",
+    "pipelineError": "Pijplijnfout",
+    "pipelineOk": "Pijplijn OK ({latencyMs}ms)",
+    "playground": {
+      "infoTitle": "__MISSING__:Memory Playground",
+      "infoDesc": "__MISSING__:Simulate what would be retrieved for a given query. No memories are modified — read-only preview.",
+      "queryLabel": "__MISSING__:Test query",
+      "queryPlaceholder": "__MISSING__:Type a question or test phrase...",
+      "strategyLabel": "__MISSING__:Strategy",
+      "strategyExact": "__MISSING__:Exact (FTS5)",
+      "strategySemantic": "__MISSING__:Semantic (vector)",
+      "strategyHybrid": "__MISSING__:Hybrid (RRF)",
+      "budgetLabel": "__MISSING__:Budget (tokens)",
+      "simulate": "__MISSING__:Simulate",
+      "resultsTitle": "__MISSING__:{count} result(s)",
+      "resolutionTitle": "__MISSING__:Search resolution",
+      "resolutionEmbedding": "__MISSING__:Embedding",
+      "resolutionStore": "__MISSING__:Vector store",
+      "resolutionStrategy": "__MISSING__:Strategy used",
+      "rerankApplied": "__MISSING__:Rerank applied",
+      "fallback": "__MISSING__:Fallback",
+      "noResults": "__MISSING__:No memories found for this query.",
+      "tokensUsed": "__MISSING__:tokens used",
+      "none": "__MISSING__:none",
+      "errorFetch": "__MISSING__:Failed to fetch preview"
+    },
+    "previous": "Vorige",
+    "procedural": "Procedural",
+    "qdrant": {
+      "title": "__MISSING__:Qdrant (Vector Store Tier 2)",
+      "description": "__MISSING__:Optional Qdrant integration for scalable semantic search",
+      "enableLabel": "__MISSING__:Enable Qdrant",
+      "enableDesc": "__MISSING__:When enabled, Qdrant is used as the primary vector store",
+      "testConnection": "__MISSING__:Test connection",
+      "testing": "__MISSING__:Testing...",
+      "statusActive": "__MISSING__:Active",
+      "statusError": "__MISSING__:Error",
+      "statusDisabled": "__MISSING__:Disabled",
+      "healthOk": "__MISSING__:Connection OK ({latencyMs}ms)",
+      "healthError": "__MISSING__:Connection error",
+      "saved": "__MISSING__:Settings saved",
+      "saveError": "__MISSING__:Failed to save",
+      "portLabel": "__MISSING__:Port",
+      "embeddingModelLabel": "__MISSING__:Embedding Model",
+      "optional": "__MISSING__:optional",
+      "apiKeyKeepPlaceholder": "__MISSING__:Leave blank to keep current key",
+      "apiKeyOptional": "__MISSING__:Leave blank if not using authentication",
+      "removeApiKey": "__MISSING__:Remove",
+      "quickSelectModel": "__MISSING__:Quick select",
+      "searchTestTitle": "__MISSING__:Semantic search test",
+      "searchPlaceholder": "__MISSING__:Type a test query...",
+      "searching": "__MISSING__:Searching...",
+      "search": "__MISSING__:Search",
+      "cleanupTitle": "__MISSING__:Clean up old points",
+      "cleanupDesc": "__MISSING__:Remove Qdrant points for expired memories (retention period).",
+      "cleaning": "__MISSING__:Cleaning...",
+      "cleanNow": "__MISSING__:Clean now",
+      "cleanupSuccess": "__MISSING__:{count} point(s) removed",
+      "cleanupFailed": "__MISSING__:Cleanup failed"
+    },
+    "rerank": {
+      "enableLabel": "__MISSING__:Enable Rerank",
+      "enableDesc": "__MISSING__:Reorders results with a reranking model after search",
+      "warning": "__MISSING__:Rerank adds +200-500ms latency and additional cost per request. Use sparingly.",
+      "providerModelLabel": "__MISSING__:Rerank Provider / Model",
+      "noProviderWithKey": "__MISSING__:No provider with configured API key. Configure a provider to use rerank.",
+      "selectProviderModel": "__MISSING__:Select a provider/model"
+    },
+    "save": "Opslaan",
+    "saving": "__MISSING__:Saving...",
+    "search": "Search memories...",
+    "semantic": "Semantic",
+    "summarize": {
+      "title": "__MISSING__:Compact old memories",
+      "noCandidates": "__MISSING__:No memories eligible for compaction (criteria: >30 days old).",
+      "candidatesDesc": "__MISSING__:{count} memories will be compacted into summaries. This action cannot be undone.",
+      "confirm": "__MISSING__:Compact now"
+    },
+    "tabs": {
+      "memories": "__MISSING__:Memories",
+      "playground": "__MISSING__:Playground",
+      "engine": "__MISSING__:Engine"
+    },
+    "title": "Memory Management",
+    "tokensUsed": "Tokens Used",
+    "tooltip": {
+      "totalEntries": "__MISSING__:Total memories stored for this API key",
+      "tokensUsed": "__MISSING__:Estimated total tokens occupied by active memories",
+      "hitRate": "__MISSING__:Read-by-ID cache hit rate (not semantic recall accuracy)",
+      "factual": "__MISSING__:Objective, permanent facts from user context",
+      "episodic": "__MISSING__:Events and experiences from conversation history",
+      "procedural": "__MISSING__:Procedures, workflows, and instructions the assistant should follow",
+      "semantic": "__MISSING__:Concepts, preferences, and domain knowledge"
+    },
+    "totalEntries": "Total Entries",
+    "type": "Type",
+    "memoryEnabled": "__MISSING__:Memory enabled"
   },
   "skills": {
     "title": "Skills",
@@ -3544,6 +3800,14 @@
     "export": "Export",
     "exporting": "Exporting...",
     "exportFailed": "Export failed",
+    "cleanHistoryButton": "__MISSING__:Clean history",
+    "cleanHistoryTitle": "__MISSING__:Clean log history?",
+    "cleanHistoryMessage": "__MISSING__:This permanently clears all request log rows, legacy detail rows, and local artifact files under DATA_DIR/call_logs. The live page will refresh after cleanup.",
+    "cleanHistoryConfirm": "__MISSING__:Clean history",
+    "cleanHistoryCancel": "__MISSING__:Cancel",
+    "cleanHistorySuccess": "__MISSING__:Cleaned {deleted} log entries, {deletedArtifacts} artifacts, and {deletedDetailedLogs} legacy detail rows.",
+    "cleanHistoryEmpty": "__MISSING__:No request log history was found.",
+    "cleanHistoryFailed": "__MISSING__:Failed to clean log history.",
     "timeRange": "Time Range",
     "lastNHours": "Last {hours}",
     "defaultRange": "default",
@@ -3551,10 +3815,14 @@
       "fetchFailed": "Failed to fetch logs",
       "copyFailed": "Failed to copy log entry",
       "copyLogEntry": "Copy log entry"
-    }
+    },
+    "compressionLogTitle": "__MISSING__:Compression Log",
+    "compressionLogEmpty": "__MISSING__:No compressed requests yet. Compression stats will appear here when requests are processed with compression enabled.",
+    "tokens": "__MISSING__:tokens"
   },
   "onboarding": {
     "welcome": "Welkom",
+    "tiers": "__MISSING__:Tiers",
     "security": "Beveiliging",
     "test": "Testen",
     "ready": "Klaar!",
@@ -3616,6 +3884,7 @@
   },
   "providers": {
     "title": "Aanbieders",
+    "Account Deactivated": "__MISSING__:Account Deactivated",
     "allProviders": "Alle aanbieders",
     "audioProviders": "Audioproviders",
     "showFreeOnly": "Alleen gratis",
@@ -3623,6 +3892,33 @@
     "addFirstProvider": "Voeg uw eerste provider toe",
     "addFirstProviderDesc": "Sluit een AI-provider aan om verzoeken via OmniRoute te routeren. U kunt gratis providers, API-sleutels of OAuth-accounts gebruiken.",
     "learnMore": "Meer informatie",
+    "adaptaTutorial": {
+      "title": "__MISSING__:How to connect Adapta Web",
+      "introPrefix": "__MISSING__:Adapta authenticates through Clerk. The token",
+      "introSuffix": "__MISSING__:is a long-lived JWT that lets OmniRoute refresh sessions automatically.",
+      "or": "__MISSING__:or",
+      "step1Title": "__MISSING__:Open Adapta chat",
+      "step1DescPrefix": "__MISSING__:Open",
+      "step1DescSuffix": "__MISSING__:and sign in with your Gold or Business account.",
+      "step2Title": "__MISSING__:Open DevTools",
+      "step2DescPrefix": "__MISSING__:Press",
+      "step2DescSuffix": "__MISSING__:to open Developer Tools.",
+      "step3Title": "__MISSING__:Go to Application → Cookies",
+      "step3DescPrefix": "__MISSING__:In the",
+      "step3DescMiddle": "__MISSING__:expand",
+      "step3DescSuffix": "__MISSING__:and click",
+      "step4Title": "__MISSING__:Copy the cookie value for",
+      "step4DescPrefix": "__MISSING__:Find the cookie named",
+      "step4DescMiddle": "__MISSING__:in the list. Click it and copy the content from the",
+      "step4DescSuffix": "__MISSING__:column. It starts with",
+      "step5Title": "__MISSING__:Paste it here and save",
+      "step5DescPrefix": "__MISSING__:Click",
+      "step5DescMiddle": "__MISSING__:paste the",
+      "step5DescSuffix": "__MISSING__:value into the API Key field, then save. OmniRoute will refresh the session automatically.",
+      "tipLabel": "__MISSING__:Tip:",
+      "tipPrefix": "__MISSING__:The",
+      "tipSuffix": "__MISSING__:cookie is long-lived, usually for months. You only need to renew it if you sign out or Adapta invalidates the session."
+    },
     "editProvider": "Aanbieder bewerken",
     "deleteProvider": "Aanbieder verwijderen",
     "noProviders": "Geen providers geconfigureerd",
@@ -3648,13 +3944,38 @@
     "apiKeyProviders": "API-sleutelproviders",
     "compatibleProviders": "API-sleutel-compatibele providers",
     "testAll": "Alles testen",
+    "distributeProxies": "__MISSING__:Distribute Proxies",
+    "distributing": "__MISSING__:Distributing...",
+    "selectedCount": "__MISSING__:{count, plural, one {# selected} other {# selected}}",
+    "accountsCount": "__MISSING__:{count, plural, one {# account} other {# accounts}}",
     "testAllOAuth": "Test alle OAuth-verbindingen",
     "testAllFree": "Test alle vrije verbindingen",
     "testAllApiKey": "Test alle API Key-verbindingen",
     "testAllCompatible": "Test alle compatibele verbindingen",
+    "testAllModels": "__MISSING__:Test all models",
+    "testAllModelsConfirm": "__MISSING__:Test all visible models? Failed models will be hidden if auto-hide is enabled.",
+    "testingAllModels": "__MISSING__:Testing {done}/{total}...",
+    "testAllResults": "__MISSING__:{ok} of {total} models working",
+    "noModelsToTest": "__MISSING__:No models match the current filter",
+    "showAllModels": "__MISSING__:All",
+    "showVisibleOnly": "__MISSING__:Visible only",
+    "freeFilterAll": "__MISSING__:All",
+    "freeFilterFreeOnly": "__MISSING__:Free only",
+    "freeFilterPaidOnly": "__MISSING__:Paid only",
+    "sortFreeFirst": "__MISSING__:Free first",
+    "showHiddenOnly": "__MISSING__:Hidden only",
+    "filterByVisibility": "__MISSING__:Filter by visibility",
+    "autoHideFailed": "__MISSING__:Auto-hide failed models",
+    "autoHideFailedHint": "__MISSING__:When enabled, Test all hides non-transient failures from public catalogs such as /v1/models. Single-model tests never auto-hide.",
     "connected": "{count} Verbonden",
     "errorCount": "{count} Fout ({code})",
     "errorCountNoCode": "{count} Fout",
+    "testAllCompleted": "__MISSING__:Tested {total} models: {ok} OK, {failed} failed",
+    "modelAutoHidden": "__MISSING__:Model {model} auto-hidden (test failed)",
+    "filterAll": "__MISSING__:All",
+    "filterVisible": "__MISSING__:Visible only",
+    "filterHidden": "__MISSING__:Hidden only",
+    "modelsHiddenCount": "__MISSING__:{count} hidden",
     "warningCount": "{count} Waarschuwing",
     "noConnections": "Geen verbindingen",
     "expiredBadge": "Expired",
@@ -3764,7 +4085,16 @@
     "batchUpdateNone": "__MISSING__:No connections were updated (they may no longer exist)",
     "batchRetestLimit": "__MISSING__:Retest up to {max} connections at a time",
     "noConnectionsToTest": "__MISSING__:No matching connections to test",
+    "batchDeleteConfirmTitle": "__MISSING__:Delete connections",
+    "batchDeleteConfirmButton": "__MISSING__:Delete",
+    "filterActive": "__MISSING__:Active",
+    "filterError": "__MISSING__:Error",
+    "filterBanned": "__MISSING__:Banned",
+    "filterCreditsExhausted": "__MISSING__:Credits Exhausted",
+    "noFilteredConnections": "__MISSING__:No connections match the current filter.",
     "failedSetAlias": "Kan alias niet instellen",
+    "setAliasSuccess": "__MISSING__:Alias {alias} set",
+    "deleteAliasSuccess": "__MISSING__:Alias {alias} deleted",
     "failedSaveConnection": "Kan de verbinding niet opslaan",
     "failedSaveConnectionRetry": "Kan de verbinding niet opslaan. Probeer het opnieuw.",
     "failedRetestConnection": "Kan de verbinding niet opnieuw testen",
@@ -3798,6 +4128,9 @@
     "connectionCount": "{count} verbinding(en)",
     "fetchingModels": "Beschikbare modellen ophalen...",
     "failedFetchModels": "Kan modellen niet ophalen",
+    "noFreeModelsFound": "__MISSING__:No free models found for this provider — nothing imported.",
+    "fetchModelsSuccess": "__MISSING__:Found {count} new models",
+    "fetchModelsFailed": "__MISSING__:Could not auto-fetch models (you can retry from settings)",
     "noModelsFound": "Geen modellen gevonden",
     "importFailed": "Importeren is mislukt",
     "noNewModelsAdded": "Er zijn geen nieuwe modellen toegevoegd.",
@@ -3806,6 +4139,10 @@
     "importingModelsTitle": "Modellen importeren",
     "copyModel": "Kopieermodel",
     "filterModels": "Modellen filteren…",
+    "testAllRateLimited": "__MISSING__:Rate limit reached, stopped early",
+    "hideFailedAuto": "__MISSING__:Auto-hide failed models",
+    "selectAllModels": "Select all",
+    "hideAllModels": "__MISSING__:Hide all",
     "modelsActive": "actief",
     "showModel": "Model tonen",
     "hideModel": "Model verbergen",
@@ -3814,6 +4151,9 @@
     "rateLimitUnprotected": "Onbeschermd",
     "enableRateLimitProtection": "Klik om de snelheidslimietbescherming in te schakelen",
     "disableRateLimitProtection": "Klik om de snelheidslimietbescherming uit te schakelen",
+    "testAllProgress": "__MISSING__:Tested {done}/{total}",
+    "testAllFailedHidden": "__MISSING__:{count} failed models hidden",
+    "testAllDone": "__MISSING__:All models tested",
     "productionKey": "Productie sleutel",
     "enterNewApiKey": "Voer een nieuwe API-sleutel in",
     "codexApplyModalTitle": "Toepassen op de Lokale Codex",
@@ -3889,10 +4229,20 @@
     "errorTypeNetworkError": "Netwerkfout",
     "errorTypeTestUnsupported": "Test niet ondersteund",
     "errorTypeUpstreamError": "Stroomopwaartse fout",
+    "errorTypeCreditsExhausted": "__MISSING__:No credits",
+    "errorTypeBanned": "__MISSING__:403 Banned",
     "proxySourceGlobal": "Globaal",
     "proxySourceProvider": "Aanbieder",
     "proxySourceKey": "Sleutel",
     "proxyConfiguredBySource": "Proxy ({source}): {host}",
+    "proxyOn": "__MISSING__:Proxy On",
+    "proxyOff": "__MISSING__:Direct (bypass proxy)",
+    "proxyEnabledTitle": "__MISSING__:Proxy is enabled for this connection",
+    "proxyDisabledTitle": "__MISSING__:Direct connection — bypasses every proxy (including the global proxy) for this connection",
+    "perKeyProxyOn": "__MISSING__:Per-key",
+    "perKeyProxyOff": "__MISSING__:Connection",
+    "perKeyProxyEnabledTitle": "__MISSING__:Per-key proxy assignment enabled for this provider",
+    "perKeyProxyDisabledTitle": "__MISSING__:Per-key proxy assignment disabled for this provider",
     "autoPriority": "Automatisch: {priority}",
     "proxy": "Proxy",
     "retestAuthentication": "Test de authenticatie opnieuw",
@@ -3920,6 +4270,12 @@
     "compatProtocolOpenAI": "OpenAI Chat Completions",
     "compatProtocolOpenAIResponses": "OpenAI Responses API",
     "compatProtocolClaude": "Anthropic Messages",
+    "targetFormatLabel": "__MISSING__:Target Format",
+    "targetFormatHint": "__MISSING__:Override the upstream wire format. Use 'Anthropic Messages' to route OpenAI-compatible providers (e.g. opencode-go) through the /v1/messages endpoint.",
+    "targetFormatAuto": "__MISSING__:Default (auto)",
+    "targetFormatGemini": "__MISSING__:Gemini",
+    "targetFormatGeminiCli": "__MISSING__:Gemini CLI",
+    "targetFormatAntigravity": "__MISSING__:Antigravity",
     "compatUpstreamHeadersLabel": "Extra upstream headers",
     "compatUpstreamHeadersHint": "High-privilege setting — same trust level as editing provider API credentials; only trusted admins should use it. Merged after OmniRoute adds auth from the provider API key. If a custom header uses the same name as an existing one (e.g. Authorization), your value fully replaces the auto-generated header (including the Bearer token) — the upstream only sees what you typed, not the key from settings. Misconfiguration can cause 401 or broken upstream auth. One row per header (e.g. extra Authentication for some gateways). Hover or focus the value to preview. Saves on blur, outside click, or closing this panel.",
     "compatUpstreamHeaderName": "Header name",
@@ -3929,6 +4285,8 @@
     "compatBadgeUpstreamHeaders": "Headers",
     "perModelQuotaLabel": "Per Model Quota Label",
     "perModelQuotaDescription": "Per Model Quota Description",
+    "importFreeModelsOnlyLabel": "__MISSING__:Import only free models",
+    "importFreeModelsOnlyHint": "__MISSING__:When enabled, only this provider's free models are imported. Paid models are skipped.",
     "perModelQuotaToggle": "Quotum per model wisselen",
     "modelId": "Model-ID",
     "customModelPlaceholder": "bijv. gpt-4.5-turbo",
@@ -3964,7 +4322,6 @@
     "email": "E-mail",
     "healthCheckMinutes": "Gezondheidscontrole (min)",
     "healthCheckHint": "Proactief tokenvernieuwingsinterval. 0 = uitgeschakeld.",
-    "selectAllModels": "Select all",
     "deselectAllModels": "Deselect all",
     "modelsActiveCount": "{active}/{total} active",
     "noModelsMatch": "No models match \"{filter}\"",
@@ -3976,6 +4333,9 @@
     "editCompatibleTitle": "Bewerk {type} Compatibel",
     "compatibleBaseUrlHint": "Root URL of your {type}-compatible API. Use Advanced Settings for custom endpoint paths.",
     "apiKeyForCheck": "API-sleutel (ter controle)",
+    "testModelIdLabel": "__MISSING__:Model ID (optional)",
+    "testModelIdPlaceholder": "__MISSING__:e.g. my-model-id",
+    "testModelIdHint": "__MISSING__:If the provider lacks a /models endpoint, enter a model ID to validate via /chat/completions instead.",
     "compatibleProdPlaceholder": "{type} Compatibel (product)",
     "tokenRefreshed": "Token refreshed successfully",
     "tokenRefreshFailed": "Token refresh failed",
@@ -4069,6 +4429,19 @@
     "codexAuthApplyFailed": "Failed to apply Codex auth.json locally",
     "codexAuthExported": "Codex auth.json exported",
     "codexAuthExportFailed": "Failed to export Codex auth.json",
+    "codexCliGuideButton": "__MISSING__:Codex CLI Guide",
+    "codexCliGuideTitle": "__MISSING__:Codex CLI Guide",
+    "codexCliGuideLoading": "__MISSING__:Loading guide...",
+    "codexCliGuideLoadFailed": "__MISSING__:Could not load the guide.",
+    "codexExternalLinkButton": "__MISSING__:External Codex link",
+    "codexExternalLinkModalTitle": "__MISSING__:External Codex link",
+    "codexExternalLinkModalDescription": "__MISSING__:Share this single-use link with the person who will authenticate the Codex account. They open it in their own browser, complete the OpenAI login, and the connection is registered here. The link expires in 15 minutes.",
+    "codexExternalLinkGenerating": "__MISSING__:Generating link...",
+    "codexExternalLinkWaiting": "__MISSING__:Waiting for browser authentication. This window refreshes automatically.",
+    "codexExternalLinkCreateFailed": "__MISSING__:Failed to generate the link.",
+    "codexExternalLinkNetworkError": "__MISSING__:Could not contact the server.",
+    "codexExternalLinkConnected": "__MISSING__:Codex account connected through the external link.",
+    "codexExternalLinkExpired": "__MISSING__:The link expired before completion.",
     "importCodexAuth": "Autorisatie importeren",
     "codexImportModalTitle": "Codex-authenticatie importeren",
     "codexImportTabSingle": "Enkel",
@@ -4146,6 +4519,8 @@
     "t3ChatWebCookiePlaceholder": "convexe-sessie-id=abc123...",
     "blockClaudeExtraUsageDescription": "Block Claude Extra Usage Description",
     "blockClaudeExtraUsageLabel": "Block Claude Extra Usage Label",
+    "disableCoolingDescription": "__MISSING__:Skip the transient cooldown so this connection stays eligible even after recoverable errors (terminal states like banned/expired still apply).",
+    "disableCoolingLabel": "__MISSING__:Disable cooldown for this connection",
     "bulkPasteAdded": "{count, plural, one {1 key added} other {# keys added}}",
     "bulkPasteDuplicatesIgnored": "{count, plural, one {1 duplicate skipped} other {# duplicates skipped}}",
     "bulkPasteHint": "Paste one API key per line. Empty lines are ignored and duplicate keys are skipped.",
@@ -4243,6 +4618,17 @@
     "personalAccessTokenLabel": "Personal Access Token Label",
     "qoderPatHint": "Qoder Pat Hint",
     "qoderPatPlaceholder": "Qoder Pat Placeholder",
+    "rateLimitOverridesSection": "__MISSING__:Rate Limit Overrides",
+    "rateLimitOverridesMaxConcurrentHint": "__MISSING__:Max concurrent requests override for this connection. Overrides the account-level cap.",
+    "rateLimitOverridesMaxConcurrentLabel": "__MISSING__:Max Concurrent (Rate Limit)",
+    "rateLimitOverridesMinTimeHint": "__MISSING__:Minimum time (ms) between requests. Overrides the default rate limiter delay.",
+    "rateLimitOverridesMinTimeLabel": "__MISSING__:Min Interval (ms)",
+    "rateLimitOverridesRpmHint": "__MISSING__:Max requests per minute for this connection. Overrides the provider default.",
+    "rateLimitOverridesRpmLabel": "__MISSING__:RPM (Requests/min)",
+    "rateLimitOverridesTpdHint": "__MISSING__:Max tokens per day for this connection. Overrides the provider default.",
+    "rateLimitOverridesTpdLabel": "__MISSING__:TPD (Tokens/day)",
+    "rateLimitOverridesTpmHint": "__MISSING__:Max tokens per minute for this connection. Overrides the provider default.",
+    "rateLimitOverridesTpmLabel": "__MISSING__:TPM (Tokens/min)",
     "refreshOauthTokenTitle": "Refresh Oauth Token Title",
     "regionHint": "Region Hint",
     "regionLabel": "Region Label",
@@ -4257,6 +4643,7 @@
     "searchProvider": "Search Provider",
     "searchProviderDesc": "Search Provider Desc",
     "searchProviders": "Zoekaanbieders...",
+    "searchByModel": "__MISSING__:Search by model…",
     "searchProvidersHeading": "Search Providers Heading",
     "searxngBaseUrlHint": "Searxng Base Url Hint",
     "searxngInfo": "Searxng Info",
@@ -4422,7 +4809,21 @@
     "webNoAuthGuideBody": "{provider} heeft geen API-sleutel of cookie nodig. Sla de verbinding op om het gratis webeindpunt te gebruiken.",
     "webSessionCredentialValidationFailed": "Validatie van sessiegegevens is mislukt. Meld u opnieuw aan, kopieer een nieuwe referentie en probeer het opnieuw.",
     "checkCookie": "Controleer koekje",
-    "checkWebToken": "Controleer token"
+    "checkWebToken": "Controleer token",
+    "huggingchatLabel": "__MISSING__:HuggingChat (Free)",
+    "huggingchatDesc": "__MISSING__:Free LLM chat via huggingface.co/chat",
+    "phindLabel": "__MISSING__:Phind (Free)",
+    "phindDesc": "__MISSING__:Free dev-focused AI chat",
+    "poeWebLabel": "__MISSING__:Poe Web",
+    "poeWebDesc": "__MISSING__:Multi-model chat via poe.com",
+    "veniceWebLabel": "__MISSING__:Venice Web",
+    "veniceWebDesc": "__MISSING__:Privacy-focused AI chat",
+    "v0VercelWebLabel": "__MISSING__:v0 Vercel Web",
+    "v0VercelWebDesc": "__MISSING__:AI code generation via v0.dev",
+    "kimiWebLabel": "__MISSING__:Kimi Web",
+    "kimiWebDesc": "__MISSING__:Chinese market AI chat via kimi.moonshot.cn",
+    "doubaoWebLabel": "__MISSING__:Doubao Web",
+    "doubaoWebDesc": "__MISSING__:ByteDance AI chat via doubao.com"
   },
   "settings": {
     "title": "Instellingen",
@@ -4528,6 +4929,7 @@
     "memoryDesc": "Persistent cross-session conversational memory",
     "memoryEnabled": "Enable Memory",
     "memoryEnabledDesc": "When enabled, OmniRoute will inject relevant past context.",
+    "memoryTokenCostWarning": "__MISSING__:Heads up: with memory enabled, OmniRoute injects up to {tokens} tokens of retrieved context into every chat request — this increases token usage and cost. To skip injection for a specific request, send the \"x-omniroute-no-memory: true\" header.",
     "maxTokens": "Max Tokens",
     "retentionDays": "Retention",
     "recent": "Recent",
@@ -4566,6 +4968,15 @@
     "modelsDevInfoOrder": "User Override → models.dev → LiteLLM → Hardcoded Default",
     "systemTheme": "Systeem Thema",
     "debugToggle": "Enable Debug Mode",
+    "homePinProviderQuotaToHome": "Pin Information to Home Page",
+    "homeProviderQuotaLimits": "Provider Quota Limits",
+    "homeProviderQuotaLimitsDesc": "Pin the Provider Quota status container (with Refresh All button) to the top of the Home page.",
+    "homeQuickStart": "Quick Start",
+    "homeQuickStartDesc": "Show the Quick Start panel on the Home page.",
+    "homeProviderTopology": "Provider Topology",
+    "homeProviderTopologyDesc": "Show the Provider Topology on the Home page.",
+    "accountEmailVisibility": "__MISSING__:Account email visibility",
+    "accountEmailVisibilityDesc": "__MISSING__:Show full account emails across providers, combos, logs, quota, and playground screens. Turn this off to mask them by default.",
     "sidebarVisibilityToggle": "Show Sidebar Items",
     "enableCache": "Cache inschakelen",
     "cacheTTL": "TTL cachen",
@@ -4599,11 +5010,17 @@
     "autoDisableDescription": "Permanently mark provider connections as deactivated if they return specific terminal ban signals (e.g. HTTP 403 'verify your account'). This removes them from the combo rotation.",
     "autoDisableThreshold": "Ban Threshold",
     "autoDisableThresholdDesc": "Consecutive ban signals required before permanent deactivation.",
+    "customBannedSignals": "__MISSING__:Banned Keywords",
+    "customBannedSignalsDesc": "__MISSING__:Additional keywords that trigger permanent account ban detection. Built-in keywords always apply.",
+    "customBannedSignalsPlaceholder": "__MISSING__:e.g. api key revoked",
+    "noCustomBannedSignals": "__MISSING__:No custom keywords. Only built-in keywords are active.",
     "resilienceStructureTitle": "Resilience Structure",
     "resilienceStructureDesc": "Deze pagina configureert alleen gedrag. De status van de live-breker wordt weergegeven op de Gezondheidspagina. Combo-specifieke nieuwe pogingen en round-robin slotcontrole blijven op de combo-instellingen staan.",
     "enableThinking": "Maak het denken mogelijk",
     "maxThinkingTokens": "Max Thinking-tokens",
     "enableProxy": "Schakel proxy in",
+    "perKeyProxyEnabled": "__MISSING__:Enable per-key proxy assignment",
+    "perKeyProxyEnabledDesc": "__MISSING__:When enabled, each provider connection can use its own proxy assignment",
     "proxyUrl": "Proxy-URL",
     "pricingRates": "Formaat prijstarieven",
     "currentPricing": "Actueel prijsoverzicht",
@@ -4683,6 +5100,13 @@
     "globalProxy": "Mondiale proxy",
     "globalProxyDesc": "Configureer een globale uitgaande proxy voor alle API-aanroepen. Individuele providers, combo's en sleutels kunnen dit overschrijven.",
     "noGlobalProxy": "Geen globale proxy geconfigureerd",
+    "proxyPool": "__MISSING__:Proxy Pool",
+    "freePool": "__MISSING__:Free Pool",
+    "proxyDocumentation": "__MISSING__:Proxy Documentation",
+    "proxyGlobalConfigTab": "__MISSING__:Global Config",
+    "proxyPoolTab": "__MISSING__:Proxy Pool",
+    "freePoolTab": "__MISSING__:Free Pool",
+    "proxyDocumentationTab": "__MISSING__:Documentation",
     "bulkHealthcheck": "Bulk Healthcheck",
     "bulkHealthcheckDesc": "Test all configured proxies against a target URL to find which ones work.",
     "healthcheckTesting": "Testing...",
@@ -4695,6 +5119,51 @@
     "healthcheckStatus": "Status",
     "healthcheckProxyUrl": "Proxy URL",
     "healthcheckLatency": "Latency",
+    "proxyDocumentationScopeTitle": "__MISSING__:Proxy scope resolution",
+    "proxyDocumentationScopeDescBefore": "__MISSING__:OmniRoute resolves the outbound proxy in priority order: ",
+    "proxyDocumentationScopeOrder": "__MISSING__:combo → account → provider → global",
+    "proxyDocumentationScopeDescAfter": "__MISSING__:. The most specific scope wins.",
+    "proxyDocumentationAddTitle": "__MISSING__:Adding a custom proxy",
+    "proxyDocumentationAddDescBefore": "__MISSING__:Go to the ",
+    "proxyDocumentationAddDescMiddle": "__MISSING__: tab → click ",
+    "proxyDocumentationAddCta": "__MISSING__:+ Add proxy",
+    "proxyDocumentationAddDescAfter": "__MISSING__:. Fill in type (http/https/socks5), host, and port. Optionally assign it to a scope.",
+    "proxyDocumentationBulkTitle": "__MISSING__:Bulk import format",
+    "proxyDocumentationBulkDesc": "__MISSING__:Pipe-delimited fields:",
+    "proxyDocumentationSocks5DescBefore": "__MISSING__:SOCKS5 proxies are disabled by default. Set",
+    "proxyDocumentationFreePoolDesc": "__MISSING__:The Free Pool tab aggregates proxies from 1proxy, Proxifly, and IPLocate. Use ⊕ to test and promote a proxy to your registry. Only proxies that pass the connectivity test are added.",
+    "proxyDocumentationVercelRelayDescBefore": "__MISSING__:The Vercel Relay is an outbound edge relay — not an inbound tunnel. Deploying one sends LLM API calls through Vercel's dynamic IPs, bypassing datacenter geo-blocks and rate limits. The relay is protected by a generated secret header",
+    "proxyDocumentationVercelRelayDescAfter": "__MISSING__:Your Vercel token is used only during deploy and is never stored.",
+    "vercelRelayTokenRequired": "__MISSING__:Token is required",
+    "vercelRelayDeployFailed": "__MISSING__:Deploy failed",
+    "vercelRelayTokenHint": "__MISSING__:Token is used only during deploy — never stored.",
+    "denoRelayTokenRequired": "__MISSING__:Deno Deploy token is required",
+    "denoRelayOrgDomainRequired": "__MISSING__:Organization domain is required",
+    "denoRelayDeployFailed": "__MISSING__:Deno Deploy failed",
+    "denoRelayTokenHint": "__MISSING__:Organization token (prefix ddo_) from console.deno.com → Organization → Settings → Organization Tokens. Used once for deploy and never stored.",
+    "denoRelayOrgDomainHint": "__MISSING__:Your Deno Deploy organization's default domain (e.g. acme.deno.net). The relay will be reachable at https://<app-name>.<org-slug>.deno.net.",
+    "proxyFreePoolFilterProtocol": "__MISSING__:Filter by protocol",
+    "proxyFreePoolProtocol": "__MISSING__:Protocol",
+    "proxyFreePoolCountryPlaceholder": "__MISSING__:Country (e.g. US)",
+    "proxyFreePoolFilterCountry": "__MISSING__:Filter by country",
+    "proxyFreePoolMinQualityPlaceholder": "__MISSING__:Min quality",
+    "proxyFreePoolMinQualityLabel": "__MISSING__:Minimum quality score",
+    "proxyFreePoolSyncAll": "__MISSING__:Sync All",
+    "proxyFreePoolTotal": "__MISSING__:Total",
+    "proxyFreePoolInPool": "__MISSING__:In pool",
+    "proxyFreePoolAvgQuality": "__MISSING__:Avg quality",
+    "proxyFreePoolSelected": "__MISSING__:{count} selected",
+    "proxyFreePoolAddSelected": "__MISSING__:Add selected to pool",
+    "proxyFreePoolAddVisible": "__MISSING__:Add all visible to pool",
+    "proxyFreePoolSource": "__MISSING__:Source",
+    "proxyFreePoolHostPort": "__MISSING__:Host:Port",
+    "proxyFreePoolType": "__MISSING__:Type",
+    "proxyFreePoolCountry": "__MISSING__:Country",
+    "proxyFreePoolQuality": "__MISSING__:Quality",
+    "proxyFreePoolLatency": "__MISSING__:Latency",
+    "proxyFreePoolEmpty": "__MISSING__:No proxies found. Click Sync All to fetch from sources.",
+    "close": "__MISSING__:Close",
+    "cancel": "__MISSING__:Cancel",
     "globalLabel": "Globaal",
     "configure": "Configureer",
     "globalSystemPrompt": "Globale systeemprompt",
@@ -4951,6 +5420,7 @@
     "systemStorage": "Systeem en opslag",
     "allDataLocal": "Alle gegevens lokaal opgeslagen op uw machine",
     "databasePath": "Databasepad",
+    "export": "__MISSING__:Export",
     "exportDatabase": "Database exporteren",
     "exportAll": "Alles exporteren (.tar.gz)",
     "importDatabase": "Database importeren",
@@ -5038,6 +5508,11 @@
     "adaptiveVolumeRoutingDesc": "Scale connections dynamically based on payload volume and throughput pressure.",
     "lkgpToggleTitle": "Last Known Good Provider (LKGP)",
     "lkgpToggleDesc": "When enabled, the router remembers which provider last served a successful response and tries it first on subsequent requests.",
+    "echoRequestedModelTitle": "__MISSING__:Echo requested model name in responses",
+    "echoRequestedModelDesc": "__MISSING__:When enabled, the response `model` field echoes the alias or combo name the client requested instead of the upstream model name. Fixes strict clients (e.g. Claude Desktop) that reject a response whose model does not match the request.",
+    "webSearchRouteTitle": "__MISSING__:Web search routing",
+    "webSearchRouteDesc": "__MISSING__:When a request includes a native web_search tool, route the whole request to this model instead of the default — useful for providers that don't implement Anthropic's web_search server tool. Leave blank to disable.",
+    "webSearchRoutePlaceholder": "__MISSING__:e.g. openrouter,anthropic/claude-3.5-sonnet",
     "clearLkgpCache": "Clear LKGP Cache",
     "lkgpCacheCleared": "LKGP cache cleared successfully",
     "lkgpCacheClearFailed": "Failed to clear LKGP cache",
@@ -5102,6 +5577,16 @@
     "clearSyncedPricing": "Clear Synced Pricing",
     "compressionTitle": "Prompt Compression",
     "compressionDesc": "Reduce token usage by compressing prompts before sending to providers",
+    "tokenSaverTitle": "__MISSING__:Token Saver",
+    "tokenSaverSubtitle": "__MISSING__:Spend fewer tokens on every request.",
+    "tokenSaverToolOutput": "__MISSING__:Tool output",
+    "tokenSaverToolOutputDesc": "__MISSING__:Clean git, grep, ls, tree, and log output before it reaches the provider.",
+    "tokenSaverLlmOutput": "__MISSING__:LLM output",
+    "tokenSaverLlmOutputDesc": "__MISSING__:Inject terse response instructions without rewriting provider output.",
+    "tokenSaverInputCompression": "__MISSING__:Input compression",
+    "tokenSaverInputCompressionDesc": "__MISSING__:Rewrite eligible chat history while preserving code, URLs, and intent.",
+    "tokenSaverFineTunePrefix": "__MISSING__:Fine-tune each engine on",
+    "tokenSaverFineTuneSuffix": "__MISSING__:or combine engines per request on",
     "compressionMode": "Compression Mode",
     "compressionModeOff": "Off",
     "compressionModeOffDesc": "No compression applied",
@@ -5121,6 +5606,11 @@
     "compressionUltraMinScore": "Minimale scoredrempel",
     "compressionUltraSlmFallback": "Terugval naar agressief",
     "compressionUltraModelPath": "SLM-modelpad",
+    "compressionUltraEngine": "__MISSING__:Ultra tier",
+    "compressionUltraEngineHeuristic": "__MISSING__:Heuristic (Tier-A, default)",
+    "compressionUltraEngineSlm": "__MISSING__:SLM (LLMLingua-2, opt-in)",
+    "compressionUltraSlmHint": "__MISSING__:SLM downloads a small ONNX model on first use (cold-start) and transparently falls back to the heuristic on timeout or if unavailable.",
+    "compressionUltraSlmPrewarm": "__MISSING__:Pre-warm SLM model on enable",
     "compressionSummarizerEnabled": "Schakel Samenvattend in",
     "compressionMaxTokensPerMessage": "Max. aantal tokens per bericht",
     "compressionMinSavings": "Minimale besparingsdrempel",
@@ -5308,13 +5798,22 @@
     "resilienceNo": "Nee",
     "resilienceDefault": "Default",
     "storageDatabaseBackupRetention": "Bewaren van databaseback-ups",
+    "storageDatabaseBackups": "__MISSING__:Database backups",
     "storagePurgeData": "Gegevens opschonen",
+    "storagePurgeDataDesc": "__MISSING__:Immediately delete all records without applying retention checks. Use with caution.",
+    "storageRetentionCleanup": "__MISSING__:Retention Settings",
+    "storageRetentionCleanupDesc": "__MISSING__:Configure operational record retention and database backup cleanup.",
+    "retentionCallDays": "__MISSING__:Call {count}d",
+    "retentionAppDays": "__MISSING__:App {count}d",
+    "retentionRows": "__MISSING__:{count} rows",
     "retentionQuotaSnapshots": "Momentopnamen van quota (dagen)",
+    "retentionCompressionAnalytics": "__MISSING__:Compression Analytics (days)",
     "retentionMcpAudit": "MCP-audit (dagen)",
     "retentionA2aEvents": "A2A-evenementen (dagen)",
     "retentionCallLogs": "Oproeplogboeken (dagen)",
     "retentionUsageHistory": "Gebruiksgeschiedenis (dagen)",
     "retentionMemoryEntries": "Geheugeninvoer (dagen)",
+    "saveRetentionSettings": "__MISSING__:Save retention settings",
     "storageAutoVacuumMode": "Automatische vacuümmodus",
     "storageScheduledVacuum": "Gepland vacuüm",
     "storageVacuumHour": "Vacuümuur (0-23)",
@@ -5328,10 +5827,16 @@
     "storageIntegrityOk": "✓ Oké",
     "storageIntegrityError": "✗ Fout",
     "storageUsageTokenBuffer": "Gebruikstokenbuffer",
+    "storageUsageTokenBufferDesc": "__MISSING__:Extra tokens added to reported usage to account for system prompt overhead.",
+    "storageUsageTokenBufferHint": "__MISSING__:Set to 0 to report raw provider token counts. Default: 2000.",
+    "storageUsageTokenBufferCurrent": "__MISSING__:Current: {value}",
     "compressionSettingsAutoTriggerMode": "Automatische triggermodus",
     "compressionSettingsMcpDescriptionCompression": "MCP-beschrijving compressie",
+    "mcpAccessibilityTitle": "__MISSING__:MCP accessibility output",
     "compressionSettingsCavemanIntensity": "De intensiteit van de holbewoner",
     "compressionSettingsCavemanOutputMode": "Holbewoner-uitvoermodus",
+    "compressionSettingsOutputStyles": "__MISSING__:Output styles",
+    "compressionStylesTileTitle": "__MISSING__:Output styles",
     "compressionSettingsOutputIntensity": "Uitgangsintensiteit",
     "compressionSettingsAutoClarityBypass": "Automatische helderheidsbypass",
     "resilienceWaitForCooldown": "Wacht op afkoelen",
@@ -5347,6 +5852,9 @@
     "cliproxyapiUrl": "CLIProxyAPI-URL",
     "cliproxyapiStatus": "CLIProxyAPI-status",
     "cliproxyapiNotDetected": "Niet gedetecteerd",
+    "cliproxyapiImportAuthTitle": "__MISSING__:Import accounts from CLIProxyAPI",
+    "cliproxyapiImportAuthDesc": "__MISSING__:Import the OAuth accounts CLIProxyAPI already saved in ~/.cli-proxy-api/ as OmniRoute connections, so you don't have to log in to each account again. Supported account types (Gemini, Codex, Claude, Antigravity, Qwen, Kimi) are imported; others are skipped.",
+    "cliproxyapiImportAuthButton": "__MISSING__:Import accounts",
     "payloadRulesTitle": "Payload-regels",
     "payloadRulesDesc": "__MISSING__:Configure request payload mutations by model and protocol. Changes are persisted in settings and hot reloaded into the runtime immediately after save.",
     "payloadRuleDefaultTitle": "__MISSING__:default",
@@ -5379,6 +5887,14 @@
     "maxResponseTokensDesc": "__MISSING__:Maximum total tokens allowed in a single response.",
     "modelCooldownsTitle": "Modellen in cooldown",
     "modelCooldownsEmpty": "Er zijn momenteel geen modellen in cooldown.",
+    "responsesStateTitle": "__MISSING__:Responses State",
+    "responsesStateDesc": "__MISSING__:Control how OmniRoute forwards previous_response_id.",
+    "responsesStateModeLabel": "__MISSING__:previous_response_id handling",
+    "responsesStateModeAuto": "__MISSING__:Auto",
+    "responsesStateModeStrip": "__MISSING__:Strip",
+    "responsesStateModePreserve": "__MISSING__:Preserve",
+    "responsesStateHint": "__MISSING__:Auto strips previous_response_id unless a connection explicitly enables OpenAI Responses storage. Strip is safest for stateless clients such as VS Code Custom Endpoint; context then depends on the client sending full history.",
+    "responsesStateSaveError": "__MISSING__:Failed to update Responses state setting",
     "codexFastTierTitle": "Codex Fast-laag",
     "codexFastTierDesc": "Injecteer wereldwijd service_tier=priority voor OpenAI Codex-verzoeken.",
     "codexFastTierHint": "Indien ingeschakeld, voegt OmniRoute service_tier=priority toe aan uitgaande Codex-aanvragen voor verbindingen die nog geen laag specificeren. Prioriteitslaag vereist een OpenAI Enterprise API-sleutel of het ChatGPT-auth Codex-pad; andere sleuteltypen ontvangen een laaggerelateerde fout van OpenAI. Instellingen per verbinding op de Codex-providerpagina hebben voorrang.",
@@ -5485,6 +6001,15 @@
     "resilienceEnableServerWaitDesc": "Indien ingeschakeld, wacht OmniRoute tot de eerste cooldown is verstreken en probeert het automatisch opnieuw.",
     "resilienceMaxAttempts": "Maximale pogingen",
     "resilienceMaxWaitPerAttempt": "Maximale wachttijd per poging",
+    "resilienceProviderCooldownTitle": "__MISSING__:Provider Cooldown",
+    "resilienceProviderCooldownScope": "__MISSING__:All combo requests",
+    "resilienceProviderCooldownTrigger": "__MISSING__:When a provider/connection fails",
+    "resilienceProviderCooldownEffect": "__MISSING__:Skips the failed provider for a cooldown period before retrying",
+    "resilienceProviderCooldownDesc": "__MISSING__:Prevents subsequent requests from re-walking the same failing providers. Cooldown scales exponentially with consecutive failures.",
+    "resilienceProviderCooldownEnabled": "__MISSING__:Enable global provider cooldown",
+    "resilienceProviderCooldownEnabledDesc": "__MISSING__:When enabled, failed providers are tracked globally and skipped for a cooldown period.",
+    "resilienceProviderCooldownMin": "__MISSING__:Minimum cooldown",
+    "resilienceProviderCooldownMax": "__MISSING__:Maximum cooldown",
     "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
     "forcedFingerprintBadge": "Required",
     "codexSessionAffinityTitle": "Affiniteit met codexsessies",
@@ -5506,13 +6031,45 @@
     "vercelRelayFreeTierNote": "__MISSING__:Relays are lightweight proxy endpoints deployed on Vercel's free tier to bypass local network/region limitations.",
     "vercelRelayDeploying": "__MISSING__:Deploying...",
     "vercelRelayDeploy": "__MISSING__:Deploy",
-    "homePinProviderQuotaToHome": "Pin Information to Home Page",
-    "homeProviderQuotaLimits": "Provider Quota Limits",
-    "homeProviderQuotaLimitsDesc": "Pin the Provider Quota status container (with Refresh All button) to the top of the Home page.",
-    "homeQuickStart": "Quick Start",
-    "homeQuickStartDesc": "Show the Quick Start panel on the Home page.",
-    "homeProviderTopology": "Provider Topology",
-    "homeProviderTopologyDesc": "Show the Provider Topology on the Home page."
+    "deployRelayButton": "__MISSING__:Deploy Relay",
+    "denoRelayButton": "__MISSING__:Deploy Deno Relay",
+    "denoRelayModalTitle": "__MISSING__:Deploy Deno Relay",
+    "denoRelayWarning": "__MISSING__:Warning: A Deno Deploy organization token is required. This token will only be used to create the relay app and will never be stored by OmniRoute.",
+    "denoRelayTokenLabel": "__MISSING__:Deno Deploy Organization Token",
+    "denoRelayOrgDomainLabel": "__MISSING__:Organization Domain",
+    "denoRelayProjectNameLabel": "__MISSING__:Deno App Name",
+    "denoRelayFreeTierNote": "__MISSING__:Deno Deploy v2 runs on a global edge network. Free tier: 1M requests & 100GiB outbound traffic per month, no per-request CPU limits, up to 20 active apps & 50 custom domains.",
+    "denoRelayDeploying": "__MISSING__:Deploying...",
+    "denoRelayDeploy": "__MISSING__:Deploy",
+    "cloudflareRelaySuccess": "__MISSING__:Cloudflare Relay deployed successfully",
+    "cloudflareRelayButton": "__MISSING__:Deploy Cloudflare Relay",
+    "cloudflareRelayModalTitle": "__MISSING__:Deploy Cloudflare Worker Relay",
+    "cloudflareRelayWarning": "__MISSING__:Deploys a Cloudflare Worker that proxies LLM requests through Cloudflare's edge network — masking the host IP behind dynamic Cloudflare addresses. The Worker enforces a one-time auth secret so the public workers.dev URL cannot be reused as an open relay.",
+    "cloudflareRelayTokenHowto": "__MISSING__:Create the API token under My Profile -> API Tokens -> Create Token -> Custom Token -> Account / Workers Scripts / Edit.",
+    "cloudflareRelayAccountIdLabel": "__MISSING__:Cloudflare Account ID",
+    "cloudflareRelayAccountIdHint": "__MISSING__:Found on the right side of the Cloudflare dashboard overview page.",
+    "cloudflareRelayApiTokenLabel": "__MISSING__:Cloudflare API Token",
+    "cloudflareRelayApiTokenHint": "__MISSING__:Requires 'Workers Scripts: Edit' permission. The token is used only at deploy time and is never stored.",
+    "cloudflareRelayProjectNameLabel": "__MISSING__:Worker Name",
+    "cloudflareRelayFreeTierNote": "__MISSING__:Free tier: 100,000 requests/day per Cloudflare account.",
+    "cloudflareRelayDeploying": "__MISSING__:Deploying...",
+    "cloudflareRelayDeploy": "__MISSING__:Deploy",
+    "cloudflareRelayCredsRequired": "__MISSING__:Account ID and API Token are required",
+    "cloudflareRelayDeployFailed": "__MISSING__:Deploy failed",
+    "modelLockout": "__MISSING__:Model Lockout",
+    "modelLockoutPageDescription": "__MISSING__:Configure which HTTP error codes trigger per-model lockout and control the cooldown behavior.",
+    "modelLockoutEnabled": "__MISSING__:Enable Model Lockout",
+    "modelLockoutEnabledDescription": "__MISSING__:When enabled, models that fail with configured error codes are temporarily locked to prevent retry loops.",
+    "modelLockoutErrorCodes": "__MISSING__:Error Codes",
+    "modelLockoutErrorCodesDescription": "__MISSING__:HTTP status codes that trigger model lockout. Type a code and click Add, or select from suggestions.",
+    "modelLockoutBaseCooldown": "__MISSING__:Base Cooldown (ms)",
+    "modelLockoutBaseCooldownDescription": "__MISSING__:Initial cooldown duration in milliseconds before a model can be retried.",
+    "modelLockoutMaxCooldown": "__MISSING__:Max Cooldown (ms)",
+    "modelLockoutMaxCooldownDescription": "__MISSING__:Maximum cooldown duration in milliseconds. Prevents excessively long lockouts.",
+    "modelLockoutExponentialBackoff": "__MISSING__:Exponential Backoff",
+    "modelLockoutExponentialBackoffDescription": "__MISSING__:When enabled, each consecutive failure increases the cooldown duration exponentially.",
+    "modelLockoutMaxBackoffSteps": "__MISSING__:Max Backoff Steps",
+    "modelLockoutMaxBackoffStepsDescription": "__MISSING__:Maximum number of backoff steps before the cooldown stops growing. The Max Cooldown cap is reached first in most configurations, making this a safety ceiling for when Max Cooldown is raised."
   },
   "contextRtk": {
     "title": "RTK Engine",
@@ -5563,7 +6120,21 @@
     "searchFilters": "Zoekfilters...",
     "tooltipDedup": "Hoe agressief herhaalde lijnen te verwijderen.",
     "tooltipMaxChars": "Maximaal aantal tekens per uitvoerblok.",
-    "tooltipMaxLines": "Maximaal aantal regels dat niet mag worden uitgevoerd bij opdrachtuitvoer. Het teveel wordt ingekort."
+    "tooltipMaxLines": "Maximaal aantal regels dat niet mag worden uitgevoerd bij opdrachtuitvoer. Het teveel wordt ingekort.",
+    "learnDiscoverTitle": "__MISSING__:Learn & Discover filters",
+    "learnDiscoverDesc": "__MISSING__:Mine your captured command output (Raw Output retention must be on) to suggest new RTK filters. Suggestions only — you review and save them.",
+    "discoverHeading": "__MISSING__:Discover repeated noise",
+    "discoverButton": "__MISSING__:Scan samples",
+    "discoverScanning": "__MISSING__:Scanning…",
+    "discoverEmpty": "__MISSING__:No repeated noise found. Enable Raw Output retention and run a few commands first.",
+    "discoverSamples": "__MISSING__:{count} sample(s) scanned",
+    "discoverHits": "__MISSING__:{hits}× across samples",
+    "learnHeading": "__MISSING__:Learn a filter for a command",
+    "learnCommandPlaceholder": "__MISSING__:e.g. npm install",
+    "learnButton": "__MISSING__:Suggest filter",
+    "learnEmpty": "__MISSING__:No suggestion yet. Type a command you have run and scan.",
+    "learnSamplesUsed": "__MISSING__:Learned from {count} matching sample(s)",
+    "suggestionError": "__MISSING__:Could not load suggestions. Check management auth and try again."
   },
   "contextCombos": {
     "title": "Compression Combos",
@@ -5853,7 +6424,80 @@
     "routeConnectionLabel": "Verbinding",
     "scenarioVision": "Visie (beeldbegrip)",
     "scenarioSchemaCoercion": "Schemadwang (gestructureerde output)",
-    "techniques": "Technieken:"
+    "techniques": "Technieken:",
+    "friendlyTitle": "__MISSING__:Translator",
+    "friendlySubtitle": "__MISSING__:Use your existing app with any provider — without rewriting code.",
+    "conceptHeadline": "__MISSING__:Your app speaks one API's \"language\". The Translator converts it to use another provider.",
+    "conceptDiagramAppLabel": "__MISSING__:Your app",
+    "conceptDiagramSourceLabel": "__MISSING__:Source format",
+    "conceptDiagramHubLabel": "__MISSING__:OpenAI (hub)",
+    "conceptDiagramTargetLabel": "__MISSING__:Target provider",
+    "conceptDiagramExampleApp": "__MISSING__:e.g. Anthropic SDK",
+    "conceptDiagramExampleSource": "__MISSING__:claude",
+    "conceptDiagramExampleTarget": "__MISSING__:Gemini",
+    "conceptHowItWorksToggle": "__MISSING__:How it works",
+    "conceptHowItWorksBody": "__MISSING__:Your app sends a request in its own format. The Translator detects the format, converts it through OpenAI as an intermediate hub (or directly when a direct translator is available), sends it to the chosen provider, and returns the response converted back to your app's format.",
+    "tabTranslate": "__MISSING__:Translate",
+    "tabMonitor": "__MISSING__:Monitor",
+    "tabTranslateAriaLabel": "__MISSING__:Go to the Translate tab",
+    "tabMonitorAriaLabel": "__MISSING__:Go to the Monitor tab",
+    "simpleAppUsesLabel": "__MISSING__:My app uses",
+    "simpleAppUsesHint": "__MISSING__:The API format your app speaks (e.g. Anthropic SDK = claude).",
+    "simpleSendToLabel": "__MISSING__:Send to",
+    "simpleSendToHint": "__MISSING__:Where to actually send the request (a provider connected in OmniRoute).",
+    "simpleStartWithLabel": "__MISSING__:Start with",
+    "simpleStartWithExamplePlaceholder": "__MISSING__:Select a ready-made example",
+    "simpleStartWithCustomOption": "__MISSING__:Paste your request (advanced)",
+    "simpleModeLabel": "__MISSING__:Mode",
+    "simpleModePreview": "__MISSING__:Preview translation only",
+    "simpleModeSend": "__MISSING__:Send and see response",
+    "simpleAdvancedToggle": "__MISSING__:Advanced",
+    "simpleInputPanelTitle": "__MISSING__:Input",
+    "simpleInputPanelHint": "__MISSING__:Free-text message or ready-made example",
+    "simpleResultPanelTitle": "__MISSING__:Translation + Response",
+    "narratedDetected": "__MISSING__:✓ Detected: {format}",
+    "narratedTranslating": "__MISSING__:Translating to {target}...",
+    "narratedSending": "__MISSING__:Sending to {target}...",
+    "narratedSuccess": "__MISSING__:→ translated to {target} · response in {latency}ms",
+    "narratedError": "__MISSING__:Failed: {reason}",
+    "narratedSeeTranslatedJson": "__MISSING__:see translated JSON",
+    "narratedSeePipeline": "__MISSING__:see pipeline",
+    "advancedSectionTitle": "__MISSING__:Advanced",
+    "advancedSectionSubtitle": "__MISSING__:Raw JSON, pipeline and technical tools. Everything here is the same as the old tabs — just reorganized.",
+    "advancedRawJsonTitle": "__MISSING__:Raw JSON (auto-detect + Monaco)",
+    "advancedRawJsonSubtitle": "__MISSING__:Paste a JSON request; the format is detected automatically.",
+    "advancedPipelineTitle": "__MISSING__:OpenAI intermediate pipeline",
+    "advancedPipelineSubtitle": "__MISSING__:Visualize each translation step (hub-and-spoke).",
+    "advancedStreamTransformTitle": "__MISSING__:Stream Transformer (Chat → Responses SSE)",
+    "advancedStreamTransformSubtitle": "__MISSING__:Converts Chat Completions SSE into Responses API.",
+    "advancedTestBenchTitle": "__MISSING__:Test Bench (8 scenarios)",
+    "advancedTestBenchSubtitle": "__MISSING__:Runs all scenarios and reports pass/fail + compatibility %.",
+    "advancedCompressionTitle": "__MISSING__:Compression Preview",
+    "advancedCompressionSubtitle": "__MISSING__:Estimate token savings across different compression modes.",
+    "monitorOriginHint": "__MISSING__:Events generated by Translate or the main pipeline appear here in real time.",
+    "monitorEmptyCta": "__MISSING__:Go to the Translate tab and send a request — it will appear here.",
+    "monitorOpenTranslateButton": "__MISSING__:Go to Translate",
+    "pipelineStepClientRequest": "__MISSING__:Client Request",
+    "pipelineStepClientRequestDesc": "__MISSING__:Request received in client format",
+    "pipelineStepFormatDetected": "__MISSING__:Format Detected",
+    "pipelineStepFormatDetectedDesc": "__MISSING__:Auto-detected source format",
+    "pipelineStepOpenAIIntermediate": "__MISSING__:OpenAI Intermediate",
+    "pipelineStepOpenAIIntermediateDesc": "__MISSING__:Translated to OpenAI hub format",
+    "pipelineStepProviderFormat": "__MISSING__:Provider Format",
+    "pipelineStepProviderFormatDesc": "__MISSING__:Translated to provider target format",
+    "pipelineStepProviderResponse": "__MISSING__:Provider Response",
+    "pipelineStepProviderResponseDesc": "__MISSING__:Streaming response from provider",
+    "conceptDiagramArrow1": "__MISSING__:speaks",
+    "conceptDiagramArrow2": "__MISSING__:translates",
+    "conceptDiagramArrow3": "__MISSING__:converts",
+    "conceptDiagramExampleHub": "__MISSING__:OpenAI",
+    "conceptDiagramHubTooltip": "__MISSING__:Intermediate hub used by the translator to convert between formats that don't have a direct mapping.",
+    "conceptDiagramSourceTooltip": "__MISSING__:The API format your app speaks (e.g., Anthropic SDK = claude).",
+    "conceptDiagramTargetTooltip": "__MISSING__:The provider where the request will actually be sent.",
+    "compressionEmptyHint": "__MISSING__:Fill in the input field on the Translate tab (Simple Controls or Raw JSON) to enable the preview.",
+    "compressionModeLabel": "__MISSING__:Compression mode",
+    "compressionPreviewButton": "__MISSING__:Preview Compression",
+    "compressionPreviewing": "__MISSING__:Previewing…"
   },
   "usage": {
     "title": "Gebruik",
@@ -6010,6 +6654,8 @@
     "notApplicable": "N.v.t",
     "rawPlanWithValue": "Ruw plan: {plan}",
     "noPlanFromProvider": "Geen abonnement van aanbieder",
+    "tokenExpiresIn": "__MISSING__:Token expires in {time}",
+    "tokenExpired": "__MISSING__:Token expired",
     "noQuotaData": "Geen quotagegevens",
     "cardExpand": "__MISSING__:Expand",
     "cardCollapse": "__MISSING__:Collapse",
@@ -6159,6 +6805,11 @@
     "quotaCutoffsButtonDefault": "Standaard",
     "quotaCutoffsButtonHelp": "Bewerk de minimale resterende quotumlimieten voor dit account.",
     "quotaCutoffsButtonDisabled": "Er zijn nog geen quotavensters beschikbaar voor dit account.",
+    "deactivateAccount": "__MISSING__:Deactivate account (stop routing)",
+    "activateAccount": "__MISSING__:Activate account (resume routing)",
+    "accountActivated": "__MISSING__:Account activated",
+    "accountDeactivated": "__MISSING__:Account deactivated",
+    "toggleActiveFailed": "__MISSING__:Failed to update account status",
     "quotaCutoffsTitle": "Quotalimieten voor {name} ({provider})",
     "quotaCutoffsExplainer": "Overschrijf het minimale resterende quotumpercentage waarbij dit account niet meer wordt geselecteerd voor elke quotumperiode. Laat dit leeg om de standaardprovider over te nemen.",
     "quotaCutoffsDefaultHint": "Standaard min. resterend: {default}%",
@@ -6179,6 +6830,7 @@
     "budgetColDailyLim": "Dagelijks lim",
     "budgetColMonthlyLim": "Maandelijks lim",
     "budgetColUsedPct": "Gebruikt %",
+    "percentUsed": "__MISSING__:{pct}% used",
     "budgetLoading": "Laden…",
     "budgetNoKeysMatch": "Er zijn geen sleutels die overeenkomen met filters",
     "budgetLinearExtrapolation": "lineaire extrapolatie",
@@ -7124,6 +7776,11 @@
     "modalEditTitle": "Modal Edit Title",
     "labelName": "Label Name",
     "labelType": "Typ",
+    "labelFamily": "__MISSING__:IP family",
+    "familyAuto": "__MISSING__:Auto (dual-stack)",
+    "familyIpv4": "__MISSING__:IPv4 only",
+    "familyIpv6": "__MISSING__:IPv6 only",
+    "familyHint": "__MISSING__:Egress address family. Auto keeps dual-stack; IPv4/IPv6 pin this proxy to that family (prevents a v4 leak under an IPv6-only proxy).",
     "labelHost": "Gastheer",
     "labelPort": "Haven",
     "labelUsername": "Gebruikersnaam",
@@ -7266,7 +7923,16 @@
     "improveConfirm": "Improve",
     "exportCode": "Export code",
     "exportCodeTitle": "Export Code",
+    "exportShort": "__MISSING__:Export",
     "noStateToExport": "No playground state available to export.",
+    "closeExportModal": "__MISSING__:Close export modal",
+    "close": "__MISSING__:Close",
+    "exportRealKeyWarning": "__MISSING__:Security warning: export blocked — a real API key was detected in the output. Please reset your API key and try again.",
+    "placeholderHintPrefix": "__MISSING__:Replace",
+    "placeholderHintSuffix": "__MISSING__:with your actual API key, or set it as an environment variable.",
+    "copyLangCode": "__MISSING__:Copy {language} code",
+    "loadingPresets": "__MISSING__:Loading…",
+    "loadPresetPlaceholder": "__MISSING__:Load preset…",
     "copyCode": "Copy",
     "copiedCode": "Copied!",
     "addModel": "+ Add model",
@@ -7291,7 +7957,27 @@
     "invalidJson": "Invalid JSON",
     "running": "Running…",
     "runLabel": "Run",
-    "enterToolResult": "Enter tool result…"
+    "enterToolResult": "Enter tool result…",
+    "build": {
+      "step1Label": "__MISSING__:What to test?",
+      "step2Label": "__MISSING__:Configure",
+      "step3Label": "__MISSING__:Run",
+      "step1Title": "__MISSING__:What do you want to test?",
+      "step1Subtitle": "__MISSING__:Choose the capability you want to explore in this session.",
+      "step2Title": "__MISSING__:Configure",
+      "step2Subtitle": "__MISSING__:Set up the tools or JSON schema that will be used in the request.",
+      "step3Title": "__MISSING__:Run",
+      "modeToolsTitle": "__MISSING__:Tools",
+      "modeToolsDesc": "__MISSING__:Test function calling — define tools and see how the model invokes them.",
+      "modeJsonTitle": "__MISSING__:JSON",
+      "modeJsonDesc": "__MISSING__:Test structured output — constrain the response to a JSON schema.",
+      "modeBothTitle": "__MISSING__:Tools + JSON",
+      "modeBothDesc": "__MISSING__:Combine function calling and structured output in a single request.",
+      "backButton": "__MISSING__:Back",
+      "nextButton": "__MISSING__:Next",
+      "runButton": "__MISSING__:Run",
+      "promptPlaceholder": "__MISSING__:Enter your message… (Enter to send, Shift+Enter for newline)"
+    }
   },
   "miniPlayground": {
     "endpoint": "__MISSING__:Endpoint",
@@ -7395,7 +8081,9 @@
     "loadingLogs": "Loading logs...",
     "noLogs": "No logs yet. Make some API calls to see them here.",
     "noMatchingLogs": "No logs matching current filters.",
-    "callLogsInfo": "Call logs are also saved as JSON files to {dataDir} and rotated based on {retentionDays} and {maxEntries}."
+    "callLogsInfo": "Call logs are also saved as JSON files to {dataDir} and rotated based on {retentionDays} and {maxEntries}.",
+    "loadMore": "__MISSING__:Load More",
+    "loadingMore": "__MISSING__:Loading more..."
   },
   "proxyLogger": {
     "filterAll": "All",
@@ -7432,7 +8120,8 @@
     "loadingProxyLogs": "Loading proxy logs...",
     "noProxyLogs": "No proxy logs yet. Configure proxies and make API calls to see them here.",
     "noMatchingLogs": "No logs match the current filters.",
-    "tlsFingerprint": "Chrome 124 TLS Fingerprint"
+    "tlsFingerprint": "Chrome 124 TLS Fingerprint",
+    "colPublicIp": "__MISSING__:Public IP"
   },
   "endpointOptions": {
     "speech": "Speech",
@@ -7572,7 +8261,86 @@
     "betaConfigSavedSuffix": "(nog niet aanwezig op de server). Het afdwingen van limieten per verzoek is nog niet opgenomen in de proxypijplijn. Op dit scherm kunt u de quotaverdeling ontwerpen en visualiseren; echte handhaving zal in een toekomstige iteratie terechtkomen met DB-persistentie en upstream-gespreksonderschepping.",
     "policyLabel": "Beleid:",
     "resetIn": "opnieuw instellen",
-    "quotaTotal": "totaal"
+    "quotaTotal": "totaal",
+    "kpiAvgUtilization": "__MISSING__:Avg utilization",
+    "kpiBorrowingNow": "__MISSING__:Borrowing now",
+    "conceptTitle": "__MISSING__:How Quota Share works",
+    "conceptIntro": "__MISSING__:Quota Share divides a provider's quota among multiple API keys using work-conserving fair-share: each key receives a proportional slice but can borrow from the free balance without exceeding the global cap.",
+    "conceptFairShare": "__MISSING__:Fair-share: each key receives quota proportional to its configured weight",
+    "conceptBorrowing": "__MISSING__:Borrowing: keys can consume free balance from others without breaching the cap",
+    "conceptGlobalCap": "__MISSING__:Hard global cap: the provider's absolute limit is never exceeded",
+    "conceptWindows": "__MISSING__:Windows: 5h, hourly, daily, weekly, monthly — each tracked independently",
+    "conceptKeyHowTitle": "__MISSING__:Enabling a key for quota",
+    "conceptKeyHowDesc": "__MISSING__:Create the key normally in API Keys — it appears in the wizard's key step automatically. Tick Exclusive there to make it quota-only. No separate enable step.",
+    "conceptExclusiveTitle": "__MISSING__:What \"Exclusive\" does",
+    "conceptExclusiveDesc": "__MISSING__:An exclusive key only sees/uses the pool's quotaShared-* models — every other model is hidden from its /v1/models and blocked.",
+    "burnRateTitle": "__MISSING__:Burn rate",
+    "burnRateExhaustsIn": "__MISSING__:Exhausts in",
+    "dimensionResetIn": "__MISSING__:Resets in",
+    "realConsumedColumn": "__MISSING__:Consumed",
+    "deficitColumn": "__MISSING__:Deficit",
+    "borrowingIndicator": "__MISSING__:borrowing",
+    "migratedFromLocalStorageNotice": "__MISSING__:Pools successfully migrated from localStorage.",
+    "policyCapAbsoluteLabel": "__MISSING__:Absolute cap",
+    "policyCapAbsolutePlaceholder": "__MISSING__:Numeric limit (optional)",
+    "multiDimensionLabel": "__MISSING__:Multi-dimension",
+    "stackedBarTitle": "__MISSING__:Slices by API key",
+    "usedSuffix": "__MISSING__:used {percent}%",
+    "wizardTitle": "__MISSING__:New quota pool",
+    "editPoolTitle": "__MISSING__:Edit pool",
+    "saveChanges": "__MISSING__:Save changes",
+    "wizardStep1Label": "__MISSING__:Account",
+    "wizardStep2Label": "__MISSING__:Limit",
+    "wizardStep3Label": "__MISSING__:Keys",
+    "wizardStep1Title": "__MISSING__:Choose provider connection",
+    "wizardStep1Subtitle": "__MISSING__:Select the provider account this pool will share quota for, set a name and default policy.",
+    "wizardStep2Title": "__MISSING__:Configure quota dimensions",
+    "wizardStep2Subtitle": "__MISSING__:Define the quota plan dimensions (unit, window, limit) for the chosen connection. Leave unchanged to keep current settings.",
+    "wizardStep3Title": "__MISSING__:Allocate API keys",
+    "wizardStep3Subtitle": "__MISSING__:Assign API keys to this pool with weight % allocations and optional caps.",
+    "wizardPoolNameLabel": "__MISSING__:Pool name",
+    "wizardPoolNamePlaceholder": "__MISSING__:My quota pool",
+    "wizardNext": "__MISSING__:Next",
+    "wizardBack": "__MISSING__:Back",
+    "wizardCreatePool": "__MISSING__:Create pool",
+    "wizardDimensionsEditedNotice": "__MISSING__:Dimensions edited — will be saved as a manual override when the pool is created.",
+    "wizardExclusiveLabel": "__MISSING__:Exclusive quota",
+    "wizardExclusiveHint": "__MISSING__:When enabled, these API keys will only be allowed to use this pool's virtual models (allowedQuotas reconciliation is applied on save).",
+    "wizardPreviewLabel": "__MISSING__:Virtual model names preview",
+    "wizardConnectionsLabel": "__MISSING__:Provider connections",
+    "wizardPrimaryBadge": "__MISSING__:primary",
+    "wizardAdditionalConnectionsNote": "__MISSING__:Additional connections use their catalog default limits (editable later).",
+    "wizardSingleProviderNote": "__MISSING__:A pool uses a single provider",
+    "wizardPreviewMoreModels": "__MISSING__:+{count} more",
+    "accountQuotaTitle": "__MISSING__:Account quota",
+    "accountQuotaNone": "__MISSING__:—",
+    "logTitle": "__MISSING__:Usage log",
+    "logEmpty": "__MISSING__:No usage yet",
+    "groupLabel": "__MISSING__:Group",
+    "newGroup": "__MISSING__:New group",
+    "renameGroup": "__MISSING__:Rename group",
+    "groupSelectHint": "__MISSING__:Filter pools by group",
+    "groupAllocationNote": "__MISSING__:Allocations apply to all pools in this group via the shared quota layer.",
+    "groupNamePrompt": "__MISSING__:Enter group name",
+    "wizardGroupLabel": "__MISSING__:Group",
+    "allGroups": "__MISSING__:All groups",
+    "endpointsTitle": "__MISSING__:Available endpoints",
+    "endpointsHint": "__MISSING__:Call these virtual models with any allocated key — routing + quota are handled per group.",
+    "previewForKey": "__MISSING__:Preview for key",
+    "previewKeyNone": "__MISSING__:(all endpoints)",
+    "endpointsBaseUrl": "__MISSING__:Base URL",
+    "endpointsCollapse": "__MISSING__:Collapse",
+    "endpointsExpand": "__MISSING__:Expand",
+    "endpointsAnthropicNote": "__MISSING__:Anthropic-native",
+    "endpointsResponsesNote": "__MISSING__:OpenAI Responses — codex/github",
+    "endpointsWsNote": "__MISSING__:WebSocket — codex only",
+    "betaText": "__MISSING__:Quota Share is functional but bugs are expected. Found one? Please report it.",
+    "betaReportLink": "__MISSING__:Report an issue",
+    "deleteGroup": "__MISSING__:Delete group",
+    "deleteGroupConfirm": "__MISSING__:Delete this group? Its pools must be reassigned or removed first.",
+    "deleteGroupHasPools": "__MISSING__:This group still has pools — reassign or delete them first.",
+    "ungroupedTitle": "__MISSING__:Ungrouped",
+    "ungroupedHint": "__MISSING__:These pools are not assigned to a known group. Edit a pool to move it into a real group."
   },
   "plugins": {
     "title": "Plugins",
@@ -7608,6 +8376,571 @@
     "status": "Status",
     "enabled": "Enabled",
     "disabled": "Disabled",
+    "installedTab": "__MISSING__:Installed",
+    "marketplaceTab": "__MISSING__:Marketplace",
+    "marketplaceUrlLabel": "__MISSING__:Custom Marketplace URL",
+    "marketplaceUrlPlaceholder": "__MISSING__:Leave empty for official Omniroute registry",
+    "saveMarketplaceUrl": "__MISSING__:Save & Reload",
+    "marketplaceUrlSaved": "__MISSING__:Marketplace URL updated",
+    "marketplaceEmpty": "__MISSING__:No plugins found in marketplace.",
+    "verified": "__MISSING__:Verified",
+    "install": "__MISSING__:Install",
+    "installedFromMarketplace": "__MISSING__:Plugin {name} installed!",
     "hooks": "Hooks"
+  },
+  "quotaPlans": {
+    "title": "__MISSING__:Plans & Quotas",
+    "description": "__MISSING__:Configure quota plans per provider — dimensions (%, requests, tokens, $) and time windows",
+    "providerLabel": "__MISSING__:Provider / Connection",
+    "detectedPlanLabel": "__MISSING__:Detected plan",
+    "manualPlanLabel": "__MISSING__:Manual override",
+    "unconfiguredLabel": "__MISSING__:Not configured — manual required",
+    "dimensionLabel": "__MISSING__:Dimensions",
+    "addDimension": "__MISSING__:Add dimension",
+    "removeDimension": "__MISSING__:Remove",
+    "limitLabel": "__MISSING__:Limit",
+    "unitOptions": {
+      "percent": "__MISSING__:%",
+      "requests": "__MISSING__:requests",
+      "tokens": "__MISSING__:tokens",
+      "usd": "__MISSING__:USD ($)"
+    },
+    "windowOptions": {
+      "5h": "__MISSING__:5 hours",
+      "hourly": "__MISSING__:Hourly",
+      "daily": "__MISSING__:Daily",
+      "weekly": "__MISSING__:Weekly",
+      "monthly": "__MISSING__:Monthly"
+    },
+    "useCatalogButton": "__MISSING__:Use catalog",
+    "saveOverrideButton": "__MISSING__:Save override",
+    "revertToCatalogButton": "__MISSING__:Revert to catalog",
+    "unknownProviderNotice": "__MISSING__:Select a provider on the left to configure its quota plan.",
+    "catalogTitle": "__MISSING__:Known catalog",
+    "catalogDescription": "__MISSING__:Automatically detected plans for the following providers:"
+  },
+  "activity": {
+    "title": "__MISSING__:Activity",
+    "description": "__MISSING__:Recent events feed",
+    "emptyTitle": "__MISSING__:No activity yet",
+    "emptyDescription": "__MISSING__:When you add providers, create combos, or rotate keys, events will appear here.",
+    "todayHeader": "__MISSING__:Today",
+    "yesterdayHeader": "__MISSING__:Yesterday",
+    "filterAll": "__MISSING__:All",
+    "filterProviders": "__MISSING__:Providers",
+    "filterCombos": "__MISSING__:Combos",
+    "filterApiKeys": "__MISSING__:API Keys",
+    "filterSettings": "__MISSING__:Settings",
+    "filterQuota": "__MISSING__:Quota",
+    "filterAuth": "__MISSING__:Auth",
+    "filterSystem": "__MISSING__:System",
+    "relative": {
+      "justNow": "__MISSING__:just now",
+      "minutesAgo": "__MISSING__:{n} min ago",
+      "hoursAgo": "__MISSING__:{n} h ago",
+      "yesterday": "__MISSING__:yesterday",
+      "daysAgo": "__MISSING__:{n} days ago"
+    },
+    "eventVerb": {
+      "providerAdded": "__MISSING__:{actor} added provider {target}",
+      "providerRemoved": "__MISSING__:{actor} removed provider {target}",
+      "providerTested": "__MISSING__:{actor} tested provider {target}",
+      "comboCreated": "__MISSING__:{actor} created combo {target}",
+      "comboUpdated": "__MISSING__:{actor} updated combo {target}",
+      "comboDeleted": "__MISSING__:{actor} removed combo {target}",
+      "apiKeyCreated": "__MISSING__:{actor} created API key {target}",
+      "apiKeyRevoked": "__MISSING__:{actor} revoked API key {target}",
+      "apiKeyRotated": "__MISSING__:{actor} rotated API key {target}",
+      "budgetThreshold": "__MISSING__:Budget threshold reached for {target}",
+      "settingUpdated": "__MISSING__:{actor} updated setting {target}",
+      "authLogin": "__MISSING__:{actor} signed in",
+      "authLogout": "__MISSING__:{actor} signed out",
+      "cloudAgentSession": "__MISSING__:Cloud agent session started for {target}",
+      "mcpToolRegistered": "__MISSING__:MCP tool {target} registered",
+      "webhookCreated": "__MISSING__:{actor} created webhook {target}",
+      "webhookDeleted": "__MISSING__:{actor} removed webhook {target}",
+      "quotaPoolCreated": "__MISSING__:{actor} created quota pool {target}",
+      "quotaPoolUpdated": "__MISSING__:{actor} updated quota pool {target}",
+      "quotaPoolDeleted": "__MISSING__:{actor} removed quota pool {target}",
+      "quotaPlanUpdated": "__MISSING__:{actor} updated quota plan {target}",
+      "quotaStoreDriverChanged": "__MISSING__:QuotaStore driver changed",
+      "updateApplied": "__MISSING__:Update {target} applied",
+      "deployCompleted": "__MISSING__:Deploy completed",
+      "skillInstalled": "__MISSING__:{actor} installed skill {target}",
+      "skillRemoved": "__MISSING__:{actor} removed skill {target}",
+      "providerCredentialsCreated": "__MISSING__:{actor} created credentials for {target}",
+      "providerCredentialsApplied": "__MISSING__:Credentials for {target} applied",
+      "providerCredentialsUpdated": "__MISSING__:{actor} updated credentials for {target}",
+      "providerCredentialsRevoked": "__MISSING__:{actor} revoked credentials for {target}",
+      "providerCredentialsBatchRevoked": "__MISSING__:{actor} batch-revoked credentials",
+      "providerCredentialsBatchUpdated": "__MISSING__:{actor} batch-updated credentials",
+      "providerCredentialsBulkCreated": "__MISSING__:{actor} bulk-created credentials",
+      "providerCredentialsBulkImported": "__MISSING__:{actor} bulk-imported credentials",
+      "providerCredentialsImported": "__MISSING__:{actor} imported credentials",
+      "providerSsrfBlocked": "__MISSING__:SSRF attempt blocked for {target}",
+      "authLoginSuccess": "__MISSING__:{actor} signed in",
+      "authLoginError": "__MISSING__:Login error for {actor}",
+      "authLoginFailed": "__MISSING__:Login failed for {actor}",
+      "authLoginLocked": "__MISSING__:{actor} locked out after too many attempts",
+      "authLoginMisconfigured": "__MISSING__:Auth configuration invalid",
+      "authLoginSetupRequired": "__MISSING__:Auth setup required",
+      "authLogoutSuccess": "__MISSING__:{actor} signed out",
+      "syncTokenCreated": "__MISSING__:{actor} created sync token",
+      "syncTokenRevoked": "__MISSING__:{actor} revoked sync token",
+      "settingsUpdate": "__MISSING__:{actor} updated settings",
+      "settingsUpdateFailed": "__MISSING__:Settings update failed",
+      "serviceRevealApiKey": "__MISSING__:{actor} revealed API key for {target}",
+      "genericEvent": "__MISSING__:{actor} {target}"
+    }
+  },
+  "agentBridge": {
+    "title": "__MISSING__:AgentBridge",
+    "subtitle": "__MISSING__:Use IDE agents with OmniRoute models — no config required",
+    "riskBannerTitle": "__MISSING__:Use at your own risk",
+    "riskBannerBody": "__MISSING__:AgentBridge intercepts HTTPS traffic from IDE agents. By activating it you accept responsibility for compliance with the terms of service of each agent. Never use on devices or networks where TLS inspection is prohibited.",
+    "riskBannerDismiss": "__MISSING__:Dismiss",
+    "serverCardTitle": "__MISSING__:AgentBridge Server",
+    "statusRunning": "__MISSING__:Running",
+    "statusStopped": "__MISSING__:Stopped",
+    "statusActive": "__MISSING__:Active",
+    "statusDnsOff": "__MISSING__:DNS off",
+    "statusSetupRequired": "__MISSING__:Setup required",
+    "statusInvestigating": "__MISSING__:Investigating",
+    "serverPort": "__MISSING__:Port",
+    "serverConns": "__MISSING__:Connections",
+    "serverIntercepted": "__MISSING__:Intercepted",
+    "serverLastStarted": "__MISSING__:Last started",
+    "startServer": "__MISSING__:Start",
+    "stopServer": "__MISSING__:Stop",
+    "restartServer": "__MISSING__:Restart",
+    "trustCert": "__MISSING__:Trust Cert",
+    "downloadCert": "__MISSING__:Download Cert",
+    "regenerateCert": "__MISSING__:Regenerate Cert",
+    "starting": "__MISSING__:Starting…",
+    "stopping": "__MISSING__:Stopping…",
+    "restarting": "__MISSING__:Restarting…",
+    "trusting": "__MISSING__:Trusting…",
+    "regenerating": "__MISSING__:Regenerating…",
+    "upstreamCaLabel": "__MISSING__:Upstream CA Certificate (corporate)",
+    "upstreamCaPlaceholder": "__MISSING__:/etc/ssl/certs/corp-ca.pem",
+    "upstreamCaTest": "__MISSING__:Test TLS",
+    "upstreamCaTestOk": "__MISSING__:TLS test passed",
+    "upstreamCaTestError": "__MISSING__:TLS test failed — check the path and CA file",
+    "bypassSectionTitle": "__MISSING__:Bypass List",
+    "bypassSectionDesc": "__MISSING__:Hosts matching these patterns are tunneled directly (no TLS decryption). Defaults include banks, .gov, and corporate SSO.",
+    "bypassDefaultsLabel": "__MISSING__:Default bypass patterns (read-only)",
+    "bypassUserLabel": "__MISSING__:Custom bypass patterns (one per line, glob or regex)",
+    "saveBypassList": "__MISSING__:Save bypass list",
+    "agentListTitle": "__MISSING__:IDE Agents",
+    "filterAll": "__MISSING__:All",
+    "filterActive": "__MISSING__:Active",
+    "filterSetupRequired": "__MISSING__:Setup required",
+    "filterInvestigating": "__MISSING__:Investigating",
+    "searchAgents": "__MISSING__:Search agents…",
+    "noAgentsMatch": "__MISSING__:No agents match the current filter",
+    "agentHosts": "__MISSING__:Intercepted hosts",
+    "certTrusted": "__MISSING__:Certificate trusted",
+    "certNotTrusted": "__MISSING__:Certificate not trusted",
+    "investigatingNotice": "__MISSING__:This agent is under investigation. Hosts and API surface are still being confirmed. Setup will be available once the upstream API is documented.",
+    "modelMappingsLabel": "__MISSING__:Model mappings",
+    "sourceModel": "__MISSING__:Source model (agent native)",
+    "targetModel": "__MISSING__:Target model (OmniRoute)",
+    "noMappings": "__MISSING__:No model mappings configured. Run setup wizard to auto-detect models.",
+    "selectModel": "__MISSING__:Select…",
+    "saveMappings": "__MISSING__:Save mappings",
+    "setupWizard": "__MISSING__:Setup wizard",
+    "startDns": "__MISSING__:Start DNS",
+    "stopDns": "__MISSING__:Stop DNS",
+    "toggling": "__MISSING__:Toggling…",
+    "viewTraffic": "__MISSING__:View traffic",
+    "emptyNoProvidersTitle": "__MISSING__:No providers configured yet",
+    "emptyNoProvidersBody": "__MISSING__:To use AgentBridge, first connect at least one provider. It will be the destination where IDE requests are routed.",
+    "emptyGoToProviders": "__MISSING__:Go to Providers",
+    "wizardTitle": "__MISSING__:Setup wizard",
+    "wizardSubtitle": "__MISSING__:3-step setup",
+    "wizardStep1Label": "__MISSING__:Verify",
+    "wizardStep2Label": "__MISSING__:DNS",
+    "wizardStep3Label": "__MISSING__:Mappings",
+    "wizardStep1Desc": "__MISSING__:Confirm the server is running and the certificate is installed.",
+    "wizardStep2Desc": "__MISSING__:The following entries will be added to /etc/hosts to redirect traffic through AgentBridge:",
+    "wizardStep3Desc": "__MISSING__:You can now configure model mappings in the agent card. Restart the IDE to apply changes.",
+    "wizardStep3Success": "__MISSING__:Agent is configured!",
+    "wizardServerCheck": "__MISSING__:AgentBridge server",
+    "wizardRunning": "__MISSING__:running",
+    "wizardNotRunning": "__MISSING__:not running",
+    "wizardCertCheck": "__MISSING__:Certificate",
+    "wizardTrusted": "__MISSING__:trusted",
+    "wizardNotTrusted": "__MISSING__:not yet trusted — use Trust Cert button",
+    "wizardTutorialTitle": "__MISSING__:Setup instructions:",
+    "wizardEnableDns": "__MISSING__:Add /etc/hosts entries",
+    "wizardDnsAlreadyEnabled": "__MISSING__:DNS already enabled for this agent",
+    "enablingDns": "__MISSING__:Enabling…",
+    "modelSelectorTitle": "__MISSING__:Select target model",
+    "modelSelectorSearch": "__MISSING__:Search models…",
+    "noModelsFound": "__MISSING__:No models found",
+    "quickLinks": "__MISSING__:Quick links",
+    "quickLinkProviders": "__MISSING__:Configure providers",
+    "quickLinkInspector": "__MISSING__:View traffic in Traffic Inspector",
+    "maintenanceTitle": "__MISSING__:Maintenance & Diagnostics",
+    "maintenanceSubtitle": "__MISSING__:Self-test the capture pipeline, undo leftover system state, and move your setup between machines.",
+    "orphanedStateWarning": "__MISSING__:A previous session left system state behind (DNS spoof, CA, or system proxy). Run Repair to clean it up.",
+    "diagnose": "__MISSING__:Diagnose",
+    "diagnosing": "__MISSING__:Diagnosing…",
+    "diagnoseHealthy": "__MISSING__:Capture pipeline is healthy.",
+    "diagnoseUnhealthy": "__MISSING__:Capture pipeline has problems:",
+    "repair": "__MISSING__:Repair",
+    "repairing": "__MISSING__:Repairing…",
+    "repairDone": "__MISSING__:Repaired: {items}",
+    "repairNothing": "__MISSING__:Nothing to repair — system state is clean.",
+    "removeCa": "__MISSING__:Remove CA",
+    "removeCaConfirm": "__MISSING__:Remove CA?",
+    "removeCaDone": "__MISSING__:MITM root CA removed from the OS trust store.",
+    "removing": "__MISSING__:Removing…",
+    "confirm": "__MISSING__:Confirm",
+    "exportConfig": "__MISSING__:Export config",
+    "exporting": "__MISSING__:Exporting…",
+    "importConfig": "__MISSING__:Import config",
+    "importing": "__MISSING__:Importing…",
+    "importInvalidJson": "__MISSING__:The selected file is not valid JSON.",
+    "importDone": "__MISSING__:Imported {bypass} bypass · {hosts} hosts · {agents} agents",
+    "save": "__MISSING__:Save",
+    "saving": "__MISSING__:Saving…",
+    "cancel": "__MISSING__:Cancel",
+    "back": "__MISSING__:Back",
+    "next": "__MISSING__:Next",
+    "done": "__MISSING__:Done",
+    "loading": "__MISSING__:Loading…",
+    "riskNoticeTitle": "__MISSING__:Risk acknowledgment",
+    "riskNoticeBody": "__MISSING__:AgentBridge will intercept HTTPS traffic from this agent by redirecting its API hosts via DNS. Only enable if you accept responsibility for compliance with the agent's terms of service and any applicable network policies.",
+    "pageMoved": {
+      "goNow": "__MISSING__:Go now",
+      "message": "__MISSING__:The MITM Proxy now lives under AgentBridge.",
+      "title": "__MISSING__:This page has moved"
+    }
+  },
+  "trafficInspector": {
+    "title": "__MISSING__:Traffic Inspector",
+    "subtitle": "__MISSING__:Monitor LLM calls and debug any application's HTTPS traffic",
+    "captureModesTitle": "__MISSING__:Capture Modes",
+    "agentBridgeMode": "__MISSING__:AgentBridge",
+    "agentBridgeModeDesc": "__MISSING__:Capture traffic from all connected IDE agents",
+    "customHostsMode": "__MISSING__:Custom Hosts",
+    "customHostsModeDesc": "__MISSING__:Add specific hosts to intercept",
+    "httpProxyMode": "__MISSING__:HTTP Proxy",
+    "httpProxyModeDesc": "__MISSING__:Use HTTP_PROXY environment variable",
+    "systemWideMode": "__MISSING__:System-wide",
+    "systemWideModeDesc": "__MISSING__:Intercept all system traffic (advanced)",
+    "tproxyMode": "__MISSING__:TPROXY Decrypt",
+    "tproxyModeUnavailable": "__MISSING__:TPROXY decrypt requires Linux + root + the native addon",
+    "filterBarTitle": "__MISSING__:Filters",
+    "profileLlmOnly": "__MISSING__:LLM only",
+    "profileCustom": "__MISSING__:Custom",
+    "profileAll": "__MISSING__:All",
+    "filterHost": "__MISSING__:Filter host…",
+    "filterAgent": "__MISSING__:Agent",
+    "filterStatus": "__MISSING__:Status",
+    "pauseBtn": "__MISSING__:Pause",
+    "resumeBtn": "__MISSING__:Resume",
+    "clearBtn": "__MISSING__:Clear",
+    "exportHar": "__MISSING__:Export .har",
+    "recordSession": "__MISSING__:REC",
+    "stopSession": "__MISSING__:Stop",
+    "liveBadge": "__MISSING__:live",
+    "offlineBadge": "__MISSING__:offline",
+    "noRequests": "__MISSING__:No requests captured yet.",
+    "noRequestsDesc": "__MISSING__:Make sure AgentBridge is running or enable another capture mode.",
+    "selectRequest": "__MISSING__:Select a request to inspect it.",
+    "tabConversation": "__MISSING__:Conversation",
+    "tabHeaders": "__MISSING__:Headers",
+    "tabRequest": "__MISSING__:Request",
+    "tabResponse": "__MISSING__:Response",
+    "tabTiming": "__MISSING__:Timing",
+    "tabLlm": "__MISSING__:LLM",
+    "tabStats": "__MISSING__:Stats",
+    "requestHeaders": "__MISSING__:Request Headers",
+    "responseHeaders": "__MISSING__:Response Headers",
+    "rawEvents": "__MISSING__:Raw events",
+    "mergedView": "__MISSING__:Merged view",
+    "noBody": "__MISSING__:No body.",
+    "streaming": "__MISSING__:streaming…",
+    "manageHosts": "__MISSING__:Manage hosts",
+    "copySnippet": "__MISSING__:Copy proxy snippet",
+    "addHost": "__MISSING__:Add",
+    "hostPlaceholder": "__MISSING__:api.openai.com",
+    "noHostsYet": "__MISSING__:No custom hosts added yet.",
+    "noSessionsYet": "__MISSING__:No sessions yet",
+    "allTraffic": "__MISSING__:All traffic (no session)",
+    "sessionsDropdown": "__MISSING__:Sessions",
+    "annotationPlaceholder": "__MISSING__:Add a note…",
+    "contextFingerprint": "__MISSING__:Context fingerprint",
+    "llmProvider": "__MISSING__:Detected provider",
+    "llmApiKind": "__MISSING__:API kind",
+    "llmModel": "__MISSING__:Model",
+    "llmMessages": "__MISSING__:Messages",
+    "llmStream": "__MISSING__:Stream",
+    "llmMappedTo": "__MISSING__:Mapped to",
+    "llmCostEstimate": "__MISSING__:Cost estimate",
+    "systemProxyExitWarning": "__MISSING__:System-wide proxy still active — leave page anyway?",
+    "customHostsTitle": "__MISSING__:Custom Hosts",
+    "loading": "__MISSING__:Loading…",
+    "copied": "__MISSING__:Copied!",
+    "copy": "__MISSING__:Copy",
+    "httpProxyTitle": "__MISSING__:HTTP Proxy Snippet — port {port}",
+    "notRecording": "__MISSING__:Not recording",
+    "anyStatus": "__MISSING__:Any status",
+    "liveOnly": "__MISSING__:Live",
+    "viewingRecordedSession": "__MISSING__:Viewing recorded session",
+    "backToLive": "__MISSING__:Back to live",
+    "untitledSession": "__MISSING__:Untitled session",
+    "contextHistory": "__MISSING__:Context History",
+    "modelResponse": "__MISSING__:Model Response",
+    "conversationNoMessages": "__MISSING__:No messages found in this request.",
+    "conversationNotAvailable": "__MISSING__:Conversation data not available. This may not be an LLM request or the body could not be parsed.",
+    "loadingCharts": "__MISSING__:Loading charts…",
+    "statsErrors": "__MISSING__:Errors",
+    "statsLatency": "__MISSING__:Latency (last 50 requests)",
+    "statsNoData": "__MISSING__:No requests yet. Start a session recording to capture data for stats.",
+    "statsStatusDistribution": "__MISSING__:Status distribution",
+    "statsSuccessful": "__MISSING__:Successful",
+    "statsTotalRequests": "__MISSING__:Total requests",
+    "timingProxyOverhead": "__MISSING__:Proxy overhead",
+    "timingUpstreamResponse": "__MISSING__:Upstream response",
+    "timingNoData": "__MISSING__:No timing data available.",
+    "timingTotalLatency": "__MISSING__:Total latency",
+    "timingTimestamp": "__MISSING__:Timestamp",
+    "timingMethod": "__MISSING__:Method",
+    "timingStatus": "__MISSING__:Status",
+    "timingRequestSize": "__MISSING__:Request size",
+    "timingResponseSize": "__MISSING__:Response size",
+    "pausedNewBadge": "__MISSING__:{count} new",
+    "clearContextFilter": "__MISSING__:clear"
+  },
+  "cliCommon": {
+    "concept": {
+      "code": {
+        "title": "__MISSING__:CLI Code",
+        "phrase": "__MISSING__:Code tools you point at OmniRoute",
+        "flow": "__MISSING__:You → CLI Code → OmniRoute → Provider",
+        "seeOther": "__MISSING__:See →"
+      },
+      "agent": {
+        "title": "__MISSING__:CLI Agents",
+        "phrase": "__MISSING__:Broad-purpose autonomous CLI agents you point at OmniRoute",
+        "flow": "__MISSING__:You → CLI Agent → OmniRoute → Provider",
+        "seeOther": "__MISSING__:See →"
+      },
+      "acp": {
+        "title": "__MISSING__:ACP Agents",
+        "phrase": "__MISSING__:CLIs that OmniRoute spawns as execution backend (reverse flow)",
+        "flow": "__MISSING__:Client → OmniRoute → spawn CLI (stdio/ACP) → response",
+        "seeOther": "__MISSING__:See →"
+      }
+    },
+    "comparison": {
+      "title": "__MISSING__:Understand the 3 CLI types in OmniRoute",
+      "thisPage": "__MISSING__:This page",
+      "open": "__MISSING__:Open →",
+      "code": {
+        "title": "__MISSING__:Code tool",
+        "desc": "__MISSING__:Points to Omni",
+        "flow": "__MISSING__:you → CLI → Omni → provider",
+        "examples": "__MISSING__:e.g.: claude, codex"
+      },
+      "agent": {
+        "title": "__MISSING__:Broad autonomous agent",
+        "desc": "__MISSING__:Points to Omni",
+        "flow": "__MISSING__:you → agent → Omni",
+        "examples": "__MISSING__:e.g.: hermes, goose"
+      },
+      "acp": {
+        "title": "__MISSING__:CLI used as backend by Omni",
+        "desc": "__MISSING__:Reverse execution",
+        "flow": "__MISSING__:Omni → spawn CLI → resp",
+        "examples": "__MISSING__:e.g.: claude, codex (ACP)"
+      }
+    },
+    "card": {
+      "detected": "__MISSING__:Detected",
+      "notDetected": "__MISSING__:Not detected",
+      "configured": "__MISSING__:Configured",
+      "notConfigured": "__MISSING__:Not configured",
+      "configure": "__MISSING__:Configure →",
+      "howToInstall": "__MISSING__:How to install →",
+      "manualConfig": "__MISSING__:Manual config",
+      "installGuide": "__MISSING__:Install guide",
+      "endpointLabel": "__MISSING__:Endpoint",
+      "baseUrlFull": "__MISSING__:Full Base URL",
+      "baseUrlPartial": "__MISSING__:Partial Base URL",
+      "refreshDetection": "__MISSING__:Refresh detection",
+      "alsoAcp": "__MISSING__:also ACP",
+      "connectProviderHint": "__MISSING__:Connect a provider in Providers"
+    },
+    "detail": {
+      "back": "__MISSING__:Back",
+      "apply": "__MISSING__:Save",
+      "reset": "__MISSING__:Clear",
+      "manualConfig": "__MISSING__:Manual configuration",
+      "vendor": "__MISSING__:Vendor",
+      "category": "__MISSING__:Type",
+      "detectionStatus": "__MISSING__:Detection",
+      "configStatus": "__MISSING__:Configuration",
+      "baseUrlLabel": "__MISSING__:Base URL",
+      "apiKeyLabel": "__MISSING__:API Key",
+      "modelMappingLabel": "__MISSING__:Model mapping",
+      "noActiveProviders": "__MISSING__:No active providers.",
+      "noActiveProvidersDesc": "__MISSING__:Go to Providers to connect at least 1 provider before configuring the CLI.",
+      "openProviders": "__MISSING__:Open Providers →"
+    }
+  },
+  "cliCode": {
+    "pageTitle": "__MISSING__:CLI Code's",
+    "pageSubtitle": "__MISSING__:Code tools pointing to OmniRoute",
+    "searchPlaceholder": "__MISSING__:Search CLI…",
+    "filterDetectionLabel": "__MISSING__:Detection",
+    "filterBaseUrlLabel": "__MISSING__:Base URL",
+    "detectionAll": "__MISSING__:All",
+    "detectionInstalled": "__MISSING__:Installed",
+    "detectionNotFound": "__MISSING__:Not found",
+    "baseUrlAll": "__MISSING__:All",
+    "baseUrlFull": "__MISSING__:Full",
+    "baseUrlPartial": "__MISSING__:Partial"
+  },
+  "cliAgents": {
+    "pageTitle": "__MISSING__:CLI Agents",
+    "pageSubtitle": "__MISSING__:Broad-purpose autonomous CLI agents",
+    "refreshDetection": "__MISSING__:Refresh detection",
+    "searchPlaceholder": "__MISSING__:Search agent…",
+    "detectionFilterLabel": "__MISSING__:Detection",
+    "detectionAll": "__MISSING__:All",
+    "detectionInstalled": "__MISSING__:Installed",
+    "detectionNotInstalled": "__MISSING__:Not installed",
+    "visibleCount": "__MISSING__:{count} visible",
+    "emptyState": "__MISSING__:No CLI agents found with the current filters."
+  },
+  "acpAgents": {
+    "pageTitle": "__MISSING__:ACP Agents",
+    "pageSubtitle": "__MISSING__:CLIs that OmniRoute spawns as execution backend",
+    "scanning": "__MISSING__:Detecting agents…",
+    "refresh": "__MISSING__:Refresh",
+    "setupGuideTitle": "__MISSING__:Setup guide",
+    "setupGuideDetectCliTitle": "__MISSING__:Detect CLI",
+    "setupGuideDetectCliDesc": "__MISSING__:Agents are identified by running the --version command in PATH.",
+    "setupGuideCustomAgentTitle": "__MISSING__:Add custom agent",
+    "setupGuideCustomAgentDesc": "__MISSING__:Fill in the form below to register a custom CLI agent.",
+    "setupGuideCommandMissingTitle": "__MISSING__:Command not found",
+    "setupGuideCommandMissingDesc": "__MISSING__:Check that the binary is in PATH.",
+    "fingerprintSettingsHint": "__MISSING__:Configure routing and fingerprints in",
+    "settingsRoutingLink": "__MISSING__:Settings → Routing",
+    "installed": "__MISSING__:Installed",
+    "notFound": "__MISSING__:Not found",
+    "builtIn": "__MISSING__:Built-in",
+    "custom": "__MISSING__:Custom",
+    "agentUseCaseHint": "__MISSING__:Available for spawn via ACP.",
+    "remove": "__MISSING__:Remove",
+    "addCustomAgent": "__MISSING__:Add custom agent",
+    "addCustomAgentDesc": "__MISSING__:Register a custom CLI agent to be spawned via ACP.",
+    "addAgent": "__MISSING__:Add agent",
+    "agentName": "__MISSING__:Name",
+    "agentNamePlaceholder": "__MISSING__:e.g.: My Agent",
+    "binaryName": "__MISSING__:Binary",
+    "binaryNamePlaceholder": "__MISSING__:e.g.: myagent",
+    "versionCommand": "__MISSING__:Version command",
+    "versionCommandPlaceholder": "__MISSING__:e.g.: myagent --version",
+    "spawnArgs": "__MISSING__:Spawn arguments",
+    "spawnArgsPlaceholder": "__MISSING__:e.g.: --quiet, --json",
+    "cliCodeRedirectCta": "__MISSING__:Open CLI Code"
+  },
+  "agentSkills": {
+    "pageTitle": "__MISSING__:Agent Skills",
+    "pageSubtitle": "__MISSING__:Teach your agent to operate OmniRoute — 22 API areas + 20 CLI families",
+    "conceptCard": {
+      "agent": {
+        "title": "__MISSING__:Agent Skills — Outbound",
+        "description": "__MISSING__:Agent Skills are machine-readable SKILL.md documents that external AI agents (Claude Code, Cursor, Copilot…) fetch from GitHub to learn how to operate OmniRoute via REST or CLI. They are read by the agent, not executed by OmniRoute.",
+        "crossLinkLabel": "__MISSING__:Understand the difference →"
+      },
+      "omni": {
+        "title": "__MISSING__:Omni Skills — Inbound",
+        "description": "__MISSING__:Omni Skills are sandbox tools that OmniRoute injects into the model's context on every request. They are executed by OmniRoute, not read by the agent.",
+        "crossLinkLabel": "__MISSING__:Understand the difference →"
+      },
+      "comparison": {
+        "colAgent": "__MISSING__:Agent Skills",
+        "colOmni": "__MISSING__:Omni Skills",
+        "whatIs": {
+          "label": "__MISSING__:What it is",
+          "agent": "__MISSING__:Machine-readable SKILL.md that teaches an external agent to operate OmniRoute",
+          "omni": "__MISSING__:Executable tools that OmniRoute injects as tools into LLM requests"
+        },
+        "direction": {
+          "label": "__MISSING__:Direction",
+          "agent": "__MISSING__:Outbound — external agent learns to control OmniRoute",
+          "omni": "__MISSING__:Inbound — OmniRoute gives tools to models passing through it"
+        },
+        "executor": {
+          "label": "__MISSING__:Executor",
+          "agent": "__MISSING__:External agent (reads markdown → acts via API/CLI)",
+          "omni": "__MISSING__:OmniRoute itself (intercepts tool_calls, Docker sandbox)"
+        },
+        "storage": {
+          "label": "__MISSING__:Storage",
+          "agent": "__MISSING__:Dynamic catalog (/api/agent-skills) → SKILL.md on GitHub",
+          "omni": "__MISSING__:SQLite (SkillsMP / skills.sh / local)"
+        },
+        "tagline": {
+          "label": "__MISSING__:Tagline",
+          "agent": "__MISSING__:Teach your agent to use OmniRoute",
+          "omni": "__MISSING__:Give executable tools to OmniRoute models"
+        }
+      }
+    },
+    "filters": {
+      "category": "__MISSING__:Category",
+      "area": "__MISSING__:Area",
+      "searchPlaceholder": "__MISSING__:Search skills…"
+    },
+    "categoryApi": "__MISSING__:API",
+    "categoryCli": "__MISSING__:CLI",
+    "categoryConfig": "__MISSING__:Config",
+    "filterAll": "__MISSING__:All",
+    "coverageLabel": "__MISSING__:Coverage",
+    "mcpUrl": "__MISSING__:MCP URL",
+    "a2aLink": "__MISSING__:A2A",
+    "copyUrl": "__MISSING__:Copy URL",
+    "viewOnGithub": "__MISSING__:View on GitHub",
+    "previewLoading": "__MISSING__:Loading skill documentation…",
+    "previewError": "__MISSING__:Failed to load skill documentation.",
+    "previewEmpty": "__MISSING__:Select a skill to preview its documentation.",
+    "generateButton": "__MISSING__:Generate missing skills",
+    "coverageBar": {
+      "complete": "__MISSING__:Complete",
+      "partial": "__MISSING__:Partial"
+    },
+    "noSkillsFound": "__MISSING__:No skills found matching your filters.",
+    "regenerateConfirm": "__MISSING__:This will regenerate all missing SKILL.md files. Continue?",
+    "regenerateRunning": "__MISSING__:Regenerating skills…",
+    "regenerateSuccess": "__MISSING__:Skills regenerated successfully.",
+    "regenerateError": "__MISSING__:Failed to regenerate skills."
+  },
+  "freeProviderRankingsPage": {
+    "title": "__MISSING__:Free Provider Rankings",
+    "subtitle": "__MISSING__:Best free providers ranked by model ELO scores from Arena AI leaderboards",
+    "loading": "__MISSING__:Loading rankings...",
+    "errorLoading": "__MISSING__:Failed to load rankings",
+    "emptyState": "__MISSING__:No rankings available yet. Arena ELO data syncs on startup (daily) — check back shortly, or trigger a manual sync. Disable Arena ELO Sync in Feature Flags or set ARENA_ELO_SYNC_ENABLED=false to opt out.",
+    "bestModel": "__MISSING__:Best",
+    "allCategories": "__MISSING__:All Categories",
+    "categoryDefault": "__MISSING__:Default",
+    "categoryCoding": "__MISSING__:Coding",
+    "categoryReview": "__MISSING__:Review",
+    "categoryDocumentation": "__MISSING__:Documentation",
+    "categoryDebugging": "__MISSING__:Debugging",
+    "colRank": "__MISSING__:Rank",
+    "colProvider": "__MISSING__:Provider",
+    "colTopModel": "__MISSING__:Top Model",
+    "colScore": "__MISSING__:Score",
+    "colAvgScore": "__MISSING__:Avg Score",
+    "colModels": "__MISSING__:Models",
+    "colType": "__MISSING__:Type"
   }
 }
diff --git a/src/i18n/messages/no.json b/src/i18n/messages/no.json
index a45db05273..7d463a4a86 100644
--- a/src/i18n/messages/no.json
+++ b/src/i18n/messages/no.json
@@ -393,6 +393,7 @@
     "cloudBenefitAccess": "Cloud Benefit Access",
     "maxRetries": "Max Retries",
     "queueTimeout": "Queue Timeout",
+    "queueDepth": "__MISSING__:Queue Depth",
     "addProvider": "Add Provider",
     "realtime": "Realtime",
     "totalTranslations": "Total Translations",
@@ -709,6 +710,7 @@
     "batchFilesListFilesTable": "Filer",
     "batchPageLoadingMore": "Laster inn mer …",
     "recommended": "__MISSING__:Recommended",
+    "understand": "__MISSING__:I understand",
     "batchConceptTitle": "Batch processing",
     "batchConceptSubtitle": "Process thousands of requests asynchronously at ~50% of the cost (24h window). Ideal for evaluations, classification, and embeddings.",
     "batchConceptHowItWorks": "How it works",
@@ -773,36 +775,13 @@
     "filesListUploadButton": "Upload",
     "filesListUsedByColumn": "Used by",
     "filesListUsedByNone": "None",
-    "filesListDelete": "Delete",
-    "filesListDownload": "Download",
-    "batchDetailActionCancel": "Cancel batch",
-    "batchDetailActionRetry": "Retry failed requests",
-    "batchDetailCancelling": "Cancelling…",
-    "batchDetailRetrying": "Preparing retry…",
-    "batchDetailCancelConfirm": "Cancel this batch? In-progress requests will stop.",
-    "batchActionCancelError": "Failed to cancel batch. Try again.",
-    "batchActionRetryError": "Failed to retry failed requests. Try again.",
-    "batchConceptRetentionNote": "Results and error files are retained for 30 days (Anthropic: 29 days)",
     "filesListUsedByRoleInput": "input",
     "filesListUsedByRoleOutput": "output",
     "filesListUsedByRoleError": "error",
-    "batchListProgressPartial": "(partial)",
     "filesListSizeColumn": "Size",
+    "batchListProgressPartial": "(partial)",
     "batchListProviderColumn": "Provider",
     "batchListProviderUnknown": "—",
-    "batchListBatchCreated": "Batch {id} created — refreshing list…",
-    "batchListBatchCreatedDismiss": "Dismiss",
-    "batchListRefreshing": "Refreshing…",
-    "batchListRefresh": "Refresh",
-    "uploadFileModalRemove": "Remove",
-    "uploadFileModalUploading": "Uploading…",
-    "wizardInputReading": "Reading file…",
-    "wizardInputReady": "Ready",
-    "wizardInputLargeFileLabel": "Large file — sampling validation",
-    "wizardInputCsvJsonlReady": "JSONL generated — ready to validate.",
-    "wizardInputLargeFileWarning": "Large file detected — validation runs by sampling (first 5 MB + last 100 KB). Full validation happens server-side.",
-    "wizardCostWindow24h": "24h completion window",
-    "wizardValidationFieldsOk": "required fields valid",
     "batchListProviderOther": "Other",
     "batchListTitle": "Batches",
     "batchListCount": "{count} batches",
@@ -839,8 +818,33 @@
     "wizardCostWindow": "Window",
     "wizardDestinationSelectProvider": "Select a provider…",
     "wizardDestinationSelectModel": "Select a model…",
-    "wizardDestinationConnectProvider": "Connect a provider"
+    "wizardDestinationConnectProvider": "Connect a provider",
+    "batchListBatchCreated": "Batch {id} created — refreshing list…",
+    "batchListBatchCreatedDismiss": "Dismiss",
+    "batchListRefreshing": "Refreshing…",
+    "batchListRefresh": "Refresh",
+    "uploadFileModalRemove": "Remove",
+    "uploadFileModalUploading": "Uploading…",
+    "wizardInputReading": "Reading file…",
+    "wizardInputReady": "Ready",
+    "wizardInputLargeFileLabel": "Large file — sampling validation",
+    "wizardInputCsvJsonlReady": "JSONL generated — ready to validate.",
+    "wizardInputLargeFileWarning": "Large file detected — validation runs by sampling (first 5 MB + last 100 KB). Full validation happens server-side.",
+    "wizardCostWindow24h": "24h completion window",
+    "wizardValidationFieldsOk": "required fields valid",
+    "filesListDelete": "Delete",
+    "filesListDownload": "Download",
+    "batchDetailActionCancel": "Cancel batch",
+    "batchDetailActionRetry": "Retry failed requests",
+    "batchDetailCancelling": "Cancelling…",
+    "batchDetailRetrying": "Preparing retry…",
+    "batchDetailCancelConfirm": "Cancel this batch? In-progress requests will stop.",
+    "batchActionCancelError": "Failed to cancel batch. Try again.",
+    "batchActionRetryError": "Failed to retry failed requests. Try again.",
+    "batchConceptRetentionNote": "Results and error files are retained for 30 days (Anthropic: 29 days)"
   },
+  "featureFlagOmnirouteEmergencyFallbackDescription": "__MISSING__:Route budget-exhausted requests to the emergency free fallback provider/model.",
+  "featureFlagArenaEloSyncEnabledDescription": "__MISSING__:Enable periodic Arena AI leaderboard ELO sync for model intelligence rankings.",
   "sidebar": {
     "home": "Hjem",
     "dashboard": "Dashbord",
@@ -968,6 +972,7 @@
     "aiFeaturesSection": "AI Features",
     "mcp": "MCP",
     "a2a": "A2A",
+    "plugins": "__MISSING__:Plugins",
     "apiEndpoints": "API Endpoints",
     "batchFiles": "Files",
     "analyticsEvals": "Evals",
@@ -976,6 +981,10 @@
     "analyticsComboHealth": "Combo Health",
     "analyticsCompression": "Compression",
     "costsBudget": "Budget",
+    "costsFreeTiers": "__MISSING__:Free-Tier Budget",
+    "costsFreeTiersSubtitle": "__MISSING__:Monthly free-token allowances",
+    "freeProviderRankings": "__MISSING__:Free Provider Rankings",
+    "freeProviderRankingsSubtitle": "__MISSING__:Best free providers ranked by model ELO scores",
     "costsQuotaShare": "Quota Sharing",
     "costsPricing": "Pricing",
     "logsProxy": "Proxy Logs",
@@ -987,10 +996,12 @@
     "settingsAppearance": "Appearance",
     "settingsAi": "AI Settings",
     "settingsSecurity": "Security",
+    "settingsAccessTokens": "__MISSING__:Access Tokens",
     "settingsFeatureFlags": "Funksjonsflagg",
     "settingsAuthz": "__MISSING__:Authz",
     "settingsRouting": "Routing",
     "settingsResilience": "Resilience",
+    "modelLockout": "__MISSING__:Model Lockout",
     "settingsAdvanced": "Advanced",
     "omniProxySection": "OmniProxy",
     "quotaTracker": "Provider Quota",
@@ -1036,6 +1047,8 @@
     "analyticsCompressionSubtitle": "Token savings stats",
     "analyticsSearchSubtitle": "Search tool analytics",
     "analyticsEvalsSubtitle": "Eval suite results",
+    "providerStats": "__MISSING__:Provider Stats",
+    "providerStatsSubtitle": "__MISSING__:Latency and performance metrics",
     "logsSubtitle": "Application logs",
     "logsProxySubtitle": "Proxy traffic logs",
     "consoleLogsSubtitle": "Console output",
@@ -1055,6 +1068,7 @@
     "agentSkillsSubtitle": "A2A skill registry",
     "mcpSubtitle": "MCP server controls",
     "a2aSubtitle": "A2A protocol server",
+    "pluginsSubtitle": "__MISSING__:Plugin marketplace & installs",
     "mediaSubtitle": "Cached media files",
     "batchFilesSubtitle": "Batch input/output files",
     "settingsSubtitle": "All settings",
@@ -1065,13 +1079,41 @@
     "settingsResilienceSubtitle": "Retries and breakers",
     "settingsAdvancedSubtitle": "Power user options",
     "settingsSecuritySubtitle": "Auth and encryption",
+    "settingsAccessTokensSubtitle": "__MISSING__:Scoped CLI tokens for remote mode",
     "settingsFeatureFlagsSubtitle": "Bytt systemfunksjoner",
     "settingsSidebar": "Sidebar",
     "settingsSidebarSubtitle": "Customize sidebar layout",
     "settingsAuthzSubtitle": "__MISSING__:Route inventory and bypass policy",
     "docsSubtitle": "Documentation",
     "issuesSubtitle": "Report a bug",
-    "changelogSubtitle": "Release notes"
+    "changelogSubtitle": "Release notes",
+    "costsQuotaPlans": "__MISSING__:Plans & Quotas",
+    "costsQuotaPlansSubtitle": "__MISSING__:Configure plans by provider",
+    "activity": "__MISSING__:Activity",
+    "activitySubtitle": "__MISSING__:Friendly feed of recent events",
+    "logsGroup": "__MISSING__:Logs",
+    "systemGroup": "__MISSING__:System",
+    "costsOverview": "__MISSING__:Overview",
+    "costsOverviewSubtitle": "__MISSING__:Consolidated cost analysis",
+    "agentBridge": "__MISSING__:Agent Bridge",
+    "agentBridgeSubtitle": "__MISSING__:Intercept IDE agent traffic",
+    "trafficInspector": "__MISSING__:Traffic Inspector",
+    "trafficInspectorSubtitle": "__MISSING__:Monitor LLM calls + debug any HTTPS traffic",
+    "cliCode": "__MISSING__:CLI Code",
+    "cliCodeSubtitle": "__MISSING__:Code tools pointing to OmniRoute",
+    "cliAgents": "__MISSING__:CLI Agents",
+    "cliAgentsSubtitle": "__MISSING__:Autonomous CLI agents",
+    "acpAgents": "__MISSING__:ACP Agents",
+    "acpAgentsSubtitle": "__MISSING__:CLIs spawned by OmniRoute",
+    "skipToContent": "__MISSING__:Skip to content",
+    "unpinSection": "__MISSING__:Unpin section",
+    "pinSectionOpen": "__MISSING__:Pin section open",
+    "reloadPage": "__MISSING__:Reload Page",
+    "dragReorderSection": "__MISSING__:Drag to reorder section",
+    "dragReorderItem": "__MISSING__:Drag to reorder",
+    "cannotHide": "__MISSING__:This item cannot be hidden",
+    "alwaysVisible": "__MISSING__:Always visible",
+    "groupSeparatorLabel": "__MISSING__:Separator"
   },
   "webhooks": {
     "title": "Webhooks",
@@ -1272,7 +1314,47 @@
     "a2aEvents": "Hendelser",
     "a2aArtifacts": "Artefakter",
     "a2aNoTasks": "Ingen A2A-oppgaver registrert.",
-    "a2aLoadingTasks": "Laster inn A2A-oppgaver..."
+    "a2aLoadingTasks": "Laster inn A2A-oppgaver...",
+    "actor": "__MISSING__:Actor",
+    "actorPlaceholder": "__MISSING__:Filter by actor",
+    "eventTypes": {
+      "apiKey.activate": "__MISSING__:API Key Activated",
+      "apiKey.ban": "__MISSING__:API Key Banned",
+      "apiKey.deactivate": "__MISSING__:API Key Deactivated",
+      "apiKey.regenerate": "__MISSING__:API Key Regenerated",
+      "apiKey.scopes.grant": "__MISSING__:API Key Scopes Granted",
+      "apiKey.scopes.revoke": "__MISSING__:API Key Scopes Revoked",
+      "apiKey.scopes.update": "__MISSING__:API Key Scopes Updated",
+      "apiKey.unban": "__MISSING__:API Key Unbanned",
+      "auth.login.error": "__MISSING__:Login Error",
+      "auth.login.failed": "__MISSING__:Login Failed",
+      "auth.login.locked": "__MISSING__:Login Locked",
+      "auth.login.misconfigured": "__MISSING__:Login Misconfigured",
+      "auth.login.setup_required": "__MISSING__:Login Setup Required",
+      "auth.login.success": "__MISSING__:Login Success",
+      "auth.logout.success": "__MISSING__:Logout Success",
+      "compliance.cleanup": "__MISSING__:Compliance Cleanup",
+      "provider.credentials.applied": "__MISSING__:Provider Credentials Applied",
+      "provider.credentials.batch_revoked": "__MISSING__:Provider Credentials Batch Revoked",
+      "provider.credentials.bulk_created": "__MISSING__:Provider Credentials Bulk Created",
+      "provider.credentials.bulk_imported": "__MISSING__:Provider Credentials Bulk Imported",
+      "provider.credentials.created": "__MISSING__:Provider Credentials Created",
+      "provider.credentials.imported": "__MISSING__:Provider Credentials Imported",
+      "provider.credentials.revoked": "__MISSING__:Provider Credentials Revoked",
+      "provider.credentials.updated": "__MISSING__:Provider Credentials Updated",
+      "provider.validation.ssrf_blocked": "__MISSING__:Provider SSRF Blocked",
+      "quota.plan.updated": "__MISSING__:Quota Plan Updated",
+      "quota.pool.created": "__MISSING__:Quota Pool Created",
+      "quota.pool.deleted": "__MISSING__:Quota Pool Deleted",
+      "quota.pool.updated": "__MISSING__:Quota Pool Updated",
+      "quota.store.driver_changed": "__MISSING__:Quota Store Driver Changed",
+      "server.start": "__MISSING__:Server Start",
+      "service.reveal_api_key": "__MISSING__:Service API Key Revealed",
+      "settings.update": "__MISSING__:Settings Updated",
+      "settings.update_failed": "__MISSING__:Settings Update Failed",
+      "sync.token.created": "__MISSING__:Sync Token Created",
+      "sync.token.revoked": "__MISSING__:Sync Token Revoked"
+    }
   },
   "themesPage": {
     "title": "Themes",
@@ -1381,7 +1463,8 @@
     "settingsResilienceDescription": "Circuit breaker, retry, and fallback configuration",
     "settingsAdvancedDescription": "Advanced payload rules, request limits, and proxy API settings",
     "mitmProxyDescription": "Configure MITM proxy settings for traffic inspection and debugging",
-    "oneProxyDescription": "Configure 1Proxy settings for advanced proxy chaining"
+    "oneProxyDescription": "Configure 1Proxy settings for advanced proxy chaining",
+    "omniSkillsDescription": "__MISSING__:Install and manage sandbox skills for automated prompt and tool execution"
   },
   "home": {
     "quickStart": "Rask start",
@@ -1612,16 +1695,24 @@
     "ownUsageVisibilityDesc": "Tillat denne nøkkelen å kalle sitt status-endepunkt for eget USD-forbruk, budsjettprosent og token-totaler.",
     "sharedAccountQuotaVisibility": "Delt kontokvote",
     "sharedAccountQuotaVisibilityDesc": "Tillat denne nøkkelen å se delt upstream-kontokvote når én eksplisitt tilkobling er konfigurert.",
+    "localUsageCommand": "__MISSING__:Allow local usage command",
+    "localUsageCommandDesc": "__MISSING__:Allows this API key to use @@om-usage to retrieve cached usage and quota information without calling an upstream provider.",
+    "localUsageCommandBadge": "__MISSING__:Usage cmd",
     "keyCreated": "API-nøkkel opprettet",
     "keyCreatedSuccess": "Nøkkel ble opprettet!",
     "keyCreatedNote": "Kopier og lagre denne nøkkelen nå – den vises ikke igjen.",
     "done": "Ferdig",
     "savePermissions": "Lagre tillatelser",
-    "endpointRestrictions": "__MISSING__:Allowed Endpoints",
-    "allEndpointsAllowed": "__MISSING__:This key can access all API endpoints.",
-    "endpointsRestricted": "__MISSING__:Restricted to {count} endpoint{count, plural, one {} other {s}}.",
+    "endpointRestrictions": "Allowed Endpoints",
+    "allEndpointsAllowed": "This key can access all API endpoints.",
+    "endpointsRestricted": "Restricted to {count} endpoint{count, plural, one {} other {s}}.",
     "autoResolve": "Auto-Resolve",
     "autoResolveDesc": "Auto-resolve ambiguous model names to native provider for this API key.",
+    "streamDefaultMode": "__MISSING__:Stream Default Compatibility",
+    "streamDefaultModeDesc": "__MISSING__:Controls omitted `stream` flags for this key. JSON mode returns non-streaming responses unless the client explicitly requests SSE.",
+    "streamDefaultLegacy": "__MISSING__:Legacy",
+    "streamDefaultJson": "__MISSING__:JSON Compatible",
+    "streamDefaultBadge": "__MISSING__:JSON stream default",
     "keyActive": "Key Active",
     "keyActiveDesc": "Enable or disable this API key. Disabled keys are immediately rejected with 403.",
     "accessSchedule": "Access Schedule",
@@ -1667,6 +1758,7 @@
     "keyOnlyAvailableAtCreation": "Full key available only at creation time — copy it when you first create the key",
     "modelsCount": "{count, plural, one {# model} other {# models}}",
     "lastUsedOn": "Siste: {date}",
+    "viewCostsFor": "__MISSING__:View costs for {name}",
     "editPermissions": "Rediger tillatelser",
     "deleteKey": "Slett nøkkel",
     "regenerateKey": "Regenerer nøkkel",
@@ -1708,9 +1800,12 @@
     "shownOf": "__MISSING__:{shown} of {total} shown",
     "emptyFilterTitle": "__MISSING__:No keys match your filters",
     "emptyFilterClear": "__MISSING__:Clear filters",
-    "endpointRestrictions": "Allowed Endpoints",
-    "allEndpointsAllowed": "This key can access all API endpoints.",
-    "endpointsRestricted": "Restricted to {count} endpoint{count, plural, one {} other {s}}."
+    "disableNonPublicModels": "__MISSING__:Disable Non-Public Models",
+    "disableNonPublicModelsDesc": "__MISSING__:Reject requests for models that are not discovered or not marked as public in the provider catalog",
+    "normalKeysSection": "__MISSING__:Normal keys",
+    "quotaKeysSection": "__MISSING__:Quota keys",
+    "quotaPill": "__MISSING__:QUOTA",
+    "quotaModeOnly": "__MISSING__:qtSd-only"
   },
   "auditLog": {
     "title": "Revisjonslogg",
@@ -1845,6 +1940,8 @@
     "freeQuota": "Free quota/mo",
     "scrapeUrl": "URL to scrape",
     "scrapeUrlPlaceholder": "https://example.com",
+    "scrapeUrlRequired": "__MISSING__:URL is required",
+    "scrapeUrlInvalid": "__MISSING__:Invalid URL — it must start with http:// or https://",
     "scrapeExtract": "Extract",
     "scrapeExtracting": "Extracting…",
     "scrapeFullPage": "Full page",
@@ -1858,6 +1955,8 @@
     "scrapeMetadata": "Metadata",
     "scrapeProvider": "Provider",
     "scrapeSize": "Size",
+    "scrapeEmptyState": "__MISSING__:Enter a URL to extract its content",
+    "scrapeProvidersAvailable": "__MISSING__:Available providers: Firecrawl, Jina Reader, Tavily.",
     "compareRun": "Compare",
     "compareRunning": "Comparing…",
     "autoProvider": "Auto (cheapest)",
@@ -2245,6 +2344,8 @@
     "leastLatency": "Minste ventetid",
     "comboName": "Kombinasjonsnavn",
     "comboNamePlaceholder": "min-kombo",
+    "comboDescription": "__MISSING__:Description",
+    "comboDescriptionPlaceholder": "__MISSING__:Optional note describing this combo",
     "deleteConfirm": "Vil du slette denne kombinasjonen?",
     "noCombosYet": "Ingen kombinasjoner ennå",
     "comboCreated": "Kombinasjonen ble opprettet",
@@ -2284,6 +2385,8 @@
     "resetAwareDesc": "Balanserer gjenværende kvote mot 5 timer og ukentlige tilbakestillinger, og runder deretter lignende resultater",
     "strictRandom": "Strict Random",
     "strictRandomDesc": "Shuffle deck — uses each model once before reshuffling",
+    "fusion": "__MISSING__:Fusion",
+    "fusionDesc": "__MISSING__:Fans the prompt to every panel model in parallel, then a judge model synthesizes one final answer",
     "models": "Modeller",
     "autoBalance": "Autobalanse",
     "advancedSettings": "Avanserte innstillinger",
@@ -2982,14 +3085,19 @@
     "ngrokStarted": "ngroktunnelen startet",
     "ngrokStopped": "ngroktunnelen stoppet",
     "ngrokRequestFailed": "Kunne ikke oppdatere ngroktunnelen",
-    "tokenSaverSubtitle": "Bruk mindre tokens på hver forespørsel.",
-    "tokenSaverToolOutput": "Verktøyutgang",
-    "tokenSaverLlmOutput": "LLM-utgang",
-    "tokenSaverInputCompression": "Inndatakomprimering",
     "apiEndpointsCatalogUnavailable": "API-katalog utilgjengelig",
     "apiEndpointsSearchPlaceholder": "Søk etter endepunkter...",
     "apiEndpointsRequiresAuth": "Krever autentisering",
     "apiEndpointsNoMatch": "Ingen endepunkter samsvarer med filteret ditt",
+    "vscodeAliasTitle": "__MISSING__:VS Code Token Alias",
+    "vscodeAliasDescriptionReady": "__MISSING__:Ready-to-paste compatibility URLs using the /api/v1/vscode/TOKEN/... endpoint.",
+    "vscodeAliasDescriptionError": "__MISSING__:Showing placeholder URLs because CLI keys could not be loaded in this session.",
+    "vscodeAliasDescriptionLoading": "__MISSING__:Loading CLI keys. Placeholder URLs are shown until a key is available.",
+    "vscodeAliasDescriptionPlaceholder": "__MISSING__:Showing placeholder URLs. Create or activate an API key in CLI Tools to replace TOKEN.",
+    "vscodeAliasManage": "__MISSING__:CLI Tools",
+    "vscodeAliasBaseLabel": "__MISSING__:VS Code base",
+    "vscodeAliasModelsLabel": "__MISSING__:VS Code models",
+    "vscodeAliasChatLabel": "__MISSING__:VS Code chat",
     "localServer": "Lokal server",
     "cloudOmniroute": "Cloud OmniRoute",
     "copyUrl": "Kopier URL",
@@ -3002,7 +3110,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
@@ -3178,42 +3289,187 @@
     "a2aStep3": "__MISSING__:Track and cancel tasks with {code1} and {code2}."
   },
   "memory": {
-    "title": "Memory Management",
-    "description": "View and manage stored memory entries",
-    "memories": "Memories",
-    "totalEntries": "Total Entries",
-    "tokensUsed": "Tokens Used",
-    "hitRate": "Hit Rate",
-    "loading": "Loading memories...",
-    "noMemories": "No memories found",
-    "search": "Search memories...",
-    "allTypes": "All Types",
-    "export": "Export",
-    "import": "Import",
-    "addMemory": "Add Memory",
-    "type": "Type",
-    "key": "Key",
-    "content": "Content",
-    "created": "Created",
-    "actions": "Actions",
-    "delete": "Delete",
-    "factual": "Factual",
-    "episodic": "Episodic",
-    "procedural": "Procedural",
-    "semantic": "Semantic",
     "a": "A",
-    "pipelineOk": "Rørledning OK ({latencyMs}ms)",
-    "pipelineError": "Rørledningsfeil",
-    "healthUnknown": "Helse ukjent",
-    "checkingHealth": "Sjekker …",
-    "checkHealth": "Sjekk helsen",
-    "pageInfo": "Side {page} av {totalPages} ({total} totalt)",
-    "previous": "Forrige",
-    "next": "Neste",
+    "actions": "Actions",
+    "addMemory": "Add Memory",
+    "allTypes": "All Types",
     "cancel": "Avbryt",
-    "save": "Lagre",
+    "checkHealth": "Sjekk helsen",
+    "checkingHealth": "Sjekker …",
+    "compactOld": "__MISSING__:Compact old",
+    "concept": {
+      "title": "__MISSING__:Conversational Memory",
+      "description": "__MISSING__:OmniRoute learns from every conversation, remembering facts, episodes, procedures, and semantic concepts that make responses more accurate and context-aware.",
+      "howWorksToggle": "__MISSING__:How it works",
+      "howWorksContent": "__MISSING__:1. Automatic extraction: at the end of each response, facts and episodes are detected and saved automatically.\n2. Retrieval: before each response, the most relevant memories are searched via FTS5 (exact), vector (semantic), or hybrid RRF.\n3. Injection: relevant memories are injected into the assistant context to improve response quality.\n4. Management: use this page to view, edit, export, and compact old memories."
+    },
+    "content": "Content",
+    "contentPlaceholder": "Verdi eller JSON-innhold å huske",
+    "created": "Created",
+    "delete": "Delete",
+    "deleteConfirmDesc": "__MISSING__:This action cannot be undone. The memory will be permanently removed.",
+    "deleteConfirmTitle": "__MISSING__:Delete memory?",
+    "description": "View and manage stored memory entries",
+    "editMemory": "__MISSING__:Edit memory",
+    "editModal": {
+      "title": "__MISSING__:Edit Memory",
+      "metadataLabel": "__MISSING__:Metadata (JSON)",
+      "metadataInvalid": "__MISSING__:Invalid JSON",
+      "saveFailed": "__MISSING__:Failed to save memory"
+    },
+    "embedding": {
+      "autoLabel": "__MISSING__:Automatic",
+      "autoDesc": "__MISSING__:Uses best available: remote provider > static > transformers",
+      "remoteLabel": "__MISSING__:Remote provider",
+      "remoteDesc": "__MISSING__:Uses embedding via provider API (requires API key)",
+      "staticLabel": "__MISSING__:Static local (potion)",
+      "staticDesc": "__MISSING__:Local embedding without WASM or external dependencies",
+      "transformersLabel": "__MISSING__:Transformers.js (MiniLM)",
+      "transformersDesc": "__MISSING__:Local embedding via @huggingface/transformers (~400MB RAM)",
+      "providerModelLabel": "__MISSING__:Provider / Model",
+      "noRemoteProviders": "__MISSING__:No providers with configured API key",
+      "selectProviderModel": "__MISSING__:Select a model",
+      "staticEnabledLabel": "__MISSING__:Enable Static Potion",
+      "staticEnabledDesc": "__MISSING__:Download and use potion-base-8M model locally",
+      "transformersEnabledLabel": "__MISSING__:Enable Transformers.js",
+      "transformersEnabledDesc": "__MISSING__:Opt-in for local MiniLM (~400MB RAM, ~3s cold start)",
+      "transformersWarning": "__MISSING__:Requires ~400MB RAM and ~3s cold start on the first semantic query."
+    },
+    "emptyState": {
+      "title": "__MISSING__:No memories yet",
+      "description": "__MISSING__:Memories are created automatically from conversations. You can also add them manually using the button above."
+    },
+    "engine": {
+      "statusTitle": "__MISSING__:Engine Status",
+      "embeddingTitle": "__MISSING__:Embedding Source",
+      "rerankTitle": "__MISSING__:Rerank (optional)",
+      "reindexNow": "__MISSING__:Reindex now",
+      "reindexStarted": "__MISSING__:Reindexing started ({pending} pending)",
+      "reindexFailed": "__MISSING__:Failed to start reindexing",
+      "keywordLabel": "__MISSING__:Keyword (FTS5)",
+      "keywordReason": "__MISSING__:Keyword search always available",
+      "embeddingLabel": "__MISSING__:Embedding",
+      "vectorStoreLabel": "__MISSING__:Vector Store",
+      "qdrantLabel": "__MISSING__:Qdrant",
+      "rerankLabel": "__MISSING__:Rerank",
+      "qdrantDisabled": "__MISSING__:Disabled",
+      "qdrantOk": "__MISSING__:Healthy ({latencyMs}ms)",
+      "qdrantError": "__MISSING__:Connection error",
+      "needsReindex": "__MISSING__:{count} memory(ies) need reindexing",
+      "configureCta": "__MISSING__:Configure",
+      "vectorStoreInstallHint": "__MISSING__:To enable vector search: npm install sqlite-vec (needs native Node.js, not WASM), then restart."
+    },
+    "episodic": "Episodic",
+    "export": "Export",
+    "factual": "Factual",
+    "healthUnknown": "Helse ukjent",
+    "hitRate": "Hit Rate",
+    "import": "Import",
+    "importError": "__MISSING__:Failed to import file",
+    "importResult": "__MISSING__:{imported} imported, {skipped} skipped",
+    "key": "Key",
     "keyPlaceholder": "f.eks. bruker.preferencer.tema",
-    "contentPlaceholder": "Verdi eller JSON-innhold å huske"
+    "loading": "Loading memories...",
+    "memories": "Memories",
+    "next": "Neste",
+    "noMemories": "No memories found",
+    "pageInfo": "Side {page} av {totalPages} ({total} totalt)",
+    "pipelineError": "Rørledningsfeil",
+    "pipelineOk": "Rørledning OK ({latencyMs}ms)",
+    "playground": {
+      "infoTitle": "__MISSING__:Memory Playground",
+      "infoDesc": "__MISSING__:Simulate what would be retrieved for a given query. No memories are modified — read-only preview.",
+      "queryLabel": "__MISSING__:Test query",
+      "queryPlaceholder": "__MISSING__:Type a question or test phrase...",
+      "strategyLabel": "__MISSING__:Strategy",
+      "strategyExact": "__MISSING__:Exact (FTS5)",
+      "strategySemantic": "__MISSING__:Semantic (vector)",
+      "strategyHybrid": "__MISSING__:Hybrid (RRF)",
+      "budgetLabel": "__MISSING__:Budget (tokens)",
+      "simulate": "__MISSING__:Simulate",
+      "resultsTitle": "__MISSING__:{count} result(s)",
+      "resolutionTitle": "__MISSING__:Search resolution",
+      "resolutionEmbedding": "__MISSING__:Embedding",
+      "resolutionStore": "__MISSING__:Vector store",
+      "resolutionStrategy": "__MISSING__:Strategy used",
+      "rerankApplied": "__MISSING__:Rerank applied",
+      "fallback": "__MISSING__:Fallback",
+      "noResults": "__MISSING__:No memories found for this query.",
+      "tokensUsed": "__MISSING__:tokens used",
+      "none": "__MISSING__:none",
+      "errorFetch": "__MISSING__:Failed to fetch preview"
+    },
+    "previous": "Forrige",
+    "procedural": "Procedural",
+    "qdrant": {
+      "title": "__MISSING__:Qdrant (Vector Store Tier 2)",
+      "description": "__MISSING__:Optional Qdrant integration for scalable semantic search",
+      "enableLabel": "__MISSING__:Enable Qdrant",
+      "enableDesc": "__MISSING__:When enabled, Qdrant is used as the primary vector store",
+      "testConnection": "__MISSING__:Test connection",
+      "testing": "__MISSING__:Testing...",
+      "statusActive": "__MISSING__:Active",
+      "statusError": "__MISSING__:Error",
+      "statusDisabled": "__MISSING__:Disabled",
+      "healthOk": "__MISSING__:Connection OK ({latencyMs}ms)",
+      "healthError": "__MISSING__:Connection error",
+      "saved": "__MISSING__:Settings saved",
+      "saveError": "__MISSING__:Failed to save",
+      "portLabel": "__MISSING__:Port",
+      "embeddingModelLabel": "__MISSING__:Embedding Model",
+      "optional": "__MISSING__:optional",
+      "apiKeyKeepPlaceholder": "__MISSING__:Leave blank to keep current key",
+      "apiKeyOptional": "__MISSING__:Leave blank if not using authentication",
+      "removeApiKey": "__MISSING__:Remove",
+      "quickSelectModel": "__MISSING__:Quick select",
+      "searchTestTitle": "__MISSING__:Semantic search test",
+      "searchPlaceholder": "__MISSING__:Type a test query...",
+      "searching": "__MISSING__:Searching...",
+      "search": "__MISSING__:Search",
+      "cleanupTitle": "__MISSING__:Clean up old points",
+      "cleanupDesc": "__MISSING__:Remove Qdrant points for expired memories (retention period).",
+      "cleaning": "__MISSING__:Cleaning...",
+      "cleanNow": "__MISSING__:Clean now",
+      "cleanupSuccess": "__MISSING__:{count} point(s) removed",
+      "cleanupFailed": "__MISSING__:Cleanup failed"
+    },
+    "rerank": {
+      "enableLabel": "__MISSING__:Enable Rerank",
+      "enableDesc": "__MISSING__:Reorders results with a reranking model after search",
+      "warning": "__MISSING__:Rerank adds +200-500ms latency and additional cost per request. Use sparingly.",
+      "providerModelLabel": "__MISSING__:Rerank Provider / Model",
+      "noProviderWithKey": "__MISSING__:No provider with configured API key. Configure a provider to use rerank.",
+      "selectProviderModel": "__MISSING__:Select a provider/model"
+    },
+    "save": "Lagre",
+    "saving": "__MISSING__:Saving...",
+    "search": "Search memories...",
+    "semantic": "Semantic",
+    "summarize": {
+      "title": "__MISSING__:Compact old memories",
+      "noCandidates": "__MISSING__:No memories eligible for compaction (criteria: >30 days old).",
+      "candidatesDesc": "__MISSING__:{count} memories will be compacted into summaries. This action cannot be undone.",
+      "confirm": "__MISSING__:Compact now"
+    },
+    "tabs": {
+      "memories": "__MISSING__:Memories",
+      "playground": "__MISSING__:Playground",
+      "engine": "__MISSING__:Engine"
+    },
+    "title": "Memory Management",
+    "tokensUsed": "Tokens Used",
+    "tooltip": {
+      "totalEntries": "__MISSING__:Total memories stored for this API key",
+      "tokensUsed": "__MISSING__:Estimated total tokens occupied by active memories",
+      "hitRate": "__MISSING__:Read-by-ID cache hit rate (not semantic recall accuracy)",
+      "factual": "__MISSING__:Objective, permanent facts from user context",
+      "episodic": "__MISSING__:Events and experiences from conversation history",
+      "procedural": "__MISSING__:Procedures, workflows, and instructions the assistant should follow",
+      "semantic": "__MISSING__:Concepts, preferences, and domain knowledge"
+    },
+    "totalEntries": "Total Entries",
+    "type": "Type",
+    "memoryEnabled": "__MISSING__:Memory enabled"
   },
   "skills": {
     "title": "Skills",
@@ -3544,6 +3800,14 @@
     "export": "Export",
     "exporting": "Exporting...",
     "exportFailed": "Export failed",
+    "cleanHistoryButton": "__MISSING__:Clean history",
+    "cleanHistoryTitle": "__MISSING__:Clean log history?",
+    "cleanHistoryMessage": "__MISSING__:This permanently clears all request log rows, legacy detail rows, and local artifact files under DATA_DIR/call_logs. The live page will refresh after cleanup.",
+    "cleanHistoryConfirm": "__MISSING__:Clean history",
+    "cleanHistoryCancel": "__MISSING__:Cancel",
+    "cleanHistorySuccess": "__MISSING__:Cleaned {deleted} log entries, {deletedArtifacts} artifacts, and {deletedDetailedLogs} legacy detail rows.",
+    "cleanHistoryEmpty": "__MISSING__:No request log history was found.",
+    "cleanHistoryFailed": "__MISSING__:Failed to clean log history.",
     "timeRange": "Time Range",
     "lastNHours": "Last {hours}",
     "defaultRange": "default",
@@ -3551,10 +3815,14 @@
       "fetchFailed": "Failed to fetch logs",
       "copyFailed": "Failed to copy log entry",
       "copyLogEntry": "Copy log entry"
-    }
+    },
+    "compressionLogTitle": "__MISSING__:Compression Log",
+    "compressionLogEmpty": "__MISSING__:No compressed requests yet. Compression stats will appear here when requests are processed with compression enabled.",
+    "tokens": "__MISSING__:tokens"
   },
   "onboarding": {
     "welcome": "Velkommen",
+    "tiers": "__MISSING__:Tiers",
     "security": "Sikkerhet",
     "test": "Test",
     "ready": "Klar!",
@@ -3616,6 +3884,7 @@
   },
   "providers": {
     "title": "Leverandører",
+    "Account Deactivated": "__MISSING__:Account Deactivated",
     "allProviders": "Alle leverandører",
     "audioProviders": "Lydleverandører",
     "showFreeOnly": "Bare gratis",
@@ -3623,6 +3892,33 @@
     "addFirstProvider": "Legg til din første leverandør",
     "addFirstProviderDesc": "Koble til en AI-leverandør for å starte ruting av forespørsler gjennom OmniRoute. Du kan bruke gratisleverandører, API-nøkler eller OAuth-kontoer.",
     "learnMore": "Lær mer",
+    "adaptaTutorial": {
+      "title": "__MISSING__:How to connect Adapta Web",
+      "introPrefix": "__MISSING__:Adapta authenticates through Clerk. The token",
+      "introSuffix": "__MISSING__:is a long-lived JWT that lets OmniRoute refresh sessions automatically.",
+      "or": "__MISSING__:or",
+      "step1Title": "__MISSING__:Open Adapta chat",
+      "step1DescPrefix": "__MISSING__:Open",
+      "step1DescSuffix": "__MISSING__:and sign in with your Gold or Business account.",
+      "step2Title": "__MISSING__:Open DevTools",
+      "step2DescPrefix": "__MISSING__:Press",
+      "step2DescSuffix": "__MISSING__:to open Developer Tools.",
+      "step3Title": "__MISSING__:Go to Application → Cookies",
+      "step3DescPrefix": "__MISSING__:In the",
+      "step3DescMiddle": "__MISSING__:expand",
+      "step3DescSuffix": "__MISSING__:and click",
+      "step4Title": "__MISSING__:Copy the cookie value for",
+      "step4DescPrefix": "__MISSING__:Find the cookie named",
+      "step4DescMiddle": "__MISSING__:in the list. Click it and copy the content from the",
+      "step4DescSuffix": "__MISSING__:column. It starts with",
+      "step5Title": "__MISSING__:Paste it here and save",
+      "step5DescPrefix": "__MISSING__:Click",
+      "step5DescMiddle": "__MISSING__:paste the",
+      "step5DescSuffix": "__MISSING__:value into the API Key field, then save. OmniRoute will refresh the session automatically.",
+      "tipLabel": "__MISSING__:Tip:",
+      "tipPrefix": "__MISSING__:The",
+      "tipSuffix": "__MISSING__:cookie is long-lived, usually for months. You only need to renew it if you sign out or Adapta invalidates the session."
+    },
     "editProvider": "Rediger leverandør",
     "deleteProvider": "Slett leverandør",
     "noProviders": "Ingen leverandører er konfigurert",
@@ -3648,13 +3944,38 @@
     "apiKeyProviders": "API-nøkkelleverandører",
     "compatibleProviders": "API-nøkkel-kompatible leverandører",
     "testAll": "Test alle",
+    "distributeProxies": "__MISSING__:Distribute Proxies",
+    "distributing": "__MISSING__:Distributing...",
+    "selectedCount": "__MISSING__:{count, plural, one {# selected} other {# selected}}",
+    "accountsCount": "__MISSING__:{count, plural, one {# account} other {# accounts}}",
     "testAllOAuth": "Test alle OAuth-tilkoblinger",
     "testAllFree": "Test alle gratis tilkoblinger",
     "testAllApiKey": "Test alle API-nøkkeltilkoblinger",
     "testAllCompatible": "Test alle kompatible tilkoblinger",
+    "testAllModels": "__MISSING__:Test all models",
+    "testAllModelsConfirm": "__MISSING__:Test all visible models? Failed models will be hidden if auto-hide is enabled.",
+    "testingAllModels": "__MISSING__:Testing {done}/{total}...",
+    "testAllResults": "__MISSING__:{ok} of {total} models working",
+    "noModelsToTest": "__MISSING__:No models match the current filter",
+    "showAllModels": "__MISSING__:All",
+    "showVisibleOnly": "__MISSING__:Visible only",
+    "freeFilterAll": "__MISSING__:All",
+    "freeFilterFreeOnly": "__MISSING__:Free only",
+    "freeFilterPaidOnly": "__MISSING__:Paid only",
+    "sortFreeFirst": "__MISSING__:Free first",
+    "showHiddenOnly": "__MISSING__:Hidden only",
+    "filterByVisibility": "__MISSING__:Filter by visibility",
+    "autoHideFailed": "__MISSING__:Auto-hide failed models",
+    "autoHideFailedHint": "__MISSING__:When enabled, Test all hides non-transient failures from public catalogs such as /v1/models. Single-model tests never auto-hide.",
     "connected": "{count} Tilkoblet",
     "errorCount": "{count} Feil ({code})",
     "errorCountNoCode": "{count} Feil",
+    "testAllCompleted": "__MISSING__:Tested {total} models: {ok} OK, {failed} failed",
+    "modelAutoHidden": "__MISSING__:Model {model} auto-hidden (test failed)",
+    "filterAll": "__MISSING__:All",
+    "filterVisible": "__MISSING__:Visible only",
+    "filterHidden": "__MISSING__:Hidden only",
+    "modelsHiddenCount": "__MISSING__:{count} hidden",
     "warningCount": "{count} Advarsel",
     "noConnections": "Ingen tilkoblinger",
     "expiredBadge": "Expired",
@@ -3764,7 +4085,16 @@
     "batchUpdateNone": "__MISSING__:No connections were updated (they may no longer exist)",
     "batchRetestLimit": "__MISSING__:Retest up to {max} connections at a time",
     "noConnectionsToTest": "__MISSING__:No matching connections to test",
+    "batchDeleteConfirmTitle": "__MISSING__:Delete connections",
+    "batchDeleteConfirmButton": "__MISSING__:Delete",
+    "filterActive": "__MISSING__:Active",
+    "filterError": "__MISSING__:Error",
+    "filterBanned": "__MISSING__:Banned",
+    "filterCreditsExhausted": "__MISSING__:Credits Exhausted",
+    "noFilteredConnections": "__MISSING__:No connections match the current filter.",
     "failedSetAlias": "Kunne ikke angi alias",
+    "setAliasSuccess": "__MISSING__:Alias {alias} set",
+    "deleteAliasSuccess": "__MISSING__:Alias {alias} deleted",
     "failedSaveConnection": "Kunne ikke lagre tilkoblingen",
     "failedSaveConnectionRetry": "Kunne ikke lagre tilkoblingen. Vennligst prøv igjen.",
     "failedRetestConnection": "Kunne ikke teste tilkoblingen på nytt",
@@ -3798,6 +4128,9 @@
     "connectionCount": "{count} tilkobling(er)",
     "fetchingModels": "Henter tilgjengelige modeller...",
     "failedFetchModels": "Kunne ikke hente modellene",
+    "noFreeModelsFound": "__MISSING__:No free models found for this provider — nothing imported.",
+    "fetchModelsSuccess": "__MISSING__:Found {count} new models",
+    "fetchModelsFailed": "__MISSING__:Could not auto-fetch models (you can retry from settings)",
     "noModelsFound": "Ingen modeller funnet",
     "importFailed": "Import mislyktes",
     "noNewModelsAdded": "Ingen nye modeller ble lagt til.",
@@ -3806,6 +4139,10 @@
     "importingModelsTitle": "Importere modeller",
     "copyModel": "Kopier modell",
     "filterModels": "Filtrer modeller…",
+    "testAllRateLimited": "__MISSING__:Rate limit reached, stopped early",
+    "hideFailedAuto": "__MISSING__:Auto-hide failed models",
+    "selectAllModels": "Select all",
+    "hideAllModels": "__MISSING__:Hide all",
     "modelsActive": "aktive",
     "showModel": "Vis modell",
     "hideModel": "Skjul modell",
@@ -3814,6 +4151,9 @@
     "rateLimitUnprotected": "Ubeskyttet",
     "enableRateLimitProtection": "Klikk for å aktivere satsgrensebeskyttelse",
     "disableRateLimitProtection": "Klikk for å deaktivere satsgrensebeskyttelse",
+    "testAllProgress": "__MISSING__:Tested {done}/{total}",
+    "testAllFailedHidden": "__MISSING__:{count} failed models hidden",
+    "testAllDone": "__MISSING__:All models tested",
     "productionKey": "Produksjonsnøkkel",
     "enterNewApiKey": "Skriv inn ny API-nøkkel",
     "codexApplyModalTitle": "Søk på Local Codex",
@@ -3889,10 +4229,20 @@
     "errorTypeNetworkError": "Nettverksfeil",
     "errorTypeTestUnsupported": "Testen støttes ikke",
     "errorTypeUpstreamError": "Oppstrøms feil",
+    "errorTypeCreditsExhausted": "__MISSING__:No credits",
+    "errorTypeBanned": "__MISSING__:403 Banned",
     "proxySourceGlobal": "Globalt",
     "proxySourceProvider": "Leverandør",
     "proxySourceKey": "Nøkkel",
     "proxyConfiguredBySource": "Fullmakt ({source}): {host}",
+    "proxyOn": "__MISSING__:Proxy On",
+    "proxyOff": "__MISSING__:Direct (bypass proxy)",
+    "proxyEnabledTitle": "__MISSING__:Proxy is enabled for this connection",
+    "proxyDisabledTitle": "__MISSING__:Direct connection — bypasses every proxy (including the global proxy) for this connection",
+    "perKeyProxyOn": "__MISSING__:Per-key",
+    "perKeyProxyOff": "__MISSING__:Connection",
+    "perKeyProxyEnabledTitle": "__MISSING__:Per-key proxy assignment enabled for this provider",
+    "perKeyProxyDisabledTitle": "__MISSING__:Per-key proxy assignment disabled for this provider",
     "autoPriority": "Auto: {priority}",
     "proxy": "Fullmakt",
     "retestAuthentication": "Test autentisering på nytt",
@@ -3920,6 +4270,12 @@
     "compatProtocolOpenAI": "OpenAI Chat Completions",
     "compatProtocolOpenAIResponses": "OpenAI Responses API",
     "compatProtocolClaude": "Anthropic Messages",
+    "targetFormatLabel": "__MISSING__:Target Format",
+    "targetFormatHint": "__MISSING__:Override the upstream wire format. Use 'Anthropic Messages' to route OpenAI-compatible providers (e.g. opencode-go) through the /v1/messages endpoint.",
+    "targetFormatAuto": "__MISSING__:Default (auto)",
+    "targetFormatGemini": "__MISSING__:Gemini",
+    "targetFormatGeminiCli": "__MISSING__:Gemini CLI",
+    "targetFormatAntigravity": "__MISSING__:Antigravity",
     "compatUpstreamHeadersLabel": "Extra upstream headers",
     "compatUpstreamHeadersHint": "High-privilege setting — same trust level as editing provider API credentials; only trusted admins should use it. Merged after OmniRoute adds auth from the provider API key. If a custom header uses the same name as an existing one (e.g. Authorization), your value fully replaces the auto-generated header (including the Bearer token) — the upstream only sees what you typed, not the key from settings. Misconfiguration can cause 401 or broken upstream auth. One row per header (e.g. extra Authentication for some gateways). Hover or focus the value to preview. Saves on blur, outside click, or closing this panel.",
     "compatUpstreamHeaderName": "Header name",
@@ -3929,6 +4285,8 @@
     "compatBadgeUpstreamHeaders": "Headers",
     "perModelQuotaLabel": "Per Model Quota Label",
     "perModelQuotaDescription": "Per Model Quota Description",
+    "importFreeModelsOnlyLabel": "__MISSING__:Import only free models",
+    "importFreeModelsOnlyHint": "__MISSING__:When enabled, only this provider's free models are imported. Paid models are skipped.",
     "perModelQuotaToggle": "Veksle mellom kvote per modell",
     "modelId": "Modell-ID",
     "customModelPlaceholder": "f.eks. gpt-4.5-turbo",
@@ -3964,7 +4322,6 @@
     "email": "E-post",
     "healthCheckMinutes": "Helsesjekk (min)",
     "healthCheckHint": "Proaktivt token-oppdateringsintervall. 0 = deaktivert.",
-    "selectAllModels": "Select all",
     "deselectAllModels": "Deselect all",
     "modelsActiveCount": "{active}/{total} active",
     "noModelsMatch": "No models match \"{filter}\"",
@@ -3976,6 +4333,9 @@
     "editCompatibleTitle": "Rediger {type} Kompatibel",
     "compatibleBaseUrlHint": "Root URL of your {type}-compatible API. Use Advanced Settings for custom endpoint paths.",
     "apiKeyForCheck": "API-nøkkel (for sjekk)",
+    "testModelIdLabel": "__MISSING__:Model ID (optional)",
+    "testModelIdPlaceholder": "__MISSING__:e.g. my-model-id",
+    "testModelIdHint": "__MISSING__:If the provider lacks a /models endpoint, enter a model ID to validate via /chat/completions instead.",
     "compatibleProdPlaceholder": "{type} Kompatibel (Prod)",
     "tokenRefreshed": "Token refreshed successfully",
     "tokenRefreshFailed": "Token refresh failed",
@@ -4069,6 +4429,19 @@
     "codexAuthApplyFailed": "Failed to apply Codex auth.json locally",
     "codexAuthExported": "Codex auth.json exported",
     "codexAuthExportFailed": "Failed to export Codex auth.json",
+    "codexCliGuideButton": "__MISSING__:Codex CLI Guide",
+    "codexCliGuideTitle": "__MISSING__:Codex CLI Guide",
+    "codexCliGuideLoading": "__MISSING__:Loading guide...",
+    "codexCliGuideLoadFailed": "__MISSING__:Could not load the guide.",
+    "codexExternalLinkButton": "__MISSING__:External Codex link",
+    "codexExternalLinkModalTitle": "__MISSING__:External Codex link",
+    "codexExternalLinkModalDescription": "__MISSING__:Share this single-use link with the person who will authenticate the Codex account. They open it in their own browser, complete the OpenAI login, and the connection is registered here. The link expires in 15 minutes.",
+    "codexExternalLinkGenerating": "__MISSING__:Generating link...",
+    "codexExternalLinkWaiting": "__MISSING__:Waiting for browser authentication. This window refreshes automatically.",
+    "codexExternalLinkCreateFailed": "__MISSING__:Failed to generate the link.",
+    "codexExternalLinkNetworkError": "__MISSING__:Could not contact the server.",
+    "codexExternalLinkConnected": "__MISSING__:Codex account connected through the external link.",
+    "codexExternalLinkExpired": "__MISSING__:The link expired before completion.",
     "importCodexAuth": "Importer auth",
     "codexImportModalTitle": "Importer Codex Auth",
     "codexImportTabSingle": "Singel",
@@ -4146,6 +4519,8 @@
     "t3ChatWebCookiePlaceholder": "convex-session-id=abc123...",
     "blockClaudeExtraUsageDescription": "Block Claude Extra Usage Description",
     "blockClaudeExtraUsageLabel": "Block Claude Extra Usage Label",
+    "disableCoolingDescription": "__MISSING__:Skip the transient cooldown so this connection stays eligible even after recoverable errors (terminal states like banned/expired still apply).",
+    "disableCoolingLabel": "__MISSING__:Disable cooldown for this connection",
     "bulkPasteAdded": "{count, plural, one {1 key added} other {# keys added}}",
     "bulkPasteDuplicatesIgnored": "{count, plural, one {1 duplicate skipped} other {# duplicates skipped}}",
     "bulkPasteHint": "Paste one API key per line. Empty lines are ignored and duplicate keys are skipped.",
@@ -4243,6 +4618,17 @@
     "personalAccessTokenLabel": "Personal Access Token Label",
     "qoderPatHint": "Qoder Pat Hint",
     "qoderPatPlaceholder": "Qoder Pat Placeholder",
+    "rateLimitOverridesSection": "__MISSING__:Rate Limit Overrides",
+    "rateLimitOverridesMaxConcurrentHint": "__MISSING__:Max concurrent requests override for this connection. Overrides the account-level cap.",
+    "rateLimitOverridesMaxConcurrentLabel": "__MISSING__:Max Concurrent (Rate Limit)",
+    "rateLimitOverridesMinTimeHint": "__MISSING__:Minimum time (ms) between requests. Overrides the default rate limiter delay.",
+    "rateLimitOverridesMinTimeLabel": "__MISSING__:Min Interval (ms)",
+    "rateLimitOverridesRpmHint": "__MISSING__:Max requests per minute for this connection. Overrides the provider default.",
+    "rateLimitOverridesRpmLabel": "__MISSING__:RPM (Requests/min)",
+    "rateLimitOverridesTpdHint": "__MISSING__:Max tokens per day for this connection. Overrides the provider default.",
+    "rateLimitOverridesTpdLabel": "__MISSING__:TPD (Tokens/day)",
+    "rateLimitOverridesTpmHint": "__MISSING__:Max tokens per minute for this connection. Overrides the provider default.",
+    "rateLimitOverridesTpmLabel": "__MISSING__:TPM (Tokens/min)",
     "refreshOauthTokenTitle": "Refresh Oauth Token Title",
     "regionHint": "Region Hint",
     "regionLabel": "Region Label",
@@ -4257,6 +4643,7 @@
     "searchProvider": "Search Provider",
     "searchProviderDesc": "Search Provider Desc",
     "searchProviders": "Søk etter leverandører...",
+    "searchByModel": "__MISSING__:Search by model…",
     "searchProvidersHeading": "Search Providers Heading",
     "searxngBaseUrlHint": "Searxng Base Url Hint",
     "searxngInfo": "Searxng Info",
@@ -4422,7 +4809,21 @@
     "webNoAuthGuideBody": "{provider} trenger ikke en API-nøkkel eller informasjonskapsel. Lagre tilkoblingen for å bruke dets gratis webendepunkt.",
     "webSessionCredentialValidationFailed": "Validering av øktlegitimasjon mislyktes. Logg på igjen, kopier en ny legitimasjon og prøv igjen.",
     "checkCookie": "Sjekk informasjonskapsel",
-    "checkWebToken": "Sjekk token"
+    "checkWebToken": "Sjekk token",
+    "huggingchatLabel": "__MISSING__:HuggingChat (Free)",
+    "huggingchatDesc": "__MISSING__:Free LLM chat via huggingface.co/chat",
+    "phindLabel": "__MISSING__:Phind (Free)",
+    "phindDesc": "__MISSING__:Free dev-focused AI chat",
+    "poeWebLabel": "__MISSING__:Poe Web",
+    "poeWebDesc": "__MISSING__:Multi-model chat via poe.com",
+    "veniceWebLabel": "__MISSING__:Venice Web",
+    "veniceWebDesc": "__MISSING__:Privacy-focused AI chat",
+    "v0VercelWebLabel": "__MISSING__:v0 Vercel Web",
+    "v0VercelWebDesc": "__MISSING__:AI code generation via v0.dev",
+    "kimiWebLabel": "__MISSING__:Kimi Web",
+    "kimiWebDesc": "__MISSING__:Chinese market AI chat via kimi.moonshot.cn",
+    "doubaoWebLabel": "__MISSING__:Doubao Web",
+    "doubaoWebDesc": "__MISSING__:ByteDance AI chat via doubao.com"
   },
   "settings": {
     "title": "Innstillinger",
@@ -4528,6 +4929,7 @@
     "memoryDesc": "Persistent cross-session conversational memory",
     "memoryEnabled": "Enable Memory",
     "memoryEnabledDesc": "When enabled, OmniRoute will inject relevant past context.",
+    "memoryTokenCostWarning": "__MISSING__:Heads up: with memory enabled, OmniRoute injects up to {tokens} tokens of retrieved context into every chat request — this increases token usage and cost. To skip injection for a specific request, send the \"x-omniroute-no-memory: true\" header.",
     "maxTokens": "Max Tokens",
     "retentionDays": "Retention",
     "recent": "Recent",
@@ -4566,6 +4968,15 @@
     "modelsDevInfoOrder": "User Override → models.dev → LiteLLM → Hardcoded Default",
     "systemTheme": "Systemtema",
     "debugToggle": "Enable Debug Mode",
+    "homePinProviderQuotaToHome": "Pin Information to Home Page",
+    "homeProviderQuotaLimits": "Provider Quota Limits",
+    "homeProviderQuotaLimitsDesc": "Pin the Provider Quota status container (with Refresh All button) to the top of the Home page.",
+    "homeQuickStart": "Quick Start",
+    "homeQuickStartDesc": "Show the Quick Start panel on the Home page.",
+    "homeProviderTopology": "Provider Topology",
+    "homeProviderTopologyDesc": "Show the Provider Topology on the Home page.",
+    "accountEmailVisibility": "__MISSING__:Account email visibility",
+    "accountEmailVisibilityDesc": "__MISSING__:Show full account emails across providers, combos, logs, quota, and playground screens. Turn this off to mask them by default.",
     "sidebarVisibilityToggle": "Show Sidebar Items",
     "enableCache": "Aktiver cache",
     "cacheTTL": "Cache TTL",
@@ -4599,11 +5010,17 @@
     "autoDisableDescription": "Permanently mark provider connections as deactivated if they return specific terminal ban signals (e.g. HTTP 403 'verify your account'). This removes them from the combo rotation.",
     "autoDisableThreshold": "Ban Threshold",
     "autoDisableThresholdDesc": "Consecutive ban signals required before permanent deactivation.",
+    "customBannedSignals": "__MISSING__:Banned Keywords",
+    "customBannedSignalsDesc": "__MISSING__:Additional keywords that trigger permanent account ban detection. Built-in keywords always apply.",
+    "customBannedSignalsPlaceholder": "__MISSING__:e.g. api key revoked",
+    "noCustomBannedSignals": "__MISSING__:No custom keywords. Only built-in keywords are active.",
     "resilienceStructureTitle": "Resilience Structure",
     "resilienceStructureDesc": "Denne siden konfigurerer bare atferd. Live breaker-tilstand vises på helsesiden. Kombinasjonsspesifikk gjenforsøk og round-robin sporkontroll forblir på kombinasjonsinnstillinger.",
     "enableThinking": "Aktiver tenkning",
     "maxThinkingTokens": "Max Thinking Tokens",
     "enableProxy": "Aktiver proxy",
+    "perKeyProxyEnabled": "__MISSING__:Enable per-key proxy assignment",
+    "perKeyProxyEnabledDesc": "__MISSING__:When enabled, each provider connection can use its own proxy assignment",
     "proxyUrl": "Proxy URL",
     "pricingRates": "Prisformat",
     "currentPricing": "Gjeldende prisoversikt",
@@ -4683,6 +5100,13 @@
     "globalProxy": "Global proxy",
     "globalProxyDesc": "Konfigurer en global utgående proxy for alle API-kall. Individuelle leverandører, kombinasjoner og nøkler kan overstyre dette.",
     "noGlobalProxy": "Ingen global proxy er konfigurert",
+    "proxyPool": "__MISSING__:Proxy Pool",
+    "freePool": "__MISSING__:Free Pool",
+    "proxyDocumentation": "__MISSING__:Proxy Documentation",
+    "proxyGlobalConfigTab": "__MISSING__:Global Config",
+    "proxyPoolTab": "__MISSING__:Proxy Pool",
+    "freePoolTab": "__MISSING__:Free Pool",
+    "proxyDocumentationTab": "__MISSING__:Documentation",
     "bulkHealthcheck": "Bulk Healthcheck",
     "bulkHealthcheckDesc": "Test all configured proxies against a target URL to find which ones work.",
     "healthcheckTesting": "Testing...",
@@ -4695,6 +5119,51 @@
     "healthcheckStatus": "Status",
     "healthcheckProxyUrl": "Proxy URL",
     "healthcheckLatency": "Latency",
+    "proxyDocumentationScopeTitle": "__MISSING__:Proxy scope resolution",
+    "proxyDocumentationScopeDescBefore": "__MISSING__:OmniRoute resolves the outbound proxy in priority order: ",
+    "proxyDocumentationScopeOrder": "__MISSING__:combo → account → provider → global",
+    "proxyDocumentationScopeDescAfter": "__MISSING__:. The most specific scope wins.",
+    "proxyDocumentationAddTitle": "__MISSING__:Adding a custom proxy",
+    "proxyDocumentationAddDescBefore": "__MISSING__:Go to the ",
+    "proxyDocumentationAddDescMiddle": "__MISSING__: tab → click ",
+    "proxyDocumentationAddCta": "__MISSING__:+ Add proxy",
+    "proxyDocumentationAddDescAfter": "__MISSING__:. Fill in type (http/https/socks5), host, and port. Optionally assign it to a scope.",
+    "proxyDocumentationBulkTitle": "__MISSING__:Bulk import format",
+    "proxyDocumentationBulkDesc": "__MISSING__:Pipe-delimited fields:",
+    "proxyDocumentationSocks5DescBefore": "__MISSING__:SOCKS5 proxies are disabled by default. Set",
+    "proxyDocumentationFreePoolDesc": "__MISSING__:The Free Pool tab aggregates proxies from 1proxy, Proxifly, and IPLocate. Use ⊕ to test and promote a proxy to your registry. Only proxies that pass the connectivity test are added.",
+    "proxyDocumentationVercelRelayDescBefore": "__MISSING__:The Vercel Relay is an outbound edge relay — not an inbound tunnel. Deploying one sends LLM API calls through Vercel's dynamic IPs, bypassing datacenter geo-blocks and rate limits. The relay is protected by a generated secret header",
+    "proxyDocumentationVercelRelayDescAfter": "__MISSING__:Your Vercel token is used only during deploy and is never stored.",
+    "vercelRelayTokenRequired": "__MISSING__:Token is required",
+    "vercelRelayDeployFailed": "__MISSING__:Deploy failed",
+    "vercelRelayTokenHint": "__MISSING__:Token is used only during deploy — never stored.",
+    "denoRelayTokenRequired": "__MISSING__:Deno Deploy token is required",
+    "denoRelayOrgDomainRequired": "__MISSING__:Organization domain is required",
+    "denoRelayDeployFailed": "__MISSING__:Deno Deploy failed",
+    "denoRelayTokenHint": "__MISSING__:Organization token (prefix ddo_) from console.deno.com → Organization → Settings → Organization Tokens. Used once for deploy and never stored.",
+    "denoRelayOrgDomainHint": "__MISSING__:Your Deno Deploy organization's default domain (e.g. acme.deno.net). The relay will be reachable at https://<app-name>.<org-slug>.deno.net.",
+    "proxyFreePoolFilterProtocol": "__MISSING__:Filter by protocol",
+    "proxyFreePoolProtocol": "__MISSING__:Protocol",
+    "proxyFreePoolCountryPlaceholder": "__MISSING__:Country (e.g. US)",
+    "proxyFreePoolFilterCountry": "__MISSING__:Filter by country",
+    "proxyFreePoolMinQualityPlaceholder": "__MISSING__:Min quality",
+    "proxyFreePoolMinQualityLabel": "__MISSING__:Minimum quality score",
+    "proxyFreePoolSyncAll": "__MISSING__:Sync All",
+    "proxyFreePoolTotal": "__MISSING__:Total",
+    "proxyFreePoolInPool": "__MISSING__:In pool",
+    "proxyFreePoolAvgQuality": "__MISSING__:Avg quality",
+    "proxyFreePoolSelected": "__MISSING__:{count} selected",
+    "proxyFreePoolAddSelected": "__MISSING__:Add selected to pool",
+    "proxyFreePoolAddVisible": "__MISSING__:Add all visible to pool",
+    "proxyFreePoolSource": "__MISSING__:Source",
+    "proxyFreePoolHostPort": "__MISSING__:Host:Port",
+    "proxyFreePoolType": "__MISSING__:Type",
+    "proxyFreePoolCountry": "__MISSING__:Country",
+    "proxyFreePoolQuality": "__MISSING__:Quality",
+    "proxyFreePoolLatency": "__MISSING__:Latency",
+    "proxyFreePoolEmpty": "__MISSING__:No proxies found. Click Sync All to fetch from sources.",
+    "close": "__MISSING__:Close",
+    "cancel": "__MISSING__:Cancel",
     "globalLabel": "Globalt",
     "configure": "Konfigurer",
     "globalSystemPrompt": "Global systemforespørsel",
@@ -4951,6 +5420,7 @@
     "systemStorage": "System og lagring",
     "allDataLocal": "Alle data lagret lokalt på maskinen din",
     "databasePath": "Databasebane",
+    "export": "__MISSING__:Export",
     "exportDatabase": "Eksporter database",
     "exportAll": "Eksporter alle (.tar.gz)",
     "importDatabase": "Importer database",
@@ -5038,6 +5508,11 @@
     "adaptiveVolumeRoutingDesc": "Scale connections dynamically based on payload volume and throughput pressure.",
     "lkgpToggleTitle": "Last Known Good Provider (LKGP)",
     "lkgpToggleDesc": "When enabled, the router remembers which provider last served a successful response and tries it first on subsequent requests.",
+    "echoRequestedModelTitle": "__MISSING__:Echo requested model name in responses",
+    "echoRequestedModelDesc": "__MISSING__:When enabled, the response `model` field echoes the alias or combo name the client requested instead of the upstream model name. Fixes strict clients (e.g. Claude Desktop) that reject a response whose model does not match the request.",
+    "webSearchRouteTitle": "__MISSING__:Web search routing",
+    "webSearchRouteDesc": "__MISSING__:When a request includes a native web_search tool, route the whole request to this model instead of the default — useful for providers that don't implement Anthropic's web_search server tool. Leave blank to disable.",
+    "webSearchRoutePlaceholder": "__MISSING__:e.g. openrouter,anthropic/claude-3.5-sonnet",
     "clearLkgpCache": "Clear LKGP Cache",
     "lkgpCacheCleared": "LKGP cache cleared successfully",
     "lkgpCacheClearFailed": "Failed to clear LKGP cache",
@@ -5102,6 +5577,16 @@
     "clearSyncedPricing": "Clear Synced Pricing",
     "compressionTitle": "Prompt Compression",
     "compressionDesc": "Reduce token usage by compressing prompts before sending to providers",
+    "tokenSaverTitle": "__MISSING__:Token Saver",
+    "tokenSaverSubtitle": "__MISSING__:Spend fewer tokens on every request.",
+    "tokenSaverToolOutput": "__MISSING__:Tool output",
+    "tokenSaverToolOutputDesc": "__MISSING__:Clean git, grep, ls, tree, and log output before it reaches the provider.",
+    "tokenSaverLlmOutput": "__MISSING__:LLM output",
+    "tokenSaverLlmOutputDesc": "__MISSING__:Inject terse response instructions without rewriting provider output.",
+    "tokenSaverInputCompression": "__MISSING__:Input compression",
+    "tokenSaverInputCompressionDesc": "__MISSING__:Rewrite eligible chat history while preserving code, URLs, and intent.",
+    "tokenSaverFineTunePrefix": "__MISSING__:Fine-tune each engine on",
+    "tokenSaverFineTuneSuffix": "__MISSING__:or combine engines per request on",
     "compressionMode": "Compression Mode",
     "compressionModeOff": "Off",
     "compressionModeOffDesc": "No compression applied",
@@ -5121,6 +5606,11 @@
     "compressionUltraMinScore": "Minimum poenggrense",
     "compressionUltraSlmFallback": "Tilbakeslag til aggressiv",
     "compressionUltraModelPath": "SLM modellbane",
+    "compressionUltraEngine": "__MISSING__:Ultra tier",
+    "compressionUltraEngineHeuristic": "__MISSING__:Heuristic (Tier-A, default)",
+    "compressionUltraEngineSlm": "__MISSING__:SLM (LLMLingua-2, opt-in)",
+    "compressionUltraSlmHint": "__MISSING__:SLM downloads a small ONNX model on first use (cold-start) and transparently falls back to the heuristic on timeout or if unavailable.",
+    "compressionUltraSlmPrewarm": "__MISSING__:Pre-warm SLM model on enable",
     "compressionSummarizerEnabled": "Aktiver Summarizer",
     "compressionMaxTokensPerMessage": "Maks tokens per melding",
     "compressionMinSavings": "Min spareterskel",
@@ -5308,13 +5798,22 @@
     "resilienceNo": "Nei",
     "resilienceDefault": "Default",
     "storageDatabaseBackupRetention": "Oppbevaring av sikkerhetskopiering av database",
+    "storageDatabaseBackups": "__MISSING__:Database backups",
     "storagePurgeData": "Tøm data",
+    "storagePurgeDataDesc": "__MISSING__:Immediately delete all records without applying retention checks. Use with caution.",
+    "storageRetentionCleanup": "__MISSING__:Retention Settings",
+    "storageRetentionCleanupDesc": "__MISSING__:Configure operational record retention and database backup cleanup.",
+    "retentionCallDays": "__MISSING__:Call {count}d",
+    "retentionAppDays": "__MISSING__:App {count}d",
+    "retentionRows": "__MISSING__:{count} rows",
     "retentionQuotaSnapshots": "Kvoteøyeblikksbilder (dager)",
+    "retentionCompressionAnalytics": "__MISSING__:Compression Analytics (days)",
     "retentionMcpAudit": "MCP-revisjon (dager)",
     "retentionA2aEvents": "A2A-hendelser (dager)",
     "retentionCallLogs": "Samtalelogger (dager)",
     "retentionUsageHistory": "Brukshistorikk (dager)",
     "retentionMemoryEntries": "Minneoppføringer (dager)",
+    "saveRetentionSettings": "__MISSING__:Save retention settings",
     "storageAutoVacuumMode": "Autovakuummodus",
     "storageScheduledVacuum": "Planlagt vakuum",
     "storageVacuumHour": "Vakuumtime (0-23)",
@@ -5328,10 +5827,16 @@
     "storageIntegrityOk": "✓ OK",
     "storageIntegrityError": "✗ Feil",
     "storageUsageTokenBuffer": "Bruk Token Buffer",
+    "storageUsageTokenBufferDesc": "__MISSING__:Extra tokens added to reported usage to account for system prompt overhead.",
+    "storageUsageTokenBufferHint": "__MISSING__:Set to 0 to report raw provider token counts. Default: 2000.",
+    "storageUsageTokenBufferCurrent": "__MISSING__:Current: {value}",
     "compressionSettingsAutoTriggerMode": "Auto trigger-modus",
     "compressionSettingsMcpDescriptionCompression": "MCP-beskrivelseskomprimering",
+    "mcpAccessibilityTitle": "__MISSING__:MCP accessibility output",
     "compressionSettingsCavemanIntensity": "Caveman intensitet",
     "compressionSettingsCavemanOutputMode": "Caveman utgangsmodus",
+    "compressionSettingsOutputStyles": "__MISSING__:Output styles",
+    "compressionStylesTileTitle": "__MISSING__:Output styles",
     "compressionSettingsOutputIntensity": "Utgangsintensitet",
     "compressionSettingsAutoClarityBypass": "Automatisk klarhetsbypass",
     "resilienceWaitForCooldown": "Vent på nedkjøling",
@@ -5347,6 +5852,9 @@
     "cliproxyapiUrl": "CLIProxyAPI URL",
     "cliproxyapiStatus": "CLIProxyAPI-status",
     "cliproxyapiNotDetected": "Ikke oppdaget",
+    "cliproxyapiImportAuthTitle": "__MISSING__:Import accounts from CLIProxyAPI",
+    "cliproxyapiImportAuthDesc": "__MISSING__:Import the OAuth accounts CLIProxyAPI already saved in ~/.cli-proxy-api/ as OmniRoute connections, so you don't have to log in to each account again. Supported account types (Gemini, Codex, Claude, Antigravity, Qwen, Kimi) are imported; others are skipped.",
+    "cliproxyapiImportAuthButton": "__MISSING__:Import accounts",
     "payloadRulesTitle": "Regler for nyttelast",
     "payloadRulesDesc": "__MISSING__:Configure request payload mutations by model and protocol. Changes are persisted in settings and hot reloaded into the runtime immediately after save.",
     "payloadRuleDefaultTitle": "__MISSING__:default",
@@ -5379,6 +5887,14 @@
     "maxResponseTokensDesc": "__MISSING__:Maximum total tokens allowed in a single response.",
     "modelCooldownsTitle": "Modeller i nedkjøling",
     "modelCooldownsEmpty": "Ingen modeller i nedkjøling akkurat nå.",
+    "responsesStateTitle": "__MISSING__:Responses State",
+    "responsesStateDesc": "__MISSING__:Control how OmniRoute forwards previous_response_id.",
+    "responsesStateModeLabel": "__MISSING__:previous_response_id handling",
+    "responsesStateModeAuto": "__MISSING__:Auto",
+    "responsesStateModeStrip": "__MISSING__:Strip",
+    "responsesStateModePreserve": "__MISSING__:Preserve",
+    "responsesStateHint": "__MISSING__:Auto strips previous_response_id unless a connection explicitly enables OpenAI Responses storage. Strip is safest for stateless clients such as VS Code Custom Endpoint; context then depends on the client sending full history.",
+    "responsesStateSaveError": "__MISSING__:Failed to update Responses state setting",
     "codexFastTierTitle": "Codex Fast Tier",
     "codexFastTierDesc": "Globalt inject service_tier=prioritet for OpenAI Codex-forespørsler.",
     "codexFastTierHint": "Når aktivert, legger OmniRoute service_tier=prioritet til utgående Codex-forespørsler for tilkoblinger som ikke allerede spesifiserer et nivå. Prioritetsnivået krever en OpenAI Enterprise API-nøkkel eller ChatGPT-auth Codex-banen; andre nøkkeltyper vil motta en nivårelatert feil fra OpenAI. Innstillinger per tilkobling på Codex-leverandørsiden har forrang.",
@@ -5485,6 +6001,15 @@
     "resilienceEnableServerWaitDesc": "Når den er aktivert, venter OmniRoute på at den første nedkjølingen utløper og prøver automatisk på nytt.",
     "resilienceMaxAttempts": "Maksimalt antall forsøk",
     "resilienceMaxWaitPerAttempt": "Maksimal venting per forsøk",
+    "resilienceProviderCooldownTitle": "__MISSING__:Provider Cooldown",
+    "resilienceProviderCooldownScope": "__MISSING__:All combo requests",
+    "resilienceProviderCooldownTrigger": "__MISSING__:When a provider/connection fails",
+    "resilienceProviderCooldownEffect": "__MISSING__:Skips the failed provider for a cooldown period before retrying",
+    "resilienceProviderCooldownDesc": "__MISSING__:Prevents subsequent requests from re-walking the same failing providers. Cooldown scales exponentially with consecutive failures.",
+    "resilienceProviderCooldownEnabled": "__MISSING__:Enable global provider cooldown",
+    "resilienceProviderCooldownEnabledDesc": "__MISSING__:When enabled, failed providers are tracked globally and skipped for a cooldown period.",
+    "resilienceProviderCooldownMin": "__MISSING__:Minimum cooldown",
+    "resilienceProviderCooldownMax": "__MISSING__:Maximum cooldown",
     "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
     "forcedFingerprintBadge": "Required",
     "codexSessionAffinityTitle": "Codex-økttilhørighet",
@@ -5506,13 +6031,45 @@
     "vercelRelayFreeTierNote": "__MISSING__:Relays are lightweight proxy endpoints deployed on Vercel's free tier to bypass local network/region limitations.",
     "vercelRelayDeploying": "__MISSING__:Deploying...",
     "vercelRelayDeploy": "__MISSING__:Deploy",
-    "homePinProviderQuotaToHome": "Pin Information to Home Page",
-    "homeProviderQuotaLimits": "Provider Quota Limits",
-    "homeProviderQuotaLimitsDesc": "Pin the Provider Quota status container (with Refresh All button) to the top of the Home page.",
-    "homeQuickStart": "Quick Start",
-    "homeQuickStartDesc": "Show the Quick Start panel on the Home page.",
-    "homeProviderTopology": "Provider Topology",
-    "homeProviderTopologyDesc": "Show the Provider Topology on the Home page."
+    "deployRelayButton": "__MISSING__:Deploy Relay",
+    "denoRelayButton": "__MISSING__:Deploy Deno Relay",
+    "denoRelayModalTitle": "__MISSING__:Deploy Deno Relay",
+    "denoRelayWarning": "__MISSING__:Warning: A Deno Deploy organization token is required. This token will only be used to create the relay app and will never be stored by OmniRoute.",
+    "denoRelayTokenLabel": "__MISSING__:Deno Deploy Organization Token",
+    "denoRelayOrgDomainLabel": "__MISSING__:Organization Domain",
+    "denoRelayProjectNameLabel": "__MISSING__:Deno App Name",
+    "denoRelayFreeTierNote": "__MISSING__:Deno Deploy v2 runs on a global edge network. Free tier: 1M requests & 100GiB outbound traffic per month, no per-request CPU limits, up to 20 active apps & 50 custom domains.",
+    "denoRelayDeploying": "__MISSING__:Deploying...",
+    "denoRelayDeploy": "__MISSING__:Deploy",
+    "cloudflareRelaySuccess": "__MISSING__:Cloudflare Relay deployed successfully",
+    "cloudflareRelayButton": "__MISSING__:Deploy Cloudflare Relay",
+    "cloudflareRelayModalTitle": "__MISSING__:Deploy Cloudflare Worker Relay",
+    "cloudflareRelayWarning": "__MISSING__:Deploys a Cloudflare Worker that proxies LLM requests through Cloudflare's edge network — masking the host IP behind dynamic Cloudflare addresses. The Worker enforces a one-time auth secret so the public workers.dev URL cannot be reused as an open relay.",
+    "cloudflareRelayTokenHowto": "__MISSING__:Create the API token under My Profile -> API Tokens -> Create Token -> Custom Token -> Account / Workers Scripts / Edit.",
+    "cloudflareRelayAccountIdLabel": "__MISSING__:Cloudflare Account ID",
+    "cloudflareRelayAccountIdHint": "__MISSING__:Found on the right side of the Cloudflare dashboard overview page.",
+    "cloudflareRelayApiTokenLabel": "__MISSING__:Cloudflare API Token",
+    "cloudflareRelayApiTokenHint": "__MISSING__:Requires 'Workers Scripts: Edit' permission. The token is used only at deploy time and is never stored.",
+    "cloudflareRelayProjectNameLabel": "__MISSING__:Worker Name",
+    "cloudflareRelayFreeTierNote": "__MISSING__:Free tier: 100,000 requests/day per Cloudflare account.",
+    "cloudflareRelayDeploying": "__MISSING__:Deploying...",
+    "cloudflareRelayDeploy": "__MISSING__:Deploy",
+    "cloudflareRelayCredsRequired": "__MISSING__:Account ID and API Token are required",
+    "cloudflareRelayDeployFailed": "__MISSING__:Deploy failed",
+    "modelLockout": "__MISSING__:Model Lockout",
+    "modelLockoutPageDescription": "__MISSING__:Configure which HTTP error codes trigger per-model lockout and control the cooldown behavior.",
+    "modelLockoutEnabled": "__MISSING__:Enable Model Lockout",
+    "modelLockoutEnabledDescription": "__MISSING__:When enabled, models that fail with configured error codes are temporarily locked to prevent retry loops.",
+    "modelLockoutErrorCodes": "__MISSING__:Error Codes",
+    "modelLockoutErrorCodesDescription": "__MISSING__:HTTP status codes that trigger model lockout. Type a code and click Add, or select from suggestions.",
+    "modelLockoutBaseCooldown": "__MISSING__:Base Cooldown (ms)",
+    "modelLockoutBaseCooldownDescription": "__MISSING__:Initial cooldown duration in milliseconds before a model can be retried.",
+    "modelLockoutMaxCooldown": "__MISSING__:Max Cooldown (ms)",
+    "modelLockoutMaxCooldownDescription": "__MISSING__:Maximum cooldown duration in milliseconds. Prevents excessively long lockouts.",
+    "modelLockoutExponentialBackoff": "__MISSING__:Exponential Backoff",
+    "modelLockoutExponentialBackoffDescription": "__MISSING__:When enabled, each consecutive failure increases the cooldown duration exponentially.",
+    "modelLockoutMaxBackoffSteps": "__MISSING__:Max Backoff Steps",
+    "modelLockoutMaxBackoffStepsDescription": "__MISSING__:Maximum number of backoff steps before the cooldown stops growing. The Max Cooldown cap is reached first in most configurations, making this a safety ceiling for when Max Cooldown is raised."
   },
   "contextRtk": {
     "title": "RTK Engine",
@@ -5563,7 +6120,21 @@
     "searchFilters": "Søkefiltre...",
     "tooltipDedup": "Hvor aggressivt å fjerne gjentatte linjer.",
     "tooltipMaxChars": "Maksimalt antall tegn per utdatablokk.",
-    "tooltipMaxLines": "Maksimalt antall linjer å holde fra kommandoutgang. Overskudd avkortes."
+    "tooltipMaxLines": "Maksimalt antall linjer å holde fra kommandoutgang. Overskudd avkortes.",
+    "learnDiscoverTitle": "__MISSING__:Learn & Discover filters",
+    "learnDiscoverDesc": "__MISSING__:Mine your captured command output (Raw Output retention must be on) to suggest new RTK filters. Suggestions only — you review and save them.",
+    "discoverHeading": "__MISSING__:Discover repeated noise",
+    "discoverButton": "__MISSING__:Scan samples",
+    "discoverScanning": "__MISSING__:Scanning…",
+    "discoverEmpty": "__MISSING__:No repeated noise found. Enable Raw Output retention and run a few commands first.",
+    "discoverSamples": "__MISSING__:{count} sample(s) scanned",
+    "discoverHits": "__MISSING__:{hits}× across samples",
+    "learnHeading": "__MISSING__:Learn a filter for a command",
+    "learnCommandPlaceholder": "__MISSING__:e.g. npm install",
+    "learnButton": "__MISSING__:Suggest filter",
+    "learnEmpty": "__MISSING__:No suggestion yet. Type a command you have run and scan.",
+    "learnSamplesUsed": "__MISSING__:Learned from {count} matching sample(s)",
+    "suggestionError": "__MISSING__:Could not load suggestions. Check management auth and try again."
   },
   "contextCombos": {
     "title": "Compression Combos",
@@ -5853,7 +6424,80 @@
     "routeConnectionLabel": "Tilkobling",
     "scenarioVision": "Visjon (bildeforståelse)",
     "scenarioSchemaCoercion": "Skjematvang (strukturert utgang)",
-    "techniques": "Teknikker:"
+    "techniques": "Teknikker:",
+    "friendlyTitle": "__MISSING__:Translator",
+    "friendlySubtitle": "__MISSING__:Use your existing app with any provider — without rewriting code.",
+    "conceptHeadline": "__MISSING__:Your app speaks one API's \"language\". The Translator converts it to use another provider.",
+    "conceptDiagramAppLabel": "__MISSING__:Your app",
+    "conceptDiagramSourceLabel": "__MISSING__:Source format",
+    "conceptDiagramHubLabel": "__MISSING__:OpenAI (hub)",
+    "conceptDiagramTargetLabel": "__MISSING__:Target provider",
+    "conceptDiagramExampleApp": "__MISSING__:e.g. Anthropic SDK",
+    "conceptDiagramExampleSource": "__MISSING__:claude",
+    "conceptDiagramExampleTarget": "__MISSING__:Gemini",
+    "conceptHowItWorksToggle": "__MISSING__:How it works",
+    "conceptHowItWorksBody": "__MISSING__:Your app sends a request in its own format. The Translator detects the format, converts it through OpenAI as an intermediate hub (or directly when a direct translator is available), sends it to the chosen provider, and returns the response converted back to your app's format.",
+    "tabTranslate": "__MISSING__:Translate",
+    "tabMonitor": "__MISSING__:Monitor",
+    "tabTranslateAriaLabel": "__MISSING__:Go to the Translate tab",
+    "tabMonitorAriaLabel": "__MISSING__:Go to the Monitor tab",
+    "simpleAppUsesLabel": "__MISSING__:My app uses",
+    "simpleAppUsesHint": "__MISSING__:The API format your app speaks (e.g. Anthropic SDK = claude).",
+    "simpleSendToLabel": "__MISSING__:Send to",
+    "simpleSendToHint": "__MISSING__:Where to actually send the request (a provider connected in OmniRoute).",
+    "simpleStartWithLabel": "__MISSING__:Start with",
+    "simpleStartWithExamplePlaceholder": "__MISSING__:Select a ready-made example",
+    "simpleStartWithCustomOption": "__MISSING__:Paste your request (advanced)",
+    "simpleModeLabel": "__MISSING__:Mode",
+    "simpleModePreview": "__MISSING__:Preview translation only",
+    "simpleModeSend": "__MISSING__:Send and see response",
+    "simpleAdvancedToggle": "__MISSING__:Advanced",
+    "simpleInputPanelTitle": "__MISSING__:Input",
+    "simpleInputPanelHint": "__MISSING__:Free-text message or ready-made example",
+    "simpleResultPanelTitle": "__MISSING__:Translation + Response",
+    "narratedDetected": "__MISSING__:✓ Detected: {format}",
+    "narratedTranslating": "__MISSING__:Translating to {target}...",
+    "narratedSending": "__MISSING__:Sending to {target}...",
+    "narratedSuccess": "__MISSING__:→ translated to {target} · response in {latency}ms",
+    "narratedError": "__MISSING__:Failed: {reason}",
+    "narratedSeeTranslatedJson": "__MISSING__:see translated JSON",
+    "narratedSeePipeline": "__MISSING__:see pipeline",
+    "advancedSectionTitle": "__MISSING__:Advanced",
+    "advancedSectionSubtitle": "__MISSING__:Raw JSON, pipeline and technical tools. Everything here is the same as the old tabs — just reorganized.",
+    "advancedRawJsonTitle": "__MISSING__:Raw JSON (auto-detect + Monaco)",
+    "advancedRawJsonSubtitle": "__MISSING__:Paste a JSON request; the format is detected automatically.",
+    "advancedPipelineTitle": "__MISSING__:OpenAI intermediate pipeline",
+    "advancedPipelineSubtitle": "__MISSING__:Visualize each translation step (hub-and-spoke).",
+    "advancedStreamTransformTitle": "__MISSING__:Stream Transformer (Chat → Responses SSE)",
+    "advancedStreamTransformSubtitle": "__MISSING__:Converts Chat Completions SSE into Responses API.",
+    "advancedTestBenchTitle": "__MISSING__:Test Bench (8 scenarios)",
+    "advancedTestBenchSubtitle": "__MISSING__:Runs all scenarios and reports pass/fail + compatibility %.",
+    "advancedCompressionTitle": "__MISSING__:Compression Preview",
+    "advancedCompressionSubtitle": "__MISSING__:Estimate token savings across different compression modes.",
+    "monitorOriginHint": "__MISSING__:Events generated by Translate or the main pipeline appear here in real time.",
+    "monitorEmptyCta": "__MISSING__:Go to the Translate tab and send a request — it will appear here.",
+    "monitorOpenTranslateButton": "__MISSING__:Go to Translate",
+    "pipelineStepClientRequest": "__MISSING__:Client Request",
+    "pipelineStepClientRequestDesc": "__MISSING__:Request received in client format",
+    "pipelineStepFormatDetected": "__MISSING__:Format Detected",
+    "pipelineStepFormatDetectedDesc": "__MISSING__:Auto-detected source format",
+    "pipelineStepOpenAIIntermediate": "__MISSING__:OpenAI Intermediate",
+    "pipelineStepOpenAIIntermediateDesc": "__MISSING__:Translated to OpenAI hub format",
+    "pipelineStepProviderFormat": "__MISSING__:Provider Format",
+    "pipelineStepProviderFormatDesc": "__MISSING__:Translated to provider target format",
+    "pipelineStepProviderResponse": "__MISSING__:Provider Response",
+    "pipelineStepProviderResponseDesc": "__MISSING__:Streaming response from provider",
+    "conceptDiagramArrow1": "__MISSING__:speaks",
+    "conceptDiagramArrow2": "__MISSING__:translates",
+    "conceptDiagramArrow3": "__MISSING__:converts",
+    "conceptDiagramExampleHub": "__MISSING__:OpenAI",
+    "conceptDiagramHubTooltip": "__MISSING__:Intermediate hub used by the translator to convert between formats that don't have a direct mapping.",
+    "conceptDiagramSourceTooltip": "__MISSING__:The API format your app speaks (e.g., Anthropic SDK = claude).",
+    "conceptDiagramTargetTooltip": "__MISSING__:The provider where the request will actually be sent.",
+    "compressionEmptyHint": "__MISSING__:Fill in the input field on the Translate tab (Simple Controls or Raw JSON) to enable the preview.",
+    "compressionModeLabel": "__MISSING__:Compression mode",
+    "compressionPreviewButton": "__MISSING__:Preview Compression",
+    "compressionPreviewing": "__MISSING__:Previewing…"
   },
   "usage": {
     "title": "Bruk",
@@ -6010,6 +6654,8 @@
     "notApplicable": "N/A",
     "rawPlanWithValue": "Rå plan: {plan}",
     "noPlanFromProvider": "Ingen plan fra leverandøren",
+    "tokenExpiresIn": "__MISSING__:Token expires in {time}",
+    "tokenExpired": "__MISSING__:Token expired",
     "noQuotaData": "Ingen kvotedata",
     "cardExpand": "__MISSING__:Expand",
     "cardCollapse": "__MISSING__:Collapse",
@@ -6159,6 +6805,11 @@
     "quotaCutoffsButtonDefault": "Standard",
     "quotaCutoffsButtonHelp": "Rediger minimum gjenværende kvoteavskjæringer for denne kontoen.",
     "quotaCutoffsButtonDisabled": "Ingen kvotevinduer er tilgjengelige for denne kontoen ennå.",
+    "deactivateAccount": "__MISSING__:Deactivate account (stop routing)",
+    "activateAccount": "__MISSING__:Activate account (resume routing)",
+    "accountActivated": "__MISSING__:Account activated",
+    "accountDeactivated": "__MISSING__:Account deactivated",
+    "toggleActiveFailed": "__MISSING__:Failed to update account status",
     "quotaCutoffsTitle": "Kvoteavskjæringer for {name} ({provider})",
     "quotaCutoffsExplainer": "Overstyr minimum gjenværende kvoteprosent der denne kontoen slutter å velges for hvert kvotevindu. La stå tomt for å arve standardleverandøren.",
     "quotaCutoffsDefaultHint": "Standard gjenværende minimum: {default}%",
@@ -6179,6 +6830,7 @@
     "budgetColDailyLim": "Daglig lim",
     "budgetColMonthlyLim": "Månedlig lim",
     "budgetColUsedPct": "Brukt %",
+    "percentUsed": "__MISSING__:{pct}% used",
     "budgetLoading": "Laster inn …",
     "budgetNoKeysMatch": "Ingen nøkler samsvarer med filtre",
     "budgetLinearExtrapolation": "lineær ekstrapolering",
@@ -7124,6 +7776,11 @@
     "modalEditTitle": "Modal Edit Title",
     "labelName": "Label Name",
     "labelType": "Type",
+    "labelFamily": "__MISSING__:IP family",
+    "familyAuto": "__MISSING__:Auto (dual-stack)",
+    "familyIpv4": "__MISSING__:IPv4 only",
+    "familyIpv6": "__MISSING__:IPv6 only",
+    "familyHint": "__MISSING__:Egress address family. Auto keeps dual-stack; IPv4/IPv6 pin this proxy to that family (prevents a v4 leak under an IPv6-only proxy).",
     "labelHost": "Vert",
     "labelPort": "Port",
     "labelUsername": "Brukernavn",
@@ -7266,7 +7923,16 @@
     "improveConfirm": "Improve",
     "exportCode": "Export code",
     "exportCodeTitle": "Export Code",
+    "exportShort": "__MISSING__:Export",
     "noStateToExport": "No playground state available to export.",
+    "closeExportModal": "__MISSING__:Close export modal",
+    "close": "__MISSING__:Close",
+    "exportRealKeyWarning": "__MISSING__:Security warning: export blocked — a real API key was detected in the output. Please reset your API key and try again.",
+    "placeholderHintPrefix": "__MISSING__:Replace",
+    "placeholderHintSuffix": "__MISSING__:with your actual API key, or set it as an environment variable.",
+    "copyLangCode": "__MISSING__:Copy {language} code",
+    "loadingPresets": "__MISSING__:Loading…",
+    "loadPresetPlaceholder": "__MISSING__:Load preset…",
     "copyCode": "Copy",
     "copiedCode": "Copied!",
     "addModel": "+ Add model",
@@ -7291,7 +7957,27 @@
     "invalidJson": "Invalid JSON",
     "running": "Running…",
     "runLabel": "Run",
-    "enterToolResult": "Enter tool result…"
+    "enterToolResult": "Enter tool result…",
+    "build": {
+      "step1Label": "__MISSING__:What to test?",
+      "step2Label": "__MISSING__:Configure",
+      "step3Label": "__MISSING__:Run",
+      "step1Title": "__MISSING__:What do you want to test?",
+      "step1Subtitle": "__MISSING__:Choose the capability you want to explore in this session.",
+      "step2Title": "__MISSING__:Configure",
+      "step2Subtitle": "__MISSING__:Set up the tools or JSON schema that will be used in the request.",
+      "step3Title": "__MISSING__:Run",
+      "modeToolsTitle": "__MISSING__:Tools",
+      "modeToolsDesc": "__MISSING__:Test function calling — define tools and see how the model invokes them.",
+      "modeJsonTitle": "__MISSING__:JSON",
+      "modeJsonDesc": "__MISSING__:Test structured output — constrain the response to a JSON schema.",
+      "modeBothTitle": "__MISSING__:Tools + JSON",
+      "modeBothDesc": "__MISSING__:Combine function calling and structured output in a single request.",
+      "backButton": "__MISSING__:Back",
+      "nextButton": "__MISSING__:Next",
+      "runButton": "__MISSING__:Run",
+      "promptPlaceholder": "__MISSING__:Enter your message… (Enter to send, Shift+Enter for newline)"
+    }
   },
   "miniPlayground": {
     "endpoint": "__MISSING__:Endpoint",
@@ -7395,7 +8081,9 @@
     "loadingLogs": "Loading logs...",
     "noLogs": "No logs yet. Make some API calls to see them here.",
     "noMatchingLogs": "No logs matching current filters.",
-    "callLogsInfo": "Call logs are also saved as JSON files to {dataDir} and rotated based on {retentionDays} and {maxEntries}."
+    "callLogsInfo": "Call logs are also saved as JSON files to {dataDir} and rotated based on {retentionDays} and {maxEntries}.",
+    "loadMore": "__MISSING__:Load More",
+    "loadingMore": "__MISSING__:Loading more..."
   },
   "proxyLogger": {
     "filterAll": "All",
@@ -7432,7 +8120,8 @@
     "loadingProxyLogs": "Loading proxy logs...",
     "noProxyLogs": "No proxy logs yet. Configure proxies and make API calls to see them here.",
     "noMatchingLogs": "No logs match the current filters.",
-    "tlsFingerprint": "Chrome 124 TLS Fingerprint"
+    "tlsFingerprint": "Chrome 124 TLS Fingerprint",
+    "colPublicIp": "__MISSING__:Public IP"
   },
   "endpointOptions": {
     "speech": "Speech",
@@ -7572,7 +8261,86 @@
     "betaConfigSavedSuffix": "(ikke vedvart på serveren ennå). Håndhevelse av grense per forespørsel er ennå ikke koblet til proxy-pipelinen. Denne skjermen lar deg designe og visualisere kvotefordelingen; reell håndhevelse vil lande i en fremtidig iterasjon med DB-persistens og oppstrøms samtaleavlytting.",
     "policyLabel": "Retningslinjer:",
     "resetIn": "tilbakestille inn",
-    "quotaTotal": "totalt"
+    "quotaTotal": "totalt",
+    "kpiAvgUtilization": "__MISSING__:Avg utilization",
+    "kpiBorrowingNow": "__MISSING__:Borrowing now",
+    "conceptTitle": "__MISSING__:How Quota Share works",
+    "conceptIntro": "__MISSING__:Quota Share divides a provider's quota among multiple API keys using work-conserving fair-share: each key receives a proportional slice but can borrow from the free balance without exceeding the global cap.",
+    "conceptFairShare": "__MISSING__:Fair-share: each key receives quota proportional to its configured weight",
+    "conceptBorrowing": "__MISSING__:Borrowing: keys can consume free balance from others without breaching the cap",
+    "conceptGlobalCap": "__MISSING__:Hard global cap: the provider's absolute limit is never exceeded",
+    "conceptWindows": "__MISSING__:Windows: 5h, hourly, daily, weekly, monthly — each tracked independently",
+    "conceptKeyHowTitle": "__MISSING__:Enabling a key for quota",
+    "conceptKeyHowDesc": "__MISSING__:Create the key normally in API Keys — it appears in the wizard's key step automatically. Tick Exclusive there to make it quota-only. No separate enable step.",
+    "conceptExclusiveTitle": "__MISSING__:What \"Exclusive\" does",
+    "conceptExclusiveDesc": "__MISSING__:An exclusive key only sees/uses the pool's quotaShared-* models — every other model is hidden from its /v1/models and blocked.",
+    "burnRateTitle": "__MISSING__:Burn rate",
+    "burnRateExhaustsIn": "__MISSING__:Exhausts in",
+    "dimensionResetIn": "__MISSING__:Resets in",
+    "realConsumedColumn": "__MISSING__:Consumed",
+    "deficitColumn": "__MISSING__:Deficit",
+    "borrowingIndicator": "__MISSING__:borrowing",
+    "migratedFromLocalStorageNotice": "__MISSING__:Pools successfully migrated from localStorage.",
+    "policyCapAbsoluteLabel": "__MISSING__:Absolute cap",
+    "policyCapAbsolutePlaceholder": "__MISSING__:Numeric limit (optional)",
+    "multiDimensionLabel": "__MISSING__:Multi-dimension",
+    "stackedBarTitle": "__MISSING__:Slices by API key",
+    "usedSuffix": "__MISSING__:used {percent}%",
+    "wizardTitle": "__MISSING__:New quota pool",
+    "editPoolTitle": "__MISSING__:Edit pool",
+    "saveChanges": "__MISSING__:Save changes",
+    "wizardStep1Label": "__MISSING__:Account",
+    "wizardStep2Label": "__MISSING__:Limit",
+    "wizardStep3Label": "__MISSING__:Keys",
+    "wizardStep1Title": "__MISSING__:Choose provider connection",
+    "wizardStep1Subtitle": "__MISSING__:Select the provider account this pool will share quota for, set a name and default policy.",
+    "wizardStep2Title": "__MISSING__:Configure quota dimensions",
+    "wizardStep2Subtitle": "__MISSING__:Define the quota plan dimensions (unit, window, limit) for the chosen connection. Leave unchanged to keep current settings.",
+    "wizardStep3Title": "__MISSING__:Allocate API keys",
+    "wizardStep3Subtitle": "__MISSING__:Assign API keys to this pool with weight % allocations and optional caps.",
+    "wizardPoolNameLabel": "__MISSING__:Pool name",
+    "wizardPoolNamePlaceholder": "__MISSING__:My quota pool",
+    "wizardNext": "__MISSING__:Next",
+    "wizardBack": "__MISSING__:Back",
+    "wizardCreatePool": "__MISSING__:Create pool",
+    "wizardDimensionsEditedNotice": "__MISSING__:Dimensions edited — will be saved as a manual override when the pool is created.",
+    "wizardExclusiveLabel": "__MISSING__:Exclusive quota",
+    "wizardExclusiveHint": "__MISSING__:When enabled, these API keys will only be allowed to use this pool's virtual models (allowedQuotas reconciliation is applied on save).",
+    "wizardPreviewLabel": "__MISSING__:Virtual model names preview",
+    "wizardConnectionsLabel": "__MISSING__:Provider connections",
+    "wizardPrimaryBadge": "__MISSING__:primary",
+    "wizardAdditionalConnectionsNote": "__MISSING__:Additional connections use their catalog default limits (editable later).",
+    "wizardSingleProviderNote": "__MISSING__:A pool uses a single provider",
+    "wizardPreviewMoreModels": "__MISSING__:+{count} more",
+    "accountQuotaTitle": "__MISSING__:Account quota",
+    "accountQuotaNone": "__MISSING__:—",
+    "logTitle": "__MISSING__:Usage log",
+    "logEmpty": "__MISSING__:No usage yet",
+    "groupLabel": "__MISSING__:Group",
+    "newGroup": "__MISSING__:New group",
+    "renameGroup": "__MISSING__:Rename group",
+    "groupSelectHint": "__MISSING__:Filter pools by group",
+    "groupAllocationNote": "__MISSING__:Allocations apply to all pools in this group via the shared quota layer.",
+    "groupNamePrompt": "__MISSING__:Enter group name",
+    "wizardGroupLabel": "__MISSING__:Group",
+    "allGroups": "__MISSING__:All groups",
+    "endpointsTitle": "__MISSING__:Available endpoints",
+    "endpointsHint": "__MISSING__:Call these virtual models with any allocated key — routing + quota are handled per group.",
+    "previewForKey": "__MISSING__:Preview for key",
+    "previewKeyNone": "__MISSING__:(all endpoints)",
+    "endpointsBaseUrl": "__MISSING__:Base URL",
+    "endpointsCollapse": "__MISSING__:Collapse",
+    "endpointsExpand": "__MISSING__:Expand",
+    "endpointsAnthropicNote": "__MISSING__:Anthropic-native",
+    "endpointsResponsesNote": "__MISSING__:OpenAI Responses — codex/github",
+    "endpointsWsNote": "__MISSING__:WebSocket — codex only",
+    "betaText": "__MISSING__:Quota Share is functional but bugs are expected. Found one? Please report it.",
+    "betaReportLink": "__MISSING__:Report an issue",
+    "deleteGroup": "__MISSING__:Delete group",
+    "deleteGroupConfirm": "__MISSING__:Delete this group? Its pools must be reassigned or removed first.",
+    "deleteGroupHasPools": "__MISSING__:This group still has pools — reassign or delete them first.",
+    "ungroupedTitle": "__MISSING__:Ungrouped",
+    "ungroupedHint": "__MISSING__:These pools are not assigned to a known group. Edit a pool to move it into a real group."
   },
   "plugins": {
     "title": "Plugins",
@@ -7608,6 +8376,571 @@
     "status": "Status",
     "enabled": "Enabled",
     "disabled": "Disabled",
+    "installedTab": "__MISSING__:Installed",
+    "marketplaceTab": "__MISSING__:Marketplace",
+    "marketplaceUrlLabel": "__MISSING__:Custom Marketplace URL",
+    "marketplaceUrlPlaceholder": "__MISSING__:Leave empty for official Omniroute registry",
+    "saveMarketplaceUrl": "__MISSING__:Save & Reload",
+    "marketplaceUrlSaved": "__MISSING__:Marketplace URL updated",
+    "marketplaceEmpty": "__MISSING__:No plugins found in marketplace.",
+    "verified": "__MISSING__:Verified",
+    "install": "__MISSING__:Install",
+    "installedFromMarketplace": "__MISSING__:Plugin {name} installed!",
     "hooks": "Hooks"
+  },
+  "quotaPlans": {
+    "title": "__MISSING__:Plans & Quotas",
+    "description": "__MISSING__:Configure quota plans per provider — dimensions (%, requests, tokens, $) and time windows",
+    "providerLabel": "__MISSING__:Provider / Connection",
+    "detectedPlanLabel": "__MISSING__:Detected plan",
+    "manualPlanLabel": "__MISSING__:Manual override",
+    "unconfiguredLabel": "__MISSING__:Not configured — manual required",
+    "dimensionLabel": "__MISSING__:Dimensions",
+    "addDimension": "__MISSING__:Add dimension",
+    "removeDimension": "__MISSING__:Remove",
+    "limitLabel": "__MISSING__:Limit",
+    "unitOptions": {
+      "percent": "__MISSING__:%",
+      "requests": "__MISSING__:requests",
+      "tokens": "__MISSING__:tokens",
+      "usd": "__MISSING__:USD ($)"
+    },
+    "windowOptions": {
+      "5h": "__MISSING__:5 hours",
+      "hourly": "__MISSING__:Hourly",
+      "daily": "__MISSING__:Daily",
+      "weekly": "__MISSING__:Weekly",
+      "monthly": "__MISSING__:Monthly"
+    },
+    "useCatalogButton": "__MISSING__:Use catalog",
+    "saveOverrideButton": "__MISSING__:Save override",
+    "revertToCatalogButton": "__MISSING__:Revert to catalog",
+    "unknownProviderNotice": "__MISSING__:Select a provider on the left to configure its quota plan.",
+    "catalogTitle": "__MISSING__:Known catalog",
+    "catalogDescription": "__MISSING__:Automatically detected plans for the following providers:"
+  },
+  "activity": {
+    "title": "__MISSING__:Activity",
+    "description": "__MISSING__:Recent events feed",
+    "emptyTitle": "__MISSING__:No activity yet",
+    "emptyDescription": "__MISSING__:When you add providers, create combos, or rotate keys, events will appear here.",
+    "todayHeader": "__MISSING__:Today",
+    "yesterdayHeader": "__MISSING__:Yesterday",
+    "filterAll": "__MISSING__:All",
+    "filterProviders": "__MISSING__:Providers",
+    "filterCombos": "__MISSING__:Combos",
+    "filterApiKeys": "__MISSING__:API Keys",
+    "filterSettings": "__MISSING__:Settings",
+    "filterQuota": "__MISSING__:Quota",
+    "filterAuth": "__MISSING__:Auth",
+    "filterSystem": "__MISSING__:System",
+    "relative": {
+      "justNow": "__MISSING__:just now",
+      "minutesAgo": "__MISSING__:{n} min ago",
+      "hoursAgo": "__MISSING__:{n} h ago",
+      "yesterday": "__MISSING__:yesterday",
+      "daysAgo": "__MISSING__:{n} days ago"
+    },
+    "eventVerb": {
+      "providerAdded": "__MISSING__:{actor} added provider {target}",
+      "providerRemoved": "__MISSING__:{actor} removed provider {target}",
+      "providerTested": "__MISSING__:{actor} tested provider {target}",
+      "comboCreated": "__MISSING__:{actor} created combo {target}",
+      "comboUpdated": "__MISSING__:{actor} updated combo {target}",
+      "comboDeleted": "__MISSING__:{actor} removed combo {target}",
+      "apiKeyCreated": "__MISSING__:{actor} created API key {target}",
+      "apiKeyRevoked": "__MISSING__:{actor} revoked API key {target}",
+      "apiKeyRotated": "__MISSING__:{actor} rotated API key {target}",
+      "budgetThreshold": "__MISSING__:Budget threshold reached for {target}",
+      "settingUpdated": "__MISSING__:{actor} updated setting {target}",
+      "authLogin": "__MISSING__:{actor} signed in",
+      "authLogout": "__MISSING__:{actor} signed out",
+      "cloudAgentSession": "__MISSING__:Cloud agent session started for {target}",
+      "mcpToolRegistered": "__MISSING__:MCP tool {target} registered",
+      "webhookCreated": "__MISSING__:{actor} created webhook {target}",
+      "webhookDeleted": "__MISSING__:{actor} removed webhook {target}",
+      "quotaPoolCreated": "__MISSING__:{actor} created quota pool {target}",
+      "quotaPoolUpdated": "__MISSING__:{actor} updated quota pool {target}",
+      "quotaPoolDeleted": "__MISSING__:{actor} removed quota pool {target}",
+      "quotaPlanUpdated": "__MISSING__:{actor} updated quota plan {target}",
+      "quotaStoreDriverChanged": "__MISSING__:QuotaStore driver changed",
+      "updateApplied": "__MISSING__:Update {target} applied",
+      "deployCompleted": "__MISSING__:Deploy completed",
+      "skillInstalled": "__MISSING__:{actor} installed skill {target}",
+      "skillRemoved": "__MISSING__:{actor} removed skill {target}",
+      "providerCredentialsCreated": "__MISSING__:{actor} created credentials for {target}",
+      "providerCredentialsApplied": "__MISSING__:Credentials for {target} applied",
+      "providerCredentialsUpdated": "__MISSING__:{actor} updated credentials for {target}",
+      "providerCredentialsRevoked": "__MISSING__:{actor} revoked credentials for {target}",
+      "providerCredentialsBatchRevoked": "__MISSING__:{actor} batch-revoked credentials",
+      "providerCredentialsBatchUpdated": "__MISSING__:{actor} batch-updated credentials",
+      "providerCredentialsBulkCreated": "__MISSING__:{actor} bulk-created credentials",
+      "providerCredentialsBulkImported": "__MISSING__:{actor} bulk-imported credentials",
+      "providerCredentialsImported": "__MISSING__:{actor} imported credentials",
+      "providerSsrfBlocked": "__MISSING__:SSRF attempt blocked for {target}",
+      "authLoginSuccess": "__MISSING__:{actor} signed in",
+      "authLoginError": "__MISSING__:Login error for {actor}",
+      "authLoginFailed": "__MISSING__:Login failed for {actor}",
+      "authLoginLocked": "__MISSING__:{actor} locked out after too many attempts",
+      "authLoginMisconfigured": "__MISSING__:Auth configuration invalid",
+      "authLoginSetupRequired": "__MISSING__:Auth setup required",
+      "authLogoutSuccess": "__MISSING__:{actor} signed out",
+      "syncTokenCreated": "__MISSING__:{actor} created sync token",
+      "syncTokenRevoked": "__MISSING__:{actor} revoked sync token",
+      "settingsUpdate": "__MISSING__:{actor} updated settings",
+      "settingsUpdateFailed": "__MISSING__:Settings update failed",
+      "serviceRevealApiKey": "__MISSING__:{actor} revealed API key for {target}",
+      "genericEvent": "__MISSING__:{actor} {target}"
+    }
+  },
+  "agentBridge": {
+    "title": "__MISSING__:AgentBridge",
+    "subtitle": "__MISSING__:Use IDE agents with OmniRoute models — no config required",
+    "riskBannerTitle": "__MISSING__:Use at your own risk",
+    "riskBannerBody": "__MISSING__:AgentBridge intercepts HTTPS traffic from IDE agents. By activating it you accept responsibility for compliance with the terms of service of each agent. Never use on devices or networks where TLS inspection is prohibited.",
+    "riskBannerDismiss": "__MISSING__:Dismiss",
+    "serverCardTitle": "__MISSING__:AgentBridge Server",
+    "statusRunning": "__MISSING__:Running",
+    "statusStopped": "__MISSING__:Stopped",
+    "statusActive": "__MISSING__:Active",
+    "statusDnsOff": "__MISSING__:DNS off",
+    "statusSetupRequired": "__MISSING__:Setup required",
+    "statusInvestigating": "__MISSING__:Investigating",
+    "serverPort": "__MISSING__:Port",
+    "serverConns": "__MISSING__:Connections",
+    "serverIntercepted": "__MISSING__:Intercepted",
+    "serverLastStarted": "__MISSING__:Last started",
+    "startServer": "__MISSING__:Start",
+    "stopServer": "__MISSING__:Stop",
+    "restartServer": "__MISSING__:Restart",
+    "trustCert": "__MISSING__:Trust Cert",
+    "downloadCert": "__MISSING__:Download Cert",
+    "regenerateCert": "__MISSING__:Regenerate Cert",
+    "starting": "__MISSING__:Starting…",
+    "stopping": "__MISSING__:Stopping…",
+    "restarting": "__MISSING__:Restarting…",
+    "trusting": "__MISSING__:Trusting…",
+    "regenerating": "__MISSING__:Regenerating…",
+    "upstreamCaLabel": "__MISSING__:Upstream CA Certificate (corporate)",
+    "upstreamCaPlaceholder": "__MISSING__:/etc/ssl/certs/corp-ca.pem",
+    "upstreamCaTest": "__MISSING__:Test TLS",
+    "upstreamCaTestOk": "__MISSING__:TLS test passed",
+    "upstreamCaTestError": "__MISSING__:TLS test failed — check the path and CA file",
+    "bypassSectionTitle": "__MISSING__:Bypass List",
+    "bypassSectionDesc": "__MISSING__:Hosts matching these patterns are tunneled directly (no TLS decryption). Defaults include banks, .gov, and corporate SSO.",
+    "bypassDefaultsLabel": "__MISSING__:Default bypass patterns (read-only)",
+    "bypassUserLabel": "__MISSING__:Custom bypass patterns (one per line, glob or regex)",
+    "saveBypassList": "__MISSING__:Save bypass list",
+    "agentListTitle": "__MISSING__:IDE Agents",
+    "filterAll": "__MISSING__:All",
+    "filterActive": "__MISSING__:Active",
+    "filterSetupRequired": "__MISSING__:Setup required",
+    "filterInvestigating": "__MISSING__:Investigating",
+    "searchAgents": "__MISSING__:Search agents…",
+    "noAgentsMatch": "__MISSING__:No agents match the current filter",
+    "agentHosts": "__MISSING__:Intercepted hosts",
+    "certTrusted": "__MISSING__:Certificate trusted",
+    "certNotTrusted": "__MISSING__:Certificate not trusted",
+    "investigatingNotice": "__MISSING__:This agent is under investigation. Hosts and API surface are still being confirmed. Setup will be available once the upstream API is documented.",
+    "modelMappingsLabel": "__MISSING__:Model mappings",
+    "sourceModel": "__MISSING__:Source model (agent native)",
+    "targetModel": "__MISSING__:Target model (OmniRoute)",
+    "noMappings": "__MISSING__:No model mappings configured. Run setup wizard to auto-detect models.",
+    "selectModel": "__MISSING__:Select…",
+    "saveMappings": "__MISSING__:Save mappings",
+    "setupWizard": "__MISSING__:Setup wizard",
+    "startDns": "__MISSING__:Start DNS",
+    "stopDns": "__MISSING__:Stop DNS",
+    "toggling": "__MISSING__:Toggling…",
+    "viewTraffic": "__MISSING__:View traffic",
+    "emptyNoProvidersTitle": "__MISSING__:No providers configured yet",
+    "emptyNoProvidersBody": "__MISSING__:To use AgentBridge, first connect at least one provider. It will be the destination where IDE requests are routed.",
+    "emptyGoToProviders": "__MISSING__:Go to Providers",
+    "wizardTitle": "__MISSING__:Setup wizard",
+    "wizardSubtitle": "__MISSING__:3-step setup",
+    "wizardStep1Label": "__MISSING__:Verify",
+    "wizardStep2Label": "__MISSING__:DNS",
+    "wizardStep3Label": "__MISSING__:Mappings",
+    "wizardStep1Desc": "__MISSING__:Confirm the server is running and the certificate is installed.",
+    "wizardStep2Desc": "__MISSING__:The following entries will be added to /etc/hosts to redirect traffic through AgentBridge:",
+    "wizardStep3Desc": "__MISSING__:You can now configure model mappings in the agent card. Restart the IDE to apply changes.",
+    "wizardStep3Success": "__MISSING__:Agent is configured!",
+    "wizardServerCheck": "__MISSING__:AgentBridge server",
+    "wizardRunning": "__MISSING__:running",
+    "wizardNotRunning": "__MISSING__:not running",
+    "wizardCertCheck": "__MISSING__:Certificate",
+    "wizardTrusted": "__MISSING__:trusted",
+    "wizardNotTrusted": "__MISSING__:not yet trusted — use Trust Cert button",
+    "wizardTutorialTitle": "__MISSING__:Setup instructions:",
+    "wizardEnableDns": "__MISSING__:Add /etc/hosts entries",
+    "wizardDnsAlreadyEnabled": "__MISSING__:DNS already enabled for this agent",
+    "enablingDns": "__MISSING__:Enabling…",
+    "modelSelectorTitle": "__MISSING__:Select target model",
+    "modelSelectorSearch": "__MISSING__:Search models…",
+    "noModelsFound": "__MISSING__:No models found",
+    "quickLinks": "__MISSING__:Quick links",
+    "quickLinkProviders": "__MISSING__:Configure providers",
+    "quickLinkInspector": "__MISSING__:View traffic in Traffic Inspector",
+    "maintenanceTitle": "__MISSING__:Maintenance & Diagnostics",
+    "maintenanceSubtitle": "__MISSING__:Self-test the capture pipeline, undo leftover system state, and move your setup between machines.",
+    "orphanedStateWarning": "__MISSING__:A previous session left system state behind (DNS spoof, CA, or system proxy). Run Repair to clean it up.",
+    "diagnose": "__MISSING__:Diagnose",
+    "diagnosing": "__MISSING__:Diagnosing…",
+    "diagnoseHealthy": "__MISSING__:Capture pipeline is healthy.",
+    "diagnoseUnhealthy": "__MISSING__:Capture pipeline has problems:",
+    "repair": "__MISSING__:Repair",
+    "repairing": "__MISSING__:Repairing…",
+    "repairDone": "__MISSING__:Repaired: {items}",
+    "repairNothing": "__MISSING__:Nothing to repair — system state is clean.",
+    "removeCa": "__MISSING__:Remove CA",
+    "removeCaConfirm": "__MISSING__:Remove CA?",
+    "removeCaDone": "__MISSING__:MITM root CA removed from the OS trust store.",
+    "removing": "__MISSING__:Removing…",
+    "confirm": "__MISSING__:Confirm",
+    "exportConfig": "__MISSING__:Export config",
+    "exporting": "__MISSING__:Exporting…",
+    "importConfig": "__MISSING__:Import config",
+    "importing": "__MISSING__:Importing…",
+    "importInvalidJson": "__MISSING__:The selected file is not valid JSON.",
+    "importDone": "__MISSING__:Imported {bypass} bypass · {hosts} hosts · {agents} agents",
+    "save": "__MISSING__:Save",
+    "saving": "__MISSING__:Saving…",
+    "cancel": "__MISSING__:Cancel",
+    "back": "__MISSING__:Back",
+    "next": "__MISSING__:Next",
+    "done": "__MISSING__:Done",
+    "loading": "__MISSING__:Loading…",
+    "riskNoticeTitle": "__MISSING__:Risk acknowledgment",
+    "riskNoticeBody": "__MISSING__:AgentBridge will intercept HTTPS traffic from this agent by redirecting its API hosts via DNS. Only enable if you accept responsibility for compliance with the agent's terms of service and any applicable network policies.",
+    "pageMoved": {
+      "goNow": "__MISSING__:Go now",
+      "message": "__MISSING__:The MITM Proxy now lives under AgentBridge.",
+      "title": "__MISSING__:This page has moved"
+    }
+  },
+  "trafficInspector": {
+    "title": "__MISSING__:Traffic Inspector",
+    "subtitle": "__MISSING__:Monitor LLM calls and debug any application's HTTPS traffic",
+    "captureModesTitle": "__MISSING__:Capture Modes",
+    "agentBridgeMode": "__MISSING__:AgentBridge",
+    "agentBridgeModeDesc": "__MISSING__:Capture traffic from all connected IDE agents",
+    "customHostsMode": "__MISSING__:Custom Hosts",
+    "customHostsModeDesc": "__MISSING__:Add specific hosts to intercept",
+    "httpProxyMode": "__MISSING__:HTTP Proxy",
+    "httpProxyModeDesc": "__MISSING__:Use HTTP_PROXY environment variable",
+    "systemWideMode": "__MISSING__:System-wide",
+    "systemWideModeDesc": "__MISSING__:Intercept all system traffic (advanced)",
+    "tproxyMode": "__MISSING__:TPROXY Decrypt",
+    "tproxyModeUnavailable": "__MISSING__:TPROXY decrypt requires Linux + root + the native addon",
+    "filterBarTitle": "__MISSING__:Filters",
+    "profileLlmOnly": "__MISSING__:LLM only",
+    "profileCustom": "__MISSING__:Custom",
+    "profileAll": "__MISSING__:All",
+    "filterHost": "__MISSING__:Filter host…",
+    "filterAgent": "__MISSING__:Agent",
+    "filterStatus": "__MISSING__:Status",
+    "pauseBtn": "__MISSING__:Pause",
+    "resumeBtn": "__MISSING__:Resume",
+    "clearBtn": "__MISSING__:Clear",
+    "exportHar": "__MISSING__:Export .har",
+    "recordSession": "__MISSING__:REC",
+    "stopSession": "__MISSING__:Stop",
+    "liveBadge": "__MISSING__:live",
+    "offlineBadge": "__MISSING__:offline",
+    "noRequests": "__MISSING__:No requests captured yet.",
+    "noRequestsDesc": "__MISSING__:Make sure AgentBridge is running or enable another capture mode.",
+    "selectRequest": "__MISSING__:Select a request to inspect it.",
+    "tabConversation": "__MISSING__:Conversation",
+    "tabHeaders": "__MISSING__:Headers",
+    "tabRequest": "__MISSING__:Request",
+    "tabResponse": "__MISSING__:Response",
+    "tabTiming": "__MISSING__:Timing",
+    "tabLlm": "__MISSING__:LLM",
+    "tabStats": "__MISSING__:Stats",
+    "requestHeaders": "__MISSING__:Request Headers",
+    "responseHeaders": "__MISSING__:Response Headers",
+    "rawEvents": "__MISSING__:Raw events",
+    "mergedView": "__MISSING__:Merged view",
+    "noBody": "__MISSING__:No body.",
+    "streaming": "__MISSING__:streaming…",
+    "manageHosts": "__MISSING__:Manage hosts",
+    "copySnippet": "__MISSING__:Copy proxy snippet",
+    "addHost": "__MISSING__:Add",
+    "hostPlaceholder": "__MISSING__:api.openai.com",
+    "noHostsYet": "__MISSING__:No custom hosts added yet.",
+    "noSessionsYet": "__MISSING__:No sessions yet",
+    "allTraffic": "__MISSING__:All traffic (no session)",
+    "sessionsDropdown": "__MISSING__:Sessions",
+    "annotationPlaceholder": "__MISSING__:Add a note…",
+    "contextFingerprint": "__MISSING__:Context fingerprint",
+    "llmProvider": "__MISSING__:Detected provider",
+    "llmApiKind": "__MISSING__:API kind",
+    "llmModel": "__MISSING__:Model",
+    "llmMessages": "__MISSING__:Messages",
+    "llmStream": "__MISSING__:Stream",
+    "llmMappedTo": "__MISSING__:Mapped to",
+    "llmCostEstimate": "__MISSING__:Cost estimate",
+    "systemProxyExitWarning": "__MISSING__:System-wide proxy still active — leave page anyway?",
+    "customHostsTitle": "__MISSING__:Custom Hosts",
+    "loading": "__MISSING__:Loading…",
+    "copied": "__MISSING__:Copied!",
+    "copy": "__MISSING__:Copy",
+    "httpProxyTitle": "__MISSING__:HTTP Proxy Snippet — port {port}",
+    "notRecording": "__MISSING__:Not recording",
+    "anyStatus": "__MISSING__:Any status",
+    "liveOnly": "__MISSING__:Live",
+    "viewingRecordedSession": "__MISSING__:Viewing recorded session",
+    "backToLive": "__MISSING__:Back to live",
+    "untitledSession": "__MISSING__:Untitled session",
+    "contextHistory": "__MISSING__:Context History",
+    "modelResponse": "__MISSING__:Model Response",
+    "conversationNoMessages": "__MISSING__:No messages found in this request.",
+    "conversationNotAvailable": "__MISSING__:Conversation data not available. This may not be an LLM request or the body could not be parsed.",
+    "loadingCharts": "__MISSING__:Loading charts…",
+    "statsErrors": "__MISSING__:Errors",
+    "statsLatency": "__MISSING__:Latency (last 50 requests)",
+    "statsNoData": "__MISSING__:No requests yet. Start a session recording to capture data for stats.",
+    "statsStatusDistribution": "__MISSING__:Status distribution",
+    "statsSuccessful": "__MISSING__:Successful",
+    "statsTotalRequests": "__MISSING__:Total requests",
+    "timingProxyOverhead": "__MISSING__:Proxy overhead",
+    "timingUpstreamResponse": "__MISSING__:Upstream response",
+    "timingNoData": "__MISSING__:No timing data available.",
+    "timingTotalLatency": "__MISSING__:Total latency",
+    "timingTimestamp": "__MISSING__:Timestamp",
+    "timingMethod": "__MISSING__:Method",
+    "timingStatus": "__MISSING__:Status",
+    "timingRequestSize": "__MISSING__:Request size",
+    "timingResponseSize": "__MISSING__:Response size",
+    "pausedNewBadge": "__MISSING__:{count} new",
+    "clearContextFilter": "__MISSING__:clear"
+  },
+  "cliCommon": {
+    "concept": {
+      "code": {
+        "title": "__MISSING__:CLI Code",
+        "phrase": "__MISSING__:Code tools you point at OmniRoute",
+        "flow": "__MISSING__:You → CLI Code → OmniRoute → Provider",
+        "seeOther": "__MISSING__:See →"
+      },
+      "agent": {
+        "title": "__MISSING__:CLI Agents",
+        "phrase": "__MISSING__:Broad-purpose autonomous CLI agents you point at OmniRoute",
+        "flow": "__MISSING__:You → CLI Agent → OmniRoute → Provider",
+        "seeOther": "__MISSING__:See →"
+      },
+      "acp": {
+        "title": "__MISSING__:ACP Agents",
+        "phrase": "__MISSING__:CLIs that OmniRoute spawns as execution backend (reverse flow)",
+        "flow": "__MISSING__:Client → OmniRoute → spawn CLI (stdio/ACP) → response",
+        "seeOther": "__MISSING__:See →"
+      }
+    },
+    "comparison": {
+      "title": "__MISSING__:Understand the 3 CLI types in OmniRoute",
+      "thisPage": "__MISSING__:This page",
+      "open": "__MISSING__:Open →",
+      "code": {
+        "title": "__MISSING__:Code tool",
+        "desc": "__MISSING__:Points to Omni",
+        "flow": "__MISSING__:you → CLI → Omni → provider",
+        "examples": "__MISSING__:e.g.: claude, codex"
+      },
+      "agent": {
+        "title": "__MISSING__:Broad autonomous agent",
+        "desc": "__MISSING__:Points to Omni",
+        "flow": "__MISSING__:you → agent → Omni",
+        "examples": "__MISSING__:e.g.: hermes, goose"
+      },
+      "acp": {
+        "title": "__MISSING__:CLI used as backend by Omni",
+        "desc": "__MISSING__:Reverse execution",
+        "flow": "__MISSING__:Omni → spawn CLI → resp",
+        "examples": "__MISSING__:e.g.: claude, codex (ACP)"
+      }
+    },
+    "card": {
+      "detected": "__MISSING__:Detected",
+      "notDetected": "__MISSING__:Not detected",
+      "configured": "__MISSING__:Configured",
+      "notConfigured": "__MISSING__:Not configured",
+      "configure": "__MISSING__:Configure →",
+      "howToInstall": "__MISSING__:How to install →",
+      "manualConfig": "__MISSING__:Manual config",
+      "installGuide": "__MISSING__:Install guide",
+      "endpointLabel": "__MISSING__:Endpoint",
+      "baseUrlFull": "__MISSING__:Full Base URL",
+      "baseUrlPartial": "__MISSING__:Partial Base URL",
+      "refreshDetection": "__MISSING__:Refresh detection",
+      "alsoAcp": "__MISSING__:also ACP",
+      "connectProviderHint": "__MISSING__:Connect a provider in Providers"
+    },
+    "detail": {
+      "back": "__MISSING__:Back",
+      "apply": "__MISSING__:Save",
+      "reset": "__MISSING__:Clear",
+      "manualConfig": "__MISSING__:Manual configuration",
+      "vendor": "__MISSING__:Vendor",
+      "category": "__MISSING__:Type",
+      "detectionStatus": "__MISSING__:Detection",
+      "configStatus": "__MISSING__:Configuration",
+      "baseUrlLabel": "__MISSING__:Base URL",
+      "apiKeyLabel": "__MISSING__:API Key",
+      "modelMappingLabel": "__MISSING__:Model mapping",
+      "noActiveProviders": "__MISSING__:No active providers.",
+      "noActiveProvidersDesc": "__MISSING__:Go to Providers to connect at least 1 provider before configuring the CLI.",
+      "openProviders": "__MISSING__:Open Providers →"
+    }
+  },
+  "cliCode": {
+    "pageTitle": "__MISSING__:CLI Code's",
+    "pageSubtitle": "__MISSING__:Code tools pointing to OmniRoute",
+    "searchPlaceholder": "__MISSING__:Search CLI…",
+    "filterDetectionLabel": "__MISSING__:Detection",
+    "filterBaseUrlLabel": "__MISSING__:Base URL",
+    "detectionAll": "__MISSING__:All",
+    "detectionInstalled": "__MISSING__:Installed",
+    "detectionNotFound": "__MISSING__:Not found",
+    "baseUrlAll": "__MISSING__:All",
+    "baseUrlFull": "__MISSING__:Full",
+    "baseUrlPartial": "__MISSING__:Partial"
+  },
+  "cliAgents": {
+    "pageTitle": "__MISSING__:CLI Agents",
+    "pageSubtitle": "__MISSING__:Broad-purpose autonomous CLI agents",
+    "refreshDetection": "__MISSING__:Refresh detection",
+    "searchPlaceholder": "__MISSING__:Search agent…",
+    "detectionFilterLabel": "__MISSING__:Detection",
+    "detectionAll": "__MISSING__:All",
+    "detectionInstalled": "__MISSING__:Installed",
+    "detectionNotInstalled": "__MISSING__:Not installed",
+    "visibleCount": "__MISSING__:{count} visible",
+    "emptyState": "__MISSING__:No CLI agents found with the current filters."
+  },
+  "acpAgents": {
+    "pageTitle": "__MISSING__:ACP Agents",
+    "pageSubtitle": "__MISSING__:CLIs that OmniRoute spawns as execution backend",
+    "scanning": "__MISSING__:Detecting agents…",
+    "refresh": "__MISSING__:Refresh",
+    "setupGuideTitle": "__MISSING__:Setup guide",
+    "setupGuideDetectCliTitle": "__MISSING__:Detect CLI",
+    "setupGuideDetectCliDesc": "__MISSING__:Agents are identified by running the --version command in PATH.",
+    "setupGuideCustomAgentTitle": "__MISSING__:Add custom agent",
+    "setupGuideCustomAgentDesc": "__MISSING__:Fill in the form below to register a custom CLI agent.",
+    "setupGuideCommandMissingTitle": "__MISSING__:Command not found",
+    "setupGuideCommandMissingDesc": "__MISSING__:Check that the binary is in PATH.",
+    "fingerprintSettingsHint": "__MISSING__:Configure routing and fingerprints in",
+    "settingsRoutingLink": "__MISSING__:Settings → Routing",
+    "installed": "__MISSING__:Installed",
+    "notFound": "__MISSING__:Not found",
+    "builtIn": "__MISSING__:Built-in",
+    "custom": "__MISSING__:Custom",
+    "agentUseCaseHint": "__MISSING__:Available for spawn via ACP.",
+    "remove": "__MISSING__:Remove",
+    "addCustomAgent": "__MISSING__:Add custom agent",
+    "addCustomAgentDesc": "__MISSING__:Register a custom CLI agent to be spawned via ACP.",
+    "addAgent": "__MISSING__:Add agent",
+    "agentName": "__MISSING__:Name",
+    "agentNamePlaceholder": "__MISSING__:e.g.: My Agent",
+    "binaryName": "__MISSING__:Binary",
+    "binaryNamePlaceholder": "__MISSING__:e.g.: myagent",
+    "versionCommand": "__MISSING__:Version command",
+    "versionCommandPlaceholder": "__MISSING__:e.g.: myagent --version",
+    "spawnArgs": "__MISSING__:Spawn arguments",
+    "spawnArgsPlaceholder": "__MISSING__:e.g.: --quiet, --json",
+    "cliCodeRedirectCta": "__MISSING__:Open CLI Code"
+  },
+  "agentSkills": {
+    "pageTitle": "__MISSING__:Agent Skills",
+    "pageSubtitle": "__MISSING__:Teach your agent to operate OmniRoute — 22 API areas + 20 CLI families",
+    "conceptCard": {
+      "agent": {
+        "title": "__MISSING__:Agent Skills — Outbound",
+        "description": "__MISSING__:Agent Skills are machine-readable SKILL.md documents that external AI agents (Claude Code, Cursor, Copilot…) fetch from GitHub to learn how to operate OmniRoute via REST or CLI. They are read by the agent, not executed by OmniRoute.",
+        "crossLinkLabel": "__MISSING__:Understand the difference →"
+      },
+      "omni": {
+        "title": "__MISSING__:Omni Skills — Inbound",
+        "description": "__MISSING__:Omni Skills are sandbox tools that OmniRoute injects into the model's context on every request. They are executed by OmniRoute, not read by the agent.",
+        "crossLinkLabel": "__MISSING__:Understand the difference →"
+      },
+      "comparison": {
+        "colAgent": "__MISSING__:Agent Skills",
+        "colOmni": "__MISSING__:Omni Skills",
+        "whatIs": {
+          "label": "__MISSING__:What it is",
+          "agent": "__MISSING__:Machine-readable SKILL.md that teaches an external agent to operate OmniRoute",
+          "omni": "__MISSING__:Executable tools that OmniRoute injects as tools into LLM requests"
+        },
+        "direction": {
+          "label": "__MISSING__:Direction",
+          "agent": "__MISSING__:Outbound — external agent learns to control OmniRoute",
+          "omni": "__MISSING__:Inbound — OmniRoute gives tools to models passing through it"
+        },
+        "executor": {
+          "label": "__MISSING__:Executor",
+          "agent": "__MISSING__:External agent (reads markdown → acts via API/CLI)",
+          "omni": "__MISSING__:OmniRoute itself (intercepts tool_calls, Docker sandbox)"
+        },
+        "storage": {
+          "label": "__MISSING__:Storage",
+          "agent": "__MISSING__:Dynamic catalog (/api/agent-skills) → SKILL.md on GitHub",
+          "omni": "__MISSING__:SQLite (SkillsMP / skills.sh / local)"
+        },
+        "tagline": {
+          "label": "__MISSING__:Tagline",
+          "agent": "__MISSING__:Teach your agent to use OmniRoute",
+          "omni": "__MISSING__:Give executable tools to OmniRoute models"
+        }
+      }
+    },
+    "filters": {
+      "category": "__MISSING__:Category",
+      "area": "__MISSING__:Area",
+      "searchPlaceholder": "__MISSING__:Search skills…"
+    },
+    "categoryApi": "__MISSING__:API",
+    "categoryCli": "__MISSING__:CLI",
+    "categoryConfig": "__MISSING__:Config",
+    "filterAll": "__MISSING__:All",
+    "coverageLabel": "__MISSING__:Coverage",
+    "mcpUrl": "__MISSING__:MCP URL",
+    "a2aLink": "__MISSING__:A2A",
+    "copyUrl": "__MISSING__:Copy URL",
+    "viewOnGithub": "__MISSING__:View on GitHub",
+    "previewLoading": "__MISSING__:Loading skill documentation…",
+    "previewError": "__MISSING__:Failed to load skill documentation.",
+    "previewEmpty": "__MISSING__:Select a skill to preview its documentation.",
+    "generateButton": "__MISSING__:Generate missing skills",
+    "coverageBar": {
+      "complete": "__MISSING__:Complete",
+      "partial": "__MISSING__:Partial"
+    },
+    "noSkillsFound": "__MISSING__:No skills found matching your filters.",
+    "regenerateConfirm": "__MISSING__:This will regenerate all missing SKILL.md files. Continue?",
+    "regenerateRunning": "__MISSING__:Regenerating skills…",
+    "regenerateSuccess": "__MISSING__:Skills regenerated successfully.",
+    "regenerateError": "__MISSING__:Failed to regenerate skills."
+  },
+  "freeProviderRankingsPage": {
+    "title": "__MISSING__:Free Provider Rankings",
+    "subtitle": "__MISSING__:Best free providers ranked by model ELO scores from Arena AI leaderboards",
+    "loading": "__MISSING__:Loading rankings...",
+    "errorLoading": "__MISSING__:Failed to load rankings",
+    "emptyState": "__MISSING__:No rankings available yet. Arena ELO data syncs on startup (daily) — check back shortly, or trigger a manual sync. Disable Arena ELO Sync in Feature Flags or set ARENA_ELO_SYNC_ENABLED=false to opt out.",
+    "bestModel": "__MISSING__:Best",
+    "allCategories": "__MISSING__:All Categories",
+    "categoryDefault": "__MISSING__:Default",
+    "categoryCoding": "__MISSING__:Coding",
+    "categoryReview": "__MISSING__:Review",
+    "categoryDocumentation": "__MISSING__:Documentation",
+    "categoryDebugging": "__MISSING__:Debugging",
+    "colRank": "__MISSING__:Rank",
+    "colProvider": "__MISSING__:Provider",
+    "colTopModel": "__MISSING__:Top Model",
+    "colScore": "__MISSING__:Score",
+    "colAvgScore": "__MISSING__:Avg Score",
+    "colModels": "__MISSING__:Models",
+    "colType": "__MISSING__:Type"
   }
 }
diff --git a/src/i18n/messages/phi.json b/src/i18n/messages/phi.json
index dbc66fba32..bfbd8a02d2 100644
--- a/src/i18n/messages/phi.json
+++ b/src/i18n/messages/phi.json
@@ -393,6 +393,7 @@
     "cloudBenefitAccess": "Cloud Benefit Access",
     "maxRetries": "Max Retries",
     "queueTimeout": "Queue Timeout",
+    "queueDepth": "__MISSING__:Queue Depth",
     "addProvider": "Add Provider",
     "realtime": "Realtime",
     "totalTranslations": "Total Translations",
@@ -709,6 +710,7 @@
     "batchFilesListFilesTable": "Mga file",
     "batchPageLoadingMore": "Naglo-load ng higit pa…",
     "recommended": "__MISSING__:Recommended",
+    "understand": "__MISSING__:I understand",
     "batchConceptTitle": "Batch processing",
     "batchConceptSubtitle": "Process thousands of requests asynchronously at ~50% of the cost (24h window). Ideal for evaluations, classification, and embeddings.",
     "batchConceptHowItWorks": "How it works",
@@ -773,36 +775,13 @@
     "filesListUploadButton": "Upload",
     "filesListUsedByColumn": "Used by",
     "filesListUsedByNone": "None",
-    "filesListDelete": "Delete",
-    "filesListDownload": "Download",
-    "batchDetailActionCancel": "Cancel batch",
-    "batchDetailActionRetry": "Retry failed requests",
-    "batchDetailCancelling": "Cancelling…",
-    "batchDetailRetrying": "Preparing retry…",
-    "batchDetailCancelConfirm": "Cancel this batch? In-progress requests will stop.",
-    "batchActionCancelError": "Failed to cancel batch. Try again.",
-    "batchActionRetryError": "Failed to retry failed requests. Try again.",
-    "batchConceptRetentionNote": "Results and error files are retained for 30 days (Anthropic: 29 days)",
     "filesListUsedByRoleInput": "input",
     "filesListUsedByRoleOutput": "output",
     "filesListUsedByRoleError": "error",
-    "batchListProgressPartial": "(partial)",
     "filesListSizeColumn": "Size",
+    "batchListProgressPartial": "(partial)",
     "batchListProviderColumn": "Provider",
     "batchListProviderUnknown": "—",
-    "batchListBatchCreated": "Batch {id} created — refreshing list…",
-    "batchListBatchCreatedDismiss": "Dismiss",
-    "batchListRefreshing": "Refreshing…",
-    "batchListRefresh": "Refresh",
-    "uploadFileModalRemove": "Remove",
-    "uploadFileModalUploading": "Uploading…",
-    "wizardInputReading": "Reading file…",
-    "wizardInputReady": "Ready",
-    "wizardInputLargeFileLabel": "Large file — sampling validation",
-    "wizardInputCsvJsonlReady": "JSONL generated — ready to validate.",
-    "wizardInputLargeFileWarning": "Large file detected — validation runs by sampling (first 5 MB + last 100 KB). Full validation happens server-side.",
-    "wizardCostWindow24h": "24h completion window",
-    "wizardValidationFieldsOk": "required fields valid",
     "batchListProviderOther": "Other",
     "batchListTitle": "Batches",
     "batchListCount": "{count} batches",
@@ -839,8 +818,33 @@
     "wizardCostWindow": "Window",
     "wizardDestinationSelectProvider": "Select a provider…",
     "wizardDestinationSelectModel": "Select a model…",
-    "wizardDestinationConnectProvider": "Connect a provider"
+    "wizardDestinationConnectProvider": "Connect a provider",
+    "batchListBatchCreated": "Batch {id} created — refreshing list…",
+    "batchListBatchCreatedDismiss": "Dismiss",
+    "batchListRefreshing": "Refreshing…",
+    "batchListRefresh": "Refresh",
+    "uploadFileModalRemove": "Remove",
+    "uploadFileModalUploading": "Uploading…",
+    "wizardInputReading": "Reading file…",
+    "wizardInputReady": "Ready",
+    "wizardInputLargeFileLabel": "Large file — sampling validation",
+    "wizardInputCsvJsonlReady": "JSONL generated — ready to validate.",
+    "wizardInputLargeFileWarning": "Large file detected — validation runs by sampling (first 5 MB + last 100 KB). Full validation happens server-side.",
+    "wizardCostWindow24h": "24h completion window",
+    "wizardValidationFieldsOk": "required fields valid",
+    "filesListDelete": "Delete",
+    "filesListDownload": "Download",
+    "batchDetailActionCancel": "Cancel batch",
+    "batchDetailActionRetry": "Retry failed requests",
+    "batchDetailCancelling": "Cancelling…",
+    "batchDetailRetrying": "Preparing retry…",
+    "batchDetailCancelConfirm": "Cancel this batch? In-progress requests will stop.",
+    "batchActionCancelError": "Failed to cancel batch. Try again.",
+    "batchActionRetryError": "Failed to retry failed requests. Try again.",
+    "batchConceptRetentionNote": "Results and error files are retained for 30 days (Anthropic: 29 days)"
   },
+  "featureFlagOmnirouteEmergencyFallbackDescription": "__MISSING__:Route budget-exhausted requests to the emergency free fallback provider/model.",
+  "featureFlagArenaEloSyncEnabledDescription": "__MISSING__:Enable periodic Arena AI leaderboard ELO sync for model intelligence rankings.",
   "sidebar": {
     "home": "Bahay",
     "dashboard": "Dashboard",
@@ -968,6 +972,7 @@
     "aiFeaturesSection": "AI Features",
     "mcp": "MCP",
     "a2a": "A2A",
+    "plugins": "__MISSING__:Plugins",
     "apiEndpoints": "API Endpoints",
     "batchFiles": "Files",
     "analyticsEvals": "Evals",
@@ -976,6 +981,10 @@
     "analyticsComboHealth": "Combo Health",
     "analyticsCompression": "Compression",
     "costsBudget": "Budget",
+    "costsFreeTiers": "__MISSING__:Free-Tier Budget",
+    "costsFreeTiersSubtitle": "__MISSING__:Monthly free-token allowances",
+    "freeProviderRankings": "__MISSING__:Free Provider Rankings",
+    "freeProviderRankingsSubtitle": "__MISSING__:Best free providers ranked by model ELO scores",
     "costsQuotaShare": "Quota Sharing",
     "costsPricing": "Pricing",
     "logsProxy": "Proxy Logs",
@@ -987,10 +996,12 @@
     "settingsAppearance": "Appearance",
     "settingsAi": "AI Settings",
     "settingsSecurity": "Security",
+    "settingsAccessTokens": "__MISSING__:Access Tokens",
     "settingsFeatureFlags": "Mga Flag ng Tampok",
     "settingsAuthz": "__MISSING__:Authz",
     "settingsRouting": "Routing",
     "settingsResilience": "Resilience",
+    "modelLockout": "__MISSING__:Model Lockout",
     "settingsAdvanced": "Advanced",
     "omniProxySection": "OmniProxy",
     "quotaTracker": "Provider Quota",
@@ -1036,6 +1047,8 @@
     "analyticsCompressionSubtitle": "Token savings stats",
     "analyticsSearchSubtitle": "Search tool analytics",
     "analyticsEvalsSubtitle": "Eval suite results",
+    "providerStats": "__MISSING__:Provider Stats",
+    "providerStatsSubtitle": "__MISSING__:Latency and performance metrics",
     "logsSubtitle": "Application logs",
     "logsProxySubtitle": "Proxy traffic logs",
     "consoleLogsSubtitle": "Console output",
@@ -1055,6 +1068,7 @@
     "agentSkillsSubtitle": "A2A skill registry",
     "mcpSubtitle": "MCP server controls",
     "a2aSubtitle": "A2A protocol server",
+    "pluginsSubtitle": "__MISSING__:Plugin marketplace & installs",
     "mediaSubtitle": "Cached media files",
     "batchFilesSubtitle": "Batch input/output files",
     "settingsSubtitle": "All settings",
@@ -1065,13 +1079,41 @@
     "settingsResilienceSubtitle": "Retries and breakers",
     "settingsAdvancedSubtitle": "Power user options",
     "settingsSecuritySubtitle": "Auth and encryption",
+    "settingsAccessTokensSubtitle": "__MISSING__:Scoped CLI tokens for remote mode",
     "settingsFeatureFlagsSubtitle": "I-toggle ang mga kakayahan ng system",
     "settingsSidebar": "Sidebar",
     "settingsSidebarSubtitle": "Customize sidebar layout",
     "settingsAuthzSubtitle": "__MISSING__:Route inventory and bypass policy",
     "docsSubtitle": "Documentation",
     "issuesSubtitle": "Report a bug",
-    "changelogSubtitle": "Release notes"
+    "changelogSubtitle": "Release notes",
+    "costsQuotaPlans": "__MISSING__:Plans & Quotas",
+    "costsQuotaPlansSubtitle": "__MISSING__:Configure plans by provider",
+    "activity": "__MISSING__:Activity",
+    "activitySubtitle": "__MISSING__:Friendly feed of recent events",
+    "logsGroup": "__MISSING__:Logs",
+    "systemGroup": "__MISSING__:System",
+    "costsOverview": "__MISSING__:Overview",
+    "costsOverviewSubtitle": "__MISSING__:Consolidated cost analysis",
+    "agentBridge": "__MISSING__:Agent Bridge",
+    "agentBridgeSubtitle": "__MISSING__:Intercept IDE agent traffic",
+    "trafficInspector": "__MISSING__:Traffic Inspector",
+    "trafficInspectorSubtitle": "__MISSING__:Monitor LLM calls + debug any HTTPS traffic",
+    "cliCode": "__MISSING__:CLI Code",
+    "cliCodeSubtitle": "__MISSING__:Code tools pointing to OmniRoute",
+    "cliAgents": "__MISSING__:CLI Agents",
+    "cliAgentsSubtitle": "__MISSING__:Autonomous CLI agents",
+    "acpAgents": "__MISSING__:ACP Agents",
+    "acpAgentsSubtitle": "__MISSING__:CLIs spawned by OmniRoute",
+    "skipToContent": "__MISSING__:Skip to content",
+    "unpinSection": "__MISSING__:Unpin section",
+    "pinSectionOpen": "__MISSING__:Pin section open",
+    "reloadPage": "__MISSING__:Reload Page",
+    "dragReorderSection": "__MISSING__:Drag to reorder section",
+    "dragReorderItem": "__MISSING__:Drag to reorder",
+    "cannotHide": "__MISSING__:This item cannot be hidden",
+    "alwaysVisible": "__MISSING__:Always visible",
+    "groupSeparatorLabel": "__MISSING__:Separator"
   },
   "webhooks": {
     "title": "Mga Webhook",
@@ -1272,7 +1314,47 @@
     "a2aEvents": "Mga kaganapan",
     "a2aArtifacts": "Mga artifact",
     "a2aNoTasks": "Walang mga gawaing A2A na naitala.",
-    "a2aLoadingTasks": "Nilo-load ang mga gawaing A2A..."
+    "a2aLoadingTasks": "Nilo-load ang mga gawaing A2A...",
+    "actor": "__MISSING__:Actor",
+    "actorPlaceholder": "__MISSING__:Filter by actor",
+    "eventTypes": {
+      "apiKey.activate": "__MISSING__:API Key Activated",
+      "apiKey.ban": "__MISSING__:API Key Banned",
+      "apiKey.deactivate": "__MISSING__:API Key Deactivated",
+      "apiKey.regenerate": "__MISSING__:API Key Regenerated",
+      "apiKey.scopes.grant": "__MISSING__:API Key Scopes Granted",
+      "apiKey.scopes.revoke": "__MISSING__:API Key Scopes Revoked",
+      "apiKey.scopes.update": "__MISSING__:API Key Scopes Updated",
+      "apiKey.unban": "__MISSING__:API Key Unbanned",
+      "auth.login.error": "__MISSING__:Login Error",
+      "auth.login.failed": "__MISSING__:Login Failed",
+      "auth.login.locked": "__MISSING__:Login Locked",
+      "auth.login.misconfigured": "__MISSING__:Login Misconfigured",
+      "auth.login.setup_required": "__MISSING__:Login Setup Required",
+      "auth.login.success": "__MISSING__:Login Success",
+      "auth.logout.success": "__MISSING__:Logout Success",
+      "compliance.cleanup": "__MISSING__:Compliance Cleanup",
+      "provider.credentials.applied": "__MISSING__:Provider Credentials Applied",
+      "provider.credentials.batch_revoked": "__MISSING__:Provider Credentials Batch Revoked",
+      "provider.credentials.bulk_created": "__MISSING__:Provider Credentials Bulk Created",
+      "provider.credentials.bulk_imported": "__MISSING__:Provider Credentials Bulk Imported",
+      "provider.credentials.created": "__MISSING__:Provider Credentials Created",
+      "provider.credentials.imported": "__MISSING__:Provider Credentials Imported",
+      "provider.credentials.revoked": "__MISSING__:Provider Credentials Revoked",
+      "provider.credentials.updated": "__MISSING__:Provider Credentials Updated",
+      "provider.validation.ssrf_blocked": "__MISSING__:Provider SSRF Blocked",
+      "quota.plan.updated": "__MISSING__:Quota Plan Updated",
+      "quota.pool.created": "__MISSING__:Quota Pool Created",
+      "quota.pool.deleted": "__MISSING__:Quota Pool Deleted",
+      "quota.pool.updated": "__MISSING__:Quota Pool Updated",
+      "quota.store.driver_changed": "__MISSING__:Quota Store Driver Changed",
+      "server.start": "__MISSING__:Server Start",
+      "service.reveal_api_key": "__MISSING__:Service API Key Revealed",
+      "settings.update": "__MISSING__:Settings Updated",
+      "settings.update_failed": "__MISSING__:Settings Update Failed",
+      "sync.token.created": "__MISSING__:Sync Token Created",
+      "sync.token.revoked": "__MISSING__:Sync Token Revoked"
+    }
   },
   "themesPage": {
     "title": "Themes",
@@ -1381,7 +1463,8 @@
     "settingsResilienceDescription": "Circuit breaker, retry, and fallback configuration",
     "settingsAdvancedDescription": "Advanced payload rules, request limits, and proxy API settings",
     "mitmProxyDescription": "Configure MITM proxy settings for traffic inspection and debugging",
-    "oneProxyDescription": "Configure 1Proxy settings for advanced proxy chaining"
+    "oneProxyDescription": "Configure 1Proxy settings for advanced proxy chaining",
+    "omniSkillsDescription": "__MISSING__:Install and manage sandbox skills for automated prompt and tool execution"
   },
   "home": {
     "quickStart": "Mabilis na Pagsisimula",
@@ -1612,16 +1695,24 @@
     "ownUsageVisibilityDesc": "Payagan ang key na ito na tawagin ang status endpoint nito para sa sarili nitong USD usage, budget percent, at token totals.",
     "sharedAccountQuotaVisibility": "Shared account quota",
     "sharedAccountQuotaVisibilityDesc": "Payagan ang key na ito na makita ang shared upstream account quota kapag may isang explicit connection na naka-configure.",
+    "localUsageCommand": "__MISSING__:Allow local usage command",
+    "localUsageCommandDesc": "__MISSING__:Allows this API key to use @@om-usage to retrieve cached usage and quota information without calling an upstream provider.",
+    "localUsageCommandBadge": "__MISSING__:Usage cmd",
     "keyCreated": "Nagawa ang API Key",
     "keyCreatedSuccess": "Matagumpay na nagawa ang susi!",
     "keyCreatedNote": "Kopyahin at iimbak ang key na ito ngayon — hindi na ito muling ipapakita.",
     "done": "Tapos na",
     "savePermissions": "I-save ang Mga Pahintulot",
-    "endpointRestrictions": "__MISSING__:Allowed Endpoints",
-    "allEndpointsAllowed": "__MISSING__:This key can access all API endpoints.",
-    "endpointsRestricted": "__MISSING__:Restricted to {count} endpoint{count, plural, one {} other {s}}.",
+    "endpointRestrictions": "Allowed Endpoints",
+    "allEndpointsAllowed": "This key can access all API endpoints.",
+    "endpointsRestricted": "Restricted to {count} endpoint{count, plural, one {} other {s}}.",
     "autoResolve": "Auto-Resolve",
     "autoResolveDesc": "Auto-resolve ambiguous model names to native provider for this API key.",
+    "streamDefaultMode": "__MISSING__:Stream Default Compatibility",
+    "streamDefaultModeDesc": "__MISSING__:Controls omitted `stream` flags for this key. JSON mode returns non-streaming responses unless the client explicitly requests SSE.",
+    "streamDefaultLegacy": "__MISSING__:Legacy",
+    "streamDefaultJson": "__MISSING__:JSON Compatible",
+    "streamDefaultBadge": "__MISSING__:JSON stream default",
     "keyActive": "Key Active",
     "keyActiveDesc": "Enable or disable this API key. Disabled keys are immediately rejected with 403.",
     "accessSchedule": "Access Schedule",
@@ -1667,6 +1758,7 @@
     "keyOnlyAvailableAtCreation": "Full key available only at creation time — copy it when you first create the key",
     "modelsCount": "{count, plural, one {# model} other {# models}}",
     "lastUsedOn": "Huli: {date}",
+    "viewCostsFor": "__MISSING__:View costs for {name}",
     "editPermissions": "I-edit ang mga pahintulot",
     "deleteKey": "Tanggalin ang susi",
     "regenerateKey": "I-regenerate ang susi",
@@ -1708,9 +1800,12 @@
     "shownOf": "__MISSING__:{shown} of {total} shown",
     "emptyFilterTitle": "__MISSING__:No keys match your filters",
     "emptyFilterClear": "__MISSING__:Clear filters",
-    "endpointRestrictions": "Allowed Endpoints",
-    "allEndpointsAllowed": "This key can access all API endpoints.",
-    "endpointsRestricted": "Restricted to {count} endpoint{count, plural, one {} other {s}}."
+    "disableNonPublicModels": "__MISSING__:Disable Non-Public Models",
+    "disableNonPublicModelsDesc": "__MISSING__:Reject requests for models that are not discovered or not marked as public in the provider catalog",
+    "normalKeysSection": "__MISSING__:Normal keys",
+    "quotaKeysSection": "__MISSING__:Quota keys",
+    "quotaPill": "__MISSING__:QUOTA",
+    "quotaModeOnly": "__MISSING__:qtSd-only"
   },
   "auditLog": {
     "title": "Log ng Audit",
@@ -1845,6 +1940,8 @@
     "freeQuota": "Free quota/mo",
     "scrapeUrl": "URL to scrape",
     "scrapeUrlPlaceholder": "https://example.com",
+    "scrapeUrlRequired": "__MISSING__:URL is required",
+    "scrapeUrlInvalid": "__MISSING__:Invalid URL — it must start with http:// or https://",
     "scrapeExtract": "Extract",
     "scrapeExtracting": "Extracting…",
     "scrapeFullPage": "Full page",
@@ -1858,6 +1955,8 @@
     "scrapeMetadata": "Metadata",
     "scrapeProvider": "Provider",
     "scrapeSize": "Size",
+    "scrapeEmptyState": "__MISSING__:Enter a URL to extract its content",
+    "scrapeProvidersAvailable": "__MISSING__:Available providers: Firecrawl, Jina Reader, Tavily.",
     "compareRun": "Compare",
     "compareRunning": "Comparing…",
     "autoProvider": "Auto (cheapest)",
@@ -2245,6 +2344,8 @@
     "leastLatency": "Pinakamababang Latency",
     "comboName": "Pangalan ng Combo",
     "comboNamePlaceholder": "my-combo",
+    "comboDescription": "__MISSING__:Description",
+    "comboDescriptionPlaceholder": "__MISSING__:Optional note describing this combo",
     "deleteConfirm": "I-delete ang combo na ito?",
     "noCombosYet": "Wala pang combos",
     "comboCreated": "Matagumpay na nagawa ang combo",
@@ -2284,6 +2385,8 @@
     "resetAwareDesc": "Binabalanse ang natitirang quota laban sa 5h at lingguhang pag-reset, pagkatapos ay round-robins ang mga katulad na marka",
     "strictRandom": "Strict Random",
     "strictRandomDesc": "Shuffle deck — uses each model once before reshuffling",
+    "fusion": "__MISSING__:Fusion",
+    "fusionDesc": "__MISSING__:Fans the prompt to every panel model in parallel, then a judge model synthesizes one final answer",
     "models": "Mga modelo",
     "autoBalance": "Awtomatikong balanse",
     "advancedSettings": "Mga Advanced na Setting",
@@ -2982,14 +3085,19 @@
     "ngrokStarted": "nagsimula ang ngrok tunnel",
     "ngrokStopped": "huminto ang ngrok tunnel",
     "ngrokRequestFailed": "Nabigong i-update ang ngrok tunnel",
-    "tokenSaverSubtitle": "Gumastos ng mas kaunting mga token sa bawat kahilingan.",
-    "tokenSaverToolOutput": "Output ng tool",
-    "tokenSaverLlmOutput": "LLM na output",
-    "tokenSaverInputCompression": "Input compression",
     "apiEndpointsCatalogUnavailable": "Hindi available ang API catalog",
     "apiEndpointsSearchPlaceholder": "Maghanap ng mga endpoint...",
     "apiEndpointsRequiresAuth": "Nangangailangan ng auth",
     "apiEndpointsNoMatch": "Walang mga endpoint na tumutugma sa iyong filter",
+    "vscodeAliasTitle": "__MISSING__:VS Code Token Alias",
+    "vscodeAliasDescriptionReady": "__MISSING__:Ready-to-paste compatibility URLs using the /api/v1/vscode/TOKEN/... endpoint.",
+    "vscodeAliasDescriptionError": "__MISSING__:Showing placeholder URLs because CLI keys could not be loaded in this session.",
+    "vscodeAliasDescriptionLoading": "__MISSING__:Loading CLI keys. Placeholder URLs are shown until a key is available.",
+    "vscodeAliasDescriptionPlaceholder": "__MISSING__:Showing placeholder URLs. Create or activate an API key in CLI Tools to replace TOKEN.",
+    "vscodeAliasManage": "__MISSING__:CLI Tools",
+    "vscodeAliasBaseLabel": "__MISSING__:VS Code base",
+    "vscodeAliasModelsLabel": "__MISSING__:VS Code models",
+    "vscodeAliasChatLabel": "__MISSING__:VS Code chat",
     "localServer": "Lokal na Server",
     "cloudOmniroute": "Cloud OmniRoute",
     "copyUrl": "Kopyahin ang URL",
@@ -3002,7 +3110,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
@@ -3178,42 +3289,187 @@
     "a2aStep3": "__MISSING__:Track and cancel tasks with {code1} and {code2}."
   },
   "memory": {
-    "title": "Memory Management",
-    "description": "View and manage stored memory entries",
-    "memories": "Memories",
-    "totalEntries": "Total Entries",
-    "tokensUsed": "Tokens Used",
-    "hitRate": "Hit Rate",
-    "loading": "Loading memories...",
-    "noMemories": "No memories found",
-    "search": "Search memories...",
-    "allTypes": "All Types",
-    "export": "Export",
-    "import": "Import",
-    "addMemory": "Add Memory",
-    "type": "Type",
-    "key": "Key",
-    "content": "Content",
-    "created": "Created",
-    "actions": "Actions",
-    "delete": "Delete",
-    "factual": "Factual",
-    "episodic": "Episodic",
-    "procedural": "Procedural",
-    "semantic": "Semantic",
     "a": "A",
-    "pipelineOk": "Pipeline OK ({latencyMs}ms)",
-    "pipelineError": "Error sa pipeline",
-    "healthUnknown": "Hindi alam ang kalusugan",
-    "checkingHealth": "Sinusuri…",
-    "checkHealth": "Suriin ang kalusugan",
-    "pageInfo": "Pahina {page} ng {totalPages} ({total} kabuuan)",
-    "previous": "Nakaraang",
-    "next": "Susunod",
+    "actions": "Actions",
+    "addMemory": "Add Memory",
+    "allTypes": "All Types",
     "cancel": "Kanselahin",
-    "save": "I-save",
+    "checkHealth": "Suriin ang kalusugan",
+    "checkingHealth": "Sinusuri…",
+    "compactOld": "__MISSING__:Compact old",
+    "concept": {
+      "title": "__MISSING__:Conversational Memory",
+      "description": "__MISSING__:OmniRoute learns from every conversation, remembering facts, episodes, procedures, and semantic concepts that make responses more accurate and context-aware.",
+      "howWorksToggle": "__MISSING__:How it works",
+      "howWorksContent": "__MISSING__:1. Automatic extraction: at the end of each response, facts and episodes are detected and saved automatically.\n2. Retrieval: before each response, the most relevant memories are searched via FTS5 (exact), vector (semantic), or hybrid RRF.\n3. Injection: relevant memories are injected into the assistant context to improve response quality.\n4. Management: use this page to view, edit, export, and compact old memories."
+    },
+    "content": "Content",
+    "contentPlaceholder": "Halaga o nilalaman ng JSON na dapat tandaan",
+    "created": "Created",
+    "delete": "Delete",
+    "deleteConfirmDesc": "__MISSING__:This action cannot be undone. The memory will be permanently removed.",
+    "deleteConfirmTitle": "__MISSING__:Delete memory?",
+    "description": "View and manage stored memory entries",
+    "editMemory": "__MISSING__:Edit memory",
+    "editModal": {
+      "title": "__MISSING__:Edit Memory",
+      "metadataLabel": "__MISSING__:Metadata (JSON)",
+      "metadataInvalid": "__MISSING__:Invalid JSON",
+      "saveFailed": "__MISSING__:Failed to save memory"
+    },
+    "embedding": {
+      "autoLabel": "__MISSING__:Automatic",
+      "autoDesc": "__MISSING__:Uses best available: remote provider > static > transformers",
+      "remoteLabel": "__MISSING__:Remote provider",
+      "remoteDesc": "__MISSING__:Uses embedding via provider API (requires API key)",
+      "staticLabel": "__MISSING__:Static local (potion)",
+      "staticDesc": "__MISSING__:Local embedding without WASM or external dependencies",
+      "transformersLabel": "__MISSING__:Transformers.js (MiniLM)",
+      "transformersDesc": "__MISSING__:Local embedding via @huggingface/transformers (~400MB RAM)",
+      "providerModelLabel": "__MISSING__:Provider / Model",
+      "noRemoteProviders": "__MISSING__:No providers with configured API key",
+      "selectProviderModel": "__MISSING__:Select a model",
+      "staticEnabledLabel": "__MISSING__:Enable Static Potion",
+      "staticEnabledDesc": "__MISSING__:Download and use potion-base-8M model locally",
+      "transformersEnabledLabel": "__MISSING__:Enable Transformers.js",
+      "transformersEnabledDesc": "__MISSING__:Opt-in for local MiniLM (~400MB RAM, ~3s cold start)",
+      "transformersWarning": "__MISSING__:Requires ~400MB RAM and ~3s cold start on the first semantic query."
+    },
+    "emptyState": {
+      "title": "__MISSING__:No memories yet",
+      "description": "__MISSING__:Memories are created automatically from conversations. You can also add them manually using the button above."
+    },
+    "engine": {
+      "statusTitle": "__MISSING__:Engine Status",
+      "embeddingTitle": "__MISSING__:Embedding Source",
+      "rerankTitle": "__MISSING__:Rerank (optional)",
+      "reindexNow": "__MISSING__:Reindex now",
+      "reindexStarted": "__MISSING__:Reindexing started ({pending} pending)",
+      "reindexFailed": "__MISSING__:Failed to start reindexing",
+      "keywordLabel": "__MISSING__:Keyword (FTS5)",
+      "keywordReason": "__MISSING__:Keyword search always available",
+      "embeddingLabel": "__MISSING__:Embedding",
+      "vectorStoreLabel": "__MISSING__:Vector Store",
+      "qdrantLabel": "__MISSING__:Qdrant",
+      "rerankLabel": "__MISSING__:Rerank",
+      "qdrantDisabled": "__MISSING__:Disabled",
+      "qdrantOk": "__MISSING__:Healthy ({latencyMs}ms)",
+      "qdrantError": "__MISSING__:Connection error",
+      "needsReindex": "__MISSING__:{count} memory(ies) need reindexing",
+      "configureCta": "__MISSING__:Configure",
+      "vectorStoreInstallHint": "__MISSING__:To enable vector search: npm install sqlite-vec (needs native Node.js, not WASM), then restart."
+    },
+    "episodic": "Episodic",
+    "export": "Export",
+    "factual": "Factual",
+    "healthUnknown": "Hindi alam ang kalusugan",
+    "hitRate": "Hit Rate",
+    "import": "Import",
+    "importError": "__MISSING__:Failed to import file",
+    "importResult": "__MISSING__:{imported} imported, {skipped} skipped",
+    "key": "Key",
     "keyPlaceholder": "hal. user.preferences.theme",
-    "contentPlaceholder": "Halaga o nilalaman ng JSON na dapat tandaan"
+    "loading": "Loading memories...",
+    "memories": "Memories",
+    "next": "Susunod",
+    "noMemories": "No memories found",
+    "pageInfo": "Pahina {page} ng {totalPages} ({total} kabuuan)",
+    "pipelineError": "Error sa pipeline",
+    "pipelineOk": "Pipeline OK ({latencyMs}ms)",
+    "playground": {
+      "infoTitle": "__MISSING__:Memory Playground",
+      "infoDesc": "__MISSING__:Simulate what would be retrieved for a given query. No memories are modified — read-only preview.",
+      "queryLabel": "__MISSING__:Test query",
+      "queryPlaceholder": "__MISSING__:Type a question or test phrase...",
+      "strategyLabel": "__MISSING__:Strategy",
+      "strategyExact": "__MISSING__:Exact (FTS5)",
+      "strategySemantic": "__MISSING__:Semantic (vector)",
+      "strategyHybrid": "__MISSING__:Hybrid (RRF)",
+      "budgetLabel": "__MISSING__:Budget (tokens)",
+      "simulate": "__MISSING__:Simulate",
+      "resultsTitle": "__MISSING__:{count} result(s)",
+      "resolutionTitle": "__MISSING__:Search resolution",
+      "resolutionEmbedding": "__MISSING__:Embedding",
+      "resolutionStore": "__MISSING__:Vector store",
+      "resolutionStrategy": "__MISSING__:Strategy used",
+      "rerankApplied": "__MISSING__:Rerank applied",
+      "fallback": "__MISSING__:Fallback",
+      "noResults": "__MISSING__:No memories found for this query.",
+      "tokensUsed": "__MISSING__:tokens used",
+      "none": "__MISSING__:none",
+      "errorFetch": "__MISSING__:Failed to fetch preview"
+    },
+    "previous": "Nakaraang",
+    "procedural": "Procedural",
+    "qdrant": {
+      "title": "__MISSING__:Qdrant (Vector Store Tier 2)",
+      "description": "__MISSING__:Optional Qdrant integration for scalable semantic search",
+      "enableLabel": "__MISSING__:Enable Qdrant",
+      "enableDesc": "__MISSING__:When enabled, Qdrant is used as the primary vector store",
+      "testConnection": "__MISSING__:Test connection",
+      "testing": "__MISSING__:Testing...",
+      "statusActive": "__MISSING__:Active",
+      "statusError": "__MISSING__:Error",
+      "statusDisabled": "__MISSING__:Disabled",
+      "healthOk": "__MISSING__:Connection OK ({latencyMs}ms)",
+      "healthError": "__MISSING__:Connection error",
+      "saved": "__MISSING__:Settings saved",
+      "saveError": "__MISSING__:Failed to save",
+      "portLabel": "__MISSING__:Port",
+      "embeddingModelLabel": "__MISSING__:Embedding Model",
+      "optional": "__MISSING__:optional",
+      "apiKeyKeepPlaceholder": "__MISSING__:Leave blank to keep current key",
+      "apiKeyOptional": "__MISSING__:Leave blank if not using authentication",
+      "removeApiKey": "__MISSING__:Remove",
+      "quickSelectModel": "__MISSING__:Quick select",
+      "searchTestTitle": "__MISSING__:Semantic search test",
+      "searchPlaceholder": "__MISSING__:Type a test query...",
+      "searching": "__MISSING__:Searching...",
+      "search": "__MISSING__:Search",
+      "cleanupTitle": "__MISSING__:Clean up old points",
+      "cleanupDesc": "__MISSING__:Remove Qdrant points for expired memories (retention period).",
+      "cleaning": "__MISSING__:Cleaning...",
+      "cleanNow": "__MISSING__:Clean now",
+      "cleanupSuccess": "__MISSING__:{count} point(s) removed",
+      "cleanupFailed": "__MISSING__:Cleanup failed"
+    },
+    "rerank": {
+      "enableLabel": "__MISSING__:Enable Rerank",
+      "enableDesc": "__MISSING__:Reorders results with a reranking model after search",
+      "warning": "__MISSING__:Rerank adds +200-500ms latency and additional cost per request. Use sparingly.",
+      "providerModelLabel": "__MISSING__:Rerank Provider / Model",
+      "noProviderWithKey": "__MISSING__:No provider with configured API key. Configure a provider to use rerank.",
+      "selectProviderModel": "__MISSING__:Select a provider/model"
+    },
+    "save": "I-save",
+    "saving": "__MISSING__:Saving...",
+    "search": "Search memories...",
+    "semantic": "Semantic",
+    "summarize": {
+      "title": "__MISSING__:Compact old memories",
+      "noCandidates": "__MISSING__:No memories eligible for compaction (criteria: >30 days old).",
+      "candidatesDesc": "__MISSING__:{count} memories will be compacted into summaries. This action cannot be undone.",
+      "confirm": "__MISSING__:Compact now"
+    },
+    "tabs": {
+      "memories": "__MISSING__:Memories",
+      "playground": "__MISSING__:Playground",
+      "engine": "__MISSING__:Engine"
+    },
+    "title": "Memory Management",
+    "tokensUsed": "Tokens Used",
+    "tooltip": {
+      "totalEntries": "__MISSING__:Total memories stored for this API key",
+      "tokensUsed": "__MISSING__:Estimated total tokens occupied by active memories",
+      "hitRate": "__MISSING__:Read-by-ID cache hit rate (not semantic recall accuracy)",
+      "factual": "__MISSING__:Objective, permanent facts from user context",
+      "episodic": "__MISSING__:Events and experiences from conversation history",
+      "procedural": "__MISSING__:Procedures, workflows, and instructions the assistant should follow",
+      "semantic": "__MISSING__:Concepts, preferences, and domain knowledge"
+    },
+    "totalEntries": "Total Entries",
+    "type": "Type",
+    "memoryEnabled": "__MISSING__:Memory enabled"
   },
   "skills": {
     "title": "Skills",
@@ -3544,6 +3800,14 @@
     "export": "Export",
     "exporting": "Exporting...",
     "exportFailed": "Export failed",
+    "cleanHistoryButton": "__MISSING__:Clean history",
+    "cleanHistoryTitle": "__MISSING__:Clean log history?",
+    "cleanHistoryMessage": "__MISSING__:This permanently clears all request log rows, legacy detail rows, and local artifact files under DATA_DIR/call_logs. The live page will refresh after cleanup.",
+    "cleanHistoryConfirm": "__MISSING__:Clean history",
+    "cleanHistoryCancel": "__MISSING__:Cancel",
+    "cleanHistorySuccess": "__MISSING__:Cleaned {deleted} log entries, {deletedArtifacts} artifacts, and {deletedDetailedLogs} legacy detail rows.",
+    "cleanHistoryEmpty": "__MISSING__:No request log history was found.",
+    "cleanHistoryFailed": "__MISSING__:Failed to clean log history.",
     "timeRange": "Time Range",
     "lastNHours": "Last {hours}",
     "defaultRange": "default",
@@ -3551,10 +3815,14 @@
       "fetchFailed": "Failed to fetch logs",
       "copyFailed": "Failed to copy log entry",
       "copyLogEntry": "Copy log entry"
-    }
+    },
+    "compressionLogTitle": "__MISSING__:Compression Log",
+    "compressionLogEmpty": "__MISSING__:No compressed requests yet. Compression stats will appear here when requests are processed with compression enabled.",
+    "tokens": "__MISSING__:tokens"
   },
   "onboarding": {
     "welcome": "Maligayang pagdating",
+    "tiers": "__MISSING__:Tiers",
     "security": "Seguridad",
     "test": "Pagsubok",
     "ready": "handa na!",
@@ -3616,6 +3884,7 @@
   },
   "providers": {
     "title": "Mga provider",
+    "Account Deactivated": "__MISSING__:Account Deactivated",
     "allProviders": "Lahat ng Provider",
     "audioProviders": "Mga Tagapagbigay ng Audio",
     "showFreeOnly": "Libre lang",
@@ -3623,6 +3892,33 @@
     "addFirstProvider": "Idagdag ang iyong unang provider",
     "addFirstProviderDesc": "Ikonekta ang isang AI provider para simulan ang pagruruta ng mga kahilingan sa pamamagitan ng OmniRoute. Maaari kang gumamit ng mga libreng provider, API key, o OAuth account.",
     "learnMore": "Matuto pa",
+    "adaptaTutorial": {
+      "title": "__MISSING__:How to connect Adapta Web",
+      "introPrefix": "__MISSING__:Adapta authenticates through Clerk. The token",
+      "introSuffix": "__MISSING__:is a long-lived JWT that lets OmniRoute refresh sessions automatically.",
+      "or": "__MISSING__:or",
+      "step1Title": "__MISSING__:Open Adapta chat",
+      "step1DescPrefix": "__MISSING__:Open",
+      "step1DescSuffix": "__MISSING__:and sign in with your Gold or Business account.",
+      "step2Title": "__MISSING__:Open DevTools",
+      "step2DescPrefix": "__MISSING__:Press",
+      "step2DescSuffix": "__MISSING__:to open Developer Tools.",
+      "step3Title": "__MISSING__:Go to Application → Cookies",
+      "step3DescPrefix": "__MISSING__:In the",
+      "step3DescMiddle": "__MISSING__:expand",
+      "step3DescSuffix": "__MISSING__:and click",
+      "step4Title": "__MISSING__:Copy the cookie value for",
+      "step4DescPrefix": "__MISSING__:Find the cookie named",
+      "step4DescMiddle": "__MISSING__:in the list. Click it and copy the content from the",
+      "step4DescSuffix": "__MISSING__:column. It starts with",
+      "step5Title": "__MISSING__:Paste it here and save",
+      "step5DescPrefix": "__MISSING__:Click",
+      "step5DescMiddle": "__MISSING__:paste the",
+      "step5DescSuffix": "__MISSING__:value into the API Key field, then save. OmniRoute will refresh the session automatically.",
+      "tipLabel": "__MISSING__:Tip:",
+      "tipPrefix": "__MISSING__:The",
+      "tipSuffix": "__MISSING__:cookie is long-lived, usually for months. You only need to renew it if you sign out or Adapta invalidates the session."
+    },
     "editProvider": "I-edit ang Provider",
     "deleteProvider": "Tanggalin ang Provider",
     "noProviders": "Walang mga provider na na-configure",
@@ -3648,13 +3944,38 @@
     "apiKeyProviders": "Mga API Key Provider",
     "compatibleProviders": "Mga Katugmang Provider ng API Key",
     "testAll": "Subukan ang Lahat",
+    "distributeProxies": "__MISSING__:Distribute Proxies",
+    "distributing": "__MISSING__:Distributing...",
+    "selectedCount": "__MISSING__:{count, plural, one {# selected} other {# selected}}",
+    "accountsCount": "__MISSING__:{count, plural, one {# account} other {# accounts}}",
     "testAllOAuth": "Subukan ang lahat ng OAuth na koneksyon",
     "testAllFree": "Subukan ang lahat ng Libreng koneksyon",
     "testAllApiKey": "Subukan ang lahat ng koneksyon sa API Key",
     "testAllCompatible": "Subukan ang lahat ng Mga katugmang koneksyon",
+    "testAllModels": "__MISSING__:Test all models",
+    "testAllModelsConfirm": "__MISSING__:Test all visible models? Failed models will be hidden if auto-hide is enabled.",
+    "testingAllModels": "__MISSING__:Testing {done}/{total}...",
+    "testAllResults": "__MISSING__:{ok} of {total} models working",
+    "noModelsToTest": "__MISSING__:No models match the current filter",
+    "showAllModels": "__MISSING__:All",
+    "showVisibleOnly": "__MISSING__:Visible only",
+    "freeFilterAll": "__MISSING__:All",
+    "freeFilterFreeOnly": "__MISSING__:Free only",
+    "freeFilterPaidOnly": "__MISSING__:Paid only",
+    "sortFreeFirst": "__MISSING__:Free first",
+    "showHiddenOnly": "__MISSING__:Hidden only",
+    "filterByVisibility": "__MISSING__:Filter by visibility",
+    "autoHideFailed": "__MISSING__:Auto-hide failed models",
+    "autoHideFailedHint": "__MISSING__:When enabled, Test all hides non-transient failures from public catalogs such as /v1/models. Single-model tests never auto-hide.",
     "connected": "{count} Nakakonekta",
     "errorCount": "{count} Error ({code})",
     "errorCountNoCode": "{count} Error",
+    "testAllCompleted": "__MISSING__:Tested {total} models: {ok} OK, {failed} failed",
+    "modelAutoHidden": "__MISSING__:Model {model} auto-hidden (test failed)",
+    "filterAll": "__MISSING__:All",
+    "filterVisible": "__MISSING__:Visible only",
+    "filterHidden": "__MISSING__:Hidden only",
+    "modelsHiddenCount": "__MISSING__:{count} hidden",
     "warningCount": "{count} Babala",
     "noConnections": "Walang koneksyon",
     "expiredBadge": "Expired",
@@ -3764,7 +4085,16 @@
     "batchUpdateNone": "__MISSING__:No connections were updated (they may no longer exist)",
     "batchRetestLimit": "__MISSING__:Retest up to {max} connections at a time",
     "noConnectionsToTest": "__MISSING__:No matching connections to test",
+    "batchDeleteConfirmTitle": "__MISSING__:Delete connections",
+    "batchDeleteConfirmButton": "__MISSING__:Delete",
+    "filterActive": "__MISSING__:Active",
+    "filterError": "__MISSING__:Error",
+    "filterBanned": "__MISSING__:Banned",
+    "filterCreditsExhausted": "__MISSING__:Credits Exhausted",
+    "noFilteredConnections": "__MISSING__:No connections match the current filter.",
     "failedSetAlias": "Nabigong itakda ang alias",
+    "setAliasSuccess": "__MISSING__:Alias {alias} set",
+    "deleteAliasSuccess": "__MISSING__:Alias {alias} deleted",
     "failedSaveConnection": "Nabigong i-save ang koneksyon",
     "failedSaveConnectionRetry": "Nabigong i-save ang koneksyon. Pakisubukang muli.",
     "failedRetestConnection": "Nabigong subukang muli ang koneksyon",
@@ -3798,6 +4128,9 @@
     "connectionCount": "{count} (mga) koneksyon",
     "fetchingModels": "Kinukuha ang mga available na modelo...",
     "failedFetchModels": "Nabigong kumuha ng mga modelo",
+    "noFreeModelsFound": "__MISSING__:No free models found for this provider — nothing imported.",
+    "fetchModelsSuccess": "__MISSING__:Found {count} new models",
+    "fetchModelsFailed": "__MISSING__:Could not auto-fetch models (you can retry from settings)",
     "noModelsFound": "Walang nakitang mga modelo",
     "importFailed": "Nabigo ang pag-import",
     "noNewModelsAdded": "Walang naidagdag na mga bagong modelo.",
@@ -3806,6 +4139,10 @@
     "importingModelsTitle": "Pag-import ng mga Modelo",
     "copyModel": "Kopyahin ang modelo",
     "filterModels": "I-filter ang mga modelo…",
+    "testAllRateLimited": "__MISSING__:Rate limit reached, stopped early",
+    "hideFailedAuto": "__MISSING__:Auto-hide failed models",
+    "selectAllModels": "Select all",
+    "hideAllModels": "__MISSING__:Hide all",
     "modelsActive": "aktibo",
     "showModel": "Ipakita ang modelo",
     "hideModel": "Itago ang modelo",
@@ -3814,6 +4151,9 @@
     "rateLimitUnprotected": "Hindi protektado",
     "enableRateLimitProtection": "I-click upang paganahin ang proteksyon sa limitasyon ng rate",
     "disableRateLimitProtection": "I-click upang huwag paganahin ang proteksyon sa limitasyon ng rate",
+    "testAllProgress": "__MISSING__:Tested {done}/{total}",
+    "testAllFailedHidden": "__MISSING__:{count} failed models hidden",
+    "testAllDone": "__MISSING__:All models tested",
     "productionKey": "Susi ng Produksyon",
     "enterNewApiKey": "Maglagay ng bagong API key",
     "codexApplyModalTitle": "Mag-apply sa Local Codex",
@@ -3889,10 +4229,20 @@
     "errorTypeNetworkError": "Error sa network",
     "errorTypeTestUnsupported": "Hindi sinusuportahan ang pagsubok",
     "errorTypeUpstreamError": "Upstream error",
+    "errorTypeCreditsExhausted": "__MISSING__:No credits",
+    "errorTypeBanned": "__MISSING__:403 Banned",
     "proxySourceGlobal": "Global",
     "proxySourceProvider": "Provider",
     "proxySourceKey": "Susi",
     "proxyConfiguredBySource": "Proxy ({source}): {host}",
+    "proxyOn": "__MISSING__:Proxy On",
+    "proxyOff": "__MISSING__:Direct (bypass proxy)",
+    "proxyEnabledTitle": "__MISSING__:Proxy is enabled for this connection",
+    "proxyDisabledTitle": "__MISSING__:Direct connection — bypasses every proxy (including the global proxy) for this connection",
+    "perKeyProxyOn": "__MISSING__:Per-key",
+    "perKeyProxyOff": "__MISSING__:Connection",
+    "perKeyProxyEnabledTitle": "__MISSING__:Per-key proxy assignment enabled for this provider",
+    "perKeyProxyDisabledTitle": "__MISSING__:Per-key proxy assignment disabled for this provider",
     "autoPriority": "Auto: {priority}",
     "proxy": "Proxy",
     "retestAuthentication": "Retest authentication",
@@ -3920,6 +4270,12 @@
     "compatProtocolOpenAI": "OpenAI Chat Completions",
     "compatProtocolOpenAIResponses": "OpenAI Responses API",
     "compatProtocolClaude": "Anthropic Messages",
+    "targetFormatLabel": "__MISSING__:Target Format",
+    "targetFormatHint": "__MISSING__:Override the upstream wire format. Use 'Anthropic Messages' to route OpenAI-compatible providers (e.g. opencode-go) through the /v1/messages endpoint.",
+    "targetFormatAuto": "__MISSING__:Default (auto)",
+    "targetFormatGemini": "__MISSING__:Gemini",
+    "targetFormatGeminiCli": "__MISSING__:Gemini CLI",
+    "targetFormatAntigravity": "__MISSING__:Antigravity",
     "compatUpstreamHeadersLabel": "Extra upstream headers",
     "compatUpstreamHeadersHint": "High-privilege setting — same trust level as editing provider API credentials; only trusted admins should use it. Merged after OmniRoute adds auth from the provider API key. If a custom header uses the same name as an existing one (e.g. Authorization), your value fully replaces the auto-generated header (including the Bearer token) — the upstream only sees what you typed, not the key from settings. Misconfiguration can cause 401 or broken upstream auth. One row per header (e.g. extra Authentication for some gateways). Hover or focus the value to preview. Saves on blur, outside click, or closing this panel.",
     "compatUpstreamHeaderName": "Header name",
@@ -3929,6 +4285,8 @@
     "compatBadgeUpstreamHeaders": "Headers",
     "perModelQuotaLabel": "Per Model Quota Label",
     "perModelQuotaDescription": "Per Model Quota Description",
+    "importFreeModelsOnlyLabel": "__MISSING__:Import only free models",
+    "importFreeModelsOnlyHint": "__MISSING__:When enabled, only this provider's free models are imported. Paid models are skipped.",
     "perModelQuotaToggle": "Toggle ng Quota Bawat Modelo",
     "modelId": "Model ID",
     "customModelPlaceholder": "hal. gpt-4.5-turbo",
@@ -3964,7 +4322,6 @@
     "email": "Email",
     "healthCheckMinutes": "Health Check (min)",
     "healthCheckHint": "Proactive token refresh interval. 0 = hindi pinagana.",
-    "selectAllModels": "Select all",
     "deselectAllModels": "Deselect all",
     "modelsActiveCount": "{active}/{total} active",
     "noModelsMatch": "No models match \"{filter}\"",
@@ -3976,6 +4333,9 @@
     "editCompatibleTitle": "I-edit ang {type} Compatible",
     "compatibleBaseUrlHint": "Root URL of your {type}-compatible API. Use Advanced Settings for custom endpoint paths.",
     "apiKeyForCheck": "API Key (para sa Pagsusuri)",
+    "testModelIdLabel": "__MISSING__:Model ID (optional)",
+    "testModelIdPlaceholder": "__MISSING__:e.g. my-model-id",
+    "testModelIdHint": "__MISSING__:If the provider lacks a /models endpoint, enter a model ID to validate via /chat/completions instead.",
     "compatibleProdPlaceholder": "{type} Compatible (Prod)",
     "tokenRefreshed": "Token refreshed successfully",
     "tokenRefreshFailed": "Token refresh failed",
@@ -4069,6 +4429,19 @@
     "codexAuthApplyFailed": "Failed to apply Codex auth.json locally",
     "codexAuthExported": "Codex auth.json exported",
     "codexAuthExportFailed": "Failed to export Codex auth.json",
+    "codexCliGuideButton": "__MISSING__:Codex CLI Guide",
+    "codexCliGuideTitle": "__MISSING__:Codex CLI Guide",
+    "codexCliGuideLoading": "__MISSING__:Loading guide...",
+    "codexCliGuideLoadFailed": "__MISSING__:Could not load the guide.",
+    "codexExternalLinkButton": "__MISSING__:External Codex link",
+    "codexExternalLinkModalTitle": "__MISSING__:External Codex link",
+    "codexExternalLinkModalDescription": "__MISSING__:Share this single-use link with the person who will authenticate the Codex account. They open it in their own browser, complete the OpenAI login, and the connection is registered here. The link expires in 15 minutes.",
+    "codexExternalLinkGenerating": "__MISSING__:Generating link...",
+    "codexExternalLinkWaiting": "__MISSING__:Waiting for browser authentication. This window refreshes automatically.",
+    "codexExternalLinkCreateFailed": "__MISSING__:Failed to generate the link.",
+    "codexExternalLinkNetworkError": "__MISSING__:Could not contact the server.",
+    "codexExternalLinkConnected": "__MISSING__:Codex account connected through the external link.",
+    "codexExternalLinkExpired": "__MISSING__:The link expired before completion.",
     "importCodexAuth": "Mag-import ng auth",
     "codexImportModalTitle": "Mag-import ng Codex Auth",
     "codexImportTabSingle": "Walang asawa",
@@ -4146,6 +4519,8 @@
     "t3ChatWebCookiePlaceholder": "convex-session-id=abc123...",
     "blockClaudeExtraUsageDescription": "Block Claude Extra Usage Description",
     "blockClaudeExtraUsageLabel": "Block Claude Extra Usage Label",
+    "disableCoolingDescription": "__MISSING__:Skip the transient cooldown so this connection stays eligible even after recoverable errors (terminal states like banned/expired still apply).",
+    "disableCoolingLabel": "__MISSING__:Disable cooldown for this connection",
     "bulkPasteAdded": "{count, plural, one {1 key added} other {# keys added}}",
     "bulkPasteDuplicatesIgnored": "{count, plural, one {1 duplicate skipped} other {# duplicates skipped}}",
     "bulkPasteHint": "Paste one API key per line. Empty lines are ignored and duplicate keys are skipped.",
@@ -4243,6 +4618,17 @@
     "personalAccessTokenLabel": "Personal Access Token Label",
     "qoderPatHint": "Qoder Pat Hint",
     "qoderPatPlaceholder": "Qoder Pat Placeholder",
+    "rateLimitOverridesSection": "__MISSING__:Rate Limit Overrides",
+    "rateLimitOverridesMaxConcurrentHint": "__MISSING__:Max concurrent requests override for this connection. Overrides the account-level cap.",
+    "rateLimitOverridesMaxConcurrentLabel": "__MISSING__:Max Concurrent (Rate Limit)",
+    "rateLimitOverridesMinTimeHint": "__MISSING__:Minimum time (ms) between requests. Overrides the default rate limiter delay.",
+    "rateLimitOverridesMinTimeLabel": "__MISSING__:Min Interval (ms)",
+    "rateLimitOverridesRpmHint": "__MISSING__:Max requests per minute for this connection. Overrides the provider default.",
+    "rateLimitOverridesRpmLabel": "__MISSING__:RPM (Requests/min)",
+    "rateLimitOverridesTpdHint": "__MISSING__:Max tokens per day for this connection. Overrides the provider default.",
+    "rateLimitOverridesTpdLabel": "__MISSING__:TPD (Tokens/day)",
+    "rateLimitOverridesTpmHint": "__MISSING__:Max tokens per minute for this connection. Overrides the provider default.",
+    "rateLimitOverridesTpmLabel": "__MISSING__:TPM (Tokens/min)",
     "refreshOauthTokenTitle": "Refresh Oauth Token Title",
     "regionHint": "Region Hint",
     "regionLabel": "Region Label",
@@ -4257,6 +4643,7 @@
     "searchProvider": "Search Provider",
     "searchProviderDesc": "Search Provider Desc",
     "searchProviders": "Maghanap ng mga provider...",
+    "searchByModel": "__MISSING__:Search by model…",
     "searchProvidersHeading": "Search Providers Heading",
     "searxngBaseUrlHint": "Searxng Base Url Hint",
     "searxngInfo": "Searxng Info",
@@ -4422,7 +4809,21 @@
     "webNoAuthGuideBody": "Hindi kailangan ng {provider} ng API key o cookie. I-save ang koneksyon upang magamit ang libreng web endpoint nito.",
     "webSessionCredentialValidationFailed": "Nabigo ang pagpapatunay ng kredensyal ng session. Mag-sign in muli, kumopya ng bagong kredensyal, at subukang muli.",
     "checkCookie": "Suriin ang cookie",
-    "checkWebToken": "Suriin ang token"
+    "checkWebToken": "Suriin ang token",
+    "huggingchatLabel": "__MISSING__:HuggingChat (Free)",
+    "huggingchatDesc": "__MISSING__:Free LLM chat via huggingface.co/chat",
+    "phindLabel": "__MISSING__:Phind (Free)",
+    "phindDesc": "__MISSING__:Free dev-focused AI chat",
+    "poeWebLabel": "__MISSING__:Poe Web",
+    "poeWebDesc": "__MISSING__:Multi-model chat via poe.com",
+    "veniceWebLabel": "__MISSING__:Venice Web",
+    "veniceWebDesc": "__MISSING__:Privacy-focused AI chat",
+    "v0VercelWebLabel": "__MISSING__:v0 Vercel Web",
+    "v0VercelWebDesc": "__MISSING__:AI code generation via v0.dev",
+    "kimiWebLabel": "__MISSING__:Kimi Web",
+    "kimiWebDesc": "__MISSING__:Chinese market AI chat via kimi.moonshot.cn",
+    "doubaoWebLabel": "__MISSING__:Doubao Web",
+    "doubaoWebDesc": "__MISSING__:ByteDance AI chat via doubao.com"
   },
   "settings": {
     "title": "Mga setting",
@@ -4528,6 +4929,7 @@
     "memoryDesc": "Persistent cross-session conversational memory",
     "memoryEnabled": "Enable Memory",
     "memoryEnabledDesc": "When enabled, OmniRoute will inject relevant past context.",
+    "memoryTokenCostWarning": "__MISSING__:Heads up: with memory enabled, OmniRoute injects up to {tokens} tokens of retrieved context into every chat request — this increases token usage and cost. To skip injection for a specific request, send the \"x-omniroute-no-memory: true\" header.",
     "maxTokens": "Max Tokens",
     "retentionDays": "Retention",
     "recent": "Recent",
@@ -4566,6 +4968,15 @@
     "modelsDevInfoOrder": "User Override → models.dev → LiteLLM → Hardcoded Default",
     "systemTheme": "Tema ng System",
     "debugToggle": "Enable Debug Mode",
+    "homePinProviderQuotaToHome": "Pin Information to Home Page",
+    "homeProviderQuotaLimits": "Provider Quota Limits",
+    "homeProviderQuotaLimitsDesc": "Pin the Provider Quota status container (with Refresh All button) to the top of the Home page.",
+    "homeQuickStart": "Quick Start",
+    "homeQuickStartDesc": "Show the Quick Start panel on the Home page.",
+    "homeProviderTopology": "Provider Topology",
+    "homeProviderTopologyDesc": "Show the Provider Topology on the Home page.",
+    "accountEmailVisibility": "__MISSING__:Account email visibility",
+    "accountEmailVisibilityDesc": "__MISSING__:Show full account emails across providers, combos, logs, quota, and playground screens. Turn this off to mask them by default.",
     "sidebarVisibilityToggle": "Show Sidebar Items",
     "enableCache": "Paganahin ang Cache",
     "cacheTTL": "I-cache ang TTL",
@@ -4599,11 +5010,17 @@
     "autoDisableDescription": "Permanently mark provider connections as deactivated if they return specific terminal ban signals (e.g. HTTP 403 'verify your account'). This removes them from the combo rotation.",
     "autoDisableThreshold": "Ban Threshold",
     "autoDisableThresholdDesc": "Consecutive ban signals required before permanent deactivation.",
+    "customBannedSignals": "__MISSING__:Banned Keywords",
+    "customBannedSignalsDesc": "__MISSING__:Additional keywords that trigger permanent account ban detection. Built-in keywords always apply.",
+    "customBannedSignalsPlaceholder": "__MISSING__:e.g. api key revoked",
+    "noCustomBannedSignals": "__MISSING__:No custom keywords. Only built-in keywords are active.",
     "resilienceStructureTitle": "Resilience Structure",
     "resilienceStructureDesc": "Kino-configure lang ng page na ito ang gawi. Ang estado ng live breaker ay ipinapakita sa pahina ng Kalusugan. Nananatili sa mga setting ng combo na partikular sa combo at kontrol ng round-robin slot.",
     "enableThinking": "Paganahin ang Pag-iisip",
     "maxThinkingTokens": "Max Thinking Token",
     "enableProxy": "Paganahin ang Proxy",
+    "perKeyProxyEnabled": "__MISSING__:Enable per-key proxy assignment",
+    "perKeyProxyEnabledDesc": "__MISSING__:When enabled, each provider connection can use its own proxy assignment",
     "proxyUrl": "URL ng proxy",
     "pricingRates": "Format ng Mga Rate ng Pagpepresyo",
     "currentPricing": "Pangkalahatang-ideya ng Kasalukuyang Pagpepresyo",
@@ -4683,6 +5100,13 @@
     "globalProxy": "Pandaigdigang Proxy",
     "globalProxyDesc": "Mag-configure ng pandaigdigang papalabas na proxy para sa lahat ng tawag sa API. Maaaring i-override ito ng mga indibidwal na provider, combo, at key.",
     "noGlobalProxy": "Walang na-configure na pandaigdigang proxy",
+    "proxyPool": "__MISSING__:Proxy Pool",
+    "freePool": "__MISSING__:Free Pool",
+    "proxyDocumentation": "__MISSING__:Proxy Documentation",
+    "proxyGlobalConfigTab": "__MISSING__:Global Config",
+    "proxyPoolTab": "__MISSING__:Proxy Pool",
+    "freePoolTab": "__MISSING__:Free Pool",
+    "proxyDocumentationTab": "__MISSING__:Documentation",
     "bulkHealthcheck": "Bulk Healthcheck",
     "bulkHealthcheckDesc": "Test all configured proxies against a target URL to find which ones work.",
     "healthcheckTesting": "Testing...",
@@ -4695,6 +5119,51 @@
     "healthcheckStatus": "Status",
     "healthcheckProxyUrl": "Proxy URL",
     "healthcheckLatency": "Latency",
+    "proxyDocumentationScopeTitle": "__MISSING__:Proxy scope resolution",
+    "proxyDocumentationScopeDescBefore": "__MISSING__:OmniRoute resolves the outbound proxy in priority order: ",
+    "proxyDocumentationScopeOrder": "__MISSING__:combo → account → provider → global",
+    "proxyDocumentationScopeDescAfter": "__MISSING__:. The most specific scope wins.",
+    "proxyDocumentationAddTitle": "__MISSING__:Adding a custom proxy",
+    "proxyDocumentationAddDescBefore": "__MISSING__:Go to the ",
+    "proxyDocumentationAddDescMiddle": "__MISSING__: tab → click ",
+    "proxyDocumentationAddCta": "__MISSING__:+ Add proxy",
+    "proxyDocumentationAddDescAfter": "__MISSING__:. Fill in type (http/https/socks5), host, and port. Optionally assign it to a scope.",
+    "proxyDocumentationBulkTitle": "__MISSING__:Bulk import format",
+    "proxyDocumentationBulkDesc": "__MISSING__:Pipe-delimited fields:",
+    "proxyDocumentationSocks5DescBefore": "__MISSING__:SOCKS5 proxies are disabled by default. Set",
+    "proxyDocumentationFreePoolDesc": "__MISSING__:The Free Pool tab aggregates proxies from 1proxy, Proxifly, and IPLocate. Use ⊕ to test and promote a proxy to your registry. Only proxies that pass the connectivity test are added.",
+    "proxyDocumentationVercelRelayDescBefore": "__MISSING__:The Vercel Relay is an outbound edge relay — not an inbound tunnel. Deploying one sends LLM API calls through Vercel's dynamic IPs, bypassing datacenter geo-blocks and rate limits. The relay is protected by a generated secret header",
+    "proxyDocumentationVercelRelayDescAfter": "__MISSING__:Your Vercel token is used only during deploy and is never stored.",
+    "vercelRelayTokenRequired": "__MISSING__:Token is required",
+    "vercelRelayDeployFailed": "__MISSING__:Deploy failed",
+    "vercelRelayTokenHint": "__MISSING__:Token is used only during deploy — never stored.",
+    "denoRelayTokenRequired": "__MISSING__:Deno Deploy token is required",
+    "denoRelayOrgDomainRequired": "__MISSING__:Organization domain is required",
+    "denoRelayDeployFailed": "__MISSING__:Deno Deploy failed",
+    "denoRelayTokenHint": "__MISSING__:Organization token (prefix ddo_) from console.deno.com → Organization → Settings → Organization Tokens. Used once for deploy and never stored.",
+    "denoRelayOrgDomainHint": "__MISSING__:Your Deno Deploy organization's default domain (e.g. acme.deno.net). The relay will be reachable at https://<app-name>.<org-slug>.deno.net.",
+    "proxyFreePoolFilterProtocol": "__MISSING__:Filter by protocol",
+    "proxyFreePoolProtocol": "__MISSING__:Protocol",
+    "proxyFreePoolCountryPlaceholder": "__MISSING__:Country (e.g. US)",
+    "proxyFreePoolFilterCountry": "__MISSING__:Filter by country",
+    "proxyFreePoolMinQualityPlaceholder": "__MISSING__:Min quality",
+    "proxyFreePoolMinQualityLabel": "__MISSING__:Minimum quality score",
+    "proxyFreePoolSyncAll": "__MISSING__:Sync All",
+    "proxyFreePoolTotal": "__MISSING__:Total",
+    "proxyFreePoolInPool": "__MISSING__:In pool",
+    "proxyFreePoolAvgQuality": "__MISSING__:Avg quality",
+    "proxyFreePoolSelected": "__MISSING__:{count} selected",
+    "proxyFreePoolAddSelected": "__MISSING__:Add selected to pool",
+    "proxyFreePoolAddVisible": "__MISSING__:Add all visible to pool",
+    "proxyFreePoolSource": "__MISSING__:Source",
+    "proxyFreePoolHostPort": "__MISSING__:Host:Port",
+    "proxyFreePoolType": "__MISSING__:Type",
+    "proxyFreePoolCountry": "__MISSING__:Country",
+    "proxyFreePoolQuality": "__MISSING__:Quality",
+    "proxyFreePoolLatency": "__MISSING__:Latency",
+    "proxyFreePoolEmpty": "__MISSING__:No proxies found. Click Sync All to fetch from sources.",
+    "close": "__MISSING__:Close",
+    "cancel": "__MISSING__:Cancel",
     "globalLabel": "Global",
     "configure": "I-configure",
     "globalSystemPrompt": "Global System Prompt",
@@ -4951,6 +5420,7 @@
     "systemStorage": "System at Imbakan",
     "allDataLocal": "Lahat ng data na lokal na nakaimbak sa iyong makina",
     "databasePath": "Landas ng Database",
+    "export": "__MISSING__:Export",
     "exportDatabase": "I-export ang Database",
     "exportAll": "I-export Lahat (.tar.gz)",
     "importDatabase": "Mag-import ng Database",
@@ -5038,6 +5508,11 @@
     "adaptiveVolumeRoutingDesc": "Scale connections dynamically based on payload volume and throughput pressure.",
     "lkgpToggleTitle": "Last Known Good Provider (LKGP)",
     "lkgpToggleDesc": "When enabled, the router remembers which provider last served a successful response and tries it first on subsequent requests.",
+    "echoRequestedModelTitle": "__MISSING__:Echo requested model name in responses",
+    "echoRequestedModelDesc": "__MISSING__:When enabled, the response `model` field echoes the alias or combo name the client requested instead of the upstream model name. Fixes strict clients (e.g. Claude Desktop) that reject a response whose model does not match the request.",
+    "webSearchRouteTitle": "__MISSING__:Web search routing",
+    "webSearchRouteDesc": "__MISSING__:When a request includes a native web_search tool, route the whole request to this model instead of the default — useful for providers that don't implement Anthropic's web_search server tool. Leave blank to disable.",
+    "webSearchRoutePlaceholder": "__MISSING__:e.g. openrouter,anthropic/claude-3.5-sonnet",
     "clearLkgpCache": "Clear LKGP Cache",
     "lkgpCacheCleared": "LKGP cache cleared successfully",
     "lkgpCacheClearFailed": "Failed to clear LKGP cache",
@@ -5102,6 +5577,16 @@
     "clearSyncedPricing": "Clear Synced Pricing",
     "compressionTitle": "Prompt Compression",
     "compressionDesc": "Reduce token usage by compressing prompts before sending to providers",
+    "tokenSaverTitle": "__MISSING__:Token Saver",
+    "tokenSaverSubtitle": "__MISSING__:Spend fewer tokens on every request.",
+    "tokenSaverToolOutput": "__MISSING__:Tool output",
+    "tokenSaverToolOutputDesc": "__MISSING__:Clean git, grep, ls, tree, and log output before it reaches the provider.",
+    "tokenSaverLlmOutput": "__MISSING__:LLM output",
+    "tokenSaverLlmOutputDesc": "__MISSING__:Inject terse response instructions without rewriting provider output.",
+    "tokenSaverInputCompression": "__MISSING__:Input compression",
+    "tokenSaverInputCompressionDesc": "__MISSING__:Rewrite eligible chat history while preserving code, URLs, and intent.",
+    "tokenSaverFineTunePrefix": "__MISSING__:Fine-tune each engine on",
+    "tokenSaverFineTuneSuffix": "__MISSING__:or combine engines per request on",
     "compressionMode": "Compression Mode",
     "compressionModeOff": "Off",
     "compressionModeOffDesc": "No compression applied",
@@ -5121,6 +5606,11 @@
     "compressionUltraMinScore": "Minimum na Threshold ng Marka",
     "compressionUltraSlmFallback": "Fallback sa Agresibo",
     "compressionUltraModelPath": "Path ng Modelong SLM",
+    "compressionUltraEngine": "__MISSING__:Ultra tier",
+    "compressionUltraEngineHeuristic": "__MISSING__:Heuristic (Tier-A, default)",
+    "compressionUltraEngineSlm": "__MISSING__:SLM (LLMLingua-2, opt-in)",
+    "compressionUltraSlmHint": "__MISSING__:SLM downloads a small ONNX model on first use (cold-start) and transparently falls back to the heuristic on timeout or if unavailable.",
+    "compressionUltraSlmPrewarm": "__MISSING__:Pre-warm SLM model on enable",
     "compressionSummarizerEnabled": "Paganahin ang Summarizer",
     "compressionMaxTokensPerMessage": "Max Token Bawat Mensahe",
     "compressionMinSavings": "Min Savings Threshold",
@@ -5308,13 +5798,22 @@
     "resilienceNo": "Hindi",
     "resilienceDefault": "Default",
     "storageDatabaseBackupRetention": "Pagpapanatili ng backup ng database",
+    "storageDatabaseBackups": "__MISSING__:Database backups",
     "storagePurgeData": "Purge Data",
+    "storagePurgeDataDesc": "__MISSING__:Immediately delete all records without applying retention checks. Use with caution.",
+    "storageRetentionCleanup": "__MISSING__:Retention Settings",
+    "storageRetentionCleanupDesc": "__MISSING__:Configure operational record retention and database backup cleanup.",
+    "retentionCallDays": "__MISSING__:Call {count}d",
+    "retentionAppDays": "__MISSING__:App {count}d",
+    "retentionRows": "__MISSING__:{count} rows",
     "retentionQuotaSnapshots": "Quota Snapshots (mga araw)",
+    "retentionCompressionAnalytics": "__MISSING__:Compression Analytics (days)",
     "retentionMcpAudit": "MCP Audit (mga araw)",
     "retentionA2aEvents": "A2A Events (araw)",
     "retentionCallLogs": "Mga Log ng Tawag (mga araw)",
     "retentionUsageHistory": "Kasaysayan ng Paggamit (mga araw)",
     "retentionMemoryEntries": "Mga Entry ng Memorya (mga araw)",
+    "saveRetentionSettings": "__MISSING__:Save retention settings",
     "storageAutoVacuumMode": "Auto Vacuum Mode",
     "storageScheduledVacuum": "Naka-iskedyul na Vacuum",
     "storageVacuumHour": "Oras ng Vacuum (0-23)",
@@ -5328,10 +5827,16 @@
     "storageIntegrityOk": "✓ OK",
     "storageIntegrityError": "✗ Error",
     "storageUsageTokenBuffer": "Paggamit ng Token Buffer",
+    "storageUsageTokenBufferDesc": "__MISSING__:Extra tokens added to reported usage to account for system prompt overhead.",
+    "storageUsageTokenBufferHint": "__MISSING__:Set to 0 to report raw provider token counts. Default: 2000.",
+    "storageUsageTokenBufferCurrent": "__MISSING__:Current: {value}",
     "compressionSettingsAutoTriggerMode": "Auto trigger mode",
     "compressionSettingsMcpDescriptionCompression": "compression ng paglalarawan ng MCP",
+    "mcpAccessibilityTitle": "__MISSING__:MCP accessibility output",
     "compressionSettingsCavemanIntensity": "Ang intensity ng Caveman",
     "compressionSettingsCavemanOutputMode": "Output mode ng Caveman",
+    "compressionSettingsOutputStyles": "__MISSING__:Output styles",
+    "compressionStylesTileTitle": "__MISSING__:Output styles",
     "compressionSettingsOutputIntensity": "Output intensity",
     "compressionSettingsAutoClarityBypass": "Auto clarity bypass",
     "resilienceWaitForCooldown": "Maghintay para sa Cooldown",
@@ -5347,6 +5852,9 @@
     "cliproxyapiUrl": "URL ng CLIProxyAPI",
     "cliproxyapiStatus": "Katayuan ng CLIProxyAPI",
     "cliproxyapiNotDetected": "Hindi natukoy",
+    "cliproxyapiImportAuthTitle": "__MISSING__:Import accounts from CLIProxyAPI",
+    "cliproxyapiImportAuthDesc": "__MISSING__:Import the OAuth accounts CLIProxyAPI already saved in ~/.cli-proxy-api/ as OmniRoute connections, so you don't have to log in to each account again. Supported account types (Gemini, Codex, Claude, Antigravity, Qwen, Kimi) are imported; others are skipped.",
+    "cliproxyapiImportAuthButton": "__MISSING__:Import accounts",
     "payloadRulesTitle": "Mga Panuntunan sa Payload",
     "payloadRulesDesc": "__MISSING__:Configure request payload mutations by model and protocol. Changes are persisted in settings and hot reloaded into the runtime immediately after save.",
     "payloadRuleDefaultTitle": "__MISSING__:default",
@@ -5379,6 +5887,14 @@
     "maxResponseTokensDesc": "__MISSING__:Maximum total tokens allowed in a single response.",
     "modelCooldownsTitle": "Mga modelo sa cooldown",
     "modelCooldownsEmpty": "Walang mga modelo sa cooldown sa ngayon.",
+    "responsesStateTitle": "__MISSING__:Responses State",
+    "responsesStateDesc": "__MISSING__:Control how OmniRoute forwards previous_response_id.",
+    "responsesStateModeLabel": "__MISSING__:previous_response_id handling",
+    "responsesStateModeAuto": "__MISSING__:Auto",
+    "responsesStateModeStrip": "__MISSING__:Strip",
+    "responsesStateModePreserve": "__MISSING__:Preserve",
+    "responsesStateHint": "__MISSING__:Auto strips previous_response_id unless a connection explicitly enables OpenAI Responses storage. Strip is safest for stateless clients such as VS Code Custom Endpoint; context then depends on the client sending full history.",
+    "responsesStateSaveError": "__MISSING__:Failed to update Responses state setting",
     "codexFastTierTitle": "Mabilis na Tier ng Codex",
     "codexFastTierDesc": "Globally inject service_tier=priority para sa mga kahilingan sa OpenAI Codex.",
     "codexFastTierHint": "Kapag pinagana, ang OmniRoute ay nagdaragdag ng service_tier=priority sa mga papalabas na kahilingan ng Codex para sa mga koneksyon na hindi pa tumutukoy ng isang tier. Ang priority tier ay nangangailangan ng OpenAI Enterprise API key o ang ChatGPT-auth Codex path; ang iba pang mga pangunahing uri ay makakatanggap ng error na nauugnay sa tier mula sa OpenAI. Pangunahin ang mga setting ng bawat koneksyon sa page ng provider ng Codex.",
@@ -5485,6 +6001,15 @@
     "resilienceEnableServerWaitDesc": "Kapag pinagana, hinihintay ng OmniRoute na mag-expire ang unang cooldown at awtomatikong sumusubok muli.",
     "resilienceMaxAttempts": "Pinakamataas na pagtatangka",
     "resilienceMaxWaitPerAttempt": "Pinakamataas na paghihintay sa bawat pagsubok",
+    "resilienceProviderCooldownTitle": "__MISSING__:Provider Cooldown",
+    "resilienceProviderCooldownScope": "__MISSING__:All combo requests",
+    "resilienceProviderCooldownTrigger": "__MISSING__:When a provider/connection fails",
+    "resilienceProviderCooldownEffect": "__MISSING__:Skips the failed provider for a cooldown period before retrying",
+    "resilienceProviderCooldownDesc": "__MISSING__:Prevents subsequent requests from re-walking the same failing providers. Cooldown scales exponentially with consecutive failures.",
+    "resilienceProviderCooldownEnabled": "__MISSING__:Enable global provider cooldown",
+    "resilienceProviderCooldownEnabledDesc": "__MISSING__:When enabled, failed providers are tracked globally and skipped for a cooldown period.",
+    "resilienceProviderCooldownMin": "__MISSING__:Minimum cooldown",
+    "resilienceProviderCooldownMax": "__MISSING__:Maximum cooldown",
     "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
     "forcedFingerprintBadge": "Required",
     "codexSessionAffinityTitle": "Affinity ng session ng Codex",
@@ -5506,13 +6031,45 @@
     "vercelRelayFreeTierNote": "__MISSING__:Relays are lightweight proxy endpoints deployed on Vercel's free tier to bypass local network/region limitations.",
     "vercelRelayDeploying": "__MISSING__:Deploying...",
     "vercelRelayDeploy": "__MISSING__:Deploy",
-    "homePinProviderQuotaToHome": "Pin Information to Home Page",
-    "homeProviderQuotaLimits": "Provider Quota Limits",
-    "homeProviderQuotaLimitsDesc": "Pin the Provider Quota status container (with Refresh All button) to the top of the Home page.",
-    "homeQuickStart": "Quick Start",
-    "homeQuickStartDesc": "Show the Quick Start panel on the Home page.",
-    "homeProviderTopology": "Provider Topology",
-    "homeProviderTopologyDesc": "Show the Provider Topology on the Home page."
+    "deployRelayButton": "__MISSING__:Deploy Relay",
+    "denoRelayButton": "__MISSING__:Deploy Deno Relay",
+    "denoRelayModalTitle": "__MISSING__:Deploy Deno Relay",
+    "denoRelayWarning": "__MISSING__:Warning: A Deno Deploy organization token is required. This token will only be used to create the relay app and will never be stored by OmniRoute.",
+    "denoRelayTokenLabel": "__MISSING__:Deno Deploy Organization Token",
+    "denoRelayOrgDomainLabel": "__MISSING__:Organization Domain",
+    "denoRelayProjectNameLabel": "__MISSING__:Deno App Name",
+    "denoRelayFreeTierNote": "__MISSING__:Deno Deploy v2 runs on a global edge network. Free tier: 1M requests & 100GiB outbound traffic per month, no per-request CPU limits, up to 20 active apps & 50 custom domains.",
+    "denoRelayDeploying": "__MISSING__:Deploying...",
+    "denoRelayDeploy": "__MISSING__:Deploy",
+    "cloudflareRelaySuccess": "__MISSING__:Cloudflare Relay deployed successfully",
+    "cloudflareRelayButton": "__MISSING__:Deploy Cloudflare Relay",
+    "cloudflareRelayModalTitle": "__MISSING__:Deploy Cloudflare Worker Relay",
+    "cloudflareRelayWarning": "__MISSING__:Deploys a Cloudflare Worker that proxies LLM requests through Cloudflare's edge network — masking the host IP behind dynamic Cloudflare addresses. The Worker enforces a one-time auth secret so the public workers.dev URL cannot be reused as an open relay.",
+    "cloudflareRelayTokenHowto": "__MISSING__:Create the API token under My Profile -> API Tokens -> Create Token -> Custom Token -> Account / Workers Scripts / Edit.",
+    "cloudflareRelayAccountIdLabel": "__MISSING__:Cloudflare Account ID",
+    "cloudflareRelayAccountIdHint": "__MISSING__:Found on the right side of the Cloudflare dashboard overview page.",
+    "cloudflareRelayApiTokenLabel": "__MISSING__:Cloudflare API Token",
+    "cloudflareRelayApiTokenHint": "__MISSING__:Requires 'Workers Scripts: Edit' permission. The token is used only at deploy time and is never stored.",
+    "cloudflareRelayProjectNameLabel": "__MISSING__:Worker Name",
+    "cloudflareRelayFreeTierNote": "__MISSING__:Free tier: 100,000 requests/day per Cloudflare account.",
+    "cloudflareRelayDeploying": "__MISSING__:Deploying...",
+    "cloudflareRelayDeploy": "__MISSING__:Deploy",
+    "cloudflareRelayCredsRequired": "__MISSING__:Account ID and API Token are required",
+    "cloudflareRelayDeployFailed": "__MISSING__:Deploy failed",
+    "modelLockout": "__MISSING__:Model Lockout",
+    "modelLockoutPageDescription": "__MISSING__:Configure which HTTP error codes trigger per-model lockout and control the cooldown behavior.",
+    "modelLockoutEnabled": "__MISSING__:Enable Model Lockout",
+    "modelLockoutEnabledDescription": "__MISSING__:When enabled, models that fail with configured error codes are temporarily locked to prevent retry loops.",
+    "modelLockoutErrorCodes": "__MISSING__:Error Codes",
+    "modelLockoutErrorCodesDescription": "__MISSING__:HTTP status codes that trigger model lockout. Type a code and click Add, or select from suggestions.",
+    "modelLockoutBaseCooldown": "__MISSING__:Base Cooldown (ms)",
+    "modelLockoutBaseCooldownDescription": "__MISSING__:Initial cooldown duration in milliseconds before a model can be retried.",
+    "modelLockoutMaxCooldown": "__MISSING__:Max Cooldown (ms)",
+    "modelLockoutMaxCooldownDescription": "__MISSING__:Maximum cooldown duration in milliseconds. Prevents excessively long lockouts.",
+    "modelLockoutExponentialBackoff": "__MISSING__:Exponential Backoff",
+    "modelLockoutExponentialBackoffDescription": "__MISSING__:When enabled, each consecutive failure increases the cooldown duration exponentially.",
+    "modelLockoutMaxBackoffSteps": "__MISSING__:Max Backoff Steps",
+    "modelLockoutMaxBackoffStepsDescription": "__MISSING__:Maximum number of backoff steps before the cooldown stops growing. The Max Cooldown cap is reached first in most configurations, making this a safety ceiling for when Max Cooldown is raised."
   },
   "contextRtk": {
     "title": "RTK Engine",
@@ -5563,7 +6120,21 @@
     "searchFilters": "Maghanap ng mga filter...",
     "tooltipDedup": "Gaano ka-agresibo ang pag-alis ng mga paulit-ulit na linya.",
     "tooltipMaxChars": "Pinakamataas na mga character sa bawat bloke ng output.",
-    "tooltipMaxLines": "Pinakamataas na mga linya upang panatilihin mula sa command output. Ang labis ay pinutol."
+    "tooltipMaxLines": "Pinakamataas na mga linya upang panatilihin mula sa command output. Ang labis ay pinutol.",
+    "learnDiscoverTitle": "__MISSING__:Learn & Discover filters",
+    "learnDiscoverDesc": "__MISSING__:Mine your captured command output (Raw Output retention must be on) to suggest new RTK filters. Suggestions only — you review and save them.",
+    "discoverHeading": "__MISSING__:Discover repeated noise",
+    "discoverButton": "__MISSING__:Scan samples",
+    "discoverScanning": "__MISSING__:Scanning…",
+    "discoverEmpty": "__MISSING__:No repeated noise found. Enable Raw Output retention and run a few commands first.",
+    "discoverSamples": "__MISSING__:{count} sample(s) scanned",
+    "discoverHits": "__MISSING__:{hits}× across samples",
+    "learnHeading": "__MISSING__:Learn a filter for a command",
+    "learnCommandPlaceholder": "__MISSING__:e.g. npm install",
+    "learnButton": "__MISSING__:Suggest filter",
+    "learnEmpty": "__MISSING__:No suggestion yet. Type a command you have run and scan.",
+    "learnSamplesUsed": "__MISSING__:Learned from {count} matching sample(s)",
+    "suggestionError": "__MISSING__:Could not load suggestions. Check management auth and try again."
   },
   "contextCombos": {
     "title": "Compression Combos",
@@ -5853,7 +6424,80 @@
     "routeConnectionLabel": "Koneksyon",
     "scenarioVision": "Paningin (pag-unawa sa imahe)",
     "scenarioSchemaCoercion": "Schema coercion (nakabalangkas na output)",
-    "techniques": "Mga diskarte:"
+    "techniques": "Mga diskarte:",
+    "friendlyTitle": "__MISSING__:Translator",
+    "friendlySubtitle": "__MISSING__:Use your existing app with any provider — without rewriting code.",
+    "conceptHeadline": "__MISSING__:Your app speaks one API's \"language\". The Translator converts it to use another provider.",
+    "conceptDiagramAppLabel": "__MISSING__:Your app",
+    "conceptDiagramSourceLabel": "__MISSING__:Source format",
+    "conceptDiagramHubLabel": "__MISSING__:OpenAI (hub)",
+    "conceptDiagramTargetLabel": "__MISSING__:Target provider",
+    "conceptDiagramExampleApp": "__MISSING__:e.g. Anthropic SDK",
+    "conceptDiagramExampleSource": "__MISSING__:claude",
+    "conceptDiagramExampleTarget": "__MISSING__:Gemini",
+    "conceptHowItWorksToggle": "__MISSING__:How it works",
+    "conceptHowItWorksBody": "__MISSING__:Your app sends a request in its own format. The Translator detects the format, converts it through OpenAI as an intermediate hub (or directly when a direct translator is available), sends it to the chosen provider, and returns the response converted back to your app's format.",
+    "tabTranslate": "__MISSING__:Translate",
+    "tabMonitor": "__MISSING__:Monitor",
+    "tabTranslateAriaLabel": "__MISSING__:Go to the Translate tab",
+    "tabMonitorAriaLabel": "__MISSING__:Go to the Monitor tab",
+    "simpleAppUsesLabel": "__MISSING__:My app uses",
+    "simpleAppUsesHint": "__MISSING__:The API format your app speaks (e.g. Anthropic SDK = claude).",
+    "simpleSendToLabel": "__MISSING__:Send to",
+    "simpleSendToHint": "__MISSING__:Where to actually send the request (a provider connected in OmniRoute).",
+    "simpleStartWithLabel": "__MISSING__:Start with",
+    "simpleStartWithExamplePlaceholder": "__MISSING__:Select a ready-made example",
+    "simpleStartWithCustomOption": "__MISSING__:Paste your request (advanced)",
+    "simpleModeLabel": "__MISSING__:Mode",
+    "simpleModePreview": "__MISSING__:Preview translation only",
+    "simpleModeSend": "__MISSING__:Send and see response",
+    "simpleAdvancedToggle": "__MISSING__:Advanced",
+    "simpleInputPanelTitle": "__MISSING__:Input",
+    "simpleInputPanelHint": "__MISSING__:Free-text message or ready-made example",
+    "simpleResultPanelTitle": "__MISSING__:Translation + Response",
+    "narratedDetected": "__MISSING__:✓ Detected: {format}",
+    "narratedTranslating": "__MISSING__:Translating to {target}...",
+    "narratedSending": "__MISSING__:Sending to {target}...",
+    "narratedSuccess": "__MISSING__:→ translated to {target} · response in {latency}ms",
+    "narratedError": "__MISSING__:Failed: {reason}",
+    "narratedSeeTranslatedJson": "__MISSING__:see translated JSON",
+    "narratedSeePipeline": "__MISSING__:see pipeline",
+    "advancedSectionTitle": "__MISSING__:Advanced",
+    "advancedSectionSubtitle": "__MISSING__:Raw JSON, pipeline and technical tools. Everything here is the same as the old tabs — just reorganized.",
+    "advancedRawJsonTitle": "__MISSING__:Raw JSON (auto-detect + Monaco)",
+    "advancedRawJsonSubtitle": "__MISSING__:Paste a JSON request; the format is detected automatically.",
+    "advancedPipelineTitle": "__MISSING__:OpenAI intermediate pipeline",
+    "advancedPipelineSubtitle": "__MISSING__:Visualize each translation step (hub-and-spoke).",
+    "advancedStreamTransformTitle": "__MISSING__:Stream Transformer (Chat → Responses SSE)",
+    "advancedStreamTransformSubtitle": "__MISSING__:Converts Chat Completions SSE into Responses API.",
+    "advancedTestBenchTitle": "__MISSING__:Test Bench (8 scenarios)",
+    "advancedTestBenchSubtitle": "__MISSING__:Runs all scenarios and reports pass/fail + compatibility %.",
+    "advancedCompressionTitle": "__MISSING__:Compression Preview",
+    "advancedCompressionSubtitle": "__MISSING__:Estimate token savings across different compression modes.",
+    "monitorOriginHint": "__MISSING__:Events generated by Translate or the main pipeline appear here in real time.",
+    "monitorEmptyCta": "__MISSING__:Go to the Translate tab and send a request — it will appear here.",
+    "monitorOpenTranslateButton": "__MISSING__:Go to Translate",
+    "pipelineStepClientRequest": "__MISSING__:Client Request",
+    "pipelineStepClientRequestDesc": "__MISSING__:Request received in client format",
+    "pipelineStepFormatDetected": "__MISSING__:Format Detected",
+    "pipelineStepFormatDetectedDesc": "__MISSING__:Auto-detected source format",
+    "pipelineStepOpenAIIntermediate": "__MISSING__:OpenAI Intermediate",
+    "pipelineStepOpenAIIntermediateDesc": "__MISSING__:Translated to OpenAI hub format",
+    "pipelineStepProviderFormat": "__MISSING__:Provider Format",
+    "pipelineStepProviderFormatDesc": "__MISSING__:Translated to provider target format",
+    "pipelineStepProviderResponse": "__MISSING__:Provider Response",
+    "pipelineStepProviderResponseDesc": "__MISSING__:Streaming response from provider",
+    "conceptDiagramArrow1": "__MISSING__:speaks",
+    "conceptDiagramArrow2": "__MISSING__:translates",
+    "conceptDiagramArrow3": "__MISSING__:converts",
+    "conceptDiagramExampleHub": "__MISSING__:OpenAI",
+    "conceptDiagramHubTooltip": "__MISSING__:Intermediate hub used by the translator to convert between formats that don't have a direct mapping.",
+    "conceptDiagramSourceTooltip": "__MISSING__:The API format your app speaks (e.g., Anthropic SDK = claude).",
+    "conceptDiagramTargetTooltip": "__MISSING__:The provider where the request will actually be sent.",
+    "compressionEmptyHint": "__MISSING__:Fill in the input field on the Translate tab (Simple Controls or Raw JSON) to enable the preview.",
+    "compressionModeLabel": "__MISSING__:Compression mode",
+    "compressionPreviewButton": "__MISSING__:Preview Compression",
+    "compressionPreviewing": "__MISSING__:Previewing…"
   },
   "usage": {
     "title": "Paggamit",
@@ -6010,6 +6654,8 @@
     "notApplicable": "N/A",
     "rawPlanWithValue": "Raw plan: {plan}",
     "noPlanFromProvider": "Walang plano mula sa provider",
+    "tokenExpiresIn": "__MISSING__:Token expires in {time}",
+    "tokenExpired": "__MISSING__:Token expired",
     "noQuotaData": "Walang data ng quota",
     "cardExpand": "__MISSING__:Expand",
     "cardCollapse": "__MISSING__:Collapse",
@@ -6159,6 +6805,11 @@
     "quotaCutoffsButtonDefault": "Default",
     "quotaCutoffsButtonHelp": "I-edit ang pinakamababang natitirang quota cutoff para sa account na ito.",
     "quotaCutoffsButtonDisabled": "Wala pang quota window para sa account na ito.",
+    "deactivateAccount": "__MISSING__:Deactivate account (stop routing)",
+    "activateAccount": "__MISSING__:Activate account (resume routing)",
+    "accountActivated": "__MISSING__:Account activated",
+    "accountDeactivated": "__MISSING__:Account deactivated",
+    "toggleActiveFailed": "__MISSING__:Failed to update account status",
     "quotaCutoffsTitle": "Mga cutoff ng quota para sa {name} ({provider})",
     "quotaCutoffsExplainer": "I-override ang minimum na natitirang porsyento ng quota kung saan huminto ang account na ito sa pagpili para sa bawat palugit ng quota. Iwanang blangko upang mamana ang default ng provider.",
     "quotaCutoffsDefaultHint": "Default na min na natitira: {default}%",
@@ -6179,6 +6830,7 @@
     "budgetColDailyLim": "Araw-araw na lim",
     "budgetColMonthlyLim": "Buwanang lim",
     "budgetColUsedPct": "Nagamit na %",
+    "percentUsed": "__MISSING__:{pct}% used",
     "budgetLoading": "Naglo-load…",
     "budgetNoKeysMatch": "Walang mga key na tumutugma sa mga filter",
     "budgetLinearExtrapolation": "linear extrapolation",
@@ -7124,6 +7776,11 @@
     "modalEditTitle": "Modal Edit Title",
     "labelName": "Label Name",
     "labelType": "Uri",
+    "labelFamily": "__MISSING__:IP family",
+    "familyAuto": "__MISSING__:Auto (dual-stack)",
+    "familyIpv4": "__MISSING__:IPv4 only",
+    "familyIpv6": "__MISSING__:IPv6 only",
+    "familyHint": "__MISSING__:Egress address family. Auto keeps dual-stack; IPv4/IPv6 pin this proxy to that family (prevents a v4 leak under an IPv6-only proxy).",
     "labelHost": "Host",
     "labelPort": "Port",
     "labelUsername": "Username",
@@ -7266,7 +7923,16 @@
     "improveConfirm": "Improve",
     "exportCode": "Export code",
     "exportCodeTitle": "Export Code",
+    "exportShort": "__MISSING__:Export",
     "noStateToExport": "No playground state available to export.",
+    "closeExportModal": "__MISSING__:Close export modal",
+    "close": "__MISSING__:Close",
+    "exportRealKeyWarning": "__MISSING__:Security warning: export blocked — a real API key was detected in the output. Please reset your API key and try again.",
+    "placeholderHintPrefix": "__MISSING__:Replace",
+    "placeholderHintSuffix": "__MISSING__:with your actual API key, or set it as an environment variable.",
+    "copyLangCode": "__MISSING__:Copy {language} code",
+    "loadingPresets": "__MISSING__:Loading…",
+    "loadPresetPlaceholder": "__MISSING__:Load preset…",
     "copyCode": "Copy",
     "copiedCode": "Copied!",
     "addModel": "+ Add model",
@@ -7291,7 +7957,27 @@
     "invalidJson": "Invalid JSON",
     "running": "Running…",
     "runLabel": "Run",
-    "enterToolResult": "Enter tool result…"
+    "enterToolResult": "Enter tool result…",
+    "build": {
+      "step1Label": "__MISSING__:What to test?",
+      "step2Label": "__MISSING__:Configure",
+      "step3Label": "__MISSING__:Run",
+      "step1Title": "__MISSING__:What do you want to test?",
+      "step1Subtitle": "__MISSING__:Choose the capability you want to explore in this session.",
+      "step2Title": "__MISSING__:Configure",
+      "step2Subtitle": "__MISSING__:Set up the tools or JSON schema that will be used in the request.",
+      "step3Title": "__MISSING__:Run",
+      "modeToolsTitle": "__MISSING__:Tools",
+      "modeToolsDesc": "__MISSING__:Test function calling — define tools and see how the model invokes them.",
+      "modeJsonTitle": "__MISSING__:JSON",
+      "modeJsonDesc": "__MISSING__:Test structured output — constrain the response to a JSON schema.",
+      "modeBothTitle": "__MISSING__:Tools + JSON",
+      "modeBothDesc": "__MISSING__:Combine function calling and structured output in a single request.",
+      "backButton": "__MISSING__:Back",
+      "nextButton": "__MISSING__:Next",
+      "runButton": "__MISSING__:Run",
+      "promptPlaceholder": "__MISSING__:Enter your message… (Enter to send, Shift+Enter for newline)"
+    }
   },
   "miniPlayground": {
     "endpoint": "__MISSING__:Endpoint",
@@ -7395,7 +8081,9 @@
     "loadingLogs": "Loading logs...",
     "noLogs": "No logs yet. Make some API calls to see them here.",
     "noMatchingLogs": "No logs matching current filters.",
-    "callLogsInfo": "Call logs are also saved as JSON files to {dataDir} and rotated based on {retentionDays} and {maxEntries}."
+    "callLogsInfo": "Call logs are also saved as JSON files to {dataDir} and rotated based on {retentionDays} and {maxEntries}.",
+    "loadMore": "__MISSING__:Load More",
+    "loadingMore": "__MISSING__:Loading more..."
   },
   "proxyLogger": {
     "filterAll": "All",
@@ -7432,7 +8120,8 @@
     "loadingProxyLogs": "Loading proxy logs...",
     "noProxyLogs": "No proxy logs yet. Configure proxies and make API calls to see them here.",
     "noMatchingLogs": "No logs match the current filters.",
-    "tlsFingerprint": "Chrome 124 TLS Fingerprint"
+    "tlsFingerprint": "Chrome 124 TLS Fingerprint",
+    "colPublicIp": "__MISSING__:Public IP"
   },
   "endpointOptions": {
     "speech": "Speech",
@@ -7572,7 +8261,86 @@
     "betaConfigSavedSuffix": "(hindi pa nagpapatuloy sa server). Ang pagpapatupad ng cap sa bawat kahilingan ay hindi pa naka-wire sa proxy pipeline. Hinahayaan ka ng screen na ito na idisenyo at mailarawan ang paghahati ng quota; ang tunay na pagpapatupad ay darating sa isang pag-ulit sa hinaharap na may DB pagtitiyaga at upstream na pagharang ng tawag.",
     "policyLabel": "Patakaran:",
     "resetIn": "i-reset sa",
-    "quotaTotal": "kabuuan"
+    "quotaTotal": "kabuuan",
+    "kpiAvgUtilization": "__MISSING__:Avg utilization",
+    "kpiBorrowingNow": "__MISSING__:Borrowing now",
+    "conceptTitle": "__MISSING__:How Quota Share works",
+    "conceptIntro": "__MISSING__:Quota Share divides a provider's quota among multiple API keys using work-conserving fair-share: each key receives a proportional slice but can borrow from the free balance without exceeding the global cap.",
+    "conceptFairShare": "__MISSING__:Fair-share: each key receives quota proportional to its configured weight",
+    "conceptBorrowing": "__MISSING__:Borrowing: keys can consume free balance from others without breaching the cap",
+    "conceptGlobalCap": "__MISSING__:Hard global cap: the provider's absolute limit is never exceeded",
+    "conceptWindows": "__MISSING__:Windows: 5h, hourly, daily, weekly, monthly — each tracked independently",
+    "conceptKeyHowTitle": "__MISSING__:Enabling a key for quota",
+    "conceptKeyHowDesc": "__MISSING__:Create the key normally in API Keys — it appears in the wizard's key step automatically. Tick Exclusive there to make it quota-only. No separate enable step.",
+    "conceptExclusiveTitle": "__MISSING__:What \"Exclusive\" does",
+    "conceptExclusiveDesc": "__MISSING__:An exclusive key only sees/uses the pool's quotaShared-* models — every other model is hidden from its /v1/models and blocked.",
+    "burnRateTitle": "__MISSING__:Burn rate",
+    "burnRateExhaustsIn": "__MISSING__:Exhausts in",
+    "dimensionResetIn": "__MISSING__:Resets in",
+    "realConsumedColumn": "__MISSING__:Consumed",
+    "deficitColumn": "__MISSING__:Deficit",
+    "borrowingIndicator": "__MISSING__:borrowing",
+    "migratedFromLocalStorageNotice": "__MISSING__:Pools successfully migrated from localStorage.",
+    "policyCapAbsoluteLabel": "__MISSING__:Absolute cap",
+    "policyCapAbsolutePlaceholder": "__MISSING__:Numeric limit (optional)",
+    "multiDimensionLabel": "__MISSING__:Multi-dimension",
+    "stackedBarTitle": "__MISSING__:Slices by API key",
+    "usedSuffix": "__MISSING__:used {percent}%",
+    "wizardTitle": "__MISSING__:New quota pool",
+    "editPoolTitle": "__MISSING__:Edit pool",
+    "saveChanges": "__MISSING__:Save changes",
+    "wizardStep1Label": "__MISSING__:Account",
+    "wizardStep2Label": "__MISSING__:Limit",
+    "wizardStep3Label": "__MISSING__:Keys",
+    "wizardStep1Title": "__MISSING__:Choose provider connection",
+    "wizardStep1Subtitle": "__MISSING__:Select the provider account this pool will share quota for, set a name and default policy.",
+    "wizardStep2Title": "__MISSING__:Configure quota dimensions",
+    "wizardStep2Subtitle": "__MISSING__:Define the quota plan dimensions (unit, window, limit) for the chosen connection. Leave unchanged to keep current settings.",
+    "wizardStep3Title": "__MISSING__:Allocate API keys",
+    "wizardStep3Subtitle": "__MISSING__:Assign API keys to this pool with weight % allocations and optional caps.",
+    "wizardPoolNameLabel": "__MISSING__:Pool name",
+    "wizardPoolNamePlaceholder": "__MISSING__:My quota pool",
+    "wizardNext": "__MISSING__:Next",
+    "wizardBack": "__MISSING__:Back",
+    "wizardCreatePool": "__MISSING__:Create pool",
+    "wizardDimensionsEditedNotice": "__MISSING__:Dimensions edited — will be saved as a manual override when the pool is created.",
+    "wizardExclusiveLabel": "__MISSING__:Exclusive quota",
+    "wizardExclusiveHint": "__MISSING__:When enabled, these API keys will only be allowed to use this pool's virtual models (allowedQuotas reconciliation is applied on save).",
+    "wizardPreviewLabel": "__MISSING__:Virtual model names preview",
+    "wizardConnectionsLabel": "__MISSING__:Provider connections",
+    "wizardPrimaryBadge": "__MISSING__:primary",
+    "wizardAdditionalConnectionsNote": "__MISSING__:Additional connections use their catalog default limits (editable later).",
+    "wizardSingleProviderNote": "__MISSING__:A pool uses a single provider",
+    "wizardPreviewMoreModels": "__MISSING__:+{count} more",
+    "accountQuotaTitle": "__MISSING__:Account quota",
+    "accountQuotaNone": "__MISSING__:—",
+    "logTitle": "__MISSING__:Usage log",
+    "logEmpty": "__MISSING__:No usage yet",
+    "groupLabel": "__MISSING__:Group",
+    "newGroup": "__MISSING__:New group",
+    "renameGroup": "__MISSING__:Rename group",
+    "groupSelectHint": "__MISSING__:Filter pools by group",
+    "groupAllocationNote": "__MISSING__:Allocations apply to all pools in this group via the shared quota layer.",
+    "groupNamePrompt": "__MISSING__:Enter group name",
+    "wizardGroupLabel": "__MISSING__:Group",
+    "allGroups": "__MISSING__:All groups",
+    "endpointsTitle": "__MISSING__:Available endpoints",
+    "endpointsHint": "__MISSING__:Call these virtual models with any allocated key — routing + quota are handled per group.",
+    "previewForKey": "__MISSING__:Preview for key",
+    "previewKeyNone": "__MISSING__:(all endpoints)",
+    "endpointsBaseUrl": "__MISSING__:Base URL",
+    "endpointsCollapse": "__MISSING__:Collapse",
+    "endpointsExpand": "__MISSING__:Expand",
+    "endpointsAnthropicNote": "__MISSING__:Anthropic-native",
+    "endpointsResponsesNote": "__MISSING__:OpenAI Responses — codex/github",
+    "endpointsWsNote": "__MISSING__:WebSocket — codex only",
+    "betaText": "__MISSING__:Quota Share is functional but bugs are expected. Found one? Please report it.",
+    "betaReportLink": "__MISSING__:Report an issue",
+    "deleteGroup": "__MISSING__:Delete group",
+    "deleteGroupConfirm": "__MISSING__:Delete this group? Its pools must be reassigned or removed first.",
+    "deleteGroupHasPools": "__MISSING__:This group still has pools — reassign or delete them first.",
+    "ungroupedTitle": "__MISSING__:Ungrouped",
+    "ungroupedHint": "__MISSING__:These pools are not assigned to a known group. Edit a pool to move it into a real group."
   },
   "plugins": {
     "title": "Plugins",
@@ -7608,6 +8376,571 @@
     "status": "Status",
     "enabled": "Enabled",
     "disabled": "Disabled",
+    "installedTab": "__MISSING__:Installed",
+    "marketplaceTab": "__MISSING__:Marketplace",
+    "marketplaceUrlLabel": "__MISSING__:Custom Marketplace URL",
+    "marketplaceUrlPlaceholder": "__MISSING__:Leave empty for official Omniroute registry",
+    "saveMarketplaceUrl": "__MISSING__:Save & Reload",
+    "marketplaceUrlSaved": "__MISSING__:Marketplace URL updated",
+    "marketplaceEmpty": "__MISSING__:No plugins found in marketplace.",
+    "verified": "__MISSING__:Verified",
+    "install": "__MISSING__:Install",
+    "installedFromMarketplace": "__MISSING__:Plugin {name} installed!",
     "hooks": "Hooks"
+  },
+  "quotaPlans": {
+    "title": "__MISSING__:Plans & Quotas",
+    "description": "__MISSING__:Configure quota plans per provider — dimensions (%, requests, tokens, $) and time windows",
+    "providerLabel": "__MISSING__:Provider / Connection",
+    "detectedPlanLabel": "__MISSING__:Detected plan",
+    "manualPlanLabel": "__MISSING__:Manual override",
+    "unconfiguredLabel": "__MISSING__:Not configured — manual required",
+    "dimensionLabel": "__MISSING__:Dimensions",
+    "addDimension": "__MISSING__:Add dimension",
+    "removeDimension": "__MISSING__:Remove",
+    "limitLabel": "__MISSING__:Limit",
+    "unitOptions": {
+      "percent": "__MISSING__:%",
+      "requests": "__MISSING__:requests",
+      "tokens": "__MISSING__:tokens",
+      "usd": "__MISSING__:USD ($)"
+    },
+    "windowOptions": {
+      "5h": "__MISSING__:5 hours",
+      "hourly": "__MISSING__:Hourly",
+      "daily": "__MISSING__:Daily",
+      "weekly": "__MISSING__:Weekly",
+      "monthly": "__MISSING__:Monthly"
+    },
+    "useCatalogButton": "__MISSING__:Use catalog",
+    "saveOverrideButton": "__MISSING__:Save override",
+    "revertToCatalogButton": "__MISSING__:Revert to catalog",
+    "unknownProviderNotice": "__MISSING__:Select a provider on the left to configure its quota plan.",
+    "catalogTitle": "__MISSING__:Known catalog",
+    "catalogDescription": "__MISSING__:Automatically detected plans for the following providers:"
+  },
+  "activity": {
+    "title": "__MISSING__:Activity",
+    "description": "__MISSING__:Recent events feed",
+    "emptyTitle": "__MISSING__:No activity yet",
+    "emptyDescription": "__MISSING__:When you add providers, create combos, or rotate keys, events will appear here.",
+    "todayHeader": "__MISSING__:Today",
+    "yesterdayHeader": "__MISSING__:Yesterday",
+    "filterAll": "__MISSING__:All",
+    "filterProviders": "__MISSING__:Providers",
+    "filterCombos": "__MISSING__:Combos",
+    "filterApiKeys": "__MISSING__:API Keys",
+    "filterSettings": "__MISSING__:Settings",
+    "filterQuota": "__MISSING__:Quota",
+    "filterAuth": "__MISSING__:Auth",
+    "filterSystem": "__MISSING__:System",
+    "relative": {
+      "justNow": "__MISSING__:just now",
+      "minutesAgo": "__MISSING__:{n} min ago",
+      "hoursAgo": "__MISSING__:{n} h ago",
+      "yesterday": "__MISSING__:yesterday",
+      "daysAgo": "__MISSING__:{n} days ago"
+    },
+    "eventVerb": {
+      "providerAdded": "__MISSING__:{actor} added provider {target}",
+      "providerRemoved": "__MISSING__:{actor} removed provider {target}",
+      "providerTested": "__MISSING__:{actor} tested provider {target}",
+      "comboCreated": "__MISSING__:{actor} created combo {target}",
+      "comboUpdated": "__MISSING__:{actor} updated combo {target}",
+      "comboDeleted": "__MISSING__:{actor} removed combo {target}",
+      "apiKeyCreated": "__MISSING__:{actor} created API key {target}",
+      "apiKeyRevoked": "__MISSING__:{actor} revoked API key {target}",
+      "apiKeyRotated": "__MISSING__:{actor} rotated API key {target}",
+      "budgetThreshold": "__MISSING__:Budget threshold reached for {target}",
+      "settingUpdated": "__MISSING__:{actor} updated setting {target}",
+      "authLogin": "__MISSING__:{actor} signed in",
+      "authLogout": "__MISSING__:{actor} signed out",
+      "cloudAgentSession": "__MISSING__:Cloud agent session started for {target}",
+      "mcpToolRegistered": "__MISSING__:MCP tool {target} registered",
+      "webhookCreated": "__MISSING__:{actor} created webhook {target}",
+      "webhookDeleted": "__MISSING__:{actor} removed webhook {target}",
+      "quotaPoolCreated": "__MISSING__:{actor} created quota pool {target}",
+      "quotaPoolUpdated": "__MISSING__:{actor} updated quota pool {target}",
+      "quotaPoolDeleted": "__MISSING__:{actor} removed quota pool {target}",
+      "quotaPlanUpdated": "__MISSING__:{actor} updated quota plan {target}",
+      "quotaStoreDriverChanged": "__MISSING__:QuotaStore driver changed",
+      "updateApplied": "__MISSING__:Update {target} applied",
+      "deployCompleted": "__MISSING__:Deploy completed",
+      "skillInstalled": "__MISSING__:{actor} installed skill {target}",
+      "skillRemoved": "__MISSING__:{actor} removed skill {target}",
+      "providerCredentialsCreated": "__MISSING__:{actor} created credentials for {target}",
+      "providerCredentialsApplied": "__MISSING__:Credentials for {target} applied",
+      "providerCredentialsUpdated": "__MISSING__:{actor} updated credentials for {target}",
+      "providerCredentialsRevoked": "__MISSING__:{actor} revoked credentials for {target}",
+      "providerCredentialsBatchRevoked": "__MISSING__:{actor} batch-revoked credentials",
+      "providerCredentialsBatchUpdated": "__MISSING__:{actor} batch-updated credentials",
+      "providerCredentialsBulkCreated": "__MISSING__:{actor} bulk-created credentials",
+      "providerCredentialsBulkImported": "__MISSING__:{actor} bulk-imported credentials",
+      "providerCredentialsImported": "__MISSING__:{actor} imported credentials",
+      "providerSsrfBlocked": "__MISSING__:SSRF attempt blocked for {target}",
+      "authLoginSuccess": "__MISSING__:{actor} signed in",
+      "authLoginError": "__MISSING__:Login error for {actor}",
+      "authLoginFailed": "__MISSING__:Login failed for {actor}",
+      "authLoginLocked": "__MISSING__:{actor} locked out after too many attempts",
+      "authLoginMisconfigured": "__MISSING__:Auth configuration invalid",
+      "authLoginSetupRequired": "__MISSING__:Auth setup required",
+      "authLogoutSuccess": "__MISSING__:{actor} signed out",
+      "syncTokenCreated": "__MISSING__:{actor} created sync token",
+      "syncTokenRevoked": "__MISSING__:{actor} revoked sync token",
+      "settingsUpdate": "__MISSING__:{actor} updated settings",
+      "settingsUpdateFailed": "__MISSING__:Settings update failed",
+      "serviceRevealApiKey": "__MISSING__:{actor} revealed API key for {target}",
+      "genericEvent": "__MISSING__:{actor} {target}"
+    }
+  },
+  "agentBridge": {
+    "title": "__MISSING__:AgentBridge",
+    "subtitle": "__MISSING__:Use IDE agents with OmniRoute models — no config required",
+    "riskBannerTitle": "__MISSING__:Use at your own risk",
+    "riskBannerBody": "__MISSING__:AgentBridge intercepts HTTPS traffic from IDE agents. By activating it you accept responsibility for compliance with the terms of service of each agent. Never use on devices or networks where TLS inspection is prohibited.",
+    "riskBannerDismiss": "__MISSING__:Dismiss",
+    "serverCardTitle": "__MISSING__:AgentBridge Server",
+    "statusRunning": "__MISSING__:Running",
+    "statusStopped": "__MISSING__:Stopped",
+    "statusActive": "__MISSING__:Active",
+    "statusDnsOff": "__MISSING__:DNS off",
+    "statusSetupRequired": "__MISSING__:Setup required",
+    "statusInvestigating": "__MISSING__:Investigating",
+    "serverPort": "__MISSING__:Port",
+    "serverConns": "__MISSING__:Connections",
+    "serverIntercepted": "__MISSING__:Intercepted",
+    "serverLastStarted": "__MISSING__:Last started",
+    "startServer": "__MISSING__:Start",
+    "stopServer": "__MISSING__:Stop",
+    "restartServer": "__MISSING__:Restart",
+    "trustCert": "__MISSING__:Trust Cert",
+    "downloadCert": "__MISSING__:Download Cert",
+    "regenerateCert": "__MISSING__:Regenerate Cert",
+    "starting": "__MISSING__:Starting…",
+    "stopping": "__MISSING__:Stopping…",
+    "restarting": "__MISSING__:Restarting…",
+    "trusting": "__MISSING__:Trusting…",
+    "regenerating": "__MISSING__:Regenerating…",
+    "upstreamCaLabel": "__MISSING__:Upstream CA Certificate (corporate)",
+    "upstreamCaPlaceholder": "__MISSING__:/etc/ssl/certs/corp-ca.pem",
+    "upstreamCaTest": "__MISSING__:Test TLS",
+    "upstreamCaTestOk": "__MISSING__:TLS test passed",
+    "upstreamCaTestError": "__MISSING__:TLS test failed — check the path and CA file",
+    "bypassSectionTitle": "__MISSING__:Bypass List",
+    "bypassSectionDesc": "__MISSING__:Hosts matching these patterns are tunneled directly (no TLS decryption). Defaults include banks, .gov, and corporate SSO.",
+    "bypassDefaultsLabel": "__MISSING__:Default bypass patterns (read-only)",
+    "bypassUserLabel": "__MISSING__:Custom bypass patterns (one per line, glob or regex)",
+    "saveBypassList": "__MISSING__:Save bypass list",
+    "agentListTitle": "__MISSING__:IDE Agents",
+    "filterAll": "__MISSING__:All",
+    "filterActive": "__MISSING__:Active",
+    "filterSetupRequired": "__MISSING__:Setup required",
+    "filterInvestigating": "__MISSING__:Investigating",
+    "searchAgents": "__MISSING__:Search agents…",
+    "noAgentsMatch": "__MISSING__:No agents match the current filter",
+    "agentHosts": "__MISSING__:Intercepted hosts",
+    "certTrusted": "__MISSING__:Certificate trusted",
+    "certNotTrusted": "__MISSING__:Certificate not trusted",
+    "investigatingNotice": "__MISSING__:This agent is under investigation. Hosts and API surface are still being confirmed. Setup will be available once the upstream API is documented.",
+    "modelMappingsLabel": "__MISSING__:Model mappings",
+    "sourceModel": "__MISSING__:Source model (agent native)",
+    "targetModel": "__MISSING__:Target model (OmniRoute)",
+    "noMappings": "__MISSING__:No model mappings configured. Run setup wizard to auto-detect models.",
+    "selectModel": "__MISSING__:Select…",
+    "saveMappings": "__MISSING__:Save mappings",
+    "setupWizard": "__MISSING__:Setup wizard",
+    "startDns": "__MISSING__:Start DNS",
+    "stopDns": "__MISSING__:Stop DNS",
+    "toggling": "__MISSING__:Toggling…",
+    "viewTraffic": "__MISSING__:View traffic",
+    "emptyNoProvidersTitle": "__MISSING__:No providers configured yet",
+    "emptyNoProvidersBody": "__MISSING__:To use AgentBridge, first connect at least one provider. It will be the destination where IDE requests are routed.",
+    "emptyGoToProviders": "__MISSING__:Go to Providers",
+    "wizardTitle": "__MISSING__:Setup wizard",
+    "wizardSubtitle": "__MISSING__:3-step setup",
+    "wizardStep1Label": "__MISSING__:Verify",
+    "wizardStep2Label": "__MISSING__:DNS",
+    "wizardStep3Label": "__MISSING__:Mappings",
+    "wizardStep1Desc": "__MISSING__:Confirm the server is running and the certificate is installed.",
+    "wizardStep2Desc": "__MISSING__:The following entries will be added to /etc/hosts to redirect traffic through AgentBridge:",
+    "wizardStep3Desc": "__MISSING__:You can now configure model mappings in the agent card. Restart the IDE to apply changes.",
+    "wizardStep3Success": "__MISSING__:Agent is configured!",
+    "wizardServerCheck": "__MISSING__:AgentBridge server",
+    "wizardRunning": "__MISSING__:running",
+    "wizardNotRunning": "__MISSING__:not running",
+    "wizardCertCheck": "__MISSING__:Certificate",
+    "wizardTrusted": "__MISSING__:trusted",
+    "wizardNotTrusted": "__MISSING__:not yet trusted — use Trust Cert button",
+    "wizardTutorialTitle": "__MISSING__:Setup instructions:",
+    "wizardEnableDns": "__MISSING__:Add /etc/hosts entries",
+    "wizardDnsAlreadyEnabled": "__MISSING__:DNS already enabled for this agent",
+    "enablingDns": "__MISSING__:Enabling…",
+    "modelSelectorTitle": "__MISSING__:Select target model",
+    "modelSelectorSearch": "__MISSING__:Search models…",
+    "noModelsFound": "__MISSING__:No models found",
+    "quickLinks": "__MISSING__:Quick links",
+    "quickLinkProviders": "__MISSING__:Configure providers",
+    "quickLinkInspector": "__MISSING__:View traffic in Traffic Inspector",
+    "maintenanceTitle": "__MISSING__:Maintenance & Diagnostics",
+    "maintenanceSubtitle": "__MISSING__:Self-test the capture pipeline, undo leftover system state, and move your setup between machines.",
+    "orphanedStateWarning": "__MISSING__:A previous session left system state behind (DNS spoof, CA, or system proxy). Run Repair to clean it up.",
+    "diagnose": "__MISSING__:Diagnose",
+    "diagnosing": "__MISSING__:Diagnosing…",
+    "diagnoseHealthy": "__MISSING__:Capture pipeline is healthy.",
+    "diagnoseUnhealthy": "__MISSING__:Capture pipeline has problems:",
+    "repair": "__MISSING__:Repair",
+    "repairing": "__MISSING__:Repairing…",
+    "repairDone": "__MISSING__:Repaired: {items}",
+    "repairNothing": "__MISSING__:Nothing to repair — system state is clean.",
+    "removeCa": "__MISSING__:Remove CA",
+    "removeCaConfirm": "__MISSING__:Remove CA?",
+    "removeCaDone": "__MISSING__:MITM root CA removed from the OS trust store.",
+    "removing": "__MISSING__:Removing…",
+    "confirm": "__MISSING__:Confirm",
+    "exportConfig": "__MISSING__:Export config",
+    "exporting": "__MISSING__:Exporting…",
+    "importConfig": "__MISSING__:Import config",
+    "importing": "__MISSING__:Importing…",
+    "importInvalidJson": "__MISSING__:The selected file is not valid JSON.",
+    "importDone": "__MISSING__:Imported {bypass} bypass · {hosts} hosts · {agents} agents",
+    "save": "__MISSING__:Save",
+    "saving": "__MISSING__:Saving…",
+    "cancel": "__MISSING__:Cancel",
+    "back": "__MISSING__:Back",
+    "next": "__MISSING__:Next",
+    "done": "__MISSING__:Done",
+    "loading": "__MISSING__:Loading…",
+    "riskNoticeTitle": "__MISSING__:Risk acknowledgment",
+    "riskNoticeBody": "__MISSING__:AgentBridge will intercept HTTPS traffic from this agent by redirecting its API hosts via DNS. Only enable if you accept responsibility for compliance with the agent's terms of service and any applicable network policies.",
+    "pageMoved": {
+      "goNow": "__MISSING__:Go now",
+      "message": "__MISSING__:The MITM Proxy now lives under AgentBridge.",
+      "title": "__MISSING__:This page has moved"
+    }
+  },
+  "trafficInspector": {
+    "title": "__MISSING__:Traffic Inspector",
+    "subtitle": "__MISSING__:Monitor LLM calls and debug any application's HTTPS traffic",
+    "captureModesTitle": "__MISSING__:Capture Modes",
+    "agentBridgeMode": "__MISSING__:AgentBridge",
+    "agentBridgeModeDesc": "__MISSING__:Capture traffic from all connected IDE agents",
+    "customHostsMode": "__MISSING__:Custom Hosts",
+    "customHostsModeDesc": "__MISSING__:Add specific hosts to intercept",
+    "httpProxyMode": "__MISSING__:HTTP Proxy",
+    "httpProxyModeDesc": "__MISSING__:Use HTTP_PROXY environment variable",
+    "systemWideMode": "__MISSING__:System-wide",
+    "systemWideModeDesc": "__MISSING__:Intercept all system traffic (advanced)",
+    "tproxyMode": "__MISSING__:TPROXY Decrypt",
+    "tproxyModeUnavailable": "__MISSING__:TPROXY decrypt requires Linux + root + the native addon",
+    "filterBarTitle": "__MISSING__:Filters",
+    "profileLlmOnly": "__MISSING__:LLM only",
+    "profileCustom": "__MISSING__:Custom",
+    "profileAll": "__MISSING__:All",
+    "filterHost": "__MISSING__:Filter host…",
+    "filterAgent": "__MISSING__:Agent",
+    "filterStatus": "__MISSING__:Status",
+    "pauseBtn": "__MISSING__:Pause",
+    "resumeBtn": "__MISSING__:Resume",
+    "clearBtn": "__MISSING__:Clear",
+    "exportHar": "__MISSING__:Export .har",
+    "recordSession": "__MISSING__:REC",
+    "stopSession": "__MISSING__:Stop",
+    "liveBadge": "__MISSING__:live",
+    "offlineBadge": "__MISSING__:offline",
+    "noRequests": "__MISSING__:No requests captured yet.",
+    "noRequestsDesc": "__MISSING__:Make sure AgentBridge is running or enable another capture mode.",
+    "selectRequest": "__MISSING__:Select a request to inspect it.",
+    "tabConversation": "__MISSING__:Conversation",
+    "tabHeaders": "__MISSING__:Headers",
+    "tabRequest": "__MISSING__:Request",
+    "tabResponse": "__MISSING__:Response",
+    "tabTiming": "__MISSING__:Timing",
+    "tabLlm": "__MISSING__:LLM",
+    "tabStats": "__MISSING__:Stats",
+    "requestHeaders": "__MISSING__:Request Headers",
+    "responseHeaders": "__MISSING__:Response Headers",
+    "rawEvents": "__MISSING__:Raw events",
+    "mergedView": "__MISSING__:Merged view",
+    "noBody": "__MISSING__:No body.",
+    "streaming": "__MISSING__:streaming…",
+    "manageHosts": "__MISSING__:Manage hosts",
+    "copySnippet": "__MISSING__:Copy proxy snippet",
+    "addHost": "__MISSING__:Add",
+    "hostPlaceholder": "__MISSING__:api.openai.com",
+    "noHostsYet": "__MISSING__:No custom hosts added yet.",
+    "noSessionsYet": "__MISSING__:No sessions yet",
+    "allTraffic": "__MISSING__:All traffic (no session)",
+    "sessionsDropdown": "__MISSING__:Sessions",
+    "annotationPlaceholder": "__MISSING__:Add a note…",
+    "contextFingerprint": "__MISSING__:Context fingerprint",
+    "llmProvider": "__MISSING__:Detected provider",
+    "llmApiKind": "__MISSING__:API kind",
+    "llmModel": "__MISSING__:Model",
+    "llmMessages": "__MISSING__:Messages",
+    "llmStream": "__MISSING__:Stream",
+    "llmMappedTo": "__MISSING__:Mapped to",
+    "llmCostEstimate": "__MISSING__:Cost estimate",
+    "systemProxyExitWarning": "__MISSING__:System-wide proxy still active — leave page anyway?",
+    "customHostsTitle": "__MISSING__:Custom Hosts",
+    "loading": "__MISSING__:Loading…",
+    "copied": "__MISSING__:Copied!",
+    "copy": "__MISSING__:Copy",
+    "httpProxyTitle": "__MISSING__:HTTP Proxy Snippet — port {port}",
+    "notRecording": "__MISSING__:Not recording",
+    "anyStatus": "__MISSING__:Any status",
+    "liveOnly": "__MISSING__:Live",
+    "viewingRecordedSession": "__MISSING__:Viewing recorded session",
+    "backToLive": "__MISSING__:Back to live",
+    "untitledSession": "__MISSING__:Untitled session",
+    "contextHistory": "__MISSING__:Context History",
+    "modelResponse": "__MISSING__:Model Response",
+    "conversationNoMessages": "__MISSING__:No messages found in this request.",
+    "conversationNotAvailable": "__MISSING__:Conversation data not available. This may not be an LLM request or the body could not be parsed.",
+    "loadingCharts": "__MISSING__:Loading charts…",
+    "statsErrors": "__MISSING__:Errors",
+    "statsLatency": "__MISSING__:Latency (last 50 requests)",
+    "statsNoData": "__MISSING__:No requests yet. Start a session recording to capture data for stats.",
+    "statsStatusDistribution": "__MISSING__:Status distribution",
+    "statsSuccessful": "__MISSING__:Successful",
+    "statsTotalRequests": "__MISSING__:Total requests",
+    "timingProxyOverhead": "__MISSING__:Proxy overhead",
+    "timingUpstreamResponse": "__MISSING__:Upstream response",
+    "timingNoData": "__MISSING__:No timing data available.",
+    "timingTotalLatency": "__MISSING__:Total latency",
+    "timingTimestamp": "__MISSING__:Timestamp",
+    "timingMethod": "__MISSING__:Method",
+    "timingStatus": "__MISSING__:Status",
+    "timingRequestSize": "__MISSING__:Request size",
+    "timingResponseSize": "__MISSING__:Response size",
+    "pausedNewBadge": "__MISSING__:{count} new",
+    "clearContextFilter": "__MISSING__:clear"
+  },
+  "cliCommon": {
+    "concept": {
+      "code": {
+        "title": "__MISSING__:CLI Code",
+        "phrase": "__MISSING__:Code tools you point at OmniRoute",
+        "flow": "__MISSING__:You → CLI Code → OmniRoute → Provider",
+        "seeOther": "__MISSING__:See →"
+      },
+      "agent": {
+        "title": "__MISSING__:CLI Agents",
+        "phrase": "__MISSING__:Broad-purpose autonomous CLI agents you point at OmniRoute",
+        "flow": "__MISSING__:You → CLI Agent → OmniRoute → Provider",
+        "seeOther": "__MISSING__:See →"
+      },
+      "acp": {
+        "title": "__MISSING__:ACP Agents",
+        "phrase": "__MISSING__:CLIs that OmniRoute spawns as execution backend (reverse flow)",
+        "flow": "__MISSING__:Client → OmniRoute → spawn CLI (stdio/ACP) → response",
+        "seeOther": "__MISSING__:See →"
+      }
+    },
+    "comparison": {
+      "title": "__MISSING__:Understand the 3 CLI types in OmniRoute",
+      "thisPage": "__MISSING__:This page",
+      "open": "__MISSING__:Open →",
+      "code": {
+        "title": "__MISSING__:Code tool",
+        "desc": "__MISSING__:Points to Omni",
+        "flow": "__MISSING__:you → CLI → Omni → provider",
+        "examples": "__MISSING__:e.g.: claude, codex"
+      },
+      "agent": {
+        "title": "__MISSING__:Broad autonomous agent",
+        "desc": "__MISSING__:Points to Omni",
+        "flow": "__MISSING__:you → agent → Omni",
+        "examples": "__MISSING__:e.g.: hermes, goose"
+      },
+      "acp": {
+        "title": "__MISSING__:CLI used as backend by Omni",
+        "desc": "__MISSING__:Reverse execution",
+        "flow": "__MISSING__:Omni → spawn CLI → resp",
+        "examples": "__MISSING__:e.g.: claude, codex (ACP)"
+      }
+    },
+    "card": {
+      "detected": "__MISSING__:Detected",
+      "notDetected": "__MISSING__:Not detected",
+      "configured": "__MISSING__:Configured",
+      "notConfigured": "__MISSING__:Not configured",
+      "configure": "__MISSING__:Configure →",
+      "howToInstall": "__MISSING__:How to install →",
+      "manualConfig": "__MISSING__:Manual config",
+      "installGuide": "__MISSING__:Install guide",
+      "endpointLabel": "__MISSING__:Endpoint",
+      "baseUrlFull": "__MISSING__:Full Base URL",
+      "baseUrlPartial": "__MISSING__:Partial Base URL",
+      "refreshDetection": "__MISSING__:Refresh detection",
+      "alsoAcp": "__MISSING__:also ACP",
+      "connectProviderHint": "__MISSING__:Connect a provider in Providers"
+    },
+    "detail": {
+      "back": "__MISSING__:Back",
+      "apply": "__MISSING__:Save",
+      "reset": "__MISSING__:Clear",
+      "manualConfig": "__MISSING__:Manual configuration",
+      "vendor": "__MISSING__:Vendor",
+      "category": "__MISSING__:Type",
+      "detectionStatus": "__MISSING__:Detection",
+      "configStatus": "__MISSING__:Configuration",
+      "baseUrlLabel": "__MISSING__:Base URL",
+      "apiKeyLabel": "__MISSING__:API Key",
+      "modelMappingLabel": "__MISSING__:Model mapping",
+      "noActiveProviders": "__MISSING__:No active providers.",
+      "noActiveProvidersDesc": "__MISSING__:Go to Providers to connect at least 1 provider before configuring the CLI.",
+      "openProviders": "__MISSING__:Open Providers →"
+    }
+  },
+  "cliCode": {
+    "pageTitle": "__MISSING__:CLI Code's",
+    "pageSubtitle": "__MISSING__:Code tools pointing to OmniRoute",
+    "searchPlaceholder": "__MISSING__:Search CLI…",
+    "filterDetectionLabel": "__MISSING__:Detection",
+    "filterBaseUrlLabel": "__MISSING__:Base URL",
+    "detectionAll": "__MISSING__:All",
+    "detectionInstalled": "__MISSING__:Installed",
+    "detectionNotFound": "__MISSING__:Not found",
+    "baseUrlAll": "__MISSING__:All",
+    "baseUrlFull": "__MISSING__:Full",
+    "baseUrlPartial": "__MISSING__:Partial"
+  },
+  "cliAgents": {
+    "pageTitle": "__MISSING__:CLI Agents",
+    "pageSubtitle": "__MISSING__:Broad-purpose autonomous CLI agents",
+    "refreshDetection": "__MISSING__:Refresh detection",
+    "searchPlaceholder": "__MISSING__:Search agent…",
+    "detectionFilterLabel": "__MISSING__:Detection",
+    "detectionAll": "__MISSING__:All",
+    "detectionInstalled": "__MISSING__:Installed",
+    "detectionNotInstalled": "__MISSING__:Not installed",
+    "visibleCount": "__MISSING__:{count} visible",
+    "emptyState": "__MISSING__:No CLI agents found with the current filters."
+  },
+  "acpAgents": {
+    "pageTitle": "__MISSING__:ACP Agents",
+    "pageSubtitle": "__MISSING__:CLIs that OmniRoute spawns as execution backend",
+    "scanning": "__MISSING__:Detecting agents…",
+    "refresh": "__MISSING__:Refresh",
+    "setupGuideTitle": "__MISSING__:Setup guide",
+    "setupGuideDetectCliTitle": "__MISSING__:Detect CLI",
+    "setupGuideDetectCliDesc": "__MISSING__:Agents are identified by running the --version command in PATH.",
+    "setupGuideCustomAgentTitle": "__MISSING__:Add custom agent",
+    "setupGuideCustomAgentDesc": "__MISSING__:Fill in the form below to register a custom CLI agent.",
+    "setupGuideCommandMissingTitle": "__MISSING__:Command not found",
+    "setupGuideCommandMissingDesc": "__MISSING__:Check that the binary is in PATH.",
+    "fingerprintSettingsHint": "__MISSING__:Configure routing and fingerprints in",
+    "settingsRoutingLink": "__MISSING__:Settings → Routing",
+    "installed": "__MISSING__:Installed",
+    "notFound": "__MISSING__:Not found",
+    "builtIn": "__MISSING__:Built-in",
+    "custom": "__MISSING__:Custom",
+    "agentUseCaseHint": "__MISSING__:Available for spawn via ACP.",
+    "remove": "__MISSING__:Remove",
+    "addCustomAgent": "__MISSING__:Add custom agent",
+    "addCustomAgentDesc": "__MISSING__:Register a custom CLI agent to be spawned via ACP.",
+    "addAgent": "__MISSING__:Add agent",
+    "agentName": "__MISSING__:Name",
+    "agentNamePlaceholder": "__MISSING__:e.g.: My Agent",
+    "binaryName": "__MISSING__:Binary",
+    "binaryNamePlaceholder": "__MISSING__:e.g.: myagent",
+    "versionCommand": "__MISSING__:Version command",
+    "versionCommandPlaceholder": "__MISSING__:e.g.: myagent --version",
+    "spawnArgs": "__MISSING__:Spawn arguments",
+    "spawnArgsPlaceholder": "__MISSING__:e.g.: --quiet, --json",
+    "cliCodeRedirectCta": "__MISSING__:Open CLI Code"
+  },
+  "agentSkills": {
+    "pageTitle": "__MISSING__:Agent Skills",
+    "pageSubtitle": "__MISSING__:Teach your agent to operate OmniRoute — 22 API areas + 20 CLI families",
+    "conceptCard": {
+      "agent": {
+        "title": "__MISSING__:Agent Skills — Outbound",
+        "description": "__MISSING__:Agent Skills are machine-readable SKILL.md documents that external AI agents (Claude Code, Cursor, Copilot…) fetch from GitHub to learn how to operate OmniRoute via REST or CLI. They are read by the agent, not executed by OmniRoute.",
+        "crossLinkLabel": "__MISSING__:Understand the difference →"
+      },
+      "omni": {
+        "title": "__MISSING__:Omni Skills — Inbound",
+        "description": "__MISSING__:Omni Skills are sandbox tools that OmniRoute injects into the model's context on every request. They are executed by OmniRoute, not read by the agent.",
+        "crossLinkLabel": "__MISSING__:Understand the difference →"
+      },
+      "comparison": {
+        "colAgent": "__MISSING__:Agent Skills",
+        "colOmni": "__MISSING__:Omni Skills",
+        "whatIs": {
+          "label": "__MISSING__:What it is",
+          "agent": "__MISSING__:Machine-readable SKILL.md that teaches an external agent to operate OmniRoute",
+          "omni": "__MISSING__:Executable tools that OmniRoute injects as tools into LLM requests"
+        },
+        "direction": {
+          "label": "__MISSING__:Direction",
+          "agent": "__MISSING__:Outbound — external agent learns to control OmniRoute",
+          "omni": "__MISSING__:Inbound — OmniRoute gives tools to models passing through it"
+        },
+        "executor": {
+          "label": "__MISSING__:Executor",
+          "agent": "__MISSING__:External agent (reads markdown → acts via API/CLI)",
+          "omni": "__MISSING__:OmniRoute itself (intercepts tool_calls, Docker sandbox)"
+        },
+        "storage": {
+          "label": "__MISSING__:Storage",
+          "agent": "__MISSING__:Dynamic catalog (/api/agent-skills) → SKILL.md on GitHub",
+          "omni": "__MISSING__:SQLite (SkillsMP / skills.sh / local)"
+        },
+        "tagline": {
+          "label": "__MISSING__:Tagline",
+          "agent": "__MISSING__:Teach your agent to use OmniRoute",
+          "omni": "__MISSING__:Give executable tools to OmniRoute models"
+        }
+      }
+    },
+    "filters": {
+      "category": "__MISSING__:Category",
+      "area": "__MISSING__:Area",
+      "searchPlaceholder": "__MISSING__:Search skills…"
+    },
+    "categoryApi": "__MISSING__:API",
+    "categoryCli": "__MISSING__:CLI",
+    "categoryConfig": "__MISSING__:Config",
+    "filterAll": "__MISSING__:All",
+    "coverageLabel": "__MISSING__:Coverage",
+    "mcpUrl": "__MISSING__:MCP URL",
+    "a2aLink": "__MISSING__:A2A",
+    "copyUrl": "__MISSING__:Copy URL",
+    "viewOnGithub": "__MISSING__:View on GitHub",
+    "previewLoading": "__MISSING__:Loading skill documentation…",
+    "previewError": "__MISSING__:Failed to load skill documentation.",
+    "previewEmpty": "__MISSING__:Select a skill to preview its documentation.",
+    "generateButton": "__MISSING__:Generate missing skills",
+    "coverageBar": {
+      "complete": "__MISSING__:Complete",
+      "partial": "__MISSING__:Partial"
+    },
+    "noSkillsFound": "__MISSING__:No skills found matching your filters.",
+    "regenerateConfirm": "__MISSING__:This will regenerate all missing SKILL.md files. Continue?",
+    "regenerateRunning": "__MISSING__:Regenerating skills…",
+    "regenerateSuccess": "__MISSING__:Skills regenerated successfully.",
+    "regenerateError": "__MISSING__:Failed to regenerate skills."
+  },
+  "freeProviderRankingsPage": {
+    "title": "__MISSING__:Free Provider Rankings",
+    "subtitle": "__MISSING__:Best free providers ranked by model ELO scores from Arena AI leaderboards",
+    "loading": "__MISSING__:Loading rankings...",
+    "errorLoading": "__MISSING__:Failed to load rankings",
+    "emptyState": "__MISSING__:No rankings available yet. Arena ELO data syncs on startup (daily) — check back shortly, or trigger a manual sync. Disable Arena ELO Sync in Feature Flags or set ARENA_ELO_SYNC_ENABLED=false to opt out.",
+    "bestModel": "__MISSING__:Best",
+    "allCategories": "__MISSING__:All Categories",
+    "categoryDefault": "__MISSING__:Default",
+    "categoryCoding": "__MISSING__:Coding",
+    "categoryReview": "__MISSING__:Review",
+    "categoryDocumentation": "__MISSING__:Documentation",
+    "categoryDebugging": "__MISSING__:Debugging",
+    "colRank": "__MISSING__:Rank",
+    "colProvider": "__MISSING__:Provider",
+    "colTopModel": "__MISSING__:Top Model",
+    "colScore": "__MISSING__:Score",
+    "colAvgScore": "__MISSING__:Avg Score",
+    "colModels": "__MISSING__:Models",
+    "colType": "__MISSING__:Type"
   }
 }
diff --git a/src/i18n/messages/pl.json b/src/i18n/messages/pl.json
index 112b03c4e1..9c3cca48e4 100644
--- a/src/i18n/messages/pl.json
+++ b/src/i18n/messages/pl.json
@@ -393,6 +393,7 @@
     "cloudBenefitAccess": "Cloud Benefit Access",
     "maxRetries": "Max Retries",
     "queueTimeout": "Queue Timeout",
+    "queueDepth": "__MISSING__:Queue Depth",
     "addProvider": "Add Provider",
     "realtime": "Realtime",
     "totalTranslations": "Total Translations",
@@ -709,6 +710,7 @@
     "batchFilesListFilesTable": "Pliki",
     "batchPageLoadingMore": "Ładowanie więcej…",
     "recommended": "__MISSING__:Recommended",
+    "understand": "__MISSING__:I understand",
     "batchConceptTitle": "Batch processing",
     "batchConceptSubtitle": "Process thousands of requests asynchronously at ~50% of the cost (24h window). Ideal for evaluations, classification, and embeddings.",
     "batchConceptHowItWorks": "How it works",
@@ -773,36 +775,13 @@
     "filesListUploadButton": "Upload",
     "filesListUsedByColumn": "Used by",
     "filesListUsedByNone": "None",
-    "filesListDelete": "Delete",
-    "filesListDownload": "Download",
-    "batchDetailActionCancel": "Cancel batch",
-    "batchDetailActionRetry": "Retry failed requests",
-    "batchDetailCancelling": "Cancelling…",
-    "batchDetailRetrying": "Preparing retry…",
-    "batchDetailCancelConfirm": "Cancel this batch? In-progress requests will stop.",
-    "batchActionCancelError": "Failed to cancel batch. Try again.",
-    "batchActionRetryError": "Failed to retry failed requests. Try again.",
-    "batchConceptRetentionNote": "Results and error files are retained for 30 days (Anthropic: 29 days)",
     "filesListUsedByRoleInput": "input",
     "filesListUsedByRoleOutput": "output",
     "filesListUsedByRoleError": "error",
-    "batchListProgressPartial": "(partial)",
     "filesListSizeColumn": "Size",
+    "batchListProgressPartial": "(partial)",
     "batchListProviderColumn": "Provider",
     "batchListProviderUnknown": "—",
-    "batchListBatchCreated": "Batch {id} created — refreshing list…",
-    "batchListBatchCreatedDismiss": "Dismiss",
-    "batchListRefreshing": "Refreshing…",
-    "batchListRefresh": "Refresh",
-    "uploadFileModalRemove": "Remove",
-    "uploadFileModalUploading": "Uploading…",
-    "wizardInputReading": "Reading file…",
-    "wizardInputReady": "Ready",
-    "wizardInputLargeFileLabel": "Large file — sampling validation",
-    "wizardInputCsvJsonlReady": "JSONL generated — ready to validate.",
-    "wizardInputLargeFileWarning": "Large file detected — validation runs by sampling (first 5 MB + last 100 KB). Full validation happens server-side.",
-    "wizardCostWindow24h": "24h completion window",
-    "wizardValidationFieldsOk": "required fields valid",
     "batchListProviderOther": "Other",
     "batchListTitle": "Batches",
     "batchListCount": "{count} batches",
@@ -839,8 +818,33 @@
     "wizardCostWindow": "Window",
     "wizardDestinationSelectProvider": "Select a provider…",
     "wizardDestinationSelectModel": "Select a model…",
-    "wizardDestinationConnectProvider": "Connect a provider"
+    "wizardDestinationConnectProvider": "Connect a provider",
+    "batchListBatchCreated": "Batch {id} created — refreshing list…",
+    "batchListBatchCreatedDismiss": "Dismiss",
+    "batchListRefreshing": "Refreshing…",
+    "batchListRefresh": "Refresh",
+    "uploadFileModalRemove": "Remove",
+    "uploadFileModalUploading": "Uploading…",
+    "wizardInputReading": "Reading file…",
+    "wizardInputReady": "Ready",
+    "wizardInputLargeFileLabel": "Large file — sampling validation",
+    "wizardInputCsvJsonlReady": "JSONL generated — ready to validate.",
+    "wizardInputLargeFileWarning": "Large file detected — validation runs by sampling (first 5 MB + last 100 KB). Full validation happens server-side.",
+    "wizardCostWindow24h": "24h completion window",
+    "wizardValidationFieldsOk": "required fields valid",
+    "filesListDelete": "Delete",
+    "filesListDownload": "Download",
+    "batchDetailActionCancel": "Cancel batch",
+    "batchDetailActionRetry": "Retry failed requests",
+    "batchDetailCancelling": "Cancelling…",
+    "batchDetailRetrying": "Preparing retry…",
+    "batchDetailCancelConfirm": "Cancel this batch? In-progress requests will stop.",
+    "batchActionCancelError": "Failed to cancel batch. Try again.",
+    "batchActionRetryError": "Failed to retry failed requests. Try again.",
+    "batchConceptRetentionNote": "Results and error files are retained for 30 days (Anthropic: 29 days)"
   },
+  "featureFlagOmnirouteEmergencyFallbackDescription": "__MISSING__:Route budget-exhausted requests to the emergency free fallback provider/model.",
+  "featureFlagArenaEloSyncEnabledDescription": "__MISSING__:Enable periodic Arena AI leaderboard ELO sync for model intelligence rankings.",
   "sidebar": {
     "home": "Dom",
     "dashboard": "Pulpit nawigacyjny",
@@ -968,6 +972,7 @@
     "aiFeaturesSection": "AI Features",
     "mcp": "MCP",
     "a2a": "A2A",
+    "plugins": "__MISSING__:Plugins",
     "apiEndpoints": "API Endpoints",
     "batchFiles": "Files",
     "analyticsEvals": "Evals",
@@ -976,6 +981,10 @@
     "analyticsComboHealth": "Combo Health",
     "analyticsCompression": "Compression",
     "costsBudget": "Budget",
+    "costsFreeTiers": "__MISSING__:Free-Tier Budget",
+    "costsFreeTiersSubtitle": "__MISSING__:Monthly free-token allowances",
+    "freeProviderRankings": "__MISSING__:Free Provider Rankings",
+    "freeProviderRankingsSubtitle": "__MISSING__:Best free providers ranked by model ELO scores",
     "costsQuotaShare": "Quota Sharing",
     "costsPricing": "Pricing",
     "logsProxy": "Proxy Logs",
@@ -987,10 +996,12 @@
     "settingsAppearance": "Appearance",
     "settingsAi": "AI Settings",
     "settingsSecurity": "Security",
+    "settingsAccessTokens": "__MISSING__:Access Tokens",
     "settingsFeatureFlags": "Flagi funkcyjne",
     "settingsAuthz": "__MISSING__:Authz",
     "settingsRouting": "Routing",
     "settingsResilience": "Resilience",
+    "modelLockout": "__MISSING__:Model Lockout",
     "settingsAdvanced": "Advanced",
     "omniProxySection": "OmniProxy",
     "quotaTracker": "Provider Quota",
@@ -1036,6 +1047,8 @@
     "analyticsCompressionSubtitle": "Token savings stats",
     "analyticsSearchSubtitle": "Search tool analytics",
     "analyticsEvalsSubtitle": "Eval suite results",
+    "providerStats": "__MISSING__:Provider Stats",
+    "providerStatsSubtitle": "__MISSING__:Latency and performance metrics",
     "logsSubtitle": "Application logs",
     "logsProxySubtitle": "Proxy traffic logs",
     "consoleLogsSubtitle": "Console output",
@@ -1055,6 +1068,7 @@
     "agentSkillsSubtitle": "A2A skill registry",
     "mcpSubtitle": "MCP server controls",
     "a2aSubtitle": "A2A protocol server",
+    "pluginsSubtitle": "__MISSING__:Plugin marketplace & installs",
     "mediaSubtitle": "Cached media files",
     "batchFilesSubtitle": "Batch input/output files",
     "settingsSubtitle": "All settings",
@@ -1065,13 +1079,41 @@
     "settingsResilienceSubtitle": "Retries and breakers",
     "settingsAdvancedSubtitle": "Power user options",
     "settingsSecuritySubtitle": "Auth and encryption",
+    "settingsAccessTokensSubtitle": "__MISSING__:Scoped CLI tokens for remote mode",
     "settingsFeatureFlagsSubtitle": "Przełącz możliwości systemu",
     "settingsSidebar": "Sidebar",
     "settingsSidebarSubtitle": "Customize sidebar layout",
     "settingsAuthzSubtitle": "__MISSING__:Route inventory and bypass policy",
     "docsSubtitle": "Documentation",
     "issuesSubtitle": "Report a bug",
-    "changelogSubtitle": "Release notes"
+    "changelogSubtitle": "Release notes",
+    "costsQuotaPlans": "__MISSING__:Plans & Quotas",
+    "costsQuotaPlansSubtitle": "__MISSING__:Configure plans by provider",
+    "activity": "__MISSING__:Activity",
+    "activitySubtitle": "__MISSING__:Friendly feed of recent events",
+    "logsGroup": "__MISSING__:Logs",
+    "systemGroup": "__MISSING__:System",
+    "costsOverview": "__MISSING__:Overview",
+    "costsOverviewSubtitle": "__MISSING__:Consolidated cost analysis",
+    "agentBridge": "__MISSING__:Agent Bridge",
+    "agentBridgeSubtitle": "__MISSING__:Intercept IDE agent traffic",
+    "trafficInspector": "__MISSING__:Traffic Inspector",
+    "trafficInspectorSubtitle": "__MISSING__:Monitor LLM calls + debug any HTTPS traffic",
+    "cliCode": "__MISSING__:CLI Code",
+    "cliCodeSubtitle": "__MISSING__:Code tools pointing to OmniRoute",
+    "cliAgents": "__MISSING__:CLI Agents",
+    "cliAgentsSubtitle": "__MISSING__:Autonomous CLI agents",
+    "acpAgents": "__MISSING__:ACP Agents",
+    "acpAgentsSubtitle": "__MISSING__:CLIs spawned by OmniRoute",
+    "skipToContent": "__MISSING__:Skip to content",
+    "unpinSection": "__MISSING__:Unpin section",
+    "pinSectionOpen": "__MISSING__:Pin section open",
+    "reloadPage": "__MISSING__:Reload Page",
+    "dragReorderSection": "__MISSING__:Drag to reorder section",
+    "dragReorderItem": "__MISSING__:Drag to reorder",
+    "cannotHide": "__MISSING__:This item cannot be hidden",
+    "alwaysVisible": "__MISSING__:Always visible",
+    "groupSeparatorLabel": "__MISSING__:Separator"
   },
   "webhooks": {
     "title": "Haki internetowe",
@@ -1272,7 +1314,47 @@
     "a2aEvents": "Wydarzenia",
     "a2aArtifacts": "Artefakty",
     "a2aNoTasks": "Nie zarejestrowano żadnych zadań A2A.",
-    "a2aLoadingTasks": "Ładowanie zadań A2A..."
+    "a2aLoadingTasks": "Ładowanie zadań A2A...",
+    "actor": "__MISSING__:Actor",
+    "actorPlaceholder": "__MISSING__:Filter by actor",
+    "eventTypes": {
+      "apiKey.activate": "__MISSING__:API Key Activated",
+      "apiKey.ban": "__MISSING__:API Key Banned",
+      "apiKey.deactivate": "__MISSING__:API Key Deactivated",
+      "apiKey.regenerate": "__MISSING__:API Key Regenerated",
+      "apiKey.scopes.grant": "__MISSING__:API Key Scopes Granted",
+      "apiKey.scopes.revoke": "__MISSING__:API Key Scopes Revoked",
+      "apiKey.scopes.update": "__MISSING__:API Key Scopes Updated",
+      "apiKey.unban": "__MISSING__:API Key Unbanned",
+      "auth.login.error": "__MISSING__:Login Error",
+      "auth.login.failed": "__MISSING__:Login Failed",
+      "auth.login.locked": "__MISSING__:Login Locked",
+      "auth.login.misconfigured": "__MISSING__:Login Misconfigured",
+      "auth.login.setup_required": "__MISSING__:Login Setup Required",
+      "auth.login.success": "__MISSING__:Login Success",
+      "auth.logout.success": "__MISSING__:Logout Success",
+      "compliance.cleanup": "__MISSING__:Compliance Cleanup",
+      "provider.credentials.applied": "__MISSING__:Provider Credentials Applied",
+      "provider.credentials.batch_revoked": "__MISSING__:Provider Credentials Batch Revoked",
+      "provider.credentials.bulk_created": "__MISSING__:Provider Credentials Bulk Created",
+      "provider.credentials.bulk_imported": "__MISSING__:Provider Credentials Bulk Imported",
+      "provider.credentials.created": "__MISSING__:Provider Credentials Created",
+      "provider.credentials.imported": "__MISSING__:Provider Credentials Imported",
+      "provider.credentials.revoked": "__MISSING__:Provider Credentials Revoked",
+      "provider.credentials.updated": "__MISSING__:Provider Credentials Updated",
+      "provider.validation.ssrf_blocked": "__MISSING__:Provider SSRF Blocked",
+      "quota.plan.updated": "__MISSING__:Quota Plan Updated",
+      "quota.pool.created": "__MISSING__:Quota Pool Created",
+      "quota.pool.deleted": "__MISSING__:Quota Pool Deleted",
+      "quota.pool.updated": "__MISSING__:Quota Pool Updated",
+      "quota.store.driver_changed": "__MISSING__:Quota Store Driver Changed",
+      "server.start": "__MISSING__:Server Start",
+      "service.reveal_api_key": "__MISSING__:Service API Key Revealed",
+      "settings.update": "__MISSING__:Settings Updated",
+      "settings.update_failed": "__MISSING__:Settings Update Failed",
+      "sync.token.created": "__MISSING__:Sync Token Created",
+      "sync.token.revoked": "__MISSING__:Sync Token Revoked"
+    }
   },
   "themesPage": {
     "title": "Themes",
@@ -1381,7 +1463,8 @@
     "settingsResilienceDescription": "Circuit breaker, retry, and fallback configuration",
     "settingsAdvancedDescription": "Advanced payload rules, request limits, and proxy API settings",
     "mitmProxyDescription": "Configure MITM proxy settings for traffic inspection and debugging",
-    "oneProxyDescription": "Configure 1Proxy settings for advanced proxy chaining"
+    "oneProxyDescription": "Configure 1Proxy settings for advanced proxy chaining",
+    "omniSkillsDescription": "__MISSING__:Install and manage sandbox skills for automated prompt and tool execution"
   },
   "home": {
     "quickStart": "Szybki start",
@@ -1612,16 +1695,24 @@
     "ownUsageVisibilityDesc": "Zezwól temu kluczowi wywołać własny endpoint statusu, aby zobaczyć własne użycie USD, procent budżetu i sumy tokenów.",
     "sharedAccountQuotaVisibility": "Współdzielony limit konta",
     "sharedAccountQuotaVisibilityDesc": "Zezwól temu kluczowi zobaczyć współdzielony limit konta upstream, gdy skonfigurowano jedno jawne połączenie.",
+    "localUsageCommand": "__MISSING__:Allow local usage command",
+    "localUsageCommandDesc": "__MISSING__:Allows this API key to use @@om-usage to retrieve cached usage and quota information without calling an upstream provider.",
+    "localUsageCommandBadge": "__MISSING__:Usage cmd",
     "keyCreated": "Utworzono klucz API",
     "keyCreatedSuccess": "Klucz został utworzony pomyślnie!",
     "keyCreatedNote": "Skopiuj i zapisz ten klucz teraz — nie będzie on więcej wyświetlany.",
     "done": "Gotowe",
     "savePermissions": "Zapisz uprawnienia",
-    "endpointRestrictions": "__MISSING__:Allowed Endpoints",
-    "allEndpointsAllowed": "__MISSING__:This key can access all API endpoints.",
-    "endpointsRestricted": "__MISSING__:Restricted to {count} endpoint{count, plural, one {} other {s}}.",
+    "endpointRestrictions": "Allowed Endpoints",
+    "allEndpointsAllowed": "This key can access all API endpoints.",
+    "endpointsRestricted": "Restricted to {count} endpoint{count, plural, one {} other {s}}.",
     "autoResolve": "Auto-Resolve",
     "autoResolveDesc": "Auto-resolve ambiguous model names to native provider for this API key.",
+    "streamDefaultMode": "__MISSING__:Stream Default Compatibility",
+    "streamDefaultModeDesc": "__MISSING__:Controls omitted `stream` flags for this key. JSON mode returns non-streaming responses unless the client explicitly requests SSE.",
+    "streamDefaultLegacy": "__MISSING__:Legacy",
+    "streamDefaultJson": "__MISSING__:JSON Compatible",
+    "streamDefaultBadge": "__MISSING__:JSON stream default",
     "keyActive": "Key Active",
     "keyActiveDesc": "Enable or disable this API key. Disabled keys are immediately rejected with 403.",
     "accessSchedule": "Access Schedule",
@@ -1667,6 +1758,7 @@
     "keyOnlyAvailableAtCreation": "Full key available only at creation time — copy it when you first create the key",
     "modelsCount": "{count, plural, one {# model} other {# models}}",
     "lastUsedOn": "Ostatni: {date}",
+    "viewCostsFor": "__MISSING__:View costs for {name}",
     "editPermissions": "Edytuj uprawnienia",
     "deleteKey": "Usuń klucz",
     "regenerateKey": "Zregeneruj klucz",
@@ -1708,9 +1800,12 @@
     "shownOf": "__MISSING__:{shown} of {total} shown",
     "emptyFilterTitle": "__MISSING__:No keys match your filters",
     "emptyFilterClear": "__MISSING__:Clear filters",
-    "endpointRestrictions": "Allowed Endpoints",
-    "allEndpointsAllowed": "This key can access all API endpoints.",
-    "endpointsRestricted": "Restricted to {count} endpoint{count, plural, one {} other {s}}."
+    "disableNonPublicModels": "__MISSING__:Disable Non-Public Models",
+    "disableNonPublicModelsDesc": "__MISSING__:Reject requests for models that are not discovered or not marked as public in the provider catalog",
+    "normalKeysSection": "__MISSING__:Normal keys",
+    "quotaKeysSection": "__MISSING__:Quota keys",
+    "quotaPill": "__MISSING__:QUOTA",
+    "quotaModeOnly": "__MISSING__:qtSd-only"
   },
   "auditLog": {
     "title": "Dziennik audytu",
@@ -1845,6 +1940,8 @@
     "freeQuota": "Free quota/mo",
     "scrapeUrl": "URL to scrape",
     "scrapeUrlPlaceholder": "https://example.com",
+    "scrapeUrlRequired": "__MISSING__:URL is required",
+    "scrapeUrlInvalid": "__MISSING__:Invalid URL — it must start with http:// or https://",
     "scrapeExtract": "Extract",
     "scrapeExtracting": "Extracting…",
     "scrapeFullPage": "Full page",
@@ -1858,6 +1955,8 @@
     "scrapeMetadata": "Metadata",
     "scrapeProvider": "Provider",
     "scrapeSize": "Size",
+    "scrapeEmptyState": "__MISSING__:Enter a URL to extract its content",
+    "scrapeProvidersAvailable": "__MISSING__:Available providers: Firecrawl, Jina Reader, Tavily.",
     "compareRun": "Compare",
     "compareRunning": "Comparing…",
     "autoProvider": "Auto (cheapest)",
@@ -2245,6 +2344,8 @@
     "leastLatency": "Najmniejsze opóźnienie",
     "comboName": "Nazwa kombinacji",
     "comboNamePlaceholder": "moja kombinacja",
+    "comboDescription": "__MISSING__:Description",
+    "comboDescriptionPlaceholder": "__MISSING__:Optional note describing this combo",
     "deleteConfirm": "Usunąć tę kombinację?",
     "noCombosYet": "Nie ma jeszcze żadnych kombinacji",
     "comboCreated": "Kombinacja utworzona pomyślnie",
@@ -2284,6 +2385,8 @@
     "resetAwareDesc": "Bilansuje pozostały limit w stosunku do 5-godzinnych i cotygodniowych resetów, a następnie w systemie okrężnym uzyskuje podobne wyniki",
     "strictRandom": "Strict Random",
     "strictRandomDesc": "Shuffle deck — uses each model once before reshuffling",
+    "fusion": "__MISSING__:Fusion",
+    "fusionDesc": "__MISSING__:Fans the prompt to every panel model in parallel, then a judge model synthesizes one final answer",
     "models": "Modele",
     "autoBalance": "Automatyczne balansowanie",
     "advancedSettings": "Ustawienia zaawansowane",
@@ -2982,14 +3085,19 @@
     "ngrokStarted": "Ruszył tunel Ngrok",
     "ngrokStopped": "Tunel Ngrok zatrzymał się",
     "ngrokRequestFailed": "Nie udało się zaktualizować tunelu Ngrok",
-    "tokenSaverSubtitle": "Wydawaj mniej tokenów na każde żądanie.",
-    "tokenSaverToolOutput": "Wyjście narzędzia",
-    "tokenSaverLlmOutput": "Wyjście LLM",
-    "tokenSaverInputCompression": "Kompresja wejściowa",
     "apiEndpointsCatalogUnavailable": "Katalog API niedostępny",
     "apiEndpointsSearchPlaceholder": "Wyszukaj punkty końcowe...",
     "apiEndpointsRequiresAuth": "Wymaga autoryzacji",
     "apiEndpointsNoMatch": "Żaden punkt końcowy nie pasuje do Twojego filtra",
+    "vscodeAliasTitle": "__MISSING__:VS Code Token Alias",
+    "vscodeAliasDescriptionReady": "__MISSING__:Ready-to-paste compatibility URLs using the /api/v1/vscode/TOKEN/... endpoint.",
+    "vscodeAliasDescriptionError": "__MISSING__:Showing placeholder URLs because CLI keys could not be loaded in this session.",
+    "vscodeAliasDescriptionLoading": "__MISSING__:Loading CLI keys. Placeholder URLs are shown until a key is available.",
+    "vscodeAliasDescriptionPlaceholder": "__MISSING__:Showing placeholder URLs. Create or activate an API key in CLI Tools to replace TOKEN.",
+    "vscodeAliasManage": "__MISSING__:CLI Tools",
+    "vscodeAliasBaseLabel": "__MISSING__:VS Code base",
+    "vscodeAliasModelsLabel": "__MISSING__:VS Code models",
+    "vscodeAliasChatLabel": "__MISSING__:VS Code chat",
     "localServer": "Serwer lokalny",
     "cloudOmniroute": "Chmura OmniRoute",
     "copyUrl": "Skopiuj adres URL",
@@ -3002,7 +3110,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
@@ -3178,42 +3289,187 @@
     "a2aStep3": "__MISSING__:Track and cancel tasks with {code1} and {code2}."
   },
   "memory": {
-    "title": "Memory Management",
-    "description": "View and manage stored memory entries",
-    "memories": "Memories",
-    "totalEntries": "Total Entries",
-    "tokensUsed": "Tokens Used",
-    "hitRate": "Hit Rate",
-    "loading": "Loading memories...",
-    "noMemories": "No memories found",
-    "search": "Search memories...",
-    "allTypes": "All Types",
-    "export": "Export",
-    "import": "Import",
-    "addMemory": "Add Memory",
-    "type": "Type",
-    "key": "Key",
-    "content": "Content",
-    "created": "Created",
-    "actions": "Actions",
-    "delete": "Delete",
-    "factual": "Factual",
-    "episodic": "Episodic",
-    "procedural": "Procedural",
-    "semantic": "Semantic",
     "a": "A",
-    "pipelineOk": "Potok OK ({latencyMs}ms)",
-    "pipelineError": "Błąd rurociągu",
-    "healthUnknown": "Zdrowie nieznane",
-    "checkingHealth": "Sprawdzam…",
-    "checkHealth": "Sprawdź zdrowie",
-    "pageInfo": "Strona {page} z {totalPages} (łącznie {total})",
-    "previous": "Poprzedni",
-    "next": "Następny",
+    "actions": "Actions",
+    "addMemory": "Add Memory",
+    "allTypes": "All Types",
     "cancel": "Anuluj",
-    "save": "Zapisz",
+    "checkHealth": "Sprawdź zdrowie",
+    "checkingHealth": "Sprawdzam…",
+    "compactOld": "__MISSING__:Compact old",
+    "concept": {
+      "title": "__MISSING__:Conversational Memory",
+      "description": "__MISSING__:OmniRoute learns from every conversation, remembering facts, episodes, procedures, and semantic concepts that make responses more accurate and context-aware.",
+      "howWorksToggle": "__MISSING__:How it works",
+      "howWorksContent": "__MISSING__:1. Automatic extraction: at the end of each response, facts and episodes are detected and saved automatically.\n2. Retrieval: before each response, the most relevant memories are searched via FTS5 (exact), vector (semantic), or hybrid RRF.\n3. Injection: relevant memories are injected into the assistant context to improve response quality.\n4. Management: use this page to view, edit, export, and compact old memories."
+    },
+    "content": "Content",
+    "contentPlaceholder": "Wartość lub treść JSON do zapamiętania",
+    "created": "Created",
+    "delete": "Delete",
+    "deleteConfirmDesc": "__MISSING__:This action cannot be undone. The memory will be permanently removed.",
+    "deleteConfirmTitle": "__MISSING__:Delete memory?",
+    "description": "View and manage stored memory entries",
+    "editMemory": "__MISSING__:Edit memory",
+    "editModal": {
+      "title": "__MISSING__:Edit Memory",
+      "metadataLabel": "__MISSING__:Metadata (JSON)",
+      "metadataInvalid": "__MISSING__:Invalid JSON",
+      "saveFailed": "__MISSING__:Failed to save memory"
+    },
+    "embedding": {
+      "autoLabel": "__MISSING__:Automatic",
+      "autoDesc": "__MISSING__:Uses best available: remote provider > static > transformers",
+      "remoteLabel": "__MISSING__:Remote provider",
+      "remoteDesc": "__MISSING__:Uses embedding via provider API (requires API key)",
+      "staticLabel": "__MISSING__:Static local (potion)",
+      "staticDesc": "__MISSING__:Local embedding without WASM or external dependencies",
+      "transformersLabel": "__MISSING__:Transformers.js (MiniLM)",
+      "transformersDesc": "__MISSING__:Local embedding via @huggingface/transformers (~400MB RAM)",
+      "providerModelLabel": "__MISSING__:Provider / Model",
+      "noRemoteProviders": "__MISSING__:No providers with configured API key",
+      "selectProviderModel": "__MISSING__:Select a model",
+      "staticEnabledLabel": "__MISSING__:Enable Static Potion",
+      "staticEnabledDesc": "__MISSING__:Download and use potion-base-8M model locally",
+      "transformersEnabledLabel": "__MISSING__:Enable Transformers.js",
+      "transformersEnabledDesc": "__MISSING__:Opt-in for local MiniLM (~400MB RAM, ~3s cold start)",
+      "transformersWarning": "__MISSING__:Requires ~400MB RAM and ~3s cold start on the first semantic query."
+    },
+    "emptyState": {
+      "title": "__MISSING__:No memories yet",
+      "description": "__MISSING__:Memories are created automatically from conversations. You can also add them manually using the button above."
+    },
+    "engine": {
+      "statusTitle": "__MISSING__:Engine Status",
+      "embeddingTitle": "__MISSING__:Embedding Source",
+      "rerankTitle": "__MISSING__:Rerank (optional)",
+      "reindexNow": "__MISSING__:Reindex now",
+      "reindexStarted": "__MISSING__:Reindexing started ({pending} pending)",
+      "reindexFailed": "__MISSING__:Failed to start reindexing",
+      "keywordLabel": "__MISSING__:Keyword (FTS5)",
+      "keywordReason": "__MISSING__:Keyword search always available",
+      "embeddingLabel": "__MISSING__:Embedding",
+      "vectorStoreLabel": "__MISSING__:Vector Store",
+      "qdrantLabel": "__MISSING__:Qdrant",
+      "rerankLabel": "__MISSING__:Rerank",
+      "qdrantDisabled": "__MISSING__:Disabled",
+      "qdrantOk": "__MISSING__:Healthy ({latencyMs}ms)",
+      "qdrantError": "__MISSING__:Connection error",
+      "needsReindex": "__MISSING__:{count} memory(ies) need reindexing",
+      "configureCta": "__MISSING__:Configure",
+      "vectorStoreInstallHint": "__MISSING__:To enable vector search: npm install sqlite-vec (needs native Node.js, not WASM), then restart."
+    },
+    "episodic": "Episodic",
+    "export": "Export",
+    "factual": "Factual",
+    "healthUnknown": "Zdrowie nieznane",
+    "hitRate": "Hit Rate",
+    "import": "Import",
+    "importError": "__MISSING__:Failed to import file",
+    "importResult": "__MISSING__:{imported} imported, {skipped} skipped",
+    "key": "Key",
     "keyPlaceholder": "np. motyw.preferencji.użytkownika",
-    "contentPlaceholder": "Wartość lub treść JSON do zapamiętania"
+    "loading": "Loading memories...",
+    "memories": "Memories",
+    "next": "Następny",
+    "noMemories": "No memories found",
+    "pageInfo": "Strona {page} z {totalPages} (łącznie {total})",
+    "pipelineError": "Błąd rurociągu",
+    "pipelineOk": "Potok OK ({latencyMs}ms)",
+    "playground": {
+      "infoTitle": "__MISSING__:Memory Playground",
+      "infoDesc": "__MISSING__:Simulate what would be retrieved for a given query. No memories are modified — read-only preview.",
+      "queryLabel": "__MISSING__:Test query",
+      "queryPlaceholder": "__MISSING__:Type a question or test phrase...",
+      "strategyLabel": "__MISSING__:Strategy",
+      "strategyExact": "__MISSING__:Exact (FTS5)",
+      "strategySemantic": "__MISSING__:Semantic (vector)",
+      "strategyHybrid": "__MISSING__:Hybrid (RRF)",
+      "budgetLabel": "__MISSING__:Budget (tokens)",
+      "simulate": "__MISSING__:Simulate",
+      "resultsTitle": "__MISSING__:{count} result(s)",
+      "resolutionTitle": "__MISSING__:Search resolution",
+      "resolutionEmbedding": "__MISSING__:Embedding",
+      "resolutionStore": "__MISSING__:Vector store",
+      "resolutionStrategy": "__MISSING__:Strategy used",
+      "rerankApplied": "__MISSING__:Rerank applied",
+      "fallback": "__MISSING__:Fallback",
+      "noResults": "__MISSING__:No memories found for this query.",
+      "tokensUsed": "__MISSING__:tokens used",
+      "none": "__MISSING__:none",
+      "errorFetch": "__MISSING__:Failed to fetch preview"
+    },
+    "previous": "Poprzedni",
+    "procedural": "Procedural",
+    "qdrant": {
+      "title": "__MISSING__:Qdrant (Vector Store Tier 2)",
+      "description": "__MISSING__:Optional Qdrant integration for scalable semantic search",
+      "enableLabel": "__MISSING__:Enable Qdrant",
+      "enableDesc": "__MISSING__:When enabled, Qdrant is used as the primary vector store",
+      "testConnection": "__MISSING__:Test connection",
+      "testing": "__MISSING__:Testing...",
+      "statusActive": "__MISSING__:Active",
+      "statusError": "__MISSING__:Error",
+      "statusDisabled": "__MISSING__:Disabled",
+      "healthOk": "__MISSING__:Connection OK ({latencyMs}ms)",
+      "healthError": "__MISSING__:Connection error",
+      "saved": "__MISSING__:Settings saved",
+      "saveError": "__MISSING__:Failed to save",
+      "portLabel": "__MISSING__:Port",
+      "embeddingModelLabel": "__MISSING__:Embedding Model",
+      "optional": "__MISSING__:optional",
+      "apiKeyKeepPlaceholder": "__MISSING__:Leave blank to keep current key",
+      "apiKeyOptional": "__MISSING__:Leave blank if not using authentication",
+      "removeApiKey": "__MISSING__:Remove",
+      "quickSelectModel": "__MISSING__:Quick select",
+      "searchTestTitle": "__MISSING__:Semantic search test",
+      "searchPlaceholder": "__MISSING__:Type a test query...",
+      "searching": "__MISSING__:Searching...",
+      "search": "__MISSING__:Search",
+      "cleanupTitle": "__MISSING__:Clean up old points",
+      "cleanupDesc": "__MISSING__:Remove Qdrant points for expired memories (retention period).",
+      "cleaning": "__MISSING__:Cleaning...",
+      "cleanNow": "__MISSING__:Clean now",
+      "cleanupSuccess": "__MISSING__:{count} point(s) removed",
+      "cleanupFailed": "__MISSING__:Cleanup failed"
+    },
+    "rerank": {
+      "enableLabel": "__MISSING__:Enable Rerank",
+      "enableDesc": "__MISSING__:Reorders results with a reranking model after search",
+      "warning": "__MISSING__:Rerank adds +200-500ms latency and additional cost per request. Use sparingly.",
+      "providerModelLabel": "__MISSING__:Rerank Provider / Model",
+      "noProviderWithKey": "__MISSING__:No provider with configured API key. Configure a provider to use rerank.",
+      "selectProviderModel": "__MISSING__:Select a provider/model"
+    },
+    "save": "Zapisz",
+    "saving": "__MISSING__:Saving...",
+    "search": "Search memories...",
+    "semantic": "Semantic",
+    "summarize": {
+      "title": "__MISSING__:Compact old memories",
+      "noCandidates": "__MISSING__:No memories eligible for compaction (criteria: >30 days old).",
+      "candidatesDesc": "__MISSING__:{count} memories will be compacted into summaries. This action cannot be undone.",
+      "confirm": "__MISSING__:Compact now"
+    },
+    "tabs": {
+      "memories": "__MISSING__:Memories",
+      "playground": "__MISSING__:Playground",
+      "engine": "__MISSING__:Engine"
+    },
+    "title": "Memory Management",
+    "tokensUsed": "Tokens Used",
+    "tooltip": {
+      "totalEntries": "__MISSING__:Total memories stored for this API key",
+      "tokensUsed": "__MISSING__:Estimated total tokens occupied by active memories",
+      "hitRate": "__MISSING__:Read-by-ID cache hit rate (not semantic recall accuracy)",
+      "factual": "__MISSING__:Objective, permanent facts from user context",
+      "episodic": "__MISSING__:Events and experiences from conversation history",
+      "procedural": "__MISSING__:Procedures, workflows, and instructions the assistant should follow",
+      "semantic": "__MISSING__:Concepts, preferences, and domain knowledge"
+    },
+    "totalEntries": "Total Entries",
+    "type": "Type",
+    "memoryEnabled": "__MISSING__:Memory enabled"
   },
   "skills": {
     "title": "Skills",
@@ -3544,6 +3800,14 @@
     "export": "Export",
     "exporting": "Exporting...",
     "exportFailed": "Export failed",
+    "cleanHistoryButton": "__MISSING__:Clean history",
+    "cleanHistoryTitle": "__MISSING__:Clean log history?",
+    "cleanHistoryMessage": "__MISSING__:This permanently clears all request log rows, legacy detail rows, and local artifact files under DATA_DIR/call_logs. The live page will refresh after cleanup.",
+    "cleanHistoryConfirm": "__MISSING__:Clean history",
+    "cleanHistoryCancel": "__MISSING__:Cancel",
+    "cleanHistorySuccess": "__MISSING__:Cleaned {deleted} log entries, {deletedArtifacts} artifacts, and {deletedDetailedLogs} legacy detail rows.",
+    "cleanHistoryEmpty": "__MISSING__:No request log history was found.",
+    "cleanHistoryFailed": "__MISSING__:Failed to clean log history.",
     "timeRange": "Time Range",
     "lastNHours": "Last {hours}",
     "defaultRange": "default",
@@ -3551,10 +3815,14 @@
       "fetchFailed": "Failed to fetch logs",
       "copyFailed": "Failed to copy log entry",
       "copyLogEntry": "Copy log entry"
-    }
+    },
+    "compressionLogTitle": "__MISSING__:Compression Log",
+    "compressionLogEmpty": "__MISSING__:No compressed requests yet. Compression stats will appear here when requests are processed with compression enabled.",
+    "tokens": "__MISSING__:tokens"
   },
   "onboarding": {
     "welcome": "Witamy",
+    "tiers": "__MISSING__:Tiers",
     "security": "Bezpieczeństwo",
     "test": "Testuj",
     "ready": "Gotowy!",
@@ -3616,6 +3884,7 @@
   },
   "providers": {
     "title": "Dostawcy",
+    "Account Deactivated": "__MISSING__:Account Deactivated",
     "allProviders": "Wszyscy dostawcy",
     "audioProviders": "Dostawcy dźwięku",
     "showFreeOnly": "Tylko bezpłatne",
@@ -3623,6 +3892,33 @@
     "addFirstProvider": "Dodaj swojego pierwszego dostawcę",
     "addFirstProviderDesc": "Połącz się z dostawcą AI, aby rozpocząć kierowanie żądań przez OmniRoute. Możesz korzystać z bezpłatnych dostawców, kluczy API lub kont OAuth.",
     "learnMore": "Dowiedz się więcej",
+    "adaptaTutorial": {
+      "title": "__MISSING__:How to connect Adapta Web",
+      "introPrefix": "__MISSING__:Adapta authenticates through Clerk. The token",
+      "introSuffix": "__MISSING__:is a long-lived JWT that lets OmniRoute refresh sessions automatically.",
+      "or": "__MISSING__:or",
+      "step1Title": "__MISSING__:Open Adapta chat",
+      "step1DescPrefix": "__MISSING__:Open",
+      "step1DescSuffix": "__MISSING__:and sign in with your Gold or Business account.",
+      "step2Title": "__MISSING__:Open DevTools",
+      "step2DescPrefix": "__MISSING__:Press",
+      "step2DescSuffix": "__MISSING__:to open Developer Tools.",
+      "step3Title": "__MISSING__:Go to Application → Cookies",
+      "step3DescPrefix": "__MISSING__:In the",
+      "step3DescMiddle": "__MISSING__:expand",
+      "step3DescSuffix": "__MISSING__:and click",
+      "step4Title": "__MISSING__:Copy the cookie value for",
+      "step4DescPrefix": "__MISSING__:Find the cookie named",
+      "step4DescMiddle": "__MISSING__:in the list. Click it and copy the content from the",
+      "step4DescSuffix": "__MISSING__:column. It starts with",
+      "step5Title": "__MISSING__:Paste it here and save",
+      "step5DescPrefix": "__MISSING__:Click",
+      "step5DescMiddle": "__MISSING__:paste the",
+      "step5DescSuffix": "__MISSING__:value into the API Key field, then save. OmniRoute will refresh the session automatically.",
+      "tipLabel": "__MISSING__:Tip:",
+      "tipPrefix": "__MISSING__:The",
+      "tipSuffix": "__MISSING__:cookie is long-lived, usually for months. You only need to renew it if you sign out or Adapta invalidates the session."
+    },
     "editProvider": "Edytuj dostawcę",
     "deleteProvider": "Usuń dostawcę",
     "noProviders": "Nie skonfigurowano żadnych dostawców",
@@ -3648,13 +3944,38 @@
     "apiKeyProviders": "Dostawcy kluczy API",
     "compatibleProviders": "Dostawcy obsługujący klucz API",
     "testAll": "Przetestuj wszystko",
+    "distributeProxies": "__MISSING__:Distribute Proxies",
+    "distributing": "__MISSING__:Distributing...",
+    "selectedCount": "__MISSING__:{count, plural, one {# selected} other {# selected}}",
+    "accountsCount": "__MISSING__:{count, plural, one {# account} other {# accounts}}",
     "testAllOAuth": "Przetestuj wszystkie połączenia OAuth",
     "testAllFree": "Przetestuj wszystkie bezpłatne połączenia",
     "testAllApiKey": "Przetestuj wszystkie połączenia klucza API",
     "testAllCompatible": "Przetestuj wszystkie kompatybilne połączenia",
+    "testAllModels": "__MISSING__:Test all models",
+    "testAllModelsConfirm": "__MISSING__:Test all visible models? Failed models will be hidden if auto-hide is enabled.",
+    "testingAllModels": "__MISSING__:Testing {done}/{total}...",
+    "testAllResults": "__MISSING__:{ok} of {total} models working",
+    "noModelsToTest": "__MISSING__:No models match the current filter",
+    "showAllModels": "__MISSING__:All",
+    "showVisibleOnly": "__MISSING__:Visible only",
+    "freeFilterAll": "__MISSING__:All",
+    "freeFilterFreeOnly": "__MISSING__:Free only",
+    "freeFilterPaidOnly": "__MISSING__:Paid only",
+    "sortFreeFirst": "__MISSING__:Free first",
+    "showHiddenOnly": "__MISSING__:Hidden only",
+    "filterByVisibility": "__MISSING__:Filter by visibility",
+    "autoHideFailed": "__MISSING__:Auto-hide failed models",
+    "autoHideFailedHint": "__MISSING__:When enabled, Test all hides non-transient failures from public catalogs such as /v1/models. Single-model tests never auto-hide.",
     "connected": "{count} Połączono",
     "errorCount": "{count} Błąd ({code})",
     "errorCountNoCode": "{count} Błąd",
+    "testAllCompleted": "__MISSING__:Tested {total} models: {ok} OK, {failed} failed",
+    "modelAutoHidden": "__MISSING__:Model {model} auto-hidden (test failed)",
+    "filterAll": "__MISSING__:All",
+    "filterVisible": "__MISSING__:Visible only",
+    "filterHidden": "__MISSING__:Hidden only",
+    "modelsHiddenCount": "__MISSING__:{count} hidden",
     "warningCount": "{count} Ostrzeżenie",
     "noConnections": "Brak połączeń",
     "expiredBadge": "Expired",
@@ -3764,7 +4085,16 @@
     "batchUpdateNone": "__MISSING__:No connections were updated (they may no longer exist)",
     "batchRetestLimit": "__MISSING__:Retest up to {max} connections at a time",
     "noConnectionsToTest": "__MISSING__:No matching connections to test",
+    "batchDeleteConfirmTitle": "__MISSING__:Delete connections",
+    "batchDeleteConfirmButton": "__MISSING__:Delete",
+    "filterActive": "__MISSING__:Active",
+    "filterError": "__MISSING__:Error",
+    "filterBanned": "__MISSING__:Banned",
+    "filterCreditsExhausted": "__MISSING__:Credits Exhausted",
+    "noFilteredConnections": "__MISSING__:No connections match the current filter.",
     "failedSetAlias": "Nie udało się ustawić aliasu",
+    "setAliasSuccess": "__MISSING__:Alias {alias} set",
+    "deleteAliasSuccess": "__MISSING__:Alias {alias} deleted",
     "failedSaveConnection": "Nie udało się zapisać połączenia",
     "failedSaveConnectionRetry": "Nie udało się zapisać połączenia. Spróbuj ponownie.",
     "failedRetestConnection": "Nie udało się ponownie przetestować połączenia",
@@ -3798,6 +4128,9 @@
     "connectionCount": "{count} połączenia",
     "fetchingModels": "Pobieram dostępne modele...",
     "failedFetchModels": "Nie udało się pobrać modeli",
+    "noFreeModelsFound": "__MISSING__:No free models found for this provider — nothing imported.",
+    "fetchModelsSuccess": "__MISSING__:Found {count} new models",
+    "fetchModelsFailed": "__MISSING__:Could not auto-fetch models (you can retry from settings)",
     "noModelsFound": "Nie znaleziono żadnych modeli",
     "importFailed": "Import nie powiódł się",
     "noNewModelsAdded": "Nie dodano żadnych nowych modeli.",
@@ -3806,6 +4139,10 @@
     "importingModelsTitle": "Importowanie modeli",
     "copyModel": "Skopiuj model",
     "filterModels": "Filtruj modele…",
+    "testAllRateLimited": "__MISSING__:Rate limit reached, stopped early",
+    "hideFailedAuto": "__MISSING__:Auto-hide failed models",
+    "selectAllModels": "Select all",
+    "hideAllModels": "__MISSING__:Hide all",
     "modelsActive": "aktywne",
     "showModel": "Pokaż model",
     "hideModel": "Ukryj model",
@@ -3814,6 +4151,9 @@
     "rateLimitUnprotected": "Niechroniony",
     "enableRateLimitProtection": "Kliknij, aby włączyć ochronę limitu szybkości",
     "disableRateLimitProtection": "Kliknij, aby wyłączyć ochronę limitu szybkości",
+    "testAllProgress": "__MISSING__:Tested {done}/{total}",
+    "testAllFailedHidden": "__MISSING__:{count} failed models hidden",
+    "testAllDone": "__MISSING__:All models tested",
     "productionKey": "Klucz produkcyjny",
     "enterNewApiKey": "Wprowadź nowy klucz API",
     "codexApplyModalTitle": "Zastosuj się do lokalnego kodeksu",
@@ -3889,10 +4229,20 @@
     "errorTypeNetworkError": "Błąd sieci",
     "errorTypeTestUnsupported": "Test nieobsługiwany",
     "errorTypeUpstreamError": "Błąd w górę",
+    "errorTypeCreditsExhausted": "__MISSING__:No credits",
+    "errorTypeBanned": "__MISSING__:403 Banned",
     "proxySourceGlobal": "Globalny",
     "proxySourceProvider": "Dostawca",
     "proxySourceKey": "Klucz",
     "proxyConfiguredBySource": "Pełnomocnik ({source}): {host}",
+    "proxyOn": "__MISSING__:Proxy On",
+    "proxyOff": "__MISSING__:Direct (bypass proxy)",
+    "proxyEnabledTitle": "__MISSING__:Proxy is enabled for this connection",
+    "proxyDisabledTitle": "__MISSING__:Direct connection — bypasses every proxy (including the global proxy) for this connection",
+    "perKeyProxyOn": "__MISSING__:Per-key",
+    "perKeyProxyOff": "__MISSING__:Connection",
+    "perKeyProxyEnabledTitle": "__MISSING__:Per-key proxy assignment enabled for this provider",
+    "perKeyProxyDisabledTitle": "__MISSING__:Per-key proxy assignment disabled for this provider",
     "autoPriority": "Automatycznie: {priority}",
     "proxy": "Pełnomocnik",
     "retestAuthentication": "Przetestuj ponownie uwierzytelnianie",
@@ -3920,6 +4270,12 @@
     "compatProtocolOpenAI": "OpenAI Chat Completions",
     "compatProtocolOpenAIResponses": "OpenAI Responses API",
     "compatProtocolClaude": "Anthropic Messages",
+    "targetFormatLabel": "__MISSING__:Target Format",
+    "targetFormatHint": "__MISSING__:Override the upstream wire format. Use 'Anthropic Messages' to route OpenAI-compatible providers (e.g. opencode-go) through the /v1/messages endpoint.",
+    "targetFormatAuto": "__MISSING__:Default (auto)",
+    "targetFormatGemini": "__MISSING__:Gemini",
+    "targetFormatGeminiCli": "__MISSING__:Gemini CLI",
+    "targetFormatAntigravity": "__MISSING__:Antigravity",
     "compatUpstreamHeadersLabel": "Extra upstream headers",
     "compatUpstreamHeadersHint": "High-privilege setting — same trust level as editing provider API credentials; only trusted admins should use it. Merged after OmniRoute adds auth from the provider API key. If a custom header uses the same name as an existing one (e.g. Authorization), your value fully replaces the auto-generated header (including the Bearer token) — the upstream only sees what you typed, not the key from settings. Misconfiguration can cause 401 or broken upstream auth. One row per header (e.g. extra Authentication for some gateways). Hover or focus the value to preview. Saves on blur, outside click, or closing this panel.",
     "compatUpstreamHeaderName": "Header name",
@@ -3929,6 +4285,8 @@
     "compatBadgeUpstreamHeaders": "Headers",
     "perModelQuotaLabel": "Per Model Quota Label",
     "perModelQuotaDescription": "Per Model Quota Description",
+    "importFreeModelsOnlyLabel": "__MISSING__:Import only free models",
+    "importFreeModelsOnlyHint": "__MISSING__:When enabled, only this provider's free models are imported. Paid models are skipped.",
     "perModelQuotaToggle": "Przełącz limit dla modelu",
     "modelId": "Identyfikator modelu",
     "customModelPlaceholder": "np. gpt-4.5-turbo",
@@ -3964,7 +4322,6 @@
     "email": "E-mail",
     "healthCheckMinutes": "Kontrola stanu (min)",
     "healthCheckHint": "Proaktywny interwał odświeżania tokenu. 0 = wyłączone.",
-    "selectAllModels": "Select all",
     "deselectAllModels": "Deselect all",
     "modelsActiveCount": "{active}/{total} active",
     "noModelsMatch": "No models match \"{filter}\"",
@@ -3976,6 +4333,9 @@
     "editCompatibleTitle": "Edytuj {type} Kompatybilny",
     "compatibleBaseUrlHint": "Root URL of your {type}-compatible API. Use Advanced Settings for custom endpoint paths.",
     "apiKeyForCheck": "Klucz API (do sprawdzenia)",
+    "testModelIdLabel": "__MISSING__:Model ID (optional)",
+    "testModelIdPlaceholder": "__MISSING__:e.g. my-model-id",
+    "testModelIdHint": "__MISSING__:If the provider lacks a /models endpoint, enter a model ID to validate via /chat/completions instead.",
     "compatibleProdPlaceholder": "{type} Kompatybilny (Prod)",
     "tokenRefreshed": "Token refreshed successfully",
     "tokenRefreshFailed": "Token refresh failed",
@@ -4069,6 +4429,19 @@
     "codexAuthApplyFailed": "Failed to apply Codex auth.json locally",
     "codexAuthExported": "Codex auth.json exported",
     "codexAuthExportFailed": "Failed to export Codex auth.json",
+    "codexCliGuideButton": "__MISSING__:Codex CLI Guide",
+    "codexCliGuideTitle": "__MISSING__:Codex CLI Guide",
+    "codexCliGuideLoading": "__MISSING__:Loading guide...",
+    "codexCliGuideLoadFailed": "__MISSING__:Could not load the guide.",
+    "codexExternalLinkButton": "__MISSING__:External Codex link",
+    "codexExternalLinkModalTitle": "__MISSING__:External Codex link",
+    "codexExternalLinkModalDescription": "__MISSING__:Share this single-use link with the person who will authenticate the Codex account. They open it in their own browser, complete the OpenAI login, and the connection is registered here. The link expires in 15 minutes.",
+    "codexExternalLinkGenerating": "__MISSING__:Generating link...",
+    "codexExternalLinkWaiting": "__MISSING__:Waiting for browser authentication. This window refreshes automatically.",
+    "codexExternalLinkCreateFailed": "__MISSING__:Failed to generate the link.",
+    "codexExternalLinkNetworkError": "__MISSING__:Could not contact the server.",
+    "codexExternalLinkConnected": "__MISSING__:Codex account connected through the external link.",
+    "codexExternalLinkExpired": "__MISSING__:The link expired before completion.",
     "importCodexAuth": "Importuj autoryzację",
     "codexImportModalTitle": "Importuj autoryzację Kodeksu",
     "codexImportTabSingle": "Pojedynczy",
@@ -4146,6 +4519,8 @@
     "t3ChatWebCookiePlaceholder": "wypukły-id-sesji=abc123...",
     "blockClaudeExtraUsageDescription": "Block Claude Extra Usage Description",
     "blockClaudeExtraUsageLabel": "Block Claude Extra Usage Label",
+    "disableCoolingDescription": "__MISSING__:Skip the transient cooldown so this connection stays eligible even after recoverable errors (terminal states like banned/expired still apply).",
+    "disableCoolingLabel": "__MISSING__:Disable cooldown for this connection",
     "bulkPasteAdded": "{count, plural, one {1 key added} other {# keys added}}",
     "bulkPasteDuplicatesIgnored": "{count, plural, one {1 duplicate skipped} other {# duplicates skipped}}",
     "bulkPasteHint": "Paste one API key per line. Empty lines are ignored and duplicate keys are skipped.",
@@ -4243,6 +4618,17 @@
     "personalAccessTokenLabel": "Personal Access Token Label",
     "qoderPatHint": "Qoder Pat Hint",
     "qoderPatPlaceholder": "Qoder Pat Placeholder",
+    "rateLimitOverridesSection": "__MISSING__:Rate Limit Overrides",
+    "rateLimitOverridesMaxConcurrentHint": "__MISSING__:Max concurrent requests override for this connection. Overrides the account-level cap.",
+    "rateLimitOverridesMaxConcurrentLabel": "__MISSING__:Max Concurrent (Rate Limit)",
+    "rateLimitOverridesMinTimeHint": "__MISSING__:Minimum time (ms) between requests. Overrides the default rate limiter delay.",
+    "rateLimitOverridesMinTimeLabel": "__MISSING__:Min Interval (ms)",
+    "rateLimitOverridesRpmHint": "__MISSING__:Max requests per minute for this connection. Overrides the provider default.",
+    "rateLimitOverridesRpmLabel": "__MISSING__:RPM (Requests/min)",
+    "rateLimitOverridesTpdHint": "__MISSING__:Max tokens per day for this connection. Overrides the provider default.",
+    "rateLimitOverridesTpdLabel": "__MISSING__:TPD (Tokens/day)",
+    "rateLimitOverridesTpmHint": "__MISSING__:Max tokens per minute for this connection. Overrides the provider default.",
+    "rateLimitOverridesTpmLabel": "__MISSING__:TPM (Tokens/min)",
     "refreshOauthTokenTitle": "Refresh Oauth Token Title",
     "regionHint": "Region Hint",
     "regionLabel": "Region Label",
@@ -4257,6 +4643,7 @@
     "searchProvider": "Search Provider",
     "searchProviderDesc": "Search Provider Desc",
     "searchProviders": "Wyszukaj dostawców...",
+    "searchByModel": "__MISSING__:Search by model…",
     "searchProvidersHeading": "Search Providers Heading",
     "searxngBaseUrlHint": "Searxng Base Url Hint",
     "searxngInfo": "Searxng Info",
@@ -4422,7 +4809,21 @@
     "webNoAuthGuideBody": "{provider} nie potrzebuje klucza API ani pliku cookie. Zapisz połączenie, aby móc korzystać z bezpłatnego internetowego punktu końcowego.",
     "webSessionCredentialValidationFailed": "Weryfikacja danych logowania sesji nie powiodła się. Zaloguj się ponownie, skopiuj nowe dane uwierzytelniające i spróbuj ponownie.",
     "checkCookie": "Sprawdź plik cookie",
-    "checkWebToken": "Sprawdź token"
+    "checkWebToken": "Sprawdź token",
+    "huggingchatLabel": "__MISSING__:HuggingChat (Free)",
+    "huggingchatDesc": "__MISSING__:Free LLM chat via huggingface.co/chat",
+    "phindLabel": "__MISSING__:Phind (Free)",
+    "phindDesc": "__MISSING__:Free dev-focused AI chat",
+    "poeWebLabel": "__MISSING__:Poe Web",
+    "poeWebDesc": "__MISSING__:Multi-model chat via poe.com",
+    "veniceWebLabel": "__MISSING__:Venice Web",
+    "veniceWebDesc": "__MISSING__:Privacy-focused AI chat",
+    "v0VercelWebLabel": "__MISSING__:v0 Vercel Web",
+    "v0VercelWebDesc": "__MISSING__:AI code generation via v0.dev",
+    "kimiWebLabel": "__MISSING__:Kimi Web",
+    "kimiWebDesc": "__MISSING__:Chinese market AI chat via kimi.moonshot.cn",
+    "doubaoWebLabel": "__MISSING__:Doubao Web",
+    "doubaoWebDesc": "__MISSING__:ByteDance AI chat via doubao.com"
   },
   "settings": {
     "title": "Ustawienia",
@@ -4528,6 +4929,7 @@
     "memoryDesc": "Persistent cross-session conversational memory",
     "memoryEnabled": "Enable Memory",
     "memoryEnabledDesc": "When enabled, OmniRoute will inject relevant past context.",
+    "memoryTokenCostWarning": "__MISSING__:Heads up: with memory enabled, OmniRoute injects up to {tokens} tokens of retrieved context into every chat request — this increases token usage and cost. To skip injection for a specific request, send the \"x-omniroute-no-memory: true\" header.",
     "maxTokens": "Max Tokens",
     "retentionDays": "Retention",
     "recent": "Recent",
@@ -4566,6 +4968,15 @@
     "modelsDevInfoOrder": "User Override → models.dev → LiteLLM → Hardcoded Default",
     "systemTheme": "Temat systemu",
     "debugToggle": "Enable Debug Mode",
+    "homePinProviderQuotaToHome": "Pin Information to Home Page",
+    "homeProviderQuotaLimits": "Provider Quota Limits",
+    "homeProviderQuotaLimitsDesc": "Pin the Provider Quota status container (with Refresh All button) to the top of the Home page.",
+    "homeQuickStart": "Quick Start",
+    "homeQuickStartDesc": "Show the Quick Start panel on the Home page.",
+    "homeProviderTopology": "Provider Topology",
+    "homeProviderTopologyDesc": "Show the Provider Topology on the Home page.",
+    "accountEmailVisibility": "__MISSING__:Account email visibility",
+    "accountEmailVisibilityDesc": "__MISSING__:Show full account emails across providers, combos, logs, quota, and playground screens. Turn this off to mask them by default.",
     "sidebarVisibilityToggle": "Show Sidebar Items",
     "enableCache": "Włącz pamięć podręczną",
     "cacheTTL": "Pamięć podręczna TTL",
@@ -4599,11 +5010,17 @@
     "autoDisableDescription": "Permanently mark provider connections as deactivated if they return specific terminal ban signals (e.g. HTTP 403 'verify your account'). This removes them from the combo rotation.",
     "autoDisableThreshold": "Ban Threshold",
     "autoDisableThresholdDesc": "Consecutive ban signals required before permanent deactivation.",
+    "customBannedSignals": "__MISSING__:Banned Keywords",
+    "customBannedSignalsDesc": "__MISSING__:Additional keywords that trigger permanent account ban detection. Built-in keywords always apply.",
+    "customBannedSignalsPlaceholder": "__MISSING__:e.g. api key revoked",
+    "noCustomBannedSignals": "__MISSING__:No custom keywords. Only built-in keywords are active.",
     "resilienceStructureTitle": "Resilience Structure",
     "resilienceStructureDesc": "Ta strona służy jedynie do konfiguracji zachowania. Stan wyłącznika na żywo jest wyświetlany na stronie Stan. Ponowne próby specyficzne dla kombinacji i kontrola szczeliny okrężnej pozostają w ustawieniach kombinacji.",
     "enableThinking": "Włącz myślenie",
     "maxThinkingTokens": "Żetony Max Thinking",
     "enableProxy": "Włącz serwer proxy",
+    "perKeyProxyEnabled": "__MISSING__:Enable per-key proxy assignment",
+    "perKeyProxyEnabledDesc": "__MISSING__:When enabled, each provider connection can use its own proxy assignment",
     "proxyUrl": "Adres URL serwera proxy",
     "pricingRates": "Format stawek cenowych",
     "currentPricing": "Aktualny przegląd cen",
@@ -4683,6 +5100,13 @@
     "globalProxy": "Globalny pełnomocnik",
     "globalProxyDesc": "Skonfiguruj globalny wychodzący serwer proxy dla wszystkich wywołań API. Poszczególni dostawcy, kombinacje i klucze mogą to zastąpić.",
     "noGlobalProxy": "Nie skonfigurowano globalnego serwera proxy",
+    "proxyPool": "__MISSING__:Proxy Pool",
+    "freePool": "__MISSING__:Free Pool",
+    "proxyDocumentation": "__MISSING__:Proxy Documentation",
+    "proxyGlobalConfigTab": "__MISSING__:Global Config",
+    "proxyPoolTab": "__MISSING__:Proxy Pool",
+    "freePoolTab": "__MISSING__:Free Pool",
+    "proxyDocumentationTab": "__MISSING__:Documentation",
     "bulkHealthcheck": "Bulk Healthcheck",
     "bulkHealthcheckDesc": "Test all configured proxies against a target URL to find which ones work.",
     "healthcheckTesting": "Testing...",
@@ -4695,6 +5119,51 @@
     "healthcheckStatus": "Status",
     "healthcheckProxyUrl": "Proxy URL",
     "healthcheckLatency": "Latency",
+    "proxyDocumentationScopeTitle": "__MISSING__:Proxy scope resolution",
+    "proxyDocumentationScopeDescBefore": "__MISSING__:OmniRoute resolves the outbound proxy in priority order: ",
+    "proxyDocumentationScopeOrder": "__MISSING__:combo → account → provider → global",
+    "proxyDocumentationScopeDescAfter": "__MISSING__:. The most specific scope wins.",
+    "proxyDocumentationAddTitle": "__MISSING__:Adding a custom proxy",
+    "proxyDocumentationAddDescBefore": "__MISSING__:Go to the ",
+    "proxyDocumentationAddDescMiddle": "__MISSING__: tab → click ",
+    "proxyDocumentationAddCta": "__MISSING__:+ Add proxy",
+    "proxyDocumentationAddDescAfter": "__MISSING__:. Fill in type (http/https/socks5), host, and port. Optionally assign it to a scope.",
+    "proxyDocumentationBulkTitle": "__MISSING__:Bulk import format",
+    "proxyDocumentationBulkDesc": "__MISSING__:Pipe-delimited fields:",
+    "proxyDocumentationSocks5DescBefore": "__MISSING__:SOCKS5 proxies are disabled by default. Set",
+    "proxyDocumentationFreePoolDesc": "__MISSING__:The Free Pool tab aggregates proxies from 1proxy, Proxifly, and IPLocate. Use ⊕ to test and promote a proxy to your registry. Only proxies that pass the connectivity test are added.",
+    "proxyDocumentationVercelRelayDescBefore": "__MISSING__:The Vercel Relay is an outbound edge relay — not an inbound tunnel. Deploying one sends LLM API calls through Vercel's dynamic IPs, bypassing datacenter geo-blocks and rate limits. The relay is protected by a generated secret header",
+    "proxyDocumentationVercelRelayDescAfter": "__MISSING__:Your Vercel token is used only during deploy and is never stored.",
+    "vercelRelayTokenRequired": "__MISSING__:Token is required",
+    "vercelRelayDeployFailed": "__MISSING__:Deploy failed",
+    "vercelRelayTokenHint": "__MISSING__:Token is used only during deploy — never stored.",
+    "denoRelayTokenRequired": "__MISSING__:Deno Deploy token is required",
+    "denoRelayOrgDomainRequired": "__MISSING__:Organization domain is required",
+    "denoRelayDeployFailed": "__MISSING__:Deno Deploy failed",
+    "denoRelayTokenHint": "__MISSING__:Organization token (prefix ddo_) from console.deno.com → Organization → Settings → Organization Tokens. Used once for deploy and never stored.",
+    "denoRelayOrgDomainHint": "__MISSING__:Your Deno Deploy organization's default domain (e.g. acme.deno.net). The relay will be reachable at https://<app-name>.<org-slug>.deno.net.",
+    "proxyFreePoolFilterProtocol": "__MISSING__:Filter by protocol",
+    "proxyFreePoolProtocol": "__MISSING__:Protocol",
+    "proxyFreePoolCountryPlaceholder": "__MISSING__:Country (e.g. US)",
+    "proxyFreePoolFilterCountry": "__MISSING__:Filter by country",
+    "proxyFreePoolMinQualityPlaceholder": "__MISSING__:Min quality",
+    "proxyFreePoolMinQualityLabel": "__MISSING__:Minimum quality score",
+    "proxyFreePoolSyncAll": "__MISSING__:Sync All",
+    "proxyFreePoolTotal": "__MISSING__:Total",
+    "proxyFreePoolInPool": "__MISSING__:In pool",
+    "proxyFreePoolAvgQuality": "__MISSING__:Avg quality",
+    "proxyFreePoolSelected": "__MISSING__:{count} selected",
+    "proxyFreePoolAddSelected": "__MISSING__:Add selected to pool",
+    "proxyFreePoolAddVisible": "__MISSING__:Add all visible to pool",
+    "proxyFreePoolSource": "__MISSING__:Source",
+    "proxyFreePoolHostPort": "__MISSING__:Host:Port",
+    "proxyFreePoolType": "__MISSING__:Type",
+    "proxyFreePoolCountry": "__MISSING__:Country",
+    "proxyFreePoolQuality": "__MISSING__:Quality",
+    "proxyFreePoolLatency": "__MISSING__:Latency",
+    "proxyFreePoolEmpty": "__MISSING__:No proxies found. Click Sync All to fetch from sources.",
+    "close": "__MISSING__:Close",
+    "cancel": "__MISSING__:Cancel",
     "globalLabel": "Globalny",
     "configure": "Skonfiguruj",
     "globalSystemPrompt": "Monit systemu globalnego",
@@ -4951,6 +5420,7 @@
     "systemStorage": "System i pamięć masowa",
     "allDataLocal": "Wszystkie dane przechowywane lokalnie na Twoim komputerze",
     "databasePath": "Ścieżka bazy danych",
+    "export": "__MISSING__:Export",
     "exportDatabase": "Eksportuj bazę danych",
     "exportAll": "Eksportuj wszystko (.tar.gz)",
     "importDatabase": "Importuj bazę danych",
@@ -5038,6 +5508,11 @@
     "adaptiveVolumeRoutingDesc": "Scale connections dynamically based on payload volume and throughput pressure.",
     "lkgpToggleTitle": "Last Known Good Provider (LKGP)",
     "lkgpToggleDesc": "When enabled, the router remembers which provider last served a successful response and tries it first on subsequent requests.",
+    "echoRequestedModelTitle": "__MISSING__:Echo requested model name in responses",
+    "echoRequestedModelDesc": "__MISSING__:When enabled, the response `model` field echoes the alias or combo name the client requested instead of the upstream model name. Fixes strict clients (e.g. Claude Desktop) that reject a response whose model does not match the request.",
+    "webSearchRouteTitle": "__MISSING__:Web search routing",
+    "webSearchRouteDesc": "__MISSING__:When a request includes a native web_search tool, route the whole request to this model instead of the default — useful for providers that don't implement Anthropic's web_search server tool. Leave blank to disable.",
+    "webSearchRoutePlaceholder": "__MISSING__:e.g. openrouter,anthropic/claude-3.5-sonnet",
     "clearLkgpCache": "Clear LKGP Cache",
     "lkgpCacheCleared": "LKGP cache cleared successfully",
     "lkgpCacheClearFailed": "Failed to clear LKGP cache",
@@ -5102,6 +5577,16 @@
     "clearSyncedPricing": "Clear Synced Pricing",
     "compressionTitle": "Prompt Compression",
     "compressionDesc": "Reduce token usage by compressing prompts before sending to providers",
+    "tokenSaverTitle": "__MISSING__:Token Saver",
+    "tokenSaverSubtitle": "__MISSING__:Spend fewer tokens on every request.",
+    "tokenSaverToolOutput": "__MISSING__:Tool output",
+    "tokenSaverToolOutputDesc": "__MISSING__:Clean git, grep, ls, tree, and log output before it reaches the provider.",
+    "tokenSaverLlmOutput": "__MISSING__:LLM output",
+    "tokenSaverLlmOutputDesc": "__MISSING__:Inject terse response instructions without rewriting provider output.",
+    "tokenSaverInputCompression": "__MISSING__:Input compression",
+    "tokenSaverInputCompressionDesc": "__MISSING__:Rewrite eligible chat history while preserving code, URLs, and intent.",
+    "tokenSaverFineTunePrefix": "__MISSING__:Fine-tune each engine on",
+    "tokenSaverFineTuneSuffix": "__MISSING__:or combine engines per request on",
     "compressionMode": "Compression Mode",
     "compressionModeOff": "Off",
     "compressionModeOffDesc": "No compression applied",
@@ -5121,6 +5606,11 @@
     "compressionUltraMinScore": "Minimalny próg wyniku",
     "compressionUltraSlmFallback": "Powrót do trybu agresywnego",
     "compressionUltraModelPath": "Ścieżka modelu SLM",
+    "compressionUltraEngine": "__MISSING__:Ultra tier",
+    "compressionUltraEngineHeuristic": "__MISSING__:Heuristic (Tier-A, default)",
+    "compressionUltraEngineSlm": "__MISSING__:SLM (LLMLingua-2, opt-in)",
+    "compressionUltraSlmHint": "__MISSING__:SLM downloads a small ONNX model on first use (cold-start) and transparently falls back to the heuristic on timeout or if unavailable.",
+    "compressionUltraSlmPrewarm": "__MISSING__:Pre-warm SLM model on enable",
     "compressionSummarizerEnabled": "Włącz podsumowanie",
     "compressionMaxTokensPerMessage": "Maksymalna liczba tokenów na wiadomość",
     "compressionMinSavings": "Minimalny próg oszczędności",
@@ -5308,13 +5798,22 @@
     "resilienceNo": "Nie",
     "resilienceDefault": "Default",
     "storageDatabaseBackupRetention": "Przechowywanie kopii zapasowych bazy danych",
+    "storageDatabaseBackups": "__MISSING__:Database backups",
     "storagePurgeData": "Usuń dane",
+    "storagePurgeDataDesc": "__MISSING__:Immediately delete all records without applying retention checks. Use with caution.",
+    "storageRetentionCleanup": "__MISSING__:Retention Settings",
+    "storageRetentionCleanupDesc": "__MISSING__:Configure operational record retention and database backup cleanup.",
+    "retentionCallDays": "__MISSING__:Call {count}d",
+    "retentionAppDays": "__MISSING__:App {count}d",
+    "retentionRows": "__MISSING__:{count} rows",
     "retentionQuotaSnapshots": "Migawki przydziału (dni)",
+    "retentionCompressionAnalytics": "__MISSING__:Compression Analytics (days)",
     "retentionMcpAudit": "Audyt MCP (dni)",
     "retentionA2aEvents": "Wydarzenia A2A (dni)",
     "retentionCallLogs": "Dzienniki połączeń (dni)",
     "retentionUsageHistory": "Historia użytkowania (dni)",
     "retentionMemoryEntries": "Wpisy pamięci (dni)",
+    "saveRetentionSettings": "__MISSING__:Save retention settings",
     "storageAutoVacuumMode": "Tryb automatycznego odkurzania",
     "storageScheduledVacuum": "Zaplanowana próżnia",
     "storageVacuumHour": "Godzina próżni (0-23)",
@@ -5328,10 +5827,16 @@
     "storageIntegrityOk": "✓ OK",
     "storageIntegrityError": "✗ Błąd",
     "storageUsageTokenBuffer": "Bufor tokenów użycia",
+    "storageUsageTokenBufferDesc": "__MISSING__:Extra tokens added to reported usage to account for system prompt overhead.",
+    "storageUsageTokenBufferHint": "__MISSING__:Set to 0 to report raw provider token counts. Default: 2000.",
+    "storageUsageTokenBufferCurrent": "__MISSING__:Current: {value}",
     "compressionSettingsAutoTriggerMode": "Tryb automatycznego wyzwalania",
     "compressionSettingsMcpDescriptionCompression": "Kompresja opisu MCP",
+    "mcpAccessibilityTitle": "__MISSING__:MCP accessibility output",
     "compressionSettingsCavemanIntensity": "Intensywność jaskiniowca",
     "compressionSettingsCavemanOutputMode": "Tryb wyjściowy jaskiniowca",
+    "compressionSettingsOutputStyles": "__MISSING__:Output styles",
+    "compressionStylesTileTitle": "__MISSING__:Output styles",
     "compressionSettingsOutputIntensity": "Intensywność wyjściowa",
     "compressionSettingsAutoClarityBypass": "Automatyczne obejście przejrzystości",
     "resilienceWaitForCooldown": "Poczekaj na odnowienie",
@@ -5347,6 +5852,9 @@
     "cliproxyapiUrl": "Adres URL CLIProxyAPI",
     "cliproxyapiStatus": "Stan CLIProxyAPI",
     "cliproxyapiNotDetected": "Nie wykryto",
+    "cliproxyapiImportAuthTitle": "__MISSING__:Import accounts from CLIProxyAPI",
+    "cliproxyapiImportAuthDesc": "__MISSING__:Import the OAuth accounts CLIProxyAPI already saved in ~/.cli-proxy-api/ as OmniRoute connections, so you don't have to log in to each account again. Supported account types (Gemini, Codex, Claude, Antigravity, Qwen, Kimi) are imported; others are skipped.",
+    "cliproxyapiImportAuthButton": "__MISSING__:Import accounts",
     "payloadRulesTitle": "Zasady dotyczące ładunku",
     "payloadRulesDesc": "__MISSING__:Configure request payload mutations by model and protocol. Changes are persisted in settings and hot reloaded into the runtime immediately after save.",
     "payloadRuleDefaultTitle": "__MISSING__:default",
@@ -5379,6 +5887,14 @@
     "maxResponseTokensDesc": "__MISSING__:Maximum total tokens allowed in a single response.",
     "modelCooldownsTitle": "Modele w czasie odnowienia",
     "modelCooldownsEmpty": "Brak modeli w fazie odnowienia.",
+    "responsesStateTitle": "__MISSING__:Responses State",
+    "responsesStateDesc": "__MISSING__:Control how OmniRoute forwards previous_response_id.",
+    "responsesStateModeLabel": "__MISSING__:previous_response_id handling",
+    "responsesStateModeAuto": "__MISSING__:Auto",
+    "responsesStateModeStrip": "__MISSING__:Strip",
+    "responsesStateModePreserve": "__MISSING__:Preserve",
+    "responsesStateHint": "__MISSING__:Auto strips previous_response_id unless a connection explicitly enables OpenAI Responses storage. Strip is safest for stateless clients such as VS Code Custom Endpoint; context then depends on the client sending full history.",
+    "responsesStateSaveError": "__MISSING__:Failed to update Responses state setting",
     "codexFastTierTitle": "Szybki poziom Kodeksu",
     "codexFastTierDesc": "Globalnie wstrzyknij service_tier=priority dla żądań OpenAI Codex.",
     "codexFastTierHint": "Po włączeniu OmniRoute dodaje service_tier=priority do wychodzących żądań Kodeksu dla połączeń, które nie określają jeszcze warstwy. Warstwa priorytetowa wymaga klucza API OpenAI Enterprise lub ścieżki Kodeksu uwierzytelniania ChatGPT; inne typy kluczy otrzymają od OpenAI błąd związany z poziomem. Ustawienia poszczególnych połączeń na stronie dostawcy Kodeksu mają pierwszeństwo.",
@@ -5485,6 +6001,15 @@
     "resilienceEnableServerWaitDesc": "Po włączeniu OmniRoute czeka na upłynięcie pierwszego czasu odnowienia i automatycznie ponawia próbę.",
     "resilienceMaxAttempts": "Maksymalne próby",
     "resilienceMaxWaitPerAttempt": "Maksymalny czas oczekiwania na próbę",
+    "resilienceProviderCooldownTitle": "__MISSING__:Provider Cooldown",
+    "resilienceProviderCooldownScope": "__MISSING__:All combo requests",
+    "resilienceProviderCooldownTrigger": "__MISSING__:When a provider/connection fails",
+    "resilienceProviderCooldownEffect": "__MISSING__:Skips the failed provider for a cooldown period before retrying",
+    "resilienceProviderCooldownDesc": "__MISSING__:Prevents subsequent requests from re-walking the same failing providers. Cooldown scales exponentially with consecutive failures.",
+    "resilienceProviderCooldownEnabled": "__MISSING__:Enable global provider cooldown",
+    "resilienceProviderCooldownEnabledDesc": "__MISSING__:When enabled, failed providers are tracked globally and skipped for a cooldown period.",
+    "resilienceProviderCooldownMin": "__MISSING__:Minimum cooldown",
+    "resilienceProviderCooldownMax": "__MISSING__:Maximum cooldown",
     "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
     "forcedFingerprintBadge": "Required",
     "codexSessionAffinityTitle": "Powinowactwo sesji Kodeksu",
@@ -5506,13 +6031,45 @@
     "vercelRelayFreeTierNote": "__MISSING__:Relays are lightweight proxy endpoints deployed on Vercel's free tier to bypass local network/region limitations.",
     "vercelRelayDeploying": "__MISSING__:Deploying...",
     "vercelRelayDeploy": "__MISSING__:Deploy",
-    "homePinProviderQuotaToHome": "Pin Information to Home Page",
-    "homeProviderQuotaLimits": "Provider Quota Limits",
-    "homeProviderQuotaLimitsDesc": "Pin the Provider Quota status container (with Refresh All button) to the top of the Home page.",
-    "homeQuickStart": "Quick Start",
-    "homeQuickStartDesc": "Show the Quick Start panel on the Home page.",
-    "homeProviderTopology": "Provider Topology",
-    "homeProviderTopologyDesc": "Show the Provider Topology on the Home page."
+    "deployRelayButton": "__MISSING__:Deploy Relay",
+    "denoRelayButton": "__MISSING__:Deploy Deno Relay",
+    "denoRelayModalTitle": "__MISSING__:Deploy Deno Relay",
+    "denoRelayWarning": "__MISSING__:Warning: A Deno Deploy organization token is required. This token will only be used to create the relay app and will never be stored by OmniRoute.",
+    "denoRelayTokenLabel": "__MISSING__:Deno Deploy Organization Token",
+    "denoRelayOrgDomainLabel": "__MISSING__:Organization Domain",
+    "denoRelayProjectNameLabel": "__MISSING__:Deno App Name",
+    "denoRelayFreeTierNote": "__MISSING__:Deno Deploy v2 runs on a global edge network. Free tier: 1M requests & 100GiB outbound traffic per month, no per-request CPU limits, up to 20 active apps & 50 custom domains.",
+    "denoRelayDeploying": "__MISSING__:Deploying...",
+    "denoRelayDeploy": "__MISSING__:Deploy",
+    "cloudflareRelaySuccess": "__MISSING__:Cloudflare Relay deployed successfully",
+    "cloudflareRelayButton": "__MISSING__:Deploy Cloudflare Relay",
+    "cloudflareRelayModalTitle": "__MISSING__:Deploy Cloudflare Worker Relay",
+    "cloudflareRelayWarning": "__MISSING__:Deploys a Cloudflare Worker that proxies LLM requests through Cloudflare's edge network — masking the host IP behind dynamic Cloudflare addresses. The Worker enforces a one-time auth secret so the public workers.dev URL cannot be reused as an open relay.",
+    "cloudflareRelayTokenHowto": "__MISSING__:Create the API token under My Profile -> API Tokens -> Create Token -> Custom Token -> Account / Workers Scripts / Edit.",
+    "cloudflareRelayAccountIdLabel": "__MISSING__:Cloudflare Account ID",
+    "cloudflareRelayAccountIdHint": "__MISSING__:Found on the right side of the Cloudflare dashboard overview page.",
+    "cloudflareRelayApiTokenLabel": "__MISSING__:Cloudflare API Token",
+    "cloudflareRelayApiTokenHint": "__MISSING__:Requires 'Workers Scripts: Edit' permission. The token is used only at deploy time and is never stored.",
+    "cloudflareRelayProjectNameLabel": "__MISSING__:Worker Name",
+    "cloudflareRelayFreeTierNote": "__MISSING__:Free tier: 100,000 requests/day per Cloudflare account.",
+    "cloudflareRelayDeploying": "__MISSING__:Deploying...",
+    "cloudflareRelayDeploy": "__MISSING__:Deploy",
+    "cloudflareRelayCredsRequired": "__MISSING__:Account ID and API Token are required",
+    "cloudflareRelayDeployFailed": "__MISSING__:Deploy failed",
+    "modelLockout": "__MISSING__:Model Lockout",
+    "modelLockoutPageDescription": "__MISSING__:Configure which HTTP error codes trigger per-model lockout and control the cooldown behavior.",
+    "modelLockoutEnabled": "__MISSING__:Enable Model Lockout",
+    "modelLockoutEnabledDescription": "__MISSING__:When enabled, models that fail with configured error codes are temporarily locked to prevent retry loops.",
+    "modelLockoutErrorCodes": "__MISSING__:Error Codes",
+    "modelLockoutErrorCodesDescription": "__MISSING__:HTTP status codes that trigger model lockout. Type a code and click Add, or select from suggestions.",
+    "modelLockoutBaseCooldown": "__MISSING__:Base Cooldown (ms)",
+    "modelLockoutBaseCooldownDescription": "__MISSING__:Initial cooldown duration in milliseconds before a model can be retried.",
+    "modelLockoutMaxCooldown": "__MISSING__:Max Cooldown (ms)",
+    "modelLockoutMaxCooldownDescription": "__MISSING__:Maximum cooldown duration in milliseconds. Prevents excessively long lockouts.",
+    "modelLockoutExponentialBackoff": "__MISSING__:Exponential Backoff",
+    "modelLockoutExponentialBackoffDescription": "__MISSING__:When enabled, each consecutive failure increases the cooldown duration exponentially.",
+    "modelLockoutMaxBackoffSteps": "__MISSING__:Max Backoff Steps",
+    "modelLockoutMaxBackoffStepsDescription": "__MISSING__:Maximum number of backoff steps before the cooldown stops growing. The Max Cooldown cap is reached first in most configurations, making this a safety ceiling for when Max Cooldown is raised."
   },
   "contextRtk": {
     "title": "RTK Engine",
@@ -5563,7 +6120,21 @@
     "searchFilters": "Filtry wyszukiwania...",
     "tooltipDedup": "Jak agresywnie usuwać powtarzające się linie.",
     "tooltipMaxChars": "Maksymalna liczba znaków na blok wyjściowy.",
-    "tooltipMaxLines": "Maksymalna liczba wierszy, które należy zachować w wynikach poleceń. Nadmiar jest obcinany."
+    "tooltipMaxLines": "Maksymalna liczba wierszy, które należy zachować w wynikach poleceń. Nadmiar jest obcinany.",
+    "learnDiscoverTitle": "__MISSING__:Learn & Discover filters",
+    "learnDiscoverDesc": "__MISSING__:Mine your captured command output (Raw Output retention must be on) to suggest new RTK filters. Suggestions only — you review and save them.",
+    "discoverHeading": "__MISSING__:Discover repeated noise",
+    "discoverButton": "__MISSING__:Scan samples",
+    "discoverScanning": "__MISSING__:Scanning…",
+    "discoverEmpty": "__MISSING__:No repeated noise found. Enable Raw Output retention and run a few commands first.",
+    "discoverSamples": "__MISSING__:{count} sample(s) scanned",
+    "discoverHits": "__MISSING__:{hits}× across samples",
+    "learnHeading": "__MISSING__:Learn a filter for a command",
+    "learnCommandPlaceholder": "__MISSING__:e.g. npm install",
+    "learnButton": "__MISSING__:Suggest filter",
+    "learnEmpty": "__MISSING__:No suggestion yet. Type a command you have run and scan.",
+    "learnSamplesUsed": "__MISSING__:Learned from {count} matching sample(s)",
+    "suggestionError": "__MISSING__:Could not load suggestions. Check management auth and try again."
   },
   "contextCombos": {
     "title": "Compression Combos",
@@ -5853,7 +6424,80 @@
     "routeConnectionLabel": "Połączenie",
     "scenarioVision": "Wizja (rozumienie obrazu)",
     "scenarioSchemaCoercion": "Wymuszenie schematu (wyjście strukturalne)",
-    "techniques": "Techniki:"
+    "techniques": "Techniki:",
+    "friendlyTitle": "__MISSING__:Translator",
+    "friendlySubtitle": "__MISSING__:Use your existing app with any provider — without rewriting code.",
+    "conceptHeadline": "__MISSING__:Your app speaks one API's \"language\". The Translator converts it to use another provider.",
+    "conceptDiagramAppLabel": "__MISSING__:Your app",
+    "conceptDiagramSourceLabel": "__MISSING__:Source format",
+    "conceptDiagramHubLabel": "__MISSING__:OpenAI (hub)",
+    "conceptDiagramTargetLabel": "__MISSING__:Target provider",
+    "conceptDiagramExampleApp": "__MISSING__:e.g. Anthropic SDK",
+    "conceptDiagramExampleSource": "__MISSING__:claude",
+    "conceptDiagramExampleTarget": "__MISSING__:Gemini",
+    "conceptHowItWorksToggle": "__MISSING__:How it works",
+    "conceptHowItWorksBody": "__MISSING__:Your app sends a request in its own format. The Translator detects the format, converts it through OpenAI as an intermediate hub (or directly when a direct translator is available), sends it to the chosen provider, and returns the response converted back to your app's format.",
+    "tabTranslate": "__MISSING__:Translate",
+    "tabMonitor": "__MISSING__:Monitor",
+    "tabTranslateAriaLabel": "__MISSING__:Go to the Translate tab",
+    "tabMonitorAriaLabel": "__MISSING__:Go to the Monitor tab",
+    "simpleAppUsesLabel": "__MISSING__:My app uses",
+    "simpleAppUsesHint": "__MISSING__:The API format your app speaks (e.g. Anthropic SDK = claude).",
+    "simpleSendToLabel": "__MISSING__:Send to",
+    "simpleSendToHint": "__MISSING__:Where to actually send the request (a provider connected in OmniRoute).",
+    "simpleStartWithLabel": "__MISSING__:Start with",
+    "simpleStartWithExamplePlaceholder": "__MISSING__:Select a ready-made example",
+    "simpleStartWithCustomOption": "__MISSING__:Paste your request (advanced)",
+    "simpleModeLabel": "__MISSING__:Mode",
+    "simpleModePreview": "__MISSING__:Preview translation only",
+    "simpleModeSend": "__MISSING__:Send and see response",
+    "simpleAdvancedToggle": "__MISSING__:Advanced",
+    "simpleInputPanelTitle": "__MISSING__:Input",
+    "simpleInputPanelHint": "__MISSING__:Free-text message or ready-made example",
+    "simpleResultPanelTitle": "__MISSING__:Translation + Response",
+    "narratedDetected": "__MISSING__:✓ Detected: {format}",
+    "narratedTranslating": "__MISSING__:Translating to {target}...",
+    "narratedSending": "__MISSING__:Sending to {target}...",
+    "narratedSuccess": "__MISSING__:→ translated to {target} · response in {latency}ms",
+    "narratedError": "__MISSING__:Failed: {reason}",
+    "narratedSeeTranslatedJson": "__MISSING__:see translated JSON",
+    "narratedSeePipeline": "__MISSING__:see pipeline",
+    "advancedSectionTitle": "__MISSING__:Advanced",
+    "advancedSectionSubtitle": "__MISSING__:Raw JSON, pipeline and technical tools. Everything here is the same as the old tabs — just reorganized.",
+    "advancedRawJsonTitle": "__MISSING__:Raw JSON (auto-detect + Monaco)",
+    "advancedRawJsonSubtitle": "__MISSING__:Paste a JSON request; the format is detected automatically.",
+    "advancedPipelineTitle": "__MISSING__:OpenAI intermediate pipeline",
+    "advancedPipelineSubtitle": "__MISSING__:Visualize each translation step (hub-and-spoke).",
+    "advancedStreamTransformTitle": "__MISSING__:Stream Transformer (Chat → Responses SSE)",
+    "advancedStreamTransformSubtitle": "__MISSING__:Converts Chat Completions SSE into Responses API.",
+    "advancedTestBenchTitle": "__MISSING__:Test Bench (8 scenarios)",
+    "advancedTestBenchSubtitle": "__MISSING__:Runs all scenarios and reports pass/fail + compatibility %.",
+    "advancedCompressionTitle": "__MISSING__:Compression Preview",
+    "advancedCompressionSubtitle": "__MISSING__:Estimate token savings across different compression modes.",
+    "monitorOriginHint": "__MISSING__:Events generated by Translate or the main pipeline appear here in real time.",
+    "monitorEmptyCta": "__MISSING__:Go to the Translate tab and send a request — it will appear here.",
+    "monitorOpenTranslateButton": "__MISSING__:Go to Translate",
+    "pipelineStepClientRequest": "__MISSING__:Client Request",
+    "pipelineStepClientRequestDesc": "__MISSING__:Request received in client format",
+    "pipelineStepFormatDetected": "__MISSING__:Format Detected",
+    "pipelineStepFormatDetectedDesc": "__MISSING__:Auto-detected source format",
+    "pipelineStepOpenAIIntermediate": "__MISSING__:OpenAI Intermediate",
+    "pipelineStepOpenAIIntermediateDesc": "__MISSING__:Translated to OpenAI hub format",
+    "pipelineStepProviderFormat": "__MISSING__:Provider Format",
+    "pipelineStepProviderFormatDesc": "__MISSING__:Translated to provider target format",
+    "pipelineStepProviderResponse": "__MISSING__:Provider Response",
+    "pipelineStepProviderResponseDesc": "__MISSING__:Streaming response from provider",
+    "conceptDiagramArrow1": "__MISSING__:speaks",
+    "conceptDiagramArrow2": "__MISSING__:translates",
+    "conceptDiagramArrow3": "__MISSING__:converts",
+    "conceptDiagramExampleHub": "__MISSING__:OpenAI",
+    "conceptDiagramHubTooltip": "__MISSING__:Intermediate hub used by the translator to convert between formats that don't have a direct mapping.",
+    "conceptDiagramSourceTooltip": "__MISSING__:The API format your app speaks (e.g., Anthropic SDK = claude).",
+    "conceptDiagramTargetTooltip": "__MISSING__:The provider where the request will actually be sent.",
+    "compressionEmptyHint": "__MISSING__:Fill in the input field on the Translate tab (Simple Controls or Raw JSON) to enable the preview.",
+    "compressionModeLabel": "__MISSING__:Compression mode",
+    "compressionPreviewButton": "__MISSING__:Preview Compression",
+    "compressionPreviewing": "__MISSING__:Previewing…"
   },
   "usage": {
     "title": "Użycie",
@@ -6010,6 +6654,8 @@
     "notApplicable": "Nie dotyczy",
     "rawPlanWithValue": "Surowy plan: {plan}",
     "noPlanFromProvider": "Brak planu od dostawcy",
+    "tokenExpiresIn": "__MISSING__:Token expires in {time}",
+    "tokenExpired": "__MISSING__:Token expired",
     "noQuotaData": "Brak danych dotyczących kwot",
     "cardExpand": "__MISSING__:Expand",
     "cardCollapse": "__MISSING__:Collapse",
@@ -6159,6 +6805,11 @@
     "quotaCutoffsButtonDefault": "Domyślne",
     "quotaCutoffsButtonHelp": "Edytuj minimalne pozostałe limity przydziału dla tego konta.",
     "quotaCutoffsButtonDisabled": "Dla tego konta nie są jeszcze dostępne żadne okna przydziału.",
+    "deactivateAccount": "__MISSING__:Deactivate account (stop routing)",
+    "activateAccount": "__MISSING__:Activate account (resume routing)",
+    "accountActivated": "__MISSING__:Account activated",
+    "accountDeactivated": "__MISSING__:Account deactivated",
+    "toggleActiveFailed": "__MISSING__:Failed to update account status",
     "quotaCutoffsTitle": "Ograniczenia przydziałów dla {name} ({provider})",
     "quotaCutoffsExplainer": "Zastąp minimalny pozostały procent przydziału, w którym to konto przestaje być wybierane w każdym oknie przydziału. Pozostaw puste, aby odziedziczyć domyślnego dostawcę.",
     "quotaCutoffsDefaultHint": "Domyślna pozostała min: {default}%",
@@ -6179,6 +6830,7 @@
     "budgetColDailyLim": "Limit dzienny",
     "budgetColMonthlyLim": "Limit miesięczny",
     "budgetColUsedPct": "Zużyty%",
+    "percentUsed": "__MISSING__:{pct}% used",
     "budgetLoading": "Ładowanie…",
     "budgetNoKeysMatch": "Żaden klucz nie pasuje do filtrów",
     "budgetLinearExtrapolation": "ekstrapolacja liniowa",
@@ -7124,6 +7776,11 @@
     "modalEditTitle": "Modal Edit Title",
     "labelName": "Label Name",
     "labelType": "Wpisz",
+    "labelFamily": "__MISSING__:IP family",
+    "familyAuto": "__MISSING__:Auto (dual-stack)",
+    "familyIpv4": "__MISSING__:IPv4 only",
+    "familyIpv6": "__MISSING__:IPv6 only",
+    "familyHint": "__MISSING__:Egress address family. Auto keeps dual-stack; IPv4/IPv6 pin this proxy to that family (prevents a v4 leak under an IPv6-only proxy).",
     "labelHost": "Gospodarz",
     "labelPort": "Portu",
     "labelUsername": "Nazwa użytkownika",
@@ -7266,7 +7923,16 @@
     "improveConfirm": "Improve",
     "exportCode": "Export code",
     "exportCodeTitle": "Export Code",
+    "exportShort": "__MISSING__:Export",
     "noStateToExport": "No playground state available to export.",
+    "closeExportModal": "__MISSING__:Close export modal",
+    "close": "__MISSING__:Close",
+    "exportRealKeyWarning": "__MISSING__:Security warning: export blocked — a real API key was detected in the output. Please reset your API key and try again.",
+    "placeholderHintPrefix": "__MISSING__:Replace",
+    "placeholderHintSuffix": "__MISSING__:with your actual API key, or set it as an environment variable.",
+    "copyLangCode": "__MISSING__:Copy {language} code",
+    "loadingPresets": "__MISSING__:Loading…",
+    "loadPresetPlaceholder": "__MISSING__:Load preset…",
     "copyCode": "Copy",
     "copiedCode": "Copied!",
     "addModel": "+ Add model",
@@ -7291,7 +7957,27 @@
     "invalidJson": "Invalid JSON",
     "running": "Running…",
     "runLabel": "Run",
-    "enterToolResult": "Enter tool result…"
+    "enterToolResult": "Enter tool result…",
+    "build": {
+      "step1Label": "__MISSING__:What to test?",
+      "step2Label": "__MISSING__:Configure",
+      "step3Label": "__MISSING__:Run",
+      "step1Title": "__MISSING__:What do you want to test?",
+      "step1Subtitle": "__MISSING__:Choose the capability you want to explore in this session.",
+      "step2Title": "__MISSING__:Configure",
+      "step2Subtitle": "__MISSING__:Set up the tools or JSON schema that will be used in the request.",
+      "step3Title": "__MISSING__:Run",
+      "modeToolsTitle": "__MISSING__:Tools",
+      "modeToolsDesc": "__MISSING__:Test function calling — define tools and see how the model invokes them.",
+      "modeJsonTitle": "__MISSING__:JSON",
+      "modeJsonDesc": "__MISSING__:Test structured output — constrain the response to a JSON schema.",
+      "modeBothTitle": "__MISSING__:Tools + JSON",
+      "modeBothDesc": "__MISSING__:Combine function calling and structured output in a single request.",
+      "backButton": "__MISSING__:Back",
+      "nextButton": "__MISSING__:Next",
+      "runButton": "__MISSING__:Run",
+      "promptPlaceholder": "__MISSING__:Enter your message… (Enter to send, Shift+Enter for newline)"
+    }
   },
   "miniPlayground": {
     "endpoint": "__MISSING__:Endpoint",
@@ -7395,7 +8081,9 @@
     "loadingLogs": "Loading logs...",
     "noLogs": "No logs yet. Make some API calls to see them here.",
     "noMatchingLogs": "No logs matching current filters.",
-    "callLogsInfo": "Call logs are also saved as JSON files to {dataDir} and rotated based on {retentionDays} and {maxEntries}."
+    "callLogsInfo": "Call logs are also saved as JSON files to {dataDir} and rotated based on {retentionDays} and {maxEntries}.",
+    "loadMore": "__MISSING__:Load More",
+    "loadingMore": "__MISSING__:Loading more..."
   },
   "proxyLogger": {
     "filterAll": "All",
@@ -7432,7 +8120,8 @@
     "loadingProxyLogs": "Loading proxy logs...",
     "noProxyLogs": "No proxy logs yet. Configure proxies and make API calls to see them here.",
     "noMatchingLogs": "No logs match the current filters.",
-    "tlsFingerprint": "Chrome 124 TLS Fingerprint"
+    "tlsFingerprint": "Chrome 124 TLS Fingerprint",
+    "colPublicIp": "__MISSING__:Public IP"
   },
   "endpointOptions": {
     "speech": "Speech",
@@ -7572,7 +8261,86 @@
     "betaConfigSavedSuffix": "(jeszcze nie utrwalony na serwerze). Egzekwowanie limitu na żądanie nie jest jeszcze podłączone do potoku proxy. Na tym ekranie możesz zaprojektować i wizualizować podział kwot; rzeczywiste egzekwowanie nastąpi w przyszłej iteracji z trwałością DB i przechwytywaniem połączeń wychodzących.",
     "policyLabel": "Polityka:",
     "resetIn": "zresetuj w",
-    "quotaTotal": "łącznie"
+    "quotaTotal": "łącznie",
+    "kpiAvgUtilization": "__MISSING__:Avg utilization",
+    "kpiBorrowingNow": "__MISSING__:Borrowing now",
+    "conceptTitle": "__MISSING__:How Quota Share works",
+    "conceptIntro": "__MISSING__:Quota Share divides a provider's quota among multiple API keys using work-conserving fair-share: each key receives a proportional slice but can borrow from the free balance without exceeding the global cap.",
+    "conceptFairShare": "__MISSING__:Fair-share: each key receives quota proportional to its configured weight",
+    "conceptBorrowing": "__MISSING__:Borrowing: keys can consume free balance from others without breaching the cap",
+    "conceptGlobalCap": "__MISSING__:Hard global cap: the provider's absolute limit is never exceeded",
+    "conceptWindows": "__MISSING__:Windows: 5h, hourly, daily, weekly, monthly — each tracked independently",
+    "conceptKeyHowTitle": "__MISSING__:Enabling a key for quota",
+    "conceptKeyHowDesc": "__MISSING__:Create the key normally in API Keys — it appears in the wizard's key step automatically. Tick Exclusive there to make it quota-only. No separate enable step.",
+    "conceptExclusiveTitle": "__MISSING__:What \"Exclusive\" does",
+    "conceptExclusiveDesc": "__MISSING__:An exclusive key only sees/uses the pool's quotaShared-* models — every other model is hidden from its /v1/models and blocked.",
+    "burnRateTitle": "__MISSING__:Burn rate",
+    "burnRateExhaustsIn": "__MISSING__:Exhausts in",
+    "dimensionResetIn": "__MISSING__:Resets in",
+    "realConsumedColumn": "__MISSING__:Consumed",
+    "deficitColumn": "__MISSING__:Deficit",
+    "borrowingIndicator": "__MISSING__:borrowing",
+    "migratedFromLocalStorageNotice": "__MISSING__:Pools successfully migrated from localStorage.",
+    "policyCapAbsoluteLabel": "__MISSING__:Absolute cap",
+    "policyCapAbsolutePlaceholder": "__MISSING__:Numeric limit (optional)",
+    "multiDimensionLabel": "__MISSING__:Multi-dimension",
+    "stackedBarTitle": "__MISSING__:Slices by API key",
+    "usedSuffix": "__MISSING__:used {percent}%",
+    "wizardTitle": "__MISSING__:New quota pool",
+    "editPoolTitle": "__MISSING__:Edit pool",
+    "saveChanges": "__MISSING__:Save changes",
+    "wizardStep1Label": "__MISSING__:Account",
+    "wizardStep2Label": "__MISSING__:Limit",
+    "wizardStep3Label": "__MISSING__:Keys",
+    "wizardStep1Title": "__MISSING__:Choose provider connection",
+    "wizardStep1Subtitle": "__MISSING__:Select the provider account this pool will share quota for, set a name and default policy.",
+    "wizardStep2Title": "__MISSING__:Configure quota dimensions",
+    "wizardStep2Subtitle": "__MISSING__:Define the quota plan dimensions (unit, window, limit) for the chosen connection. Leave unchanged to keep current settings.",
+    "wizardStep3Title": "__MISSING__:Allocate API keys",
+    "wizardStep3Subtitle": "__MISSING__:Assign API keys to this pool with weight % allocations and optional caps.",
+    "wizardPoolNameLabel": "__MISSING__:Pool name",
+    "wizardPoolNamePlaceholder": "__MISSING__:My quota pool",
+    "wizardNext": "__MISSING__:Next",
+    "wizardBack": "__MISSING__:Back",
+    "wizardCreatePool": "__MISSING__:Create pool",
+    "wizardDimensionsEditedNotice": "__MISSING__:Dimensions edited — will be saved as a manual override when the pool is created.",
+    "wizardExclusiveLabel": "__MISSING__:Exclusive quota",
+    "wizardExclusiveHint": "__MISSING__:When enabled, these API keys will only be allowed to use this pool's virtual models (allowedQuotas reconciliation is applied on save).",
+    "wizardPreviewLabel": "__MISSING__:Virtual model names preview",
+    "wizardConnectionsLabel": "__MISSING__:Provider connections",
+    "wizardPrimaryBadge": "__MISSING__:primary",
+    "wizardAdditionalConnectionsNote": "__MISSING__:Additional connections use their catalog default limits (editable later).",
+    "wizardSingleProviderNote": "__MISSING__:A pool uses a single provider",
+    "wizardPreviewMoreModels": "__MISSING__:+{count} more",
+    "accountQuotaTitle": "__MISSING__:Account quota",
+    "accountQuotaNone": "__MISSING__:—",
+    "logTitle": "__MISSING__:Usage log",
+    "logEmpty": "__MISSING__:No usage yet",
+    "groupLabel": "__MISSING__:Group",
+    "newGroup": "__MISSING__:New group",
+    "renameGroup": "__MISSING__:Rename group",
+    "groupSelectHint": "__MISSING__:Filter pools by group",
+    "groupAllocationNote": "__MISSING__:Allocations apply to all pools in this group via the shared quota layer.",
+    "groupNamePrompt": "__MISSING__:Enter group name",
+    "wizardGroupLabel": "__MISSING__:Group",
+    "allGroups": "__MISSING__:All groups",
+    "endpointsTitle": "__MISSING__:Available endpoints",
+    "endpointsHint": "__MISSING__:Call these virtual models with any allocated key — routing + quota are handled per group.",
+    "previewForKey": "__MISSING__:Preview for key",
+    "previewKeyNone": "__MISSING__:(all endpoints)",
+    "endpointsBaseUrl": "__MISSING__:Base URL",
+    "endpointsCollapse": "__MISSING__:Collapse",
+    "endpointsExpand": "__MISSING__:Expand",
+    "endpointsAnthropicNote": "__MISSING__:Anthropic-native",
+    "endpointsResponsesNote": "__MISSING__:OpenAI Responses — codex/github",
+    "endpointsWsNote": "__MISSING__:WebSocket — codex only",
+    "betaText": "__MISSING__:Quota Share is functional but bugs are expected. Found one? Please report it.",
+    "betaReportLink": "__MISSING__:Report an issue",
+    "deleteGroup": "__MISSING__:Delete group",
+    "deleteGroupConfirm": "__MISSING__:Delete this group? Its pools must be reassigned or removed first.",
+    "deleteGroupHasPools": "__MISSING__:This group still has pools — reassign or delete them first.",
+    "ungroupedTitle": "__MISSING__:Ungrouped",
+    "ungroupedHint": "__MISSING__:These pools are not assigned to a known group. Edit a pool to move it into a real group."
   },
   "plugins": {
     "title": "Plugins",
@@ -7608,6 +8376,571 @@
     "status": "Status",
     "enabled": "Enabled",
     "disabled": "Disabled",
+    "installedTab": "__MISSING__:Installed",
+    "marketplaceTab": "__MISSING__:Marketplace",
+    "marketplaceUrlLabel": "__MISSING__:Custom Marketplace URL",
+    "marketplaceUrlPlaceholder": "__MISSING__:Leave empty for official Omniroute registry",
+    "saveMarketplaceUrl": "__MISSING__:Save & Reload",
+    "marketplaceUrlSaved": "__MISSING__:Marketplace URL updated",
+    "marketplaceEmpty": "__MISSING__:No plugins found in marketplace.",
+    "verified": "__MISSING__:Verified",
+    "install": "__MISSING__:Install",
+    "installedFromMarketplace": "__MISSING__:Plugin {name} installed!",
     "hooks": "Hooks"
+  },
+  "quotaPlans": {
+    "title": "__MISSING__:Plans & Quotas",
+    "description": "__MISSING__:Configure quota plans per provider — dimensions (%, requests, tokens, $) and time windows",
+    "providerLabel": "__MISSING__:Provider / Connection",
+    "detectedPlanLabel": "__MISSING__:Detected plan",
+    "manualPlanLabel": "__MISSING__:Manual override",
+    "unconfiguredLabel": "__MISSING__:Not configured — manual required",
+    "dimensionLabel": "__MISSING__:Dimensions",
+    "addDimension": "__MISSING__:Add dimension",
+    "removeDimension": "__MISSING__:Remove",
+    "limitLabel": "__MISSING__:Limit",
+    "unitOptions": {
+      "percent": "__MISSING__:%",
+      "requests": "__MISSING__:requests",
+      "tokens": "__MISSING__:tokens",
+      "usd": "__MISSING__:USD ($)"
+    },
+    "windowOptions": {
+      "5h": "__MISSING__:5 hours",
+      "hourly": "__MISSING__:Hourly",
+      "daily": "__MISSING__:Daily",
+      "weekly": "__MISSING__:Weekly",
+      "monthly": "__MISSING__:Monthly"
+    },
+    "useCatalogButton": "__MISSING__:Use catalog",
+    "saveOverrideButton": "__MISSING__:Save override",
+    "revertToCatalogButton": "__MISSING__:Revert to catalog",
+    "unknownProviderNotice": "__MISSING__:Select a provider on the left to configure its quota plan.",
+    "catalogTitle": "__MISSING__:Known catalog",
+    "catalogDescription": "__MISSING__:Automatically detected plans for the following providers:"
+  },
+  "activity": {
+    "title": "__MISSING__:Activity",
+    "description": "__MISSING__:Recent events feed",
+    "emptyTitle": "__MISSING__:No activity yet",
+    "emptyDescription": "__MISSING__:When you add providers, create combos, or rotate keys, events will appear here.",
+    "todayHeader": "__MISSING__:Today",
+    "yesterdayHeader": "__MISSING__:Yesterday",
+    "filterAll": "__MISSING__:All",
+    "filterProviders": "__MISSING__:Providers",
+    "filterCombos": "__MISSING__:Combos",
+    "filterApiKeys": "__MISSING__:API Keys",
+    "filterSettings": "__MISSING__:Settings",
+    "filterQuota": "__MISSING__:Quota",
+    "filterAuth": "__MISSING__:Auth",
+    "filterSystem": "__MISSING__:System",
+    "relative": {
+      "justNow": "__MISSING__:just now",
+      "minutesAgo": "__MISSING__:{n} min ago",
+      "hoursAgo": "__MISSING__:{n} h ago",
+      "yesterday": "__MISSING__:yesterday",
+      "daysAgo": "__MISSING__:{n} days ago"
+    },
+    "eventVerb": {
+      "providerAdded": "__MISSING__:{actor} added provider {target}",
+      "providerRemoved": "__MISSING__:{actor} removed provider {target}",
+      "providerTested": "__MISSING__:{actor} tested provider {target}",
+      "comboCreated": "__MISSING__:{actor} created combo {target}",
+      "comboUpdated": "__MISSING__:{actor} updated combo {target}",
+      "comboDeleted": "__MISSING__:{actor} removed combo {target}",
+      "apiKeyCreated": "__MISSING__:{actor} created API key {target}",
+      "apiKeyRevoked": "__MISSING__:{actor} revoked API key {target}",
+      "apiKeyRotated": "__MISSING__:{actor} rotated API key {target}",
+      "budgetThreshold": "__MISSING__:Budget threshold reached for {target}",
+      "settingUpdated": "__MISSING__:{actor} updated setting {target}",
+      "authLogin": "__MISSING__:{actor} signed in",
+      "authLogout": "__MISSING__:{actor} signed out",
+      "cloudAgentSession": "__MISSING__:Cloud agent session started for {target}",
+      "mcpToolRegistered": "__MISSING__:MCP tool {target} registered",
+      "webhookCreated": "__MISSING__:{actor} created webhook {target}",
+      "webhookDeleted": "__MISSING__:{actor} removed webhook {target}",
+      "quotaPoolCreated": "__MISSING__:{actor} created quota pool {target}",
+      "quotaPoolUpdated": "__MISSING__:{actor} updated quota pool {target}",
+      "quotaPoolDeleted": "__MISSING__:{actor} removed quota pool {target}",
+      "quotaPlanUpdated": "__MISSING__:{actor} updated quota plan {target}",
+      "quotaStoreDriverChanged": "__MISSING__:QuotaStore driver changed",
+      "updateApplied": "__MISSING__:Update {target} applied",
+      "deployCompleted": "__MISSING__:Deploy completed",
+      "skillInstalled": "__MISSING__:{actor} installed skill {target}",
+      "skillRemoved": "__MISSING__:{actor} removed skill {target}",
+      "providerCredentialsCreated": "__MISSING__:{actor} created credentials for {target}",
+      "providerCredentialsApplied": "__MISSING__:Credentials for {target} applied",
+      "providerCredentialsUpdated": "__MISSING__:{actor} updated credentials for {target}",
+      "providerCredentialsRevoked": "__MISSING__:{actor} revoked credentials for {target}",
+      "providerCredentialsBatchRevoked": "__MISSING__:{actor} batch-revoked credentials",
+      "providerCredentialsBatchUpdated": "__MISSING__:{actor} batch-updated credentials",
+      "providerCredentialsBulkCreated": "__MISSING__:{actor} bulk-created credentials",
+      "providerCredentialsBulkImported": "__MISSING__:{actor} bulk-imported credentials",
+      "providerCredentialsImported": "__MISSING__:{actor} imported credentials",
+      "providerSsrfBlocked": "__MISSING__:SSRF attempt blocked for {target}",
+      "authLoginSuccess": "__MISSING__:{actor} signed in",
+      "authLoginError": "__MISSING__:Login error for {actor}",
+      "authLoginFailed": "__MISSING__:Login failed for {actor}",
+      "authLoginLocked": "__MISSING__:{actor} locked out after too many attempts",
+      "authLoginMisconfigured": "__MISSING__:Auth configuration invalid",
+      "authLoginSetupRequired": "__MISSING__:Auth setup required",
+      "authLogoutSuccess": "__MISSING__:{actor} signed out",
+      "syncTokenCreated": "__MISSING__:{actor} created sync token",
+      "syncTokenRevoked": "__MISSING__:{actor} revoked sync token",
+      "settingsUpdate": "__MISSING__:{actor} updated settings",
+      "settingsUpdateFailed": "__MISSING__:Settings update failed",
+      "serviceRevealApiKey": "__MISSING__:{actor} revealed API key for {target}",
+      "genericEvent": "__MISSING__:{actor} {target}"
+    }
+  },
+  "agentBridge": {
+    "title": "__MISSING__:AgentBridge",
+    "subtitle": "__MISSING__:Use IDE agents with OmniRoute models — no config required",
+    "riskBannerTitle": "__MISSING__:Use at your own risk",
+    "riskBannerBody": "__MISSING__:AgentBridge intercepts HTTPS traffic from IDE agents. By activating it you accept responsibility for compliance with the terms of service of each agent. Never use on devices or networks where TLS inspection is prohibited.",
+    "riskBannerDismiss": "__MISSING__:Dismiss",
+    "serverCardTitle": "__MISSING__:AgentBridge Server",
+    "statusRunning": "__MISSING__:Running",
+    "statusStopped": "__MISSING__:Stopped",
+    "statusActive": "__MISSING__:Active",
+    "statusDnsOff": "__MISSING__:DNS off",
+    "statusSetupRequired": "__MISSING__:Setup required",
+    "statusInvestigating": "__MISSING__:Investigating",
+    "serverPort": "__MISSING__:Port",
+    "serverConns": "__MISSING__:Connections",
+    "serverIntercepted": "__MISSING__:Intercepted",
+    "serverLastStarted": "__MISSING__:Last started",
+    "startServer": "__MISSING__:Start",
+    "stopServer": "__MISSING__:Stop",
+    "restartServer": "__MISSING__:Restart",
+    "trustCert": "__MISSING__:Trust Cert",
+    "downloadCert": "__MISSING__:Download Cert",
+    "regenerateCert": "__MISSING__:Regenerate Cert",
+    "starting": "__MISSING__:Starting…",
+    "stopping": "__MISSING__:Stopping…",
+    "restarting": "__MISSING__:Restarting…",
+    "trusting": "__MISSING__:Trusting…",
+    "regenerating": "__MISSING__:Regenerating…",
+    "upstreamCaLabel": "__MISSING__:Upstream CA Certificate (corporate)",
+    "upstreamCaPlaceholder": "__MISSING__:/etc/ssl/certs/corp-ca.pem",
+    "upstreamCaTest": "__MISSING__:Test TLS",
+    "upstreamCaTestOk": "__MISSING__:TLS test passed",
+    "upstreamCaTestError": "__MISSING__:TLS test failed — check the path and CA file",
+    "bypassSectionTitle": "__MISSING__:Bypass List",
+    "bypassSectionDesc": "__MISSING__:Hosts matching these patterns are tunneled directly (no TLS decryption). Defaults include banks, .gov, and corporate SSO.",
+    "bypassDefaultsLabel": "__MISSING__:Default bypass patterns (read-only)",
+    "bypassUserLabel": "__MISSING__:Custom bypass patterns (one per line, glob or regex)",
+    "saveBypassList": "__MISSING__:Save bypass list",
+    "agentListTitle": "__MISSING__:IDE Agents",
+    "filterAll": "__MISSING__:All",
+    "filterActive": "__MISSING__:Active",
+    "filterSetupRequired": "__MISSING__:Setup required",
+    "filterInvestigating": "__MISSING__:Investigating",
+    "searchAgents": "__MISSING__:Search agents…",
+    "noAgentsMatch": "__MISSING__:No agents match the current filter",
+    "agentHosts": "__MISSING__:Intercepted hosts",
+    "certTrusted": "__MISSING__:Certificate trusted",
+    "certNotTrusted": "__MISSING__:Certificate not trusted",
+    "investigatingNotice": "__MISSING__:This agent is under investigation. Hosts and API surface are still being confirmed. Setup will be available once the upstream API is documented.",
+    "modelMappingsLabel": "__MISSING__:Model mappings",
+    "sourceModel": "__MISSING__:Source model (agent native)",
+    "targetModel": "__MISSING__:Target model (OmniRoute)",
+    "noMappings": "__MISSING__:No model mappings configured. Run setup wizard to auto-detect models.",
+    "selectModel": "__MISSING__:Select…",
+    "saveMappings": "__MISSING__:Save mappings",
+    "setupWizard": "__MISSING__:Setup wizard",
+    "startDns": "__MISSING__:Start DNS",
+    "stopDns": "__MISSING__:Stop DNS",
+    "toggling": "__MISSING__:Toggling…",
+    "viewTraffic": "__MISSING__:View traffic",
+    "emptyNoProvidersTitle": "__MISSING__:No providers configured yet",
+    "emptyNoProvidersBody": "__MISSING__:To use AgentBridge, first connect at least one provider. It will be the destination where IDE requests are routed.",
+    "emptyGoToProviders": "__MISSING__:Go to Providers",
+    "wizardTitle": "__MISSING__:Setup wizard",
+    "wizardSubtitle": "__MISSING__:3-step setup",
+    "wizardStep1Label": "__MISSING__:Verify",
+    "wizardStep2Label": "__MISSING__:DNS",
+    "wizardStep3Label": "__MISSING__:Mappings",
+    "wizardStep1Desc": "__MISSING__:Confirm the server is running and the certificate is installed.",
+    "wizardStep2Desc": "__MISSING__:The following entries will be added to /etc/hosts to redirect traffic through AgentBridge:",
+    "wizardStep3Desc": "__MISSING__:You can now configure model mappings in the agent card. Restart the IDE to apply changes.",
+    "wizardStep3Success": "__MISSING__:Agent is configured!",
+    "wizardServerCheck": "__MISSING__:AgentBridge server",
+    "wizardRunning": "__MISSING__:running",
+    "wizardNotRunning": "__MISSING__:not running",
+    "wizardCertCheck": "__MISSING__:Certificate",
+    "wizardTrusted": "__MISSING__:trusted",
+    "wizardNotTrusted": "__MISSING__:not yet trusted — use Trust Cert button",
+    "wizardTutorialTitle": "__MISSING__:Setup instructions:",
+    "wizardEnableDns": "__MISSING__:Add /etc/hosts entries",
+    "wizardDnsAlreadyEnabled": "__MISSING__:DNS already enabled for this agent",
+    "enablingDns": "__MISSING__:Enabling…",
+    "modelSelectorTitle": "__MISSING__:Select target model",
+    "modelSelectorSearch": "__MISSING__:Search models…",
+    "noModelsFound": "__MISSING__:No models found",
+    "quickLinks": "__MISSING__:Quick links",
+    "quickLinkProviders": "__MISSING__:Configure providers",
+    "quickLinkInspector": "__MISSING__:View traffic in Traffic Inspector",
+    "maintenanceTitle": "__MISSING__:Maintenance & Diagnostics",
+    "maintenanceSubtitle": "__MISSING__:Self-test the capture pipeline, undo leftover system state, and move your setup between machines.",
+    "orphanedStateWarning": "__MISSING__:A previous session left system state behind (DNS spoof, CA, or system proxy). Run Repair to clean it up.",
+    "diagnose": "__MISSING__:Diagnose",
+    "diagnosing": "__MISSING__:Diagnosing…",
+    "diagnoseHealthy": "__MISSING__:Capture pipeline is healthy.",
+    "diagnoseUnhealthy": "__MISSING__:Capture pipeline has problems:",
+    "repair": "__MISSING__:Repair",
+    "repairing": "__MISSING__:Repairing…",
+    "repairDone": "__MISSING__:Repaired: {items}",
+    "repairNothing": "__MISSING__:Nothing to repair — system state is clean.",
+    "removeCa": "__MISSING__:Remove CA",
+    "removeCaConfirm": "__MISSING__:Remove CA?",
+    "removeCaDone": "__MISSING__:MITM root CA removed from the OS trust store.",
+    "removing": "__MISSING__:Removing…",
+    "confirm": "__MISSING__:Confirm",
+    "exportConfig": "__MISSING__:Export config",
+    "exporting": "__MISSING__:Exporting…",
+    "importConfig": "__MISSING__:Import config",
+    "importing": "__MISSING__:Importing…",
+    "importInvalidJson": "__MISSING__:The selected file is not valid JSON.",
+    "importDone": "__MISSING__:Imported {bypass} bypass · {hosts} hosts · {agents} agents",
+    "save": "__MISSING__:Save",
+    "saving": "__MISSING__:Saving…",
+    "cancel": "__MISSING__:Cancel",
+    "back": "__MISSING__:Back",
+    "next": "__MISSING__:Next",
+    "done": "__MISSING__:Done",
+    "loading": "__MISSING__:Loading…",
+    "riskNoticeTitle": "__MISSING__:Risk acknowledgment",
+    "riskNoticeBody": "__MISSING__:AgentBridge will intercept HTTPS traffic from this agent by redirecting its API hosts via DNS. Only enable if you accept responsibility for compliance with the agent's terms of service and any applicable network policies.",
+    "pageMoved": {
+      "goNow": "__MISSING__:Go now",
+      "message": "__MISSING__:The MITM Proxy now lives under AgentBridge.",
+      "title": "__MISSING__:This page has moved"
+    }
+  },
+  "trafficInspector": {
+    "title": "__MISSING__:Traffic Inspector",
+    "subtitle": "__MISSING__:Monitor LLM calls and debug any application's HTTPS traffic",
+    "captureModesTitle": "__MISSING__:Capture Modes",
+    "agentBridgeMode": "__MISSING__:AgentBridge",
+    "agentBridgeModeDesc": "__MISSING__:Capture traffic from all connected IDE agents",
+    "customHostsMode": "__MISSING__:Custom Hosts",
+    "customHostsModeDesc": "__MISSING__:Add specific hosts to intercept",
+    "httpProxyMode": "__MISSING__:HTTP Proxy",
+    "httpProxyModeDesc": "__MISSING__:Use HTTP_PROXY environment variable",
+    "systemWideMode": "__MISSING__:System-wide",
+    "systemWideModeDesc": "__MISSING__:Intercept all system traffic (advanced)",
+    "tproxyMode": "__MISSING__:TPROXY Decrypt",
+    "tproxyModeUnavailable": "__MISSING__:TPROXY decrypt requires Linux + root + the native addon",
+    "filterBarTitle": "__MISSING__:Filters",
+    "profileLlmOnly": "__MISSING__:LLM only",
+    "profileCustom": "__MISSING__:Custom",
+    "profileAll": "__MISSING__:All",
+    "filterHost": "__MISSING__:Filter host…",
+    "filterAgent": "__MISSING__:Agent",
+    "filterStatus": "__MISSING__:Status",
+    "pauseBtn": "__MISSING__:Pause",
+    "resumeBtn": "__MISSING__:Resume",
+    "clearBtn": "__MISSING__:Clear",
+    "exportHar": "__MISSING__:Export .har",
+    "recordSession": "__MISSING__:REC",
+    "stopSession": "__MISSING__:Stop",
+    "liveBadge": "__MISSING__:live",
+    "offlineBadge": "__MISSING__:offline",
+    "noRequests": "__MISSING__:No requests captured yet.",
+    "noRequestsDesc": "__MISSING__:Make sure AgentBridge is running or enable another capture mode.",
+    "selectRequest": "__MISSING__:Select a request to inspect it.",
+    "tabConversation": "__MISSING__:Conversation",
+    "tabHeaders": "__MISSING__:Headers",
+    "tabRequest": "__MISSING__:Request",
+    "tabResponse": "__MISSING__:Response",
+    "tabTiming": "__MISSING__:Timing",
+    "tabLlm": "__MISSING__:LLM",
+    "tabStats": "__MISSING__:Stats",
+    "requestHeaders": "__MISSING__:Request Headers",
+    "responseHeaders": "__MISSING__:Response Headers",
+    "rawEvents": "__MISSING__:Raw events",
+    "mergedView": "__MISSING__:Merged view",
+    "noBody": "__MISSING__:No body.",
+    "streaming": "__MISSING__:streaming…",
+    "manageHosts": "__MISSING__:Manage hosts",
+    "copySnippet": "__MISSING__:Copy proxy snippet",
+    "addHost": "__MISSING__:Add",
+    "hostPlaceholder": "__MISSING__:api.openai.com",
+    "noHostsYet": "__MISSING__:No custom hosts added yet.",
+    "noSessionsYet": "__MISSING__:No sessions yet",
+    "allTraffic": "__MISSING__:All traffic (no session)",
+    "sessionsDropdown": "__MISSING__:Sessions",
+    "annotationPlaceholder": "__MISSING__:Add a note…",
+    "contextFingerprint": "__MISSING__:Context fingerprint",
+    "llmProvider": "__MISSING__:Detected provider",
+    "llmApiKind": "__MISSING__:API kind",
+    "llmModel": "__MISSING__:Model",
+    "llmMessages": "__MISSING__:Messages",
+    "llmStream": "__MISSING__:Stream",
+    "llmMappedTo": "__MISSING__:Mapped to",
+    "llmCostEstimate": "__MISSING__:Cost estimate",
+    "systemProxyExitWarning": "__MISSING__:System-wide proxy still active — leave page anyway?",
+    "customHostsTitle": "__MISSING__:Custom Hosts",
+    "loading": "__MISSING__:Loading…",
+    "copied": "__MISSING__:Copied!",
+    "copy": "__MISSING__:Copy",
+    "httpProxyTitle": "__MISSING__:HTTP Proxy Snippet — port {port}",
+    "notRecording": "__MISSING__:Not recording",
+    "anyStatus": "__MISSING__:Any status",
+    "liveOnly": "__MISSING__:Live",
+    "viewingRecordedSession": "__MISSING__:Viewing recorded session",
+    "backToLive": "__MISSING__:Back to live",
+    "untitledSession": "__MISSING__:Untitled session",
+    "contextHistory": "__MISSING__:Context History",
+    "modelResponse": "__MISSING__:Model Response",
+    "conversationNoMessages": "__MISSING__:No messages found in this request.",
+    "conversationNotAvailable": "__MISSING__:Conversation data not available. This may not be an LLM request or the body could not be parsed.",
+    "loadingCharts": "__MISSING__:Loading charts…",
+    "statsErrors": "__MISSING__:Errors",
+    "statsLatency": "__MISSING__:Latency (last 50 requests)",
+    "statsNoData": "__MISSING__:No requests yet. Start a session recording to capture data for stats.",
+    "statsStatusDistribution": "__MISSING__:Status distribution",
+    "statsSuccessful": "__MISSING__:Successful",
+    "statsTotalRequests": "__MISSING__:Total requests",
+    "timingProxyOverhead": "__MISSING__:Proxy overhead",
+    "timingUpstreamResponse": "__MISSING__:Upstream response",
+    "timingNoData": "__MISSING__:No timing data available.",
+    "timingTotalLatency": "__MISSING__:Total latency",
+    "timingTimestamp": "__MISSING__:Timestamp",
+    "timingMethod": "__MISSING__:Method",
+    "timingStatus": "__MISSING__:Status",
+    "timingRequestSize": "__MISSING__:Request size",
+    "timingResponseSize": "__MISSING__:Response size",
+    "pausedNewBadge": "__MISSING__:{count} new",
+    "clearContextFilter": "__MISSING__:clear"
+  },
+  "cliCommon": {
+    "concept": {
+      "code": {
+        "title": "__MISSING__:CLI Code",
+        "phrase": "__MISSING__:Code tools you point at OmniRoute",
+        "flow": "__MISSING__:You → CLI Code → OmniRoute → Provider",
+        "seeOther": "__MISSING__:See →"
+      },
+      "agent": {
+        "title": "__MISSING__:CLI Agents",
+        "phrase": "__MISSING__:Broad-purpose autonomous CLI agents you point at OmniRoute",
+        "flow": "__MISSING__:You → CLI Agent → OmniRoute → Provider",
+        "seeOther": "__MISSING__:See →"
+      },
+      "acp": {
+        "title": "__MISSING__:ACP Agents",
+        "phrase": "__MISSING__:CLIs that OmniRoute spawns as execution backend (reverse flow)",
+        "flow": "__MISSING__:Client → OmniRoute → spawn CLI (stdio/ACP) → response",
+        "seeOther": "__MISSING__:See →"
+      }
+    },
+    "comparison": {
+      "title": "__MISSING__:Understand the 3 CLI types in OmniRoute",
+      "thisPage": "__MISSING__:This page",
+      "open": "__MISSING__:Open →",
+      "code": {
+        "title": "__MISSING__:Code tool",
+        "desc": "__MISSING__:Points to Omni",
+        "flow": "__MISSING__:you → CLI → Omni → provider",
+        "examples": "__MISSING__:e.g.: claude, codex"
+      },
+      "agent": {
+        "title": "__MISSING__:Broad autonomous agent",
+        "desc": "__MISSING__:Points to Omni",
+        "flow": "__MISSING__:you → agent → Omni",
+        "examples": "__MISSING__:e.g.: hermes, goose"
+      },
+      "acp": {
+        "title": "__MISSING__:CLI used as backend by Omni",
+        "desc": "__MISSING__:Reverse execution",
+        "flow": "__MISSING__:Omni → spawn CLI → resp",
+        "examples": "__MISSING__:e.g.: claude, codex (ACP)"
+      }
+    },
+    "card": {
+      "detected": "__MISSING__:Detected",
+      "notDetected": "__MISSING__:Not detected",
+      "configured": "__MISSING__:Configured",
+      "notConfigured": "__MISSING__:Not configured",
+      "configure": "__MISSING__:Configure →",
+      "howToInstall": "__MISSING__:How to install →",
+      "manualConfig": "__MISSING__:Manual config",
+      "installGuide": "__MISSING__:Install guide",
+      "endpointLabel": "__MISSING__:Endpoint",
+      "baseUrlFull": "__MISSING__:Full Base URL",
+      "baseUrlPartial": "__MISSING__:Partial Base URL",
+      "refreshDetection": "__MISSING__:Refresh detection",
+      "alsoAcp": "__MISSING__:also ACP",
+      "connectProviderHint": "__MISSING__:Connect a provider in Providers"
+    },
+    "detail": {
+      "back": "__MISSING__:Back",
+      "apply": "__MISSING__:Save",
+      "reset": "__MISSING__:Clear",
+      "manualConfig": "__MISSING__:Manual configuration",
+      "vendor": "__MISSING__:Vendor",
+      "category": "__MISSING__:Type",
+      "detectionStatus": "__MISSING__:Detection",
+      "configStatus": "__MISSING__:Configuration",
+      "baseUrlLabel": "__MISSING__:Base URL",
+      "apiKeyLabel": "__MISSING__:API Key",
+      "modelMappingLabel": "__MISSING__:Model mapping",
+      "noActiveProviders": "__MISSING__:No active providers.",
+      "noActiveProvidersDesc": "__MISSING__:Go to Providers to connect at least 1 provider before configuring the CLI.",
+      "openProviders": "__MISSING__:Open Providers →"
+    }
+  },
+  "cliCode": {
+    "pageTitle": "__MISSING__:CLI Code's",
+    "pageSubtitle": "__MISSING__:Code tools pointing to OmniRoute",
+    "searchPlaceholder": "__MISSING__:Search CLI…",
+    "filterDetectionLabel": "__MISSING__:Detection",
+    "filterBaseUrlLabel": "__MISSING__:Base URL",
+    "detectionAll": "__MISSING__:All",
+    "detectionInstalled": "__MISSING__:Installed",
+    "detectionNotFound": "__MISSING__:Not found",
+    "baseUrlAll": "__MISSING__:All",
+    "baseUrlFull": "__MISSING__:Full",
+    "baseUrlPartial": "__MISSING__:Partial"
+  },
+  "cliAgents": {
+    "pageTitle": "__MISSING__:CLI Agents",
+    "pageSubtitle": "__MISSING__:Broad-purpose autonomous CLI agents",
+    "refreshDetection": "__MISSING__:Refresh detection",
+    "searchPlaceholder": "__MISSING__:Search agent…",
+    "detectionFilterLabel": "__MISSING__:Detection",
+    "detectionAll": "__MISSING__:All",
+    "detectionInstalled": "__MISSING__:Installed",
+    "detectionNotInstalled": "__MISSING__:Not installed",
+    "visibleCount": "__MISSING__:{count} visible",
+    "emptyState": "__MISSING__:No CLI agents found with the current filters."
+  },
+  "acpAgents": {
+    "pageTitle": "__MISSING__:ACP Agents",
+    "pageSubtitle": "__MISSING__:CLIs that OmniRoute spawns as execution backend",
+    "scanning": "__MISSING__:Detecting agents…",
+    "refresh": "__MISSING__:Refresh",
+    "setupGuideTitle": "__MISSING__:Setup guide",
+    "setupGuideDetectCliTitle": "__MISSING__:Detect CLI",
+    "setupGuideDetectCliDesc": "__MISSING__:Agents are identified by running the --version command in PATH.",
+    "setupGuideCustomAgentTitle": "__MISSING__:Add custom agent",
+    "setupGuideCustomAgentDesc": "__MISSING__:Fill in the form below to register a custom CLI agent.",
+    "setupGuideCommandMissingTitle": "__MISSING__:Command not found",
+    "setupGuideCommandMissingDesc": "__MISSING__:Check that the binary is in PATH.",
+    "fingerprintSettingsHint": "__MISSING__:Configure routing and fingerprints in",
+    "settingsRoutingLink": "__MISSING__:Settings → Routing",
+    "installed": "__MISSING__:Installed",
+    "notFound": "__MISSING__:Not found",
+    "builtIn": "__MISSING__:Built-in",
+    "custom": "__MISSING__:Custom",
+    "agentUseCaseHint": "__MISSING__:Available for spawn via ACP.",
+    "remove": "__MISSING__:Remove",
+    "addCustomAgent": "__MISSING__:Add custom agent",
+    "addCustomAgentDesc": "__MISSING__:Register a custom CLI agent to be spawned via ACP.",
+    "addAgent": "__MISSING__:Add agent",
+    "agentName": "__MISSING__:Name",
+    "agentNamePlaceholder": "__MISSING__:e.g.: My Agent",
+    "binaryName": "__MISSING__:Binary",
+    "binaryNamePlaceholder": "__MISSING__:e.g.: myagent",
+    "versionCommand": "__MISSING__:Version command",
+    "versionCommandPlaceholder": "__MISSING__:e.g.: myagent --version",
+    "spawnArgs": "__MISSING__:Spawn arguments",
+    "spawnArgsPlaceholder": "__MISSING__:e.g.: --quiet, --json",
+    "cliCodeRedirectCta": "__MISSING__:Open CLI Code"
+  },
+  "agentSkills": {
+    "pageTitle": "__MISSING__:Agent Skills",
+    "pageSubtitle": "__MISSING__:Teach your agent to operate OmniRoute — 22 API areas + 20 CLI families",
+    "conceptCard": {
+      "agent": {
+        "title": "__MISSING__:Agent Skills — Outbound",
+        "description": "__MISSING__:Agent Skills are machine-readable SKILL.md documents that external AI agents (Claude Code, Cursor, Copilot…) fetch from GitHub to learn how to operate OmniRoute via REST or CLI. They are read by the agent, not executed by OmniRoute.",
+        "crossLinkLabel": "__MISSING__:Understand the difference →"
+      },
+      "omni": {
+        "title": "__MISSING__:Omni Skills — Inbound",
+        "description": "__MISSING__:Omni Skills are sandbox tools that OmniRoute injects into the model's context on every request. They are executed by OmniRoute, not read by the agent.",
+        "crossLinkLabel": "__MISSING__:Understand the difference →"
+      },
+      "comparison": {
+        "colAgent": "__MISSING__:Agent Skills",
+        "colOmni": "__MISSING__:Omni Skills",
+        "whatIs": {
+          "label": "__MISSING__:What it is",
+          "agent": "__MISSING__:Machine-readable SKILL.md that teaches an external agent to operate OmniRoute",
+          "omni": "__MISSING__:Executable tools that OmniRoute injects as tools into LLM requests"
+        },
+        "direction": {
+          "label": "__MISSING__:Direction",
+          "agent": "__MISSING__:Outbound — external agent learns to control OmniRoute",
+          "omni": "__MISSING__:Inbound — OmniRoute gives tools to models passing through it"
+        },
+        "executor": {
+          "label": "__MISSING__:Executor",
+          "agent": "__MISSING__:External agent (reads markdown → acts via API/CLI)",
+          "omni": "__MISSING__:OmniRoute itself (intercepts tool_calls, Docker sandbox)"
+        },
+        "storage": {
+          "label": "__MISSING__:Storage",
+          "agent": "__MISSING__:Dynamic catalog (/api/agent-skills) → SKILL.md on GitHub",
+          "omni": "__MISSING__:SQLite (SkillsMP / skills.sh / local)"
+        },
+        "tagline": {
+          "label": "__MISSING__:Tagline",
+          "agent": "__MISSING__:Teach your agent to use OmniRoute",
+          "omni": "__MISSING__:Give executable tools to OmniRoute models"
+        }
+      }
+    },
+    "filters": {
+      "category": "__MISSING__:Category",
+      "area": "__MISSING__:Area",
+      "searchPlaceholder": "__MISSING__:Search skills…"
+    },
+    "categoryApi": "__MISSING__:API",
+    "categoryCli": "__MISSING__:CLI",
+    "categoryConfig": "__MISSING__:Config",
+    "filterAll": "__MISSING__:All",
+    "coverageLabel": "__MISSING__:Coverage",
+    "mcpUrl": "__MISSING__:MCP URL",
+    "a2aLink": "__MISSING__:A2A",
+    "copyUrl": "__MISSING__:Copy URL",
+    "viewOnGithub": "__MISSING__:View on GitHub",
+    "previewLoading": "__MISSING__:Loading skill documentation…",
+    "previewError": "__MISSING__:Failed to load skill documentation.",
+    "previewEmpty": "__MISSING__:Select a skill to preview its documentation.",
+    "generateButton": "__MISSING__:Generate missing skills",
+    "coverageBar": {
+      "complete": "__MISSING__:Complete",
+      "partial": "__MISSING__:Partial"
+    },
+    "noSkillsFound": "__MISSING__:No skills found matching your filters.",
+    "regenerateConfirm": "__MISSING__:This will regenerate all missing SKILL.md files. Continue?",
+    "regenerateRunning": "__MISSING__:Regenerating skills…",
+    "regenerateSuccess": "__MISSING__:Skills regenerated successfully.",
+    "regenerateError": "__MISSING__:Failed to regenerate skills."
+  },
+  "freeProviderRankingsPage": {
+    "title": "__MISSING__:Free Provider Rankings",
+    "subtitle": "__MISSING__:Best free providers ranked by model ELO scores from Arena AI leaderboards",
+    "loading": "__MISSING__:Loading rankings...",
+    "errorLoading": "__MISSING__:Failed to load rankings",
+    "emptyState": "__MISSING__:No rankings available yet. Arena ELO data syncs on startup (daily) — check back shortly, or trigger a manual sync. Disable Arena ELO Sync in Feature Flags or set ARENA_ELO_SYNC_ENABLED=false to opt out.",
+    "bestModel": "__MISSING__:Best",
+    "allCategories": "__MISSING__:All Categories",
+    "categoryDefault": "__MISSING__:Default",
+    "categoryCoding": "__MISSING__:Coding",
+    "categoryReview": "__MISSING__:Review",
+    "categoryDocumentation": "__MISSING__:Documentation",
+    "categoryDebugging": "__MISSING__:Debugging",
+    "colRank": "__MISSING__:Rank",
+    "colProvider": "__MISSING__:Provider",
+    "colTopModel": "__MISSING__:Top Model",
+    "colScore": "__MISSING__:Score",
+    "colAvgScore": "__MISSING__:Avg Score",
+    "colModels": "__MISSING__:Models",
+    "colType": "__MISSING__:Type"
   }
 }
diff --git a/src/i18n/messages/pt-BR.json b/src/i18n/messages/pt-BR.json
index 6dc337f3b6..e02983e1b0 100644
--- a/src/i18n/messages/pt-BR.json
+++ b/src/i18n/messages/pt-BR.json
@@ -1,1566 +1,4 @@
 {
-  "a2aDashboard": {
-    "loading": "Carregando painel A2A...",
-    "confirmCancelTask": "Cancelar tarefa {taskId}?",
-    "cancelTaskFailed": "Falha ao cancelar tarefa.",
-    "cancelTaskSuccess": "Tarefa {taskId} cancelada.",
-    "smokeSendFailed": "Falha no smoke test de message/send.",
-    "smokeSendSuccessWithTask": "message/send ok (tarefa {taskId}).",
-    "smokeSendSuccess": "message/send ok.",
-    "smokeStreamFailed": "Falha no smoke test de message/stream.",
-    "smokeStreamSuccessWithTask": "message/stream ok (tarefa {taskId}{stateSuffix}).",
-    "smokeStreamNoTaskId": "message/stream finalizado sem task id.",
-    "health": "Saúde",
-    "ok": "ok",
-    "totalTasks": "Total de tarefas",
-    "activeStreams": "Streams ativos",
-    "lastTask": "Última tarefa",
-    "taskStateOverview": "Visão de estados das tarefas",
-    "state": {
-      "submitted": "submetida",
-      "working": "executando",
-      "completed": "concluída",
-      "failed": "falhou",
-      "cancelled": "cancelada"
-    },
-    "agentCard": "Cartão do agente",
-    "agentCardPath": "/.well-known/agent.json",
-    "version": "Versão",
-    "url": "URL",
-    "capabilities": "Capacidades",
-    "agentCardNotAvailable": "Cartão do agente indisponível.",
-    "quickValidation": "Validação rápida",
-    "quickValidationDescription": "Executa chamadas de smoke pelo endpoint `/a2a` em produção.",
-    "runMessageSend": "Executar message/send",
-    "runMessageStream": "Executar message/stream",
-    "taskManagement": "Gestão de tarefas",
-    "taskSummary": "{total} tarefas | página {page} de {totalPages}",
-    "allStates": "todos",
-    "allSkills": "todas as skills",
-    "loadingTasks": "Carregando tarefas...",
-    "noTasksForFilters": "Nenhuma tarefa encontrada para os filtros atuais.",
-    "tableTask": "Tarefa",
-    "tableSkill": "Skill",
-    "tableState": "Estado",
-    "tableUpdated": "Atualizada",
-    "tableActions": "Ações",
-    "view": "Ver",
-    "cancel": "Cancelar",
-    "previous": "Anterior",
-    "next": "Próxima",
-    "taskDetail": "Detalhe da tarefa",
-    "close": "Fechar",
-    "metadata": "Metadados",
-    "events": "Eventos",
-    "artifacts": "Artefatos",
-    "tablePhase": "Table Phase",
-    "offset": "Offset",
-    "limit": "Limit",
-    "skill": "Skill",
-    "rpcEndpoint": "POSTAR /a2a",
-    "rpcMethodSend": "mensagem/enviar",
-    "rpcMethodStream": "mensagem/fluxo",
-    "rpcMethodGet": "tarefas/obter",
-    "rpcMethodCancel": "tarefas/cancelar",
-    "serviceLabel": "A2A",
-    "online": "Online",
-    "offline": "Offline",
-    "disableLabel": "Desativar {label}",
-    "enableLabel": "Ativar {label}",
-    "a2aDisabledTitle": "O A2A está desativado",
-    "a2aDisabledDesc": "Ative o A2A acima para visualizar a telemetria de tarefas, detalhes do agente e ferramentas de validação.",
-    "a2aIntro": "Endpoint Agent2Agent JSON-RPC 2.0 — envie tarefas, transmita respostas, cancele trabalhos em andamento.",
-    "a2aStep1": "Descubra o cartão do agente em {code}.",
-    "a2aStep2": "Envie JSON-RPC para {code1} usando {code2} ou {code3}.",
-    "a2aStep3": "Rastreie e cancele tarefas com {code1} and {code2}."
-  },
-  "agents": {
-    "title": "Agentes CLI",
-    "description": "Descubra agentes CLI instalados no seu sistema. Adicione agentes customizados para auto-detecção.",
-    "refresh": "Atualizar",
-    "installed": "Instalado",
-    "notFound": "Não encontrado",
-    "builtIn": "Nativo",
-    "custom": "Customizado",
-    "remove": "Remover",
-    "addCustomAgent": "Adicionar Agente Customizado",
-    "addCustomAgentDesc": "Registre qualquer ferramenta CLI para detecção. Ela será verificada automaticamente ao atualizar.",
-    "agentName": "Nome do Agente",
-    "binaryName": "Nome do Binário",
-    "versionCommand": "Comando de Versão",
-    "spawnArgs": "Argumentos",
-    "addAgent": "Adicionar Agente",
-    "scanning": "Scanning system for CLI agents...",
-    "opencodeIntegration": "OpenCode Integration",
-    "opencodeDetected": "opencode {version} detected",
-    "opencodeDesc": "Generate a ready-to-use {configFile} with your OmniRoute base URL and all available models — drop it in your project root and run {command}.",
-    "downloadConfig": "Download {file}",
-    "downloaded": "Downloaded!",
-    "setupGuideTitle": "Setup guide",
-    "openCliTools": "Open CLI Tools",
-    "setupGuideDetectCliTitle": "Detect installed CLIs",
-    "setupGuideDetectCliDesc": "Click Refresh after installing or updating a CLI so OmniRoute can rescan binaries and versions.",
-    "setupGuideCustomAgentTitle": "Register custom binary",
-    "setupGuideCustomAgentDesc": "Use Add Custom Agent when your CLI is not in the built-in list. Provide binary name and version command.",
-    "setupGuideCommandMissingTitle": "Fix 'command not found'",
-    "setupGuideCommandMissingDesc": "Ensure the CLI command exists in PATH, open a new terminal session, and rerun Refresh.",
-    "cliToolsRedirectTitle": "Procurando configuração de cliente?",
-    "cliToolsRedirectDesc": "Use CLI Tools quando quiser que seu editor ou cliente de terminal chame o OmniRoute por HTTP em vez de ser iniciado localmente.",
-    "spawnArgsPlaceholder": "ex.: --quiet, --json",
-    "binaryNamePlaceholder": "ex.: meu-worker",
-    "versionCommandPlaceholder": "ex.: meu-worker --version",
-    "architectureTitle": "Fluxo de execução ACP",
-    "flowLocalBinary": "Binário local",
-    "flowOmniRoute": "OmniRoute",
-    "agentNamePlaceholder": "ex.: Meu Worker Customizado",
-    "architectureDescription": "Esta tela é para binários que o OmniRoute inicia localmente como workers. O OmniRoute detecta o binário, faz o spawn e o usa como endpoint final de execução.",
-    "flowExecute": "Executa tarefa",
-    "flowSpawn": "Inicia worker",
-    "cliToolsRedirectCta": "Ir para CLI Tools",
-    "comparisonTitle": "Ferramentas CLI versus alvos de agente – Qual é a diferença?",
-    "comparisonCliToolsLabel": "Página de ferramentas CLI",
-    "comparisonCliToolsTitle": "Seu IDE envia solicitações através do OmniRoute",
-    "comparisonCliToolsDesc": "Configure Claude Code, Codex, Cursor e outros IDEs para usar OmniRoute como URL base da API. OmniRoute atua como um proxy, roteando solicitações para seus provedores configurados.",
-    "comparisonAgentsLabel": "Esta página (alvos do agente)",
-    "comparisonAgentsTitle": "OmniRoute envia solicitações para ferramentas CLI locais",
-    "comparisonAgentsDesc": "OmniRoute pode gerar binários CLI locais (claude, codex, goose) como backends de execução. A ferramenta CLI processa a solicitação usando sua própria autenticação e retorna o resultado.",
-    "comparisonSummary": "Resumindo: CLI Tools = você configura ferramentas para apontar para OmniRoute. Destinos do agente = OmniRoute usa ferramentas como pontos de extremidade.",
-    "agentUseCaseHint": "Pode ser usado como alvo de execução via protocolo ACP",
-    "flowDiagramClient": "Aplicativo cliente",
-    "flowDiagramClientDesc": "SDK, API ou serviço upstream",
-    "flowDiagramOmniRoute": "OmniRoute",
-    "flowDiagramOmniRouteDesc": "Recebe solicitação e seleciona alvo",
-    "flowDiagramSpawn": "Processo de geração",
-    "flowDiagramSpawnDesc": "Lança o binário CLI via stdio",
-    "flowDiagramCli": "Agente CLI",
-    "flowDiagramCliDesc": "Processos com autenticação/modelo próprio",
-    "fingerprintSettingsHint": "A correspondência de impressão digital CLI (solicitações disfarçadas como ferramentas CLI específicas) pode ser configurada em",
-    "settingsRoutingLink": "Configurações/Roteamento",
-    "openSettings": "Configurações",
-    "copyRawUrlTitle": "Copie o URL bruto para a área de transferência",
-    "copied": "Copiado!",
-    "copyUrl": "Copiar URL",
-    "startHere": "Comece aqui",
-    "badgeNew": "Novo",
-    "viewOnGithub": "Ver no GitHub",
-    "howToUse": "Como usar",
-    "browseAllSkillsOnGithub": "Procure todas as habilidades no GitHub",
-    "apiSkills": "Habilidades de API",
-    "cliSkills": "Habilidades CLI",
-    "apiSkillsSubtitle": "{count} skills — controle o OmniRoute via REST / HTTP",
-    "cliSkillsSubtitle": "{count} skills — controle o OmniRoute via o binário terminal omniroute",
-    "howToUseStep1": "Clique em <bold>{copyUrl}</bold> na habilidade que você deseja que seu agente conheça.",
-    "howToUseStep2": "No seu agente de IA (Claude, Cursor, Cline…), diga:",
-    "howToUseStep2Code": "Use a habilidade em [pasted-url]",
-    "howToUseStep3": "O agente busca o SKILL.md e aprende a API ou CLI do OmniRoute — sem necessidade de manuais."
-  },
-  "analytics": {
-    "title": "Análises",
-    "usageAnalyticsTitle": "Análise de Uso",
-    "diversityScoreTitle": "Diversidade de Provedores",
-    "diversityScoreDesc": "Instantâneo da concentração de provedores para a janela de tráfego recente.",
-    "diversityShannonEntropy": "Entropia de Shannon",
-    "diversityWindow": "Janela: {count} reqs · Últimos {mins} mins",
-    "diversityHealthy": "Distribuição Saudável",
-    "diversityRiskHigh": "Alto Risco de Lock-in de Fornecedor",
-    "diversityRiskModerate": "Distribuição Moderada",
-    "diversityScoreLabel": "score",
-    "diversityHigherExplanation": "Valores mais altos significam que o tráfego está espalhado por múltiplos provedores.",
-    "diversityNoData": "Nenhum dado de uso recente disponível.",
-    "chartRequests": "Solicitações",
-    "chartInput": "Entrada",
-    "chartOutput": "Saída",
-    "chartTotal": "Total",
-    "chartCost": "Custo",
-    "chartShare": "Participação",
-    "chartServiceTier": "Nível de Serviço",
-    "chartServiceTierSplit": "Divisão de custo Fast / Standard",
-    "chartCostPct": "{pct}% do custo",
-    "chartUsageDetail": "Detalhes de Uso",
-    "chartCacheRead": "Leitura de cache",
-    "chartCostByProvider": "Custo por Provedor",
-    "chartNoCostData": "Sem dados de custo",
-    "chartModelUsageOverTime": "Uso de Modelos ao Longo do Tempo",
-    "chartNoData": "Sem dados",
-    "chartWeekly": "Semanal",
-    "chartModelBreakdown": "Detalhamento por Modelo",
-    "chartModel": "Modelo",
-    "chartProvider": "Provedor",
-    "chartProviderBreakdown": "Detalhamento por Provedor",
-    "filterAllKeys": "Todas as Chaves",
-    "filterSearchKeys": "Buscar chaves…",
-    "filterNoKeysMatch": "Nenhuma chave corresponde",
-    "filterOneKey": "1 chave",
-    "filterMultipleKeys": "{count} chaves",
-    "rangeToday": "Hoje",
-    "rangeYesterday": "Ontem",
-    "rangeLast3Days": "Últimos 3 dias",
-    "rangeThisWeek": "Esta semana",
-    "rangeLast14Days": "Últimos 14 dias",
-    "rangeThisMonth": "Este mês",
-    "rangeQuickSelect": "Seleção Rápida",
-    "rangeStart": "Início",
-    "rangeEnd": "Fim",
-    "rangeCancel": "Cancelar",
-    "rangeApply": "Aplicar",
-    "rangeErrorInvalid": "O início deve ser anterior ao fim",
-    "period1D": "1D",
-    "period7D": "7D",
-    "period30D": "30D",
-    "period90D": "90D",
-    "periodYTD": "YTD",
-    "periodAll": "Tudo",
-    "totalTokens": "Total de Tokens",
-    "inputTokens": "Tokens de Entrada",
-    "outputTokens": "Tokens de Saída",
-    "estCost": "Custo Est.",
-    "infraTitle": "Infraestrutura",
-    "infraAccounts": "Contas",
-    "infraProviders": "Provedores",
-    "infraApiKeys": "Chaves de API",
-    "infraModels": "Modelos",
-    "perfTitle": "Desempenho",
-    "perfAvgTokens": "Média de Tokens/Req",
-    "perfCostReq": "Custo/Req",
-    "perfIoRatio": "Taxa E/S",
-    "perfFastReq": "Solicitações Rápidas",
-    "highlightsTitle": "Destaques",
-    "highlightsTopModel": "Modelo Top",
-    "highlightsTopProvider": "Provedor Top",
-    "highlightsBusiestDay": "Dia Mais Atarefado",
-    "highlightsDiversity": "Diversidade",
-    "highlightsFallbackRate": "Taxa de Fallback",
-    "customRange": "Personalizado",
-    "overviewDescription": "Monitore padrões de uso da API, consumo de tokens, custos e tendências de atividade em todos os provedores e modelos.",
-    "evalsDescription": "Execute suítes de avaliação para testar e validar seus endpoints LLM. Compare qualidade de modelos, detecte regressões e faça benchmarks de latência.",
-    "overview": "Visão Geral",
-    "evals": "Avaliações",
-    "utilization": "Utilização",
-    "utilizationDescription": "Tendências de uso de cota do provedor e rastreamento de limites de taxa",
-    "modelStatus": "Status do modelo",
-    "modelStatusCooldown": "Recarga",
-    "modelStatusUnavailable": "Indisponível",
-    "modelStatusError": "Erro",
-    "comboHealth": "Saúde do Combo",
-    "comboHealthDescription": "Cota em nível de combo, distribuição de uso e métricas de desempenho",
-    "compressionAnalyticsTitle": "Compression Analytics",
-    "compressionAnalyticsDescription": "Compression analytics — token savings, mode breakdown, and provider stats.",
-    "autoRoutingTotalAutoRequests": "Total de solicitações automáticas",
-    "autoRoutingAvgSelectionScore": "Pontuação média de seleção",
-    "autoRoutingExplorationRate": "Taxa de Exploração",
-    "autoRoutingLkgpHitRate": "Taxa de acerto LKGP",
-    "autoRoutingRequestsByVariant": "Solicitações por variante",
-    "autoRoutingTopRoutedProviders": "Principais provedores roteados",
-    "comboHealthWorstQuotaLeft": "Pior cota restante",
-    "comboHealthUsageSkew": "Distorção de uso",
-    "comboHealthSuccessRate": "Taxa de sucesso",
-    "comboHealthQuotaHealth": "Integridade da cota",
-    "comboHealthRequests": "Solicitações",
-    "comboHealthTokens": "Fichas",
-    "comboHealthAvgLatency": "Latência média",
-    "comboHealthTotalRequests": "Total de solicitações",
-    "comboHealthExecutionTargets": "Metas de execução",
-    "comboHealthSuccess": "Sucesso",
-    "comboHealthLatency": "Latência",
-    "comboHealthQuota": "Cota",
-    "comboHealthTitle": "Saúde combinada",
-    "comboHealthUnableToLoad": "Não foi possível carregar a saúde do combo",
-    "comboHealthGettingStarted": "Primeiros passos",
-    "compressionAnalyticsTotalRequests": "Total de solicitações",
-    "compressionAnalyticsTokensSaved": "Tokens salvos",
-    "compressionAnalyticsAvgSavings": "Economia média",
-    "compressionAnalyticsAvgDuration": "Duração média",
-    "compressionAnalyticsReceipts": "Recibos",
-    "compressionAnalyticsFallbacks": "Alternativos",
-    "compressionAnalyticsPromptTokens": "Tokens de prompt",
-    "compressionAnalyticsCompletionTokens": "Tokens de conclusão",
-    "compressionAnalyticsTotalTokens": "Totais de fichas",
-    "compressionAnalyticsCacheTokens": "Tokens de cache",
-    "compressionAnalyticsNoDataYet": "Ainda não há dados de compactação",
-    "searchAnalyticsTotalSearches": "Total de pesquisas",
-    "searchAnalyticsCacheHitRate": "Taxa de acertos do cache",
-    "searchAnalyticsTotalCost": "Custo total",
-    "searchAnalyticsAvgResponse": "Resposta média",
-    "searchAnalyticsNoSearchesYet": "Nenhuma pesquisa ainda",
-    "providerUtilizationTitle": "Utilização do provedor",
-    "providerUtilizationFailedToLoad": "Falha ao carregar dados de utilização",
-    "providerUtilizationNoData": "Não há dados de utilização disponíveis",
-    "providerUtilizationGettingStarted": "Primeiros passos",
-    "providerUtilizationLatestSnapshot": "Instantâneo de cota mais recente",
-    "providerUtilizationRemainingCapacity": "Capacidade restante"
-  },
-  "apiManager": {
-    "title": "Chaves de API",
-    "createKey": "Criar Chave de API",
-    "key": "Chave",
-    "revokeKey": "Revogar Chave",
-    "revokeConfirm": "Tem certeza que deseja revogar esta chave de API?",
-    "noKeys": "Nenhuma chave de API ainda",
-    "noKeysDesc": "Crie sua primeira chave de API para autenticar requisições ao seu endpoint",
-    "keyLabel": "Rótulo da Chave",
-    "permissions": "Permissões",
-    "expiresAt": "Expira",
-    "never": "Nunca",
-    "revoke": "Revogar",
-    "showKey": "Mostrar Chave",
-    "hideKey": "Ocultar Chave",
-    "copyKey": "Copiar Chave de API",
-    "allModels": "Todos os modelos",
-    "selectedModels": "Modelos Selecionados",
-    "readOnly": "Somente Leitura",
-    "fullAccess": "Acesso Total",
-    "keyManagement": "Gerenciamento de Chaves de API",
-    "keyManagementDesc": "Crie e gerencie chaves de API para autenticar requisições ao seu endpoint",
-    "totalKeys": "Total de Chaves",
-    "restricted": "Restrita",
-    "totalRequests": "Total de Requisições",
-    "modelsAvailable": "Modelos Disponíveis",
-    "registeredKeys": "Chaves Registradas",
-    "keysRegistered": "{count} chaves registradas",
-    "keyRegistered": "{count} chave registrada",
-    "keysSecurityNote": "Cada chave isola o rastreamento de uso e pode ser revogada independentemente. As chaves são mascaradas após a criação por segurança.",
-    "createFirstKey": "Crie Sua Primeira Chave",
-    "name": "Nome",
-    "usage": "Uso",
-    "created": "Criado",
-    "actions": "Ações",
-    "reqs": "reqs",
-    "neverUsed": "Nunca usada",
-    "deleteConfirm": "Excluir esta chave de API?",
-    "usageTips": "Dicas de Uso",
-    "tipAuth": "Use chaves de API no cabeçalho Authorization como Bearer SUA_CHAVE",
-    "tipSecure": "As chaves são mostradas apenas uma vez durante a criação — armazene-as com segurança",
-    "tipSeparate": "Crie chaves separadas para diferentes clientes ou ambientes",
-    "tipRestrict": "Restrinja chaves a modelos específicos para maior segurança e controle de custos",
-    "keyName": "Nome da Chave",
-    "keyNamePlaceholder": "ex: Chave de Produção",
-    "keyNameDesc": "Escolha um nome descritivo para identificar o propósito desta chave",
-    "managementAccessDesc": "Permitir que esta chave de API gerencie a configuração do OmniRoute.",
-    "selfServiceVisibility": "Visibilidade de autoatendimento",
-    "selfServiceVisibilityDesc": "Controla o que esta chave pode ver sobre o próprio uso e a cota upstream compartilhada.",
-    "ownUsageVisibility": "Custo próprio e uso de tokens",
-    "ownUsageVisibilityDesc": "Permitir que esta chave chame seu endpoint de status para ver o próprio uso em USD, percentual do orçamento e totais de tokens.",
-    "sharedAccountQuotaVisibility": "Cota de conta compartilhada",
-    "sharedAccountQuotaVisibilityDesc": "Permitir que esta chave veja a cota da conta upstream compartilhada quando uma conexão explícita estiver configurada.",
-    "localUsageCommand": "Permitir comando local de uso",
-    "localUsageCommandDesc": "Permite que esta API key use @@om-usage para consultar consumo e limites em cache, sem chamar provider externo.",
-    "localUsageCommandBadge": "Cmd uso",
-    "keyCreated": "Chave de API Criada",
-    "keyCreatedSuccess": "Chave criada com sucesso!",
-    "keyCreatedNote": "Copie e armazene esta chave agora — ela não será mostrada novamente.",
-    "done": "Pronto",
-    "savePermissions": "Salvar Permissões",
-    "endpointRestrictions": "Endpoints Permitidos",
-    "allEndpointsAllowed": "Esta chave pode acessar todos os endpoints de API.",
-    "endpointsRestricted": "Restrito a {count} endpoint{count, plural, one {} other {s}}.",
-    "autoResolve": "Auto-Resolve",
-    "autoResolveDesc": "Resolve automaticamente nomes ambíguos de modelo para o provedor nativo desta API key.",
-    "keyActive": "Chave Ativa",
-    "keyActiveDesc": "Ativa ou desativa esta API key. Chaves desativadas são bloqueadas com 403.",
-    "accessSchedule": "Horário de Acesso",
-    "accessScheduleDesc": "Restrinja o acesso a horários e dias da semana específicos.",
-    "scheduleFrom": "Das",
-    "scheduleUntil": "Até",
-    "scheduleDays": "Dias",
-    "scheduleTimezone": "Fuso Horário",
-    "scheduleTimezoneHint": "Use nomes IANA, ex: America/Sao_Paulo",
-    "scheduleActive": "Agenda",
-    "disabled": "Desativada",
-    "daySun": "Dom",
-    "dayMon": "Seg",
-    "dayTue": "Ter",
-    "dayWed": "Qua",
-    "dayThu": "Qui",
-    "dayFri": "Sex",
-    "daySat": "Sáb",
-    "allowAll": "Permitir Tudo",
-    "restrict": "Restringir",
-    "allowAllInfo": "Esta chave pode acessar todos os modelos disponíveis.",
-    "restrictInfo": "Esta chave pode acessar {selected} de {total} modelos.",
-    "selected": "{count} selecionados",
-    "all": "Todos",
-    "clear": "Limpar",
-    "searchModels": "Buscar modelos por nome ou provedor...",
-    "noModelsFound": "Nenhum modelo encontrado",
-    "keyNameRequired": "Nome da chave é obrigatório",
-    "keyNameTooLong": "Nome da chave deve ter {max} caracteres ou menos",
-    "keyNameInvalid": "Nome da chave pode conter apenas letras, números, espaços, hífens e sublinhados",
-    "invalidKeyName": "Nome de chave inválido",
-    "failedCreateKey": "Falha ao criar chave",
-    "failedCreateKeyRetry": "Falha ao criar chave. Tente novamente.",
-    "invalidKeyId": "ID de chave inválido",
-    "failedDeleteKey": "Falha ao excluir chave",
-    "failedDeleteKeyRetry": "Falha ao excluir chave. Tente novamente.",
-    "invalidModelsSelection": "Seleção de modelos inválida",
-    "cannotSelectMoreThanModels": "Não é possível selecionar mais de {max} modelos",
-    "failedUpdatePermissions": "Falha ao atualizar permissões",
-    "failedUpdatePermissionsRetry": "Falha ao atualizar permissões. Tente novamente.",
-    "unknownProvider": "desconhecido",
-    "copyMaskedKey": "Copiar chave mascarada",
-    "keyOnlyAvailableAtCreation": "Full key available only at creation time — copy it when you first create the key",
-    "modelsCount": "{count, plural, one {# modelo} other {# modelos}}",
-    "lastUsedOn": "Último: {date}",
-    "editPermissions": "Editar permissões",
-    "deleteKey": "Excluir chave",
-    "regenerateKey": "Chave regenerada",
-    "regenerateConfirm": "Tem certeza de que deseja regenerar esta chave de API? A chave antiga será imediatamente invalidada.",
-    "failedRegenerateKey": "Falha ao regenerar a chave de API",
-    "failedRegenerateKeyRetry": "Falha ao regenerar a chave de API. Por favor, tente novamente.",
-    "model": "{count} modelo",
-    "models": "{count} modelos",
-    "permissionsTitle": "Permissões: {name}",
-    "allowAllDesc": "Esta chave pode acessar todos os modelos disponíveis.",
-    "restrictDesc": "Esta chave pode acessar {selectedCount} de {totalModels} modelos.",
-    "selectedCount": "{count} selecionados",
-    "maxActiveSessions": "Máximo de sessões ativas",
-    "apiManagerCustomRateLimits": "Limites de taxas personalizadas",
-    "apiManagerCustomRateLimitsDesc": "Substitua os limites padrão globais. Deixe em branco para usar os padrões.",
-    "apiManagerRateLimitRequestsPlaceholder": "Solicitações",
-    "apiManagerRateLimitReqPer": "solicitação /",
-    "apiManagerRateLimitSecondsPlaceholder": "Segundos",
-    "apiManagerRemoveLimitTitle": "Remover limite",
-    "apiManagerTimezonePlaceholder": "América/São_Paulo",
-    "noLogPayloadPrivacy": "Privacidade de carga útil sem registro",
-    "bannedStatus": "Status banido",
-    "managementApiAccess": "Acesso à API de gerenciamento",
-    "expirationDate": "Data de expiração",
-    "managementAccess": "Acesso de gerenciamento",
-    "allowedConnections": "Conexões permitidas",
-    "searchPlaceholder": "Buscar por nome ou token...",
-    "activeOnly": "Apenas ativas",
-    "filterStatus": "STATUS",
-    "filterType": "TIPO",
-    "filterAll": "Todas",
-    "filterStatusActive": "Ativa",
-    "filterStatusDisabled": "Desativada",
-    "filterStatusBanned": "Banida",
-    "filterStatusExpired": "Expirada",
-    "filterTypeStandard": "Padrão",
-    "filterTypeManage": "Gerenciamento",
-    "filterTypeRestricted": "Restrita",
-    "shownOf": "{shown} de {total} exibidas",
-    "emptyFilterTitle": "Nenhuma chave corresponde aos filtros",
-    "emptyFilterClear": "Limpar filtros",
-    "normalKeysSection": "Chaves normais",
-    "quotaKeysSection": "Chaves de cota",
-    "quotaPill": "QUOTA",
-    "quotaModeOnly": "só-qtSd"
-  },
-  "auditLog": {
-    "title": "Log de Auditoria",
-    "searchPlaceholder": "Buscar ações...",
-    "action": "Ação",
-    "actor": "Autor",
-    "target": "Alvo",
-    "ipAddress": "Endereço IP",
-    "timestamp": "Data/Hora",
-    "noEntries": "Nenhum registro de auditoria",
-    "filterByAction": "Filtrar por ação...",
-    "filterByActor": "Filtrar por autor...",
-    "filterEntriesAria": "Filtrar entradas do log de auditoria",
-    "filterByActionTypeAria": "Filtrar por tipo de ação",
-    "filterByActorAria": "Filtrar por autor",
-    "refreshAuditLogAria": "Atualizar log de auditoria",
-    "tableAria": "Entradas do log de auditoria",
-    "failedFetchAuditLog": "Falha ao carregar log de auditoria",
-    "notAvailable": "—",
-    "description": "Ações administrativas e eventos de segurança",
-    "showing": "Mostrando {count} entradas (offset {offset})",
-    "previous": "Anterior"
-  },
-  "auth": {
-    "welcome": "Bem-vindo",
-    "signIn": "Entrar",
-    "enterPassword": "Digite sua senha para continuar",
-    "password": "Senha",
-    "unifiedProxy": "Proxy Unificado de API de IA",
-    "unifiedAiApiProxy": "Proxy Unificado de API de IA",
-    "unifiedAiApiProxyDesc": "Roteie requisições para múltiplos provedores de IA por um único endpoint. Balanceamento de carga, failover e rastreamento de uso integrados.",
-    "passwordNotEnabled": "Proteção por senha não está ativada",
-    "loading": "Carregando...",
-    "invalidPassword": "Senha inválida",
-    "errorOccurredRetry": "Ocorreu um erro. Tente novamente.",
-    "configureInstance": "Vamos configurar sua instância OmniRoute",
-    "runOnboardingWizard": "Execute o assistente de onboarding para definir sua senha e conectar seu primeiro provedor de IA.",
-    "startOnboarding": "Iniciar Onboarding",
-    "secureYourInstance": "Proteja sua Instância",
-    "setPasswordDescription": "Defina uma senha para proteger seu painel e garantir que seus endpoints de API não sejam acessados sem autorização.",
-    "configurePassword": "Configurar Senha",
-    "continue": "Continuar",
-    "windowWillClose": "Esta janela será fechada automaticamente...",
-    "closeTabNow": "Você já pode fechar esta aba.",
-    "copyUrlManual": "Copie a URL da barra de endereços e cole no aplicativo.",
-    "accessDeniedDescription": "Você não tem permissão para acessar este recurso. Verifique sua chave de API ou contate o administrador.",
-    "goToDashboard": "Ir para o Painel",
-    "featureMultiProviderTitle": "Multi-Provedor",
-    "featureMultiProviderDesc": "OpenAI, Anthropic, Google e outros",
-    "featureLoadBalancingTitle": "Balanceamento de Carga",
-    "featureLoadBalancingDesc": "Distribua requisições de forma inteligente",
-    "featureUsageTrackingTitle": "Rastreamento de Uso",
-    "featureUsageTrackingDesc": "Monitore custos e tokens",
-    "resetPassword": "Redefinir Senha",
-    "resetDescription": "Escolha um método para recuperar acesso ao painel",
-    "stopServer": "Pare o servidor OmniRoute",
-    "processing": "Processando...",
-    "pleaseWait": "Aguarde enquanto completamos a autorização.",
-    "authSuccess": "Autorização bem-sucedida!",
-    "copyUrl": "Copiar esta URL",
-    "accessDenied": "Acesso Negado",
-    "methodCliTitle": "Método 1: Reset via CLI",
-    "methodCliDescription": "Execute o comando abaixo no servidor onde o OmniRoute está em execução:",
-    "methodCliHint": "Isso solicitará que você defina uma nova senha. O servidor deve ser parado antes.",
-    "methodManualTitle": "Método 2: Reset Manual",
-    "methodManualDescription": "Remova a senha do banco de dados e defina uma nova na inicialização:",
-    "setPasswordInYour": "Defina uma nova senha no seu",
-    "fileLabelSuffix": "arquivo:",
-    "newPasswordPlaceholder": "sua_nova_senha",
-    "deleteSettingsFile": "Exclua",
-    "orRemovePasswordHashField": "ou remova o campo passwordHash",
-    "restartServerWithNewPassword": "Reinicie o servidor - ele usará a nova senha",
-    "backToLogin": "Voltar para o Login",
-    "forgotPassword": "Esqueceu a senha?",
-    "defaultPasswordHint": "Default password: CHANGEME (unless INITIAL_PASSWORD was set)",
-    "Authorization": "Autorização",
-    "Content-Disposition": "Disposição de conteúdo",
-    "waitingForAuthorization": "Aguardando autorização...",
-    "waitingForGoogleAuthorization": "Aguardando autorização do Google...",
-    "waitingForOpenAIAuthorization": "Aguardando autorização do OpenAI...",
-    "waitingForAntigravityAuthorization": "Aguardando autorização antigravidade...",
-    "waitingForQoderAuthorization": "Aguardando autorização do Qoder...",
-    "exchangingCodeForTokens": "Trocando código por tokens...",
-    "nodeIncompatibleTitle": "Incompatible Node.js Version",
-    "nodeIncompatibleDesc": "You are running Node.js {version}, which is outside OmniRoute's supported secure runtime policy. Use a patched Node.js 20.x or 22.x LTS release.",
-    "nodeIncompatibleFixLabel": "Fix: install a patched Node.js 22 LTS release",
-    "nodeIncompatibleHint": "OmniRoute requires Node.js 20.20.2+ (20.x LTS), 22.22.2+ (22.x LTS) or 24.0.0+ (24.x LTS). Node 24 LTS is recommended."
-  },
-  "cache": {
-    "title": "Cache Management",
-    "description": "Monitor and manage semantic response cache, hit rates, and token savings.",
-    "refresh": "Refresh",
-    "clearAll": "Clear All",
-    "memoryEntries": "Memory Entries",
-    "memoryEntriesSub": "In-memory LRU",
-    "dbEntries": "DB Entries",
-    "dbEntriesSub": "Persisted (SQLite)",
-    "cacheHits": "Cache Hits",
-    "cacheHitsSub": "of {total} total",
-    "tokensSaved": "Tokens Saved",
-    "tokensSavedSub": "Estimated from hits",
-    "hitRate": "Hit Rate",
-    "performance": "Cache Performance",
-    "autoRefresh": "Auto-refreshes every {seconds}s",
-    "hits": "Hits",
-    "misses": "Misses",
-    "total": "Total",
-    "behavior": "Cache Behavior",
-    "behaviorDeterministic": "Only non-streaming requests with temperature=0 are cached.",
-    "behaviorBypass": "Bypass with header {header}.",
-    "behaviorTwoTier": "Two-tier storage: in-memory LRU (fast) + SQLite (persistent across restarts).",
-    "behaviorTtl": "Default TTL: 30 minutes. Configure via {envVar}.",
-    "idempotency": "Idempotency Layer",
-    "activeDedupKeys": "Active Dedup Keys",
-    "dedupWindow": "Dedup Window",
-    "clearSuccess": "Cache cleared. {count} expired entries removed.",
-    "clearError": "Failed to clear cache.",
-    "unavailable": "Cache unavailable",
-    "unavailableDesc": "Could not fetch cache statistics. Make sure the server is running.",
-    "loadingCacheAria": "Carregando cache",
-    "promptCache": "Prompt Cache (Provider-Side)",
-    "semanticCache": "Semantic Cache",
-    "promptCacheSectionDesc": "Shows provider-side prompt caching activity from usage history so you can see where cache control is active and how much input reuse you are getting.",
-    "promptTrendDesc": "Hourly request volume, cache coverage, and cache read volume across the last 24 hours.",
-    "cachedRequests": "Cached Requests",
-    "cachedRequests24h": "Cached Requests (24h)",
-    "cacheHitRate": "Cache Hit Rate",
-    "cacheRate": "Cache Rate",
-    "cacheRateDesc": "of total requests",
-    "cachedTokens": "Cached Tokens",
-    "cacheCreationTokens": "Cache Creation Tokens",
-    "cacheMetrics": "Prompt Cache Metrics",
-    "withCacheControl": "With Cache Control",
-    "cachedTokensRead": "Cached Tokens (Read)",
-    "cacheCreationWrite": "Cache Creation (Write)",
-    "cacheReuseRatio": "Cache Reuse Ratio",
-    "cacheReuseRatioDesc": "Cached tokens / Total input tokens",
-    "estCostSaved": "Est. Cost Saved",
-    "lastUpdated": "Last updated",
-    "hoursTracked": "hours tracked",
-    "busiestHour": "Busiest Hour",
-    "peakCacheRate": "Peak Cache Rate",
-    "trendHour": "Hour",
-    "activityVolume": "Activity",
-    "requestsShort": "reqs",
-    "inputShort": "In",
-    "cachedShort": "Cached",
-    "writeShort": "Write",
-    "resetting": "Resetting...",
-    "resetMetrics": "Reset Metrics",
-    "byProvider": "Breakdown by Provider",
-    "providerCacheRateDesc": "Each provider exposes total input tokens, cache read tokens, and cache write tokens so you can verify the reuse ratio against raw totals.",
-    "provider": "Provider",
-    "requests": "Requests",
-    "inputTokens": "Input Tokens",
-    "cachedTokensCol": "Cached",
-    "cacheCreation": "Creation",
-    "trend24h": "Cache Trend (24h)",
-    "peakCached": "Peak cached",
-    "cached": "Cached",
-    "overview": "Overview",
-    "tableProvider": "Provedor",
-    "tableModel": "Modelo",
-    "performanceTitle": "Desempenho",
-    "semanticCacheSectionDesc": "OmniRoute's own deterministic response cache. When enabled, repeated non-streaming temperature=0 requests can be served locally without hitting the upstream provider.",
-    "semanticCacheDisabledDesc": "Semantic cache is disabled. OmniRoute will skip local response reuse until you turn it back on in Settings.",
-    "semanticEntriesDesc": "Persisted semantic cache records currently stored in SQLite. Provider-side prompt cache activity is not listed here.",
-    "searchEntries": "Search entries...",
-    "search": "Search",
-    "loading": "Loading...",
-    "entriesLoadError": "Failed to load semantic cache entries.",
-    "noEntries": "No cache entries found",
-    "noPromptCacheData": "No provider-side prompt cache activity has been recorded yet.",
-    "noTrendData": "No prompt cache activity has been recorded over the last 24 hours.",
-    "signature": "Signature",
-    "model": "Model",
-    "created": "Created",
-    "expires": "Expires",
-    "actions": "Actions",
-    "deduplicatedRequests": "Requisições Desduplicadas",
-    "savedCalls": "Chamadas API Poupadas",
-    "totalProcessed": "Total Processado",
-    "disabled": "Disabled",
-    "totalRequests": "Total Requests",
-    "reasoningCache": "Repetição do raciocínio",
-    "reasoningCacheDesc": "Preserva o pensamento do modelo para fluxos de chamada de ferramentas multivoltas",
-    "reasoningEntries": "Entradas ativas",
-    "reasoningReplayRate": "Taxa de repetição",
-    "reasoningReplays": "Total de repetições",
-    "reasoningCharsCached": "Personagens em cache",
-    "reasoningMisses": "Perdas de cache",
-    "reasoningByProvider": "Por provedor",
-    "reasoningByModel": "Por modelo",
-    "reasoningRecentEntries": "Entradas recentes",
-    "reasoningToolCallId": "ID de chamada da ferramenta",
-    "reasoningChars": "Personagens",
-    "reasoningAge": "Idade",
-    "reasoningView": "Ver",
-    "reasoningDetail": "Conteúdo de raciocínio",
-    "reasoningBehavior": "Comportamento",
-    "reasoningBehaviorCapture": "Captura reasoning_content de respostas de streaming",
-    "reasoningBehaviorReplay": "Reinjeta no próximo turno quando o cliente o omite",
-    "reasoningBehaviorFallback": "Memória em primeiro lugar com substituto SQLite para recuperação de falhas",
-    "reasoningBehaviorTtl": "TTL: 2 horas | Entradas máximas: 2.000 (memória)",
-    "reasoningBehaviorModels": "Suportado: DeepSeek, Kimi, Qwen-Thinking, GLM",
-    "reasoningClearAll": "Limpar cache de raciocínio",
-    "reasoningClearSuccess": "Entradas de cache de raciocínio {count} apagadas",
-    "reasoningClearError": "Falha ao limpar o cache de raciocínio",
-    "reasoningNoData": "Nenhuma entrada de raciocínio armazenada em cache ainda. As entradas aparecem quando os modelos de pensamento usam chamada de ferramenta.",
-    "cachePerformanceRetry": "Tentar novamente",
-    "cachePerformanceHitRate": "Taxa de acerto",
-    "cachePerformanceAvgLatency": "Latência média (ms)",
-    "cachePerformanceP95Latency": "Latência p95 (ms)",
-    "retry": "Tentar novamente",
-    "reasoningAvgChars": "Média de caracteres",
-    "tableShare": "Participação",
-    "justNow": "agora mesmo",
-    "minutesAgo": "{minutes}m atrás",
-    "hoursAgo": "{hours}h atrás",
-    "daysAgo": "{days}d atrás",
-    "entries": "Entries"
-  },
-  "cliTools": {
-    "title": "Ferramentas CLI",
-    "noActiveProviders": "Nenhum provedor ativo",
-    "noActiveProvidersDesc": "Adicione e conecte provedores primeiro para configurar as ferramentas CLI.",
-    "mapModels": "Mapear Modelos",
-    "testConnection": "Testar Conexão",
-    "connectionStatus": "Status da Conexão",
-    "configureEndpoint": "Configurar Endpoint",
-    "instructions": "Instruções",
-    "modelMapping": "Mapeamento de Modelos",
-    "baseUrl": "URL Base",
-    "apiKey": "Chave de API",
-    "configured": "Configurado",
-    "notConfigured": "Não configurado",
-    "notInstalled": "Não instalado",
-    "custom": "Customizado",
-    "unknown": "Desconhecido",
-    "lastSavedAt": "Último salvamento: {date}",
-    "never": "Nunca",
-    "justNow": "agora mesmo",
-    "minutesAgoShort": "{count} min atrás",
-    "hoursAgoShort": "{count} h atrás",
-    "daysAgoShort": "{count} d atrás",
-    "monthsAgoShort": "{count} mês(es) atrás",
-    "yearsAgoShort": "{count} ano(s) atrás",
-    "runtimeCheckFailed": "Falha ao verificar runtime",
-    "yourApiKeyPlaceholder": "sua-api-key",
-    "modelPlaceholder": "provedor/modelo-id",
-    "configurationSaved": "Configuração salva com sucesso.",
-    "failedToSave": "Falha ao salvar configuração.",
-    "noApiKeysCreateOne": "Sem chaves de API - crie uma na página Chaves",
-    "defaultOmnirouteKey": "sk_omniroute (padrão)",
-    "selectModel": "Selecionar Modelo",
-    "selectModelForAlias": "Selecionar modelo para {alias}",
-    "selectModelForTool": "Selecionar Modelo para {tool}",
-    "select": "Selecionar",
-    "clear": "Limpar",
-    "comingSoon": "Em breve",
-    "checkingRuntime": "Verificando status de runtime...",
-    "guideOnlyIntegration": "Integração apenas por guia (não requer runtime local)",
-    "cliRuntimeDetected": "Runtime de CLI detectado e pronto",
-    "cliFoundNotRunnable": "CLI encontrado, mas não executável{reason}",
-    "cliRuntimeNotDetected": "Runtime de CLI não detectado",
-    "binary": "Binário",
-    "configPath": "Caminho de config",
-    "configPathShort": "Config",
-    "failedCheckRuntimeStatus": "Falha ao verificar status de runtime.",
-    "copy": "Copiar",
-    "copied": "Copiado",
-    "copyConfig": "Copiar Config",
-    "saveConfig": "Salvar Config",
-    "selectionSaved": "Seleção salva",
-    "guide": "Guia",
-    "detected": "Detectado",
-    "notReady": "Não pronto",
-    "active": "Ativo",
-    "inactive": "Inativo",
-    "startMitm": "Iniciar MITM",
-    "stopMitm": "Parar MITM",
-    "mitmStarted": "MITM iniciado com sucesso!",
-    "mitmStopped": "MITM parado com sucesso!",
-    "failedStart": "Falha ao iniciar MITM",
-    "failedStop": "Falha ao parar MITM",
-    "saveMappings": "Salvar Mapeamentos",
-    "mappingsSaved": "Mapeamentos salvos!",
-    "failedSaveMappings": "Falha ao salvar mapeamentos",
-    "howItWorks": "Como funciona:",
-    "antigravityHowWorksDesc": "O Antigravity envia requisições para o endpoint do Google. O MITM intercepta e redireciona para o OmniRoute.",
-    "antigravityStep1": "1. Inicie o MITM para rotear as requisições pelo OmniRoute.",
-    "antigravityStep2Prefix": "2. Adicione",
-    "antigravityStep2Suffix": "ao arquivo hosts como 127.0.0.1.",
-    "antigravityStep3": "3. Abra o Antigravity e as requisições serão proxyadas.",
-    "mitmHowWorksDesc": "{toolName} sends requests to its provider endpoint. MITM intercepts and redirects them to OmniRoute.",
-    "mitmStep1": "1. Start MITM to route requests through OmniRoute.",
-    "mitmStep2Prefix": "2. Add",
-    "mitmStep2Suffix": "to your hosts file as 127.0.0.1.",
-    "mitmStep3": "3. Open {toolName} and requests will be proxied.",
-    "sudoPasswordRequiredTitle": "Senha sudo necessária",
-    "sudoPasswordHint": "A senha de administrador é necessária para modificar hosts e configurações de proxy do sistema.",
-    "enterSudoPassword": "Digite a senha sudo",
-    "sudoPasswordRequiredError": "A senha sudo é obrigatória.",
-    "cancel": "Cancelar",
-    "confirm": "Confirmar",
-    "settingsApplied": "Configurações aplicadas com sucesso!",
-    "failedApplySettings": "Falha ao aplicar configurações",
-    "settingsReset": "Configurações resetadas com sucesso!",
-    "failedResetSettings": "Falha ao resetar configurações",
-    "backupRestored": "Backup restaurado!",
-    "failedRestore": "Falha ao restaurar",
-    "checkingCli": "Verificando CLI {tool}...",
-    "cliNotRunnable": "CLI {tool} instalado, mas não executável",
-    "cliNotInstalled": "CLI {tool} não instalado",
-    "cliNotDetected": "CLI {tool} não detectado",
-    "cliDetectedReady": "CLI {tool} detectado e pronto",
-    "cliFoundFailedHealthcheck": "CLI {tool} foi encontrado, mas falhou no healthcheck de runtime{reason}.",
-    "installCliPrompt": "Instale o CLI {tool} para usar este recurso.",
-    "installCodexPrompt": "Instale o Codex CLI para usar a aplicação automática.",
-    "hide": "Ocultar",
-    "howToInstall": "Como instalar",
-    "installationGuide": "Guia de instalação",
-    "platforms": "macOS / Linux / Windows:",
-    "afterInstallationRun": "Após a instalação, execute",
-    "toVerify": "para verificar.",
-    "current": "Atual",
-    "baseUrlPlaceholder": "https://.../v1",
-    "resetToDefault": "Redefinir para padrão",
-    "providerModelPlaceholder": "provedor/modelo-id",
-    "apply": "Aplicar",
-    "reset": "Resetar",
-    "manualConfig": "Configuração manual",
-    "backups": "Backups",
-    "configBackups": "Backups de configuração",
-    "noBackupsYet": "Ainda não há backups. Backups são criados automaticamente antes de cada Aplicar ou Resetar.",
-    "restore": "Restaurar",
-    "backupRestoredReloading": "Backup restaurado! Recarregando status...",
-    "failedRestoreBackup": "Falha ao restaurar backup",
-    "applied": "Aplicado!",
-    "failed": "Falhou",
-    "resetDone": "Resetado!",
-    "omnirouteConfiguredOpenAiCompatible": "OmniRoute está configurado como provedor compatível com OpenAI",
-    "provider": "Provedor",
-    "model": "Modelo",
-    "providers": "Provedores",
-    "auth": "Autenticação",
-    "noApiKeysAvailable": "Nenhuma chave de API disponível",
-    "usingDefaultOmniroute": "Usando padrão: sk_omniroute",
-    "updateConfig": "Atualizar config",
-    "applyConfig": "Aplicar config",
-    "noBackupsAvailable": "Nenhum backup disponível.",
-    "profileSaved": "Perfil \"{name}\" salvo!",
-    "failedSaveProfile": "Falha ao salvar perfil",
-    "profileActivated": "Perfil ativado!",
-    "failedActivateProfile": "Falha ao ativar perfil",
-    "profiles": "Perfis",
-    "savedProfiles": "Perfis salvos",
-    "noProfilesYet": "Nenhum perfil salvo ainda. Salve a configuração atual como perfil abaixo.",
-    "activate": "Ativar",
-    "deleteProfile": "Excluir perfil",
-    "profileNamePlaceholder": "Nome do perfil (ex: Conta Pessoal)",
-    "saveCurrent": "Salvar atual",
-    "codexAuthNotePrefix": "Codex usa",
-    "codexAuthNoteMiddle": "com",
-    "codexAuthNoteSuffix": "Clique em \"Aplicar\" para configurar automaticamente.",
-    "claudeManualConfiguration": "Claude CLI - Configuração manual",
-    "codexManualConfiguration": "Codex CLI - Configuração manual",
-    "droidManualConfiguration": "Factory Droid - Configuração manual",
-    "openClawManualConfiguration": "Open Claw - Configuração manual",
-    "clineManualConfiguration": "Configuração manual do Cline",
-    "kiloManualConfiguration": "Configuração manual do Kilo Code",
-    "whenToUseLabel": "Quando usar",
-    "openToolDocs": "Abrir documentos de ferramentas",
-    "toolUseCases": {
-      "claude": "Use quando desejar fluxos de trabalho de planejamento robustos e refatorações longas de vários arquivos com Claude Code.",
-      "codex": "Use quando sua equipe estiver padronizada em fluxos OpenAI Codex CLI e autenticação baseada em perfil.",
-      "droid": "Use quando precisar de um agente de terminal leve focado em codificação rápida e loops de execução de comandos.",
-      "openclaw": "Use quando desejar um agente de codificação no estilo Open Claw, mas roteado por meio de políticas OmniRoute.",
-      "cline": "Use quando você configura agentes de codificação dentro de editores e deseja configuração guiada com modelos OmniRoute.",
-      "kilo": "Use quando seu fluxo de trabalho depender de comandos Kilo Code e edições iterativas rápidas.",
-      "cursor": "Use ao codificar no Cursor e você precisar de modelos personalizados compatíveis com OpenAI por meio do OmniRoute.",
-      "continue": "Use ao executar Continue em IDEs e você precisar de uma configuração de provedor portátil baseada em JSON.",
-      "opencode": "Use quando preferir execuções de agentes nativos de terminal e automação com script via OpenCode.",
-      "kiro": "Use ao integrar o Kiro e controlar o roteamento do modelo centralmente no OmniRoute.",
-      "windsurf": "Use when you want an AI-first IDE with Codeium/Windsurf models routed through OmniRoute.",
-      "antigravity": "Use quando o tráfego Antigravity/Kiro deve ser interceptado através do MITM e roteado para OmniRoute.",
-      "copilot": "Use quando desejar UX no estilo de bate-papo do Copilot enquanto impõe chaves OmniRoute e regras de roteamento.",
-      "amp": "Use when you want Amp CLI routed through OmniRoute with stable shorthand aliases and OpenAI-compatible setup.",
-      "qwen": "Use quando precisar do Alibaba Qwen Code CLI para tarefas de programação.",
-      "hermes": "Use quando precisar de um assistente leve de IA nativo do terminal para tarefas rápidas.",
-      "hermes-agent": "Use quando precisar do Hermes Agent (pela Nousresearch) com modelos padrão, delegação, visão e auxiliares roteados pelo OmniRoute.",
-      "custom": "Use quando seu CLI ou SDK não estiver hardcoded no OmniRoute, mas ainda aceitar base URL, chave de API e model string compatíveis com OpenAI."
-    },
-    "toolDescriptions": {
-      "antigravity": "Google Antigravity IDE com MITM",
-      "claude": "CLI Claude Code da Anthropic",
-      "codex": "CLI Codex da OpenAI",
-      "droid": "Assistente de IA Factory Droid",
-      "openclaw": "Assistente de IA Open Claw",
-      "cline": "CLI assistente de codificação Cline",
-      "kilo": "CLI assistente de IA Kilo Code",
-      "cursor": "Editor de código com IA Cursor",
-      "continue": "Assistente de IA Continue",
-      "opencode": "OpenCode AI coding agent (Terminal)",
-      "kiro": "Amazon Kiro — IDE com IA",
-      "windsurf": "Windsurf — Editor de Código com IA",
-      "copilot": "GitHub Copilot — Assistente de IA",
-      "qwen": "Alibaba Qwen Code CLI",
-      "amp": "CLI do assistente de codificação Sourcegraph Amp",
-      "hermes": "Assistente de Terminal Hermes AI",
-      "hermes-agent": "Hermes Agent (by Nousresearch) - IA de terminal avançada com suporte multi-modelo (delegação, visão, compressão, etc.)",
-      "custom": "Gerador genérico de configuração para CLI ou SDK OpenAI-compatible"
-    },
-    "guides": {
-      "cursor": {
-        "notes": {
-          "0": "Requer conta Cursor Pro para usar este recurso.",
-          "1": "O Cursor roteia requisições pelo próprio servidor, então endpoint local não é suportado. Ative o Cloud Endpoint em Configurações."
-        },
-        "steps": {
-          "1": {
-            "title": "Abrir Configurações",
-            "desc": "Vá em Configurações -> Modelos"
-          },
-          "2": {
-            "title": "Ativar OpenAI API",
-            "desc": "Ative a opção \"OpenAI API key\""
-          },
-          "3": {
-            "title": "URL Base"
-          },
-          "4": {
-            "title": "Chave de API"
-          },
-          "5": {
-            "title": "Adicionar Modelo Customizado",
-            "desc": "Clique em \"View All Model\" -> \"Add Custom Model\""
-          },
-          "6": {
-            "title": "Selecionar Modelo"
-          }
-        }
-      },
-      "continue": {
-        "steps": {
-          "1": {
-            "title": "Abrir Config",
-            "desc": "Abra o arquivo de configuração do Continue"
-          },
-          "2": {
-            "title": "Chave de API"
-          },
-          "3": {
-            "title": "Selecionar Modelo"
-          },
-          "4": {
-            "title": "Adicionar Config de Modelo",
-            "desc": "Adicione a configuração abaixo ao array de modelos:"
-          }
-        },
-        "notes": {
-          "0": "Continuar usa o arquivo de configuração JSON."
-        }
-      },
-      "opencode": {
-        "steps": {
-          "1": {
-            "title": "Install OpenCode",
-            "desc": "Install via npm: npm install -g opencode-ai"
-          },
-          "2": {
-            "title": "API Key"
-          },
-          "3": {
-            "title": "Set Base URL",
-            "desc": "opencode config set baseUrl {baseUrl}"
-          },
-          "4": {
-            "title": "Select Model"
-          },
-          "5": {
-            "title": "Use Thinking Variant",
-            "desc": "For thinking models, run with --variant high/low/max (example command below)."
-          }
-        },
-        "notes": {
-          "0": "OpenCode requer configuração de chave API.",
-          "1": "Configure a URL base para seu endpoint do OmniRoute."
-        }
-      },
-      "kiro": {
-        "steps": {
-          "1": {
-            "title": "Open Kiro Settings",
-            "desc": "Go to Settings → AI Provider"
-          },
-          "2": {
-            "title": "Base URL",
-            "desc": "Paste your OmniRoute endpoint URL"
-          },
-          "3": {
-            "title": "API Key"
-          },
-          "4": {
-            "title": "Select Model"
-          }
-        },
-        "notes": {
-          "0": "Kiro requer uma conta Amazon."
-        }
-      },
-      "windsurf": {
-        "steps": {
-          "1": {
-            "title": "Open AI Settings",
-            "desc": "Click the AI Settings icon in Windsurf or go to Settings"
-          },
-          "2": {
-            "title": "Add Custom Provider",
-            "desc": "Select \"Add custom provider\" (OpenAI-compatible)"
-          },
-          "3": {
-            "title": "Base URL",
-            "desc": "http://127.0.0.1:20128/v1"
-          },
-          "4": {
-            "title": "API Key",
-            "desc": "Select your OmniRoute API key"
-          },
-          "5": {
-            "title": "Select Model",
-            "desc": "Choose a model from the dropdown"
-          }
-        }
-      }
-    },
-    "autoConfiguredTab": "Auto-configurados",
-    "toolCategoriesDesc": "Agrupe CLIs pelo modo como o OmniRoute os configura ou intercepta para deixar esta página mais fácil de escanear.",
-    "allToolsTab": "Todas as ferramentas",
-    "guidedClientsTab": "Clientes guiados",
-    "mitmClientsTab": "Clientes MITM",
-    "customCliTab": "Custom CLI",
-    "toolCategories": "Categorias de Ferramentas",
-    "visibleToolsCount": "{count} ferramentas visíveis",
-    "customCliBuilderTitle": "Construtor CLI compatível com OpenAI",
-    "customCliBuilderDescription": "Gere env vars e snippets JSON para qualquer CLI ou SDK que aceite um URL base, chave de API e ID de modelo compatível com OpenAI.",
-    "customCliNoModels": "Conecte pelo menos um provedor para preencher os seletores de modelo.",
-    "customCliNameLabel": "Nome da CLI",
-    "customCliNamePlaceholder": "por exemplo Minha equipe CLI",
-    "customCliDefaultModelLabel": "Modelo padrão",
-    "customCliDefaultModelHelp": "Use qualquer ID de modelo ou combinação do OmniRoute. A maioria das CLIs compatíveis com OpenAI só precisa da URL base /v1 mais uma string de modelo.",
-    "customCliKeyHelper": "Para instalações locais, o OmniRoute pode usar sk_omniroute. No modo nuvem, escolha uma das suas chaves de API de gerenciamento.",
-    "customCliAliasMappingsLabel": "Mapeamentos de alias",
-    "customCliAliasMappingsHelp": "Aliases auxiliares opcionais para scripts wrapper ou arquivos de configuração que desejam nomes abreviados estáveis.",
-    "customCliAddAlias": "Adicionar alias",
-    "customCliNoMappings": "Ainda não há mapeamentos de alias. Adicione um se seu wrapper ou scripts de equipe usarem nomes abreviados estáveis.",
-    "customCliAliasPlaceholder": "por exemplo revisão",
-    "customCliTargetModelLabel": "Modelo de destino",
-    "customCliEndpointHintLabel": "Como conectar o endpoint",
-    "customCliEndpointHint": "Aponte qualquer cliente compatível com OpenAI para a URL base OmniRoute /v1. O endpoint bruto de conclusões do chat é {endpoint}. Use o bloco JSON quando a ferramenta desejar um objeto provedor ou o script env quando ler variáveis ​​OPENAI_*.",
-    "customCliEnvBlockTitle": "Fragmento de ambiente/shell",
-    "customCliJsonBlockTitle": "Bloco JSON do provedor",
-    "copilotConfigGenerator": "Gerador de configuração do GitHub Copilot",
-    "copilotApiKey": "Chave de API",
-    "copilotFilterModelsPlaceholder": "Filtrar modelos...",
-    "copilotMaxInputTokens": "Máximo de tokens de entrada",
-    "copilotMaxOutputTokens": "Máximo de tokens de saída",
-    "copilotToolCalling": "Chamada de ferramenta",
-    "copilotPasteInto": "Cole em: ",
-    "wireApiChatCompletions": "Conclusões de bate-papo (/chat/completions)",
-    "wireApiResponses": "API de respostas (/respostas)"
-  },
-  "cloudAgents": {
-    "title": "Agentes de nuvem",
-    "description": "Gerenciar agentes de codificação autônomos (Jules, Devin, Codex Cloud)",
-    "loading": "Carregando tarefas...",
-    "aboutTitle": "Sobre agentes de nuvem",
-    "aboutDescription": "Os agentes de nuvem são assistentes remotos de codificação de IA que podem executar tarefas de forma autônoma. Eles funcionam de maneira diferente dos agentes CLI locais – você interage com eles por meio da API do OmniRoute.",
-    "howItWorksTitle": "Como funciona:",
-    "howItWorksDesc": "Crie uma tarefa → Agente analisa e propõe um plano → Você aprova → Agente executa → Resultados retornados",
-    "newTaskTitle": "Criar nova tarefa",
-    "newTaskDescription": "Inicie uma nova tarefa com um agente de nuvem",
-    "selectAgent": "Selecione Agente",
-    "taskDescription": "Descrição da tarefa",
-    "taskDescriptionPlaceholder": "Descreva o que você deseja que o agente faça...",
-    "startTask": "Iniciar tarefa",
-    "tasks": "Tarefas",
-    "taskDetail": "Detalhe da tarefa",
-    "noTasks": "Nenhuma tarefa ainda. Crie um para começar.",
-    "noTasksTitle": "Nenhuma tarefa ainda",
-    "noTasksDesc": "Crie sua primeira tarefa para começar.",
-    "tasksTab": "Tarefas",
-    "agentsTab": "Agentes",
-    "settingsTab": "Configurações",
-    "agentsEnabled": "Ativado",
-    "agentsDisabled": "Desativado",
-    "filterAllProviders": "Todos os Provedores",
-    "filterAll": "Todos",
-    "autoRefreshing": "Atualização automática",
-    "viewPR": "Ver Pull Request",
-    "connected": "Conectado",
-    "notConnected": "Não conectado",
-    "configure": "Configurar",
-    "settingsTitle": "Configurações de Agentes de Nuvem",
-    "settingsDesc": "Configure as preferências locais para agentes de nuvem.",
-    "settingEnableAgents": "Ativar agentes de nuvem",
-    "settingEnableAgentsDesc": "Permitir que o OmniRoute orquestre agentes de codificação autônomos.",
-    "settingAutoPR": "Criar PR automaticamente",
-    "settingAutoPRDesc": "Quando uma tarefa for concluída, cria automaticamente um Pull Request com as alterações.",
-    "settingRequireApproval": "Exigir aprovação de plano",
-    "settingRequireApprovalDesc": "Sempre aguardar aprovação manual antes que um agente execute um plano proposto.",
-    "untitledTask": "Tarefa sem título",
-    "created": "Criado",
-    "conversation": "Conversa",
-    "result": "Resultado",
-    "error": "Erro",
-    "planReady": "Plano pronto para aprovação",
-    "approvePlan": "Aprovar plano",
-    "rejectPlan": "Rejeitar e cancelar",
-    "sendMessagePlaceholder": "Envie uma mensagem para o agente...",
-    "cancel": "Cancelar",
-    "delete": "Excluir",
-    "selectTaskPrompt": "Selecione uma tarefa para ver detalhes",
-    "statusPending": "Pendente",
-    "statusRunning": "Correndo",
-    "statusWaitingApproval": "Aguardando aprovação",
-    "statusCompleted": "Concluído",
-    "statusFailed": "Falha",
-    "statusCancelled": "Cancelado",
-    "repositoryName": "Nome do repositório",
-    "repositoryUrl": "URL do repositório",
-    "branch": "Filial"
-  },
-  "combos": {
-    "title": "Combos",
-    "description": "Crie combos de modelos com roteamento ponderado e suporte a fallback",
-    "autoCatalogTitle": "Catálogo de roteamento automático",
-    "autoCatalogTemplateCount": "{count} modelos",
-    "autoCatalogDescription": "Combos automáticos/* integrados resolvidos dinamicamente a partir de provedores conectados. Use qualquer um desses IDs como campo de modelo — nenhuma configuração é necessária.",
-    "autoCatalogExpand": "Expanda o catálogo de roteamento automático",
-    "autoCatalogCollapse": "Recolher catálogo de roteamento automático",
-    "createCombo": "Criar Combo",
-    "editCombo": "Editar Combo",
-    "deleteCombo": "Excluir Combo",
-    "noModels": "Sem modelos",
-    "noModelsYet": "Nenhum modelo adicionado",
-    "addModel": "Adicionar Modelo",
-    "addModelToCombo": "Adicionar Modelo ao Combo",
-    "routingStrategy": "Estratégia de Roteamento",
-    "maxRetries": "Máximo de Tentativas",
-    "timeout": "Timeout (ms)",
-    "healthcheck": "Verificação de Saúde",
-    "priority": "Prioridade",
-    "fallback": "Fallback",
-    "roundRobin": "Round Robin",
-    "random": "Aleatório",
-    "leastLatency": "Menor Latência",
-    "comboName": "Nome do Combo",
-    "comboNamePlaceholder": "meu-combo",
-    "deleteConfirm": "Excluir este combo?",
-    "noCombosYet": "Nenhum combo ainda",
-    "comboCreated": "Combo criado com sucesso",
-    "comboUpdated": "Combo atualizado com sucesso",
-    "comboDeleted": "Combo excluído",
-    "failedCreate": "Falha ao criar combo",
-    "failedUpdate": "Falha ao atualizar combo",
-    "errorCreating": "Erro ao criar combo",
-    "errorUpdating": "Erro ao atualizar combo",
-    "errorDeleting": "Erro ao excluir combo",
-    "testFailed": "Requisição de teste falhou",
-    "failedToggle": "Falha ao alternar combo",
-    "testResults": "Resultados do Teste — {name}",
-    "resolvedBy": "Resolvido por:",
-    "more": "+{count} mais",
-    "reqs": "reqs",
-    "success": "sucesso",
-    "proxyConfigured": "Proxy configurado",
-    "copyComboName": "Copiar nome do combo",
-    "enableCombo": "Ativar combo",
-    "disableCombo": "Desativar combo",
-    "testCombo": "Testar combo",
-    "duplicate": "Duplicar",
-    "proxyConfig": "Configuração de proxy",
-    "nameRequired": "Nome é obrigatório",
-    "nameInvalid": "Apenas letras, números, -, _, / e . permitidos",
-    "nameHint": "Letras, números, -, _, / e . permitidos",
-    "priorityDesc": "Fallback sequencial: tenta modelo 1 primeiro, depois 2, etc.",
-    "weightedDesc": "Distribui tráfego por porcentagem de peso com fallback",
-    "roundRobinDesc": "Distribuição circular: cada requisição vai para o próximo modelo na rotação",
-    "contextRelay": "Context Relay",
-    "contextRelayDesc": "Preserva a continuidade da sessão com resumos de handoff quando as contas giram",
-    "randomDesc": "Seleção aleatória uniforme, depois fallback para modelos restantes",
-    "leastUsedDesc": "Escolhe o modelo com menos requisições, equilibrando carga ao longo do tempo",
-    "costOptimizedDesc": "Roteia para o modelo mais barato primeiro baseado em preços",
-    "resetAware": "RR com reconhecimento de redefinição",
-    "resetAwareDesc": "Equilibra a cota restante com redefinições de 5h e semanais e, em seguida, faz um round-robin de pontuações semelhantes",
-    "strictRandom": "Aleatório Estrito",
-    "strictRandomDesc": "Baralho embaralhado — usa cada modelo uma vez antes de reembaralhar",
-    "models": "Modelos",
-    "autoBalance": "Auto-balancear",
-    "advancedSettings": "Configurações Avançadas",
-    "retryDelay": "Intervalo de Tentativa (ms)",
-    "concurrencyPerModel": "Concorrência / Modelo",
-    "queueTimeout": "Timeout da Fila (ms)",
-    "contextRelayHandoffThreshold": "Limite de Handoff",
-    "contextRelayHandoffThresholdHelp": "Quando o uso de quota atinge este limite, o OmniRoute gera um resumo estruturado antes de a conta ativa esgotar.",
-    "contextRelayMaxMessages": "Máx. de Mensagens no Resumo",
-    "contextRelayMaxMessagesHelp": "Limita quanto histórico recente será condensado no resumo de relay.",
-    "contextRelaySummaryModel": "Modelo do Resumo",
-    "contextRelaySummaryModelHelp": "Modelo opcional usado apenas para gerar o resumo de handoff. Deixe vazio para reutilizar o modelo ativo do combo.",
-    "contextRelayProviderNote": "O Context Relay atualmente gera handoffs para rotação de contas Codex. Combine com múltiplas contas do mesmo provedor para melhor continuidade.",
-    "advancedHint": "Deixe vazio para usar padrões globais. Estes substituem configurações por provedor.",
-    "failoverBeforeRetry": "Failover antes de tentar novamente",
-    "maxSetRetries": "Máximo de tentativas definidas",
-    "setRetryDelayMs": "Definir atraso de nova tentativa (ms)",
-    "moveUp": "Mover para cima",
-    "moveDown": "Mover para baixo",
-    "removeModel": "Remover",
-    "saving": "Salvando...",
-    "weighted": "Ponderado",
-    "leastUsed": "Menos Usado",
-    "costOpt": "Custo-Otim",
-    "strategyGuideTitle": "Como usar esta estratégia",
-    "strategyGuideWhen": "Quando usar",
-    "strategyGuideAvoid": "Evite quando",
-    "strategyGuideExample": "Exemplo",
-    "strategyGuide": {
-      "priority": {
-        "when": "Você tem um modelo principal e quer fallback apenas em falha.",
-        "avoid": "Você precisa distribuir requisições entre modelos.",
-        "example": "Modelo principal para código e backup mais barato para indisponibilidade."
-      },
-      "weighted": {
-        "when": "Você precisa dividir tráfego com percentuais controlados.",
-        "avoid": "Você não consegue manter os pesos atualizados.",
-        "example": "80% modelo estável + 20% modelo canário."
-      },
-      "round-robin": {
-        "when": "Você quer distribuição previsível e equilibrada.",
-        "avoid": "Os modelos têm custo ou latência muito diferentes.",
-        "example": "Mesmo modelo em múltiplas contas para espalhar throughput."
-      },
-      "random": {
-        "when": "Você quer distribuição simples com baixa configuração.",
-        "avoid": "Você precisa de garantias rígidas de distribuição.",
-        "example": "Protótipos rápidos com modelos equivalentes."
-      },
-      "least-used": {
-        "when": "Você quer balanceamento adaptativo baseado no uso recente.",
-        "avoid": "Seu volume é baixo e não se beneficia dessa adaptação.",
-        "example": "Workloads mistos onde um modelo tende a ficar sobrecarregado."
-      },
-      "cost-optimized": {
-        "when": "Redução de custo é a prioridade principal.",
-        "avoid": "A base de preços está ausente ou desatualizada.",
-        "example": "Jobs em lote ou segundo plano focados em menor custo."
-      },
-      "reset-aware": {
-        "when": "Você roteia várias contas com telemetria de cota e diferentes janelas de redefinição.",
-        "avoid": "A telemetria de cota não está disponível para a maioria das contas.",
-        "example": "Prefira uma redefinição semanal de 60% da conta amanhã a uma redefinição de 80% da conta mais tarde."
-      },
-      "strict-random": {
-        "when": "Você quer distribuição perfeitamente uniforme — cada modelo é usado uma vez antes de repetir.",
-        "avoid": "Os modelos têm qualidade ou latência muito diferentes e a ordem importa.",
-        "example": "Múltiplas contas do mesmo modelo para distribuir uso de forma equilibrada."
-      },
-      "p2c": {
-        "when": "Use when you want low-latency selection using Power-of-Two-Choices algorithm.",
-        "avoid": "Avoid for small combos with 2 or fewer models — no benefit over round-robin.",
-        "example": "Example: High-throughput inference across 4+ equivalent model endpoints."
-      },
-      "context-relay": {
-        "when": "Use when long sessions must survive account rotation without losing the working context.",
-        "avoid": "Avoid when account switching is rare or when you do not want extra summarization requests.",
-        "example": "Example: Codex sessions that rotate across multiple accounts near quota exhaustion."
-      },
-      "fill-first": {
-        "when": "Use quando quiser esgotar totalmente a cota de um provedor antes de passar para o próximo.",
-        "avoid": "Evite quando precisar de balanceamento de carga em nível de solicitação entre provedores.",
-        "example": "Exemplo: Use todos os créditos Deepgram de $ 200 antes de voltar para Groq."
-      },
-      "auto": {
-        "when": "Use quando precisar de roteamento de pontuação multifatorial com base em custo, latência e qualidade.",
-        "avoid": "Evite quando precisar de ordem de prioridade estrita ou persistência histórica.",
-        "example": "Exemplo: equilibre solicitações entre modelos com diferentes intensidades."
-      },
-      "lkgp": {
-        "when": "Use quando desejar rotear com base em taxas de sucesso e desempenho históricos.",
-        "avoid": "Evite quando os dados históricos são limitados ou não confiáveis.",
-        "example": "Exemplo: Direcione para modelos com bom histórico em tarefas específicas."
-      },
-      "context-optimized": {
-        "when": "Use quando precisar otimizar o uso da janela de contexto entre modelos.",
-        "avoid": "Evite quando os modelos têm comprimentos de contexto semelhantes ou as tarefas são simples.",
-        "example": "Exemplo: Distribua longas conversas entre modelos com janelas de contexto maiores."
-      }
-    },
-    "advancedHelp": {
-      "maxRetries": "Quantas tentativas serão feitas antes de falhar a requisição.",
-      "retryDelay": "Espera inicial entre tentativas. Valores maiores reduzem picos.",
-      "timeout": "Tempo máximo da requisição antes de cancelar.",
-      "healthcheck": "Ignora modelos/provedores não saudáveis no roteamento.",
-      "concurrencyPerModel": "Máximo de requisições simultâneas por modelo no round-robin.",
-      "queueTimeout": "Tempo máximo em fila antes de expirar no round-robin.",
-      "failoverBeforeRetry": "Quando ativado, qualquer erro upstream aciona o failover imediato para o próximo destino combinado, ignorando todas as novas tentativas e URLs substitutos.",
-      "maxSetRetries": "Número de vezes para tentar novamente o destino completo definido quando todos os alvos falharem. 0 = nenhuma nova tentativa de nível definido.",
-      "setRetryDelayMs": "Atraso entre novas tentativas de nível definido, dando tempo para que problemas transitórios sejam resolvidos."
-    },
-    "templatesTitle": "Templates rápidos",
-    "templatesDescription": "Aplique um perfil inicial e depois ajuste modelos e configuração.",
-    "templateApply": "Aplicar template",
-    "templateHighAvailability": "Alta disponibilidade",
-    "templateHighAvailabilityDesc": "Roteamento por prioridade com healthcheck e retries seguros.",
-    "templateCostSaver": "Economia de custo",
-    "templateCostSaverDesc": "Roteamento custo-otimizado para workloads com foco em orçamento.",
-    "templateBalanced": "Carga balanceada",
-    "templateBalancedDesc": "Roteamento por menos uso para distribuir demanda ao longo do tempo.",
-    "usageGuideHide": "Ocultar",
-    "usageGuideDontShowAgain": "Não mostrar novamente",
-    "usageGuideShow": "Mostrar guia",
-    "quickTestTitle": "Combo pronto para validar",
-    "quickTestDescription": "Rode um teste agora para confirmar fallback e latência.",
-    "testNow": "Testar agora",
-    "pricingCoverage": "Cobertura de preços",
-    "pricingCoverageHint": "Custo-otimizado funciona melhor quando todos os modelos têm preço configurado.",
-    "pricingAvailable": "Preço disponível",
-    "pricingMissing": "Sem preço",
-    "pricingAvailableShort": "com-preço",
-    "pricingMissingShort": "sem-preço",
-    "warningRoundRobinSingleModel": "Round-robin é mais útil com pelo menos 2 modelos.",
-    "warningCostOptimizedPartialPricing": "Apenas {priced} de {total} modelos têm preço. O roteamento pode ficar parcialmente orientado a custo.",
-    "warningCostOptimizedNoPricing": "Não há dados de preço para este combo. Custo-otimizado pode rotear de forma inesperada.",
-    "filterAll": "All",
-    "filterIntelligent": "Intelligent",
-    "filterDeterministic": "Deterministic",
-    "filterEmptyTitle": "No combos match this strategy filter.",
-    "filterEmptyIntelligentDescription": "Create an auto or LKGP combo to populate the intelligent routing dashboard.",
-    "filterEmptyDeterministicDescription": "Only auto and LKGP combos exist right now. Switch back to All or create a deterministic combo.",
-    "readinessTitle": "Pronto para salvar?",
-    "readinessDescription": "Revise a lista de verificação antes de criar ou atualizar este combo.",
-    "readinessCheckName": "O nome do combo é válido",
-    "readinessCheckModels": "Pelo menos um modelo está selecionado",
-    "readinessCheckWeights": "O total dos pesos é 100%",
-    "readinessCheckWeightsOptional": "Regra de pesos não obrigatória",
-    "readinessCheckPricing": "Dados de preços disponíveis",
-    "readinessCheckPricingOptional": "Regra de preços não obrigatória",
-    "saveBlockedTitle": "O salvamento está bloqueado até corrigir os itens abaixo:",
-    "saveBlockName": "Defina um nome para o combo.",
-    "saveBlockModels": "Adicione pelo menos um modelo.",
-    "saveBlockWeighted": "Ajuste os pesos para 100% (atual: {total}%).",
-    "saveBlockPricing": "Adicione preço para pelo menos um modelo ou escolha outra estratégia.",
-    "recommendationsLabel": "Recommended setup",
-    "applyRecommendations": "Apply recommendations",
-    "recommendationsUpdated": "Recommendations updated for {strategy}.",
-    "recommendationsApplied": "Recommendations applied to this combo.",
-    "intelligentPanelTitle": "Intelligent Routing Dashboard",
-    "intelligentPanelDesc": "Real-time scoring and health status for this auto-routing combo.",
-    "configOnlyStatus": "Visualização de Configuração",
-    "configOnlyHint": "Este painel mostra apenas as entradas de roteamento. O estado em tempo real do disjuntor está disponível na página de Saúde.",
-    "routingInputs": "Entradas de Roteamento",
-    "routingInputsHint": "Pacote de modo e ponderação ficam aqui; o estado em tempo real do disjuntor fica na página de Saúde.",
-    "emailVisibilityHint": "Os emails da conta aqui seguem a opção de privacidade global.",
-    "emailVisibilityTooltip": "Use o ícone de olho para revelar ou ocultar os emails da conta globalmente nas telas de combos, provedores e cotas.",
-    "manualModel": "Modelo manual",
-    "manualModelInvalid": "Insira um modelo como provedor/modelo.",
-    "manualModelUnknownProvider": "Prefixo de provedor desconhecido.",
-    "builderDynamicAccountShort": "Conta dinâmica",
-    "builderNeedValidName": "Defina um nome de combo válido antes de continuar.",
-    "statusOverview": "Status Overview",
-    "normalOperation": "Normal Operation",
-    "allProvidersHealthy": "Providers are reporting healthy routing conditions.",
-    "incidentMode": "Incident Mode",
-    "highCircuitBreakerRate": "High circuit breaker trip rate detected.",
-    "activeModePack": "Active Mode Pack",
-    "modePackUpdated": "Mode pack updated to {pack}.",
-    "modePackHint": "Switch presets to bias the routing engine without rebuilding the combo.",
-    "providerScores": "Provider Scores",
-    "allProvidersEvaluated": "No candidate pool configured. All active providers are evaluated at runtime.",
-    "excludedProviders": "Excluded Providers",
-    "excludedProvidersHint": "Providers with an OPEN circuit breaker are temporarily excluded from routing.",
-    "noExcludedProviders": "No providers are currently excluded.",
-    "cooldownMinutes": "Cooldown: {minutes}m",
-    "builderIntelligentTitle": "Intelligent Routing Configuration",
-    "builderIntelligentDesc": "Configure the multi-factor scoring engine for this auto-routing combo.",
-    "candidatePoolLabel": "Candidate Pool",
-    "candidatePoolHint": "Select which providers this engine should evaluate. Leave empty to use all active providers.",
-    "candidatePoolEmpty": "No active providers available yet.",
-    "candidatePoolAllProviders": "All providers",
-    "modePackLabel": "Mode Pack",
-    "routerStrategyLabel": "Router Strategy",
-    "strategyRules": "Rules (6-Factor Scoring)",
-    "explorationRateLabel": "Exploration Rate",
-    "explorationRateHint": "{percent}% of requests can explore non-optimal providers.",
-    "budgetCapLabel": "Budget Cap (USD / request)",
-    "budgetCapPlaceholder": "No limit",
-    "advancedWeightsTitle": "Advanced: Scoring Weights",
-    "weightQuota": "Quota",
-    "weightHealth": "Health",
-    "weightCostInv": "Cost",
-    "weightLatencyInv": "Latency",
-    "weightTaskFit": "Task Fit",
-    "weightStability": "Stability",
-    "weightTierPriority": "Tier",
-    "reviewIntelligentTitle": "Intelligent Routing Config",
-    "strategyRecommendations": {
-      "priority": {
-        "title": "Fail-safe básico",
-        "description": "Use um modelo principal e mantenha a cadeia de fallback curta e confiável.",
-        "tip1": "Coloque o modelo mais confiável em primeiro.",
-        "tip2": "Mantenha 1-2 modelos de backup com qualidade similar.",
-        "tip3": "Use retries seguros para absorver falhas transitórias do provedor."
-      },
-      "weighted": {
-        "title": "Divisão controlada de tráfego",
-        "description": "Ótimo para rollouts canário e migração gradual entre modelos.",
-        "tip1": "Comece com divisão conservadora tipo 90/10.",
-        "tip2": "Mantenha o total em 100% e rebalanceie após mudanças.",
-        "tip3": "Monitore sucesso e latência antes de aumentar o peso canário."
-      },
-      "round-robin": {
-        "title": "Distribuição previsível de carga",
-        "description": "Melhor quando os modelos são equivalentes e você precisa de distribuição uniforme.",
-        "tip1": "Use pelo menos 2 modelos.",
-        "tip2": "Configure limites de concorrência para evitar sobrecarga.",
-        "tip3": "Use timeout de fila para falhar rápido sob saturação."
-      },
-      "random": {
-        "title": "Distribuição rápida com baixa configuração",
-        "description": "Use quando precisar de distribuição simples sem garantias rígidas.",
-        "tip1": "Use modelos com perfis de latência semelhantes.",
-        "tip2": "Mantenha retries habilitados para absorver falhas aleatórias.",
-        "tip3": "Prefira para experimentação, não para SLAs rígidos."
-      },
-      "least-used": {
-        "title": "Balanceamento adaptativo",
-        "description": "Roteia para modelos menos usados para reduzir hotspots ao longo do tempo.",
-        "tip1": "Funciona melhor sob tráfego contínuo.",
-        "tip2": "Combine com health checks para balanceamento mais seguro.",
-        "tip3": "Acompanhe uso por modelo para validar ganhos na distribuição."
-      },
-      "cost-optimized": {
-        "title": "Roteamento por orçamento",
-        "description": "Roteia para modelos mais baratos quando metadados de preço estão disponíveis.",
-        "tip1": "Garanta cobertura de preços para todos os modelos selecionados.",
-        "tip2": "Mantenha um fallback de qualidade para prompts difíceis.",
-        "tip3": "Use para jobs em lote/background onde custo é o KPI principal."
-      },
-      "reset-aware": {
-        "title": "Rotação de conta com reconhecimento de redefinição",
-        "description": "Equilibra a cota restante do provedor em relação ao tempo de redefinição.",
-        "tip1": "Use etapas de conta explícitas ou roteamento de tags de conta para provedores com telemetria de cota.",
-        "tip2": "Ajuste a sessão versus pesos semanais quando a exaustão de curto prazo for mais arriscada.",
-        "tip3": "Mantenha a faixa de amarração pequena para que contas equivalentes ainda girem de forma justa."
-      },
-      "strict-random": {
-        "title": "Distribuição estritamente uniforme",
-        "description": "Cada modelo é usado exatamente uma vez antes de reembaralhar o baralho.",
-        "tip1": "Ideal para múltiplas contas do mesmo modelo.",
-        "tip2": "Garante que nenhuma conta é repetida antes de todas serem usadas.",
-        "tip3": "Combine com health checks para pular contas indisponíveis sem quebrar o ciclo."
-      },
-      "fill-first": {
-        "description": "Esgotar as cotas do provedor sequencialmente antes de voltar atrás.",
-        "tip1": "Use para roteamento baseado em cotas com cadeias de fallback claras.",
-        "tip2": "Defina cotas com precisão para evitar retrocessos prematuros.",
-        "tip3": "Funciona melhor com provedores que oferecem níveis gratuitos ou pacotes de crédito.",
-        "title": "Esgotamento de cotas"
-      },
-      "auto": {
-        "description": "Rota baseada na pontuação em tempo real de custo, latência, qualidade e integridade.",
-        "tip1": "Deixe o motor equilibrar vários fatores automaticamente.",
-        "tip2": "Monitore quais fatores orientam as decisões de roteamento nos logs.",
-        "tip3": "Use para cargas de trabalho complexas onde nenhum fator único domina.",
-        "title": "Otimização multifatorial"
-      },
-      "lkgp": {
-        "description": "Rota baseada em desempenho histórico e padrões de sucesso.",
-        "tip1": "Requer histórico de solicitações suficiente para previsões precisas.",
-        "tip2": "Bom para cargas de trabalho com padrões de desempenho de modelo consistentes.",
-        "tip3": "Monitore a precisão da previsão e ajuste os pesos conforme necessário.",
-        "title": "Roteamento baseado em histórico"
-      },
-      "context-optimized": {
-        "description": "Otimize o roteamento com base no uso da janela de contexto e na eficiência do token.",
-        "tip1": "Encaminhe conversas longas para modelos com janelas de contexto maiores.",
-        "tip2": "Monitore a utilização do contexto para evitar desperdício de tokens.",
-        "tip3": "Melhor para IA conversacional que exige ampla retenção de contexto.",
-        "title": "Otimização de Contexto"
-      },
-      "context-relay": {
-        "description": "Melhor quando a rotação de conta é esperada e a próxima conta deve herdar um resumo de tarefa simplificado.",
-        "tip1": "Use com provedores que alternam contas para a mesma família de modelos.",
-        "tip2": "Defina o limite de transferência abaixo dos limites rígidos de cota para o tempo de geração do resumo.",
-        "tip3": "Defina um modelo de resumo dedicado apenas se o primário for muito caro ou instável.",
-        "title": "Prioridade de continuidade da sessão"
-      },
-      "p2c": {
-        "description": "Direcione para o provedor com a carga atual mais baixa com base em métricas em tempo real.",
-        "tip1": "Monitore as métricas de integridade do provedor para uma avaliação precisa da carga.",
-        "tip2": "Funciona melhor com pools de provedores homogêneos.",
-        "tip3": "Ajuste a sensibilidade para evitar oscilações durante picos de tráfego.",
-        "title": "Poder de Duas Escolhas"
-      }
-    },
-    "templateFreeStack": "Free Stack ($0)",
-    "templateFreeStackDesc": "Round-robin across all free providers: Kiro (Claude), Qoder (5 models), Qwen (4 models), Gemini CLI. Zero cost, never stops coding.",
-    "auto": "Auto Combo",
-    "autoDesc": "Pool de roteamento inteligente (Otimizado)",
-    "lkgp": "Modo LKGP",
-    "lkgpDesc": "Último Provedor Bom Conhecido (Resiliência previsível)",
-    "wizardGuideTitle": "Getting Started with Combos",
-    "wizardGuideDesc": "Create model combos to route AI traffic intelligently",
-    "wizardGuideHint": "or click + Create Combo above",
-    "createFirstCombo": "Create Your First Combo",
-    "wizardStep1Title": "Name Your Combo",
-    "wizardStep1Desc": "Give your combo a unique name to identify it in routing rules",
-    "wizardStep2Title": "Add Models",
-    "wizardStep2Desc": "Select AI models and arrange their fallback priority order",
-    "wizardStep3Title": "Choose Strategy",
-    "wizardStep3Desc": "Pick how requests are distributed across your models - 13 strategies available",
-    "wizardStep4Title": "Review & Save",
-    "wizardStep4Desc": "Review your configuration and activate the combo",
-    "emailVisibilityStateOn": "On",
-    "emailVisibilityStateOff": "Off",
-    "reorderHandle": "Drag to reorder",
-    "failedReorder": "Failed to reorder models",
-    "builderFlowTitle": "Combo Builder Flow",
-    "builderStage": {
-      "basics": {
-        "label": "Basics",
-        "description": "Name and starting template"
-      },
-      "steps": {
-        "label": "Steps",
-        "description": "Provider, model, and account selection"
-      },
-      "strategy": {
-        "label": "Strategy",
-        "description": "Routing behavior and advanced settings"
-      },
-      "intelligent": {
-        "label": "Smart Routing",
-        "description": "Auto-routing candidate pool, presets, and scoring"
-      },
-      "review": {
-        "label": "Review",
-        "description": "Final validation before saving"
-      }
-    },
-    "builderStageVisited": "Stage completed",
-    "builderStageCurrent": "Current stage",
-    "builderStagePending": "Pending",
-    "builderStageLocked": "Locked — complete previous stage first",
-    "builderTitle": "Build a Combo",
-    "builderBrowseCatalog": "Browse catalog",
-    "builderProvider": "Provider",
-    "builderLoadingProviders": "Loading providers...",
-    "builderSelectProvider": "Select provider",
-    "builderModel": "Model",
-    "builderSelectModel": "Select model",
-    "builderProviderFirst": "Pick provider first",
-    "builderAccount": "Account",
-    "builderPreview": "Preview",
-    "builderAddStep": "Add step",
-    "builderDuplicateExact": "Esta etapa exata de provedor/modelo/conta já está no combo.",
-    "builderComboRef": "Combo Ref",
-    "builderAddComboRef": "Add combo reference",
-    "builderComboRefStep": "Add combo reference",
-    "builderPinnedAccount": "Pinned Account",
-    "builderLegacyEntry": "Legacy entry",
-    "reviewName": "Name",
-    "reviewStrategy": "Strategy",
-    "reviewSteps": "Steps",
-    "reviewAccounts": "Accounts",
-    "reviewProviders": "Providers",
-    "reviewComboRefs": "Combo References",
-    "reviewAdvanced": "Advanced Settings",
-    "reviewAgentFlags": "Agent Flags",
-    "reviewSequence": "Model Sequence",
-    "reviewNoSteps": "No steps configured",
-    "builderStagesDescription": "Conclua cada etapa para definir combos, construir etapas, selecionar estratégia de roteamento e revisar resultados.",
-    "builderStepsDescription": "Crie cada etapa do combo em ordem: provedor, modelo e conta. Isso permite reutilizar o mesmo provedor e modelo em contas diferentes.",
-    "selectProvider": "Selecione o provedor",
-    "selectProviderPlaceholder": "Selecione um provedor",
-    "selectModel": "Selecione o modelo",
-    "selectModelPlaceholder": "Selecione um provedor primeiro",
-    "selectAccount": "Selecione a conta",
-    "selectComboToReference": "Selecione o combo para referência",
-    "comboReference": "Referência de combinação",
-    "addComboReference": "Adicionar referência de combinação",
-    "addStepBeforeContinue": "Adicione pelo menos uma etapa antes de prosseguir para a próxima etapa.",
-    "previewNextStep": "Pré-visualizar o próximo passo",
-    "autoSelectAccount": "Selecionar conta automaticamente em tempo de execução",
-    "modePackBalanced": "Equilibrado",
-    "modePackBudget": "Orçamento",
-    "modePackPerformance": "Desempenho",
-    "modePackCustom": "Personalizado",
-    "browseLegacyCatalog": "Navegue pelo catálogo combinado legado",
-    "agentFeaturesTitle": "Recursos do agente",
-    "agentFeaturesDescription": "Habilite recursos avançados para agentes usando esta combinação",
-    "agentFeaturesSystemMessageOverride": "Substituir mensagem do sistema",
-    "agentFeaturesSystemMessagePlaceholder": "Você é um assistente especialista...",
-    "agentFeaturesSystemMessageHint": "Substituição de mensagens do sistema para agentes",
-    "agentFeaturesToolFilterRegex": "/padrão-regex/",
-    "agentFeaturesToolFilterHint": "Regex de filtro de ferramenta para agentes",
-    "agentFeaturesContextCacheHint": "Habilitar cache no contexto para ferramentas de agente",
-    "agentFeaturesContextCacheProtection": "Proteja o cache contra mutações da ferramenta do agente",
-    "agentFeaturesContextLength": "Comprimento do contexto",
-    "agentFeaturesContextLengthPlaceholder": "por exemplo 128.000",
-    "agentFeaturesContextLengthHint": "Define a janela de contexto para este combo em /v1/models.",
-    "agentFeaturesContextLengthErrorInteger": "O comprimento do contexto precisa ser um número inteiro válido",
-    "agentFeaturesContextLengthErrorRange": "O comprimento do contexto precisa estar entre 1.000 e 2.000.000",
-    "compressionOverride": "Substituição de compactação",
-    "modePack": "Pacote de modos"
-  },
   "common": {
     "save": "Salvar",
     "cancel": "Cancelar",
@@ -1955,6 +393,7 @@
     "cloudBenefitAccess": "Cloud Benefit Access",
     "maxRetries": "Max Retries",
     "queueTimeout": "Queue Timeout",
+    "queueDepth": "__MISSING__:Queue Depth",
     "addProvider": "Add Provider",
     "realtime": "Realtime",
     "totalTranslations": "Total Translations",
@@ -2404,6 +843,411 @@
     "batchActionRetryError": "Falha ao refazer requisições com falha. Tente novamente.",
     "batchConceptRetentionNote": "Arquivos de resultado e erro ficam retidos por 30 dias (Anthropic: 29 dias)"
   },
+  "featureFlagOmnirouteEmergencyFallbackDescription": "__MISSING__:Route budget-exhausted requests to the emergency free fallback provider/model.",
+  "featureFlagArenaEloSyncEnabledDescription": "__MISSING__:Enable periodic Arena AI leaderboard ELO sync for model intelligence rankings.",
+  "sidebar": {
+    "home": "Início",
+    "dashboard": "Painel",
+    "providers": "Provedores",
+    "combos": "Combos",
+    "usage": "Uso",
+    "analytics": "Análises",
+    "costs": "Custos",
+    "health": "Saúde",
+    "proxy": "Proxy",
+    "limits": "Limites e Cotas",
+    "cliTools": "Ferramentas CLI",
+    "media": "Mídia",
+    "settings": "Configurações",
+    "translator": "Tradutor",
+    "playground": "Playground",
+    "searchTools": "Search Tools",
+    "agents": "Agentes",
+    "cloudAgents": "Agentes de nuvem",
+    "memory": "Memória",
+    "skills": "Habilidades",
+    "omniSkills": "OmniSkills",
+    "agentSkills": "Habilidades do agente",
+    "docs": "Documentação",
+    "issues": "Problemas",
+    "endpoints": "Endpoints",
+    "endpointsSubtitle": "Seus URLs de conexão de IA",
+    "apiManager": "Gerenciador API",
+    "apiManagerSubtitle": "Gerenciar chaves de API e acesso",
+    "embeddedServices": "Serviços Embarcados",
+    "embeddedServicesSubtitle": "Gerenciar serviços de proxy locais",
+    "logs": "Logs",
+    "webhooks": "Webhooks",
+    "webhooksSubtitle": "Seja notificado sobre eventos",
+    "combosSubtitle": "Provedores de grupo para failover",
+    "batchSubtitle": "Processar várias solicitações",
+    "contextCavemanSubtitle": "Compactação imediata",
+    "contextRtkSubtitle": "Filtragem de saída",
+    "auditLog": "Log de Auditoria",
+    "shutdown": "Desligar",
+    "restart": "Reiniciar",
+    "shutdownConfirm": "Desligar o OmniRoute?",
+    "restartConfirm": "Reiniciar o OmniRoute?",
+    "version": "v{version}",
+    "debug": "Depuração",
+    "system": "Sistema",
+    "help": "Ajuda",
+    "primarySection": "Main",
+    "cliSection": "CLI",
+    "debugSection": "Debug",
+    "systemSection": "System",
+    "helpSection": "Help",
+    "serverDisconnected": "Servidor Desconectado",
+    "serverDisconnectedMsg": "O servidor proxy foi parado ou está reiniciando.",
+    "expandSidebar": "Expandir barra lateral",
+    "collapseSidebar": "Recolher barra lateral",
+    "themes": "Themes",
+    "presetColors": "Popular colors",
+    "createTheme": "Create theme",
+    "chooseColor": "Pick one color",
+    "themeCoral": "Coral",
+    "themeBlue": "Blue",
+    "themeRed": "Red",
+    "themeGreen": "Green",
+    "themeViolet": "Violet",
+    "themeOrange": "Orange",
+    "themeCyan": "Cyan",
+    "cliToolsShort": "Ferramentas",
+    "cache": "Cache",
+    "cacheShort": "Cache",
+    "batch": "Testes em Lote",
+    "themeSystem": "Theme System",
+    "whitelabelingDesc": "Whitelabeling Desc",
+    "switchThemes": "Switch Themes",
+    "themeAccentDesc": "Theme Accent Desc",
+    "uploadFavicon": "Upload Favicon",
+    "themeDark": "Theme Dark",
+    "customLogoDesc": "Custom Logo Desc",
+    "sidebarVisibilityToggle": "Sidebar Visibility Toggle",
+    "themeAccent": "Theme Accent",
+    "resetFavicon": "Reset Favicon",
+    "whitelabeling": "Whitelabeling",
+    "darkMode": "Dark Mode",
+    "uploadLogo": "Upload Logo",
+    "themeLight": "Theme Light",
+    "appName": "App Name",
+    "appNameDesc": "App Name Desc",
+    "resetLogo": "Reset Logo",
+    "customFavicon": "Custom Favicon",
+    "hideHealthLogs": "Hide Health Logs",
+    "customLogo": "Custom Logo",
+    "appearance": "Appearance",
+    "themeSelectionAria": "Theme Selection Aria",
+    "themeCreate": "Theme Create",
+    "customFaviconDesc": "Custom Favicon Desc",
+    "logoPreview": "Logo Preview",
+    "themeCustom": "Theme Custom",
+    "hideHealthLogsDesc": "Hide Health Logs Desc",
+    "faviconPreview": "Favicon Preview",
+    "changelog": "Changelog",
+    "contextSection": "Context & Cache",
+    "contextCaveman": "Caveman",
+    "contextRtk": "RTK",
+    "contextCombos": "Combos de Engines",
+    "contextLite": "Lite",
+    "contextAggressive": "Aggressive",
+    "contextUltra": "Ultra",
+    "contextSettings": "Compression Settings",
+    "contextHeadroom": "Headroom",
+    "contextSessionDedup": "Session Dedup",
+    "contextCcr": "CCR",
+    "contextLlmlingua": "LLMLingua",
+    "combosLive": "Combo Studio",
+    "compressionStudio": "Compression Studio",
+    "routingSection": "Routing",
+    "protocolsSection": "Protocols",
+    "agentsAiSection": "Agents & AI",
+    "cacheContextSection": "Cache & Context",
+    "analyticsSection": "Analytics",
+    "costsSection": "Custos",
+    "monitoringSection": "Monitoring",
+    "auditSecuritySection": "Audit & Security",
+    "devtoolsSection": "Dev Tools",
+    "configurationSection": "Configuration",
+    "aiFeaturesSection": "AI Features",
+    "mcp": "MCP",
+    "a2a": "A2A",
+    "plugins": "__MISSING__:Plugins",
+    "apiEndpoints": "API Endpoints",
+    "batchFiles": "Files",
+    "analyticsEvals": "Evals",
+    "analyticsSearch": "Search",
+    "analyticsUtilization": "Utilization",
+    "analyticsComboHealth": "Combo Health",
+    "analyticsCompression": "Compression",
+    "costsBudget": "Budget",
+    "costsFreeTiers": "__MISSING__:Free-Tier Budget",
+    "costsFreeTiersSubtitle": "__MISSING__:Monthly free-token allowances",
+    "freeProviderRankings": "__MISSING__:Free Provider Rankings",
+    "freeProviderRankingsSubtitle": "__MISSING__:Best free providers ranked by model ELO scores",
+    "costsQuotaShare": "Compartilhamento de Cota",
+    "costsPricing": "Pricing",
+    "logsProxy": "Proxy Logs",
+    "logsConsole": "Console",
+    "logsActivity": "Activity",
+    "auditMcp": "MCP Audit",
+    "auditA2a": "Auditoria A2A",
+    "settingsGeneral": "General",
+    "settingsAppearance": "Appearance",
+    "settingsAi": "AI Settings",
+    "settingsSecurity": "Security",
+    "settingsAccessTokens": "Tokens de Acesso",
+    "settingsFeatureFlags": "Sinalizadores de recursos",
+    "settingsAuthz": "Autorização",
+    "settingsRouting": "Routing",
+    "settingsResilience": "Resilience",
+    "modelLockout": "__MISSING__:Model Lockout",
+    "settingsAdvanced": "Advanced",
+    "omniProxySection": "OmniProxy",
+    "quotaTracker": "Provider Quota",
+    "providerQuota": "Provider Quota",
+    "runtime": "Runtime",
+    "consoleLogs": "Console Logs",
+    "globalRouting": "Global Routing",
+    "mitmProxy": "MITM Proxy",
+    "oneProxy": "1Proxy",
+    "agenticFeaturesSection": "Agentic Features",
+    "otherFeaturesSection": "Other Features",
+    "compressionContextGroup": "Compression Context",
+    "toolsGroup": "Tools",
+    "integrationsGroup": "Integrations",
+    "proxyGroup": "Proxy",
+    "costsParametersGroup": "Costs Parameters",
+    "auditGroup": "Audit",
+    "batchGroup": "Batch",
+    "homeSubtitle": "Visão geral do painel",
+    "providersSubtitle": "Gerenciar provedores de IA",
+    "quotaTrackerSubtitle": "Acompanhar limites de uso",
+    "providerQuotaSubtitle": "Acompanhar limites de uso por provedor",
+    "runtimeSubtitle": "Resiliência e sessões em tempo real",
+    "contextCombosSubtitle": "Combinar engines de compressão",
+    "cliToolsSubtitle": "Configurar runtimes CLI",
+    "agentsSubtitle": "Gerenciar agentes locais",
+    "cloudAgentsSubtitle": "Gerenciar agentes na nuvem",
+    "apiEndpointsSubtitle": "Expor endpoints customizados",
+    "proxySubtitle": "Configurações do proxy HTTP",
+    "mitmProxySubtitle": "Interceptação MITM",
+    "oneProxySubtitle": "Gateway proxy público",
+    "leaderboard": "Leaderboard",
+    "profile": "Profile",
+    "tokens": "Tokens",
+    "leaderboardSubtitle": "Rankings and achievements",
+    "profileSubtitle": "Account and preferences",
+    "tokensSubtitle": "Token usage and budgets",
+    "usageSubtitle": "Estatísticas de tráfego e uso",
+    "analyticsComboHealthSubtitle": "Confiabilidade dos targets do combo",
+    "analyticsUtilizationSubtitle": "Utilização de provedores",
+    "costsSubtitle": "Detalhamento de gastos",
+    "cacheSubtitle": "Taxa de acertos do cache",
+    "analyticsCompressionSubtitle": "Estatísticas de economia de tokens",
+    "analyticsSearchSubtitle": "Analytics das ferramentas de busca",
+    "analyticsEvalsSubtitle": "Resultados das suites de avaliação",
+    "providerStats": "__MISSING__:Provider Stats",
+    "providerStatsSubtitle": "__MISSING__:Latency and performance metrics",
+    "logsSubtitle": "Logs da aplicação",
+    "logsProxySubtitle": "Logs de tráfego do proxy",
+    "consoleLogsSubtitle": "Saída do console",
+    "logsActivitySubtitle": "Log de atividade do usuário",
+    "healthSubtitle": "Verificação de saúde do sistema",
+    "costsPricingSubtitle": "Regras de preço por modelo",
+    "costsBudgetSubtitle": "Limites de orçamento",
+    "costsQuotaShareSubtitle": "Compartilhe cotas de provedor entre chaves",
+    "auditLogSubtitle": "Auditoria de autorização",
+    "auditMcpSubtitle": "Auditoria do servidor MCP",
+    "auditA2aSubtitle": "Auditoria do protocolo A2A",
+    "translatorSubtitle": "Conversão de formatos",
+    "playgroundSubtitle": "Testar prompts ao vivo",
+    "searchToolsSubtitle": "Registro de ferramentas de busca",
+    "memorySubtitle": "Memória persistente do agente",
+    "omniSkillsSubtitle": "Registro de skills sandbox",
+    "agentSkillsSubtitle": "Registro de skills A2A",
+    "mcpSubtitle": "Controles do servidor MCP",
+    "a2aSubtitle": "Servidor do protocolo A2A",
+    "pluginsSubtitle": "__MISSING__:Plugin marketplace & installs",
+    "mediaSubtitle": "Arquivos de mídia em cache",
+    "batchFilesSubtitle": "Arquivos de entrada/saída de batch",
+    "settingsSubtitle": "Todas as configurações",
+    "settingsGeneralSubtitle": "Básicos do app",
+    "settingsAppearanceSubtitle": "Tema e layout",
+    "settingsAiSubtitle": "Padrões de comportamento da IA",
+    "globalRoutingSubtitle": "Regras de roteamento global",
+    "settingsResilienceSubtitle": "Retries e circuit breakers",
+    "settingsAdvancedSubtitle": "Opções avançadas",
+    "settingsSecuritySubtitle": "Auth e criptografia",
+    "settingsAccessTokensSubtitle": "Tokens de CLI com escopo para modo remoto",
+    "settingsFeatureFlagsSubtitle": "Alternar recursos do sistema",
+    "settingsSidebar": "Sidebar",
+    "settingsSidebarSubtitle": "Customize sidebar layout",
+    "settingsAuthzSubtitle": "Inventário de rotas e política de bypass",
+    "docsSubtitle": "Documentação",
+    "issuesSubtitle": "Reportar um bug",
+    "changelogSubtitle": "Notas de versão",
+    "costsQuotaPlans": "Planos & Cotas",
+    "costsQuotaPlansSubtitle": "Configurar planos por provider",
+    "activity": "Atividade",
+    "activitySubtitle": "Feed amigável de eventos recentes",
+    "logsGroup": "Logs",
+    "systemGroup": "Sistema",
+    "costsOverview": "Visão geral",
+    "costsOverviewSubtitle": "Análise consolidada de custos",
+    "agentBridge": "Agent Bridge",
+    "agentBridgeSubtitle": "Interceptar tráfego de agentes IDE",
+    "trafficInspector": "Inspector de Tráfego",
+    "trafficInspectorSubtitle": "Monitorar chamadas LLM + debugar tráfego HTTPS",
+    "cliCode": "CLI Code's",
+    "cliCodeSubtitle": "Ferramentas de código que apontam para o OmniRoute",
+    "cliAgents": "CLI Agents",
+    "cliAgentsSubtitle": "Agentes autônomos com CLI",
+    "acpAgents": "ACP Agents",
+    "acpAgentsSubtitle": "CLIs spawnadas pelo OmniRoute",
+    "skipToContent": "__MISSING__:Skip to content",
+    "unpinSection": "__MISSING__:Unpin section",
+    "pinSectionOpen": "__MISSING__:Pin section open",
+    "reloadPage": "__MISSING__:Reload Page",
+    "dragReorderSection": "__MISSING__:Drag to reorder section",
+    "dragReorderItem": "__MISSING__:Drag to reorder",
+    "cannotHide": "__MISSING__:This item cannot be hidden",
+    "alwaysVisible": "__MISSING__:Always visible",
+    "groupSeparatorLabel": "__MISSING__:Separator"
+  },
+  "webhooks": {
+    "title": "Webhooks",
+    "description": "Configure retornos de chamada HTTP para eventos do sistema.",
+    "configuredWebhooks": "Webhooks configurados",
+    "configuredWebhooksDesc": "Gerencie endpoints de entrega, eventos assinados, status e envios de teste.",
+    "addWebhook": "Adicionar webhook",
+    "editWebhook": "Editar webhook",
+    "name": "Nome",
+    "namePlaceholder": "Monitoramento de produção",
+    "unnamedWebhook": "Webhook sem nome",
+    "url": "URL do terminal",
+    "events": "Eventos",
+    "allEvents": "Todos os eventos",
+    "secret": "Segredo",
+    "secretPlaceholder": "Deixe em branco para gerar automaticamente um segredo",
+    "secretEditPlaceholder": "Deixe em branco para manter o segredo atual",
+    "status": "Estado",
+    "active": "Ativo",
+    "inactive": "Inativo",
+    "errored": "Erro",
+    "total": "Total",
+    "lastTriggered": "Último acionado",
+    "actions": "Ações",
+    "enabled": "Habilitado",
+    "enabledDesc": "Webhooks desativados permanecem salvos, mas não recebem entregas.",
+    "refresh": "Atualizar",
+    "loading": "Carregando webhooks...",
+    "never": "Nunca",
+    "failureCount": "{count, plural, =0 {no failures} one {# failure} other {# failures}}",
+    "testWebhook": "Enviar teste",
+    "testSuccess": "Webhook de teste enviado com sucesso.",
+    "testFailed": "O teste do webhook falhou.",
+    "saveSuccess": "Webhook salvo com sucesso.",
+    "saveFailed": "Falha ao salvar o webhook.",
+    "loadFailed": "Falha ao carregar webhooks.",
+    "delete": "Excluir",
+    "deleteConfirm": "Tem certeza de que deseja excluir este webhook?",
+    "deleteSuccess": "Webhook excluído com sucesso.",
+    "deleteFailed": "Falha ao excluir o webhook.",
+    "edit": "Editar",
+    "enable": "Habilitar",
+    "disable": "Desativar",
+    "noWebhooks": "Nenhum webhooks configurado ainda.",
+    "signatureTitle": "Assinaturas de webhook",
+    "signatureDescription": "Cada entrega inclui um cabeçalho X-Webhook-Signature assinado com HMAC-SHA256 usando o segredo do webhook. Verifique a assinatura antes de confiar na carga.",
+    "wizard": {
+      "cancel": "Cancelar",
+      "step1Title": "Selecionar Integração",
+      "step2Title": "Configurar Alvo",
+      "step3Title": "Eventos e Teste",
+      "back": "Voltar",
+      "next": "Próximo",
+      "finish": "Finalizar",
+      "step1Desc": "Selecione o sistema de integração de destino para este webhook."
+    },
+    "howItWorks": {
+      "step1": "Escolha um provedor de integração (ex: Slack, Discord, webhook personalizado) e configure os detalhes da conexão.",
+      "step2": "Configure os eventos do sistema para assinar (ex: erros de conclusão, fallbacks de modelo ou limites de uso).",
+      "step3": "Verifique a configuração enviando uma carga de teste para garantir que o endpoint a receba.",
+      "step4": "Proteja seu endpoint validando o cabeçalho X-Webhook-Signature HMAC-SHA256 usando o segredo do webhook.",
+      "title": "Como os Webhooks Funcionam",
+      "customOnly": "Aplicável apenas para integrações de endpoint personalizadas.",
+      "hmacRecipeTitle": "Receita de Verificação HMAC",
+      "hmacRecipe": "Para verificar cargas de webhook no Node.js, calcule o HMAC-SHA256 do corpo bruto da requisição usando sua chave secreta. Compare-o com o cabeçalho X-Webhook-Signature usando timingSafeEqual.",
+      "timeoutNote": "As entregas de webhook têm um tempo limite de 10 segundos.",
+      "retryNote": "Entregas falhas são tentadas até 5 vezes com backoff exponencial.",
+      "docsLink": "Leia o guia completo do desenvolvedor de Webhooks",
+      "hmacRecipePython": "Verificação HMAC em Python: hmac.new(secret, body, hashlib.sha256).hexdigest()",
+      "hmacRecipeBash": "Verificação HMAC em Bash: echo -n \"$body\" | openssl dgst -sha256 -hmac \"$secret\""
+    },
+    "deliveries": {
+      "title": "Como os Webhooks Funcionam",
+      "loadFailed": "Falha ao carregar logs de entrega do webhook.",
+      "empty": "Nenhuma entrega registrada ainda. Acione um evento ou envie uma carga de teste.",
+      "status": "Status",
+      "event": "Evento",
+      "latency": "Latência",
+      "at": "Enviado em"
+    },
+    "kinds": {
+      "comingSoon": "Em breve",
+      "slack": "Slack",
+      "slackDesc": "Postar eventos do sistema diretamente em um canal do Slack",
+      "telegram": "Telegram",
+      "telegramDesc": "Enviar mensagens de evento usando um bot do Telegram",
+      "discord": "Discord",
+      "discordDesc": "Entregar atualizações em tempo real diretamente para um servidor do Discord",
+      "custom": "Webhook Personalizado",
+      "customDesc": "Entregar cargas de eventos do sistema para qualquer endpoint HTTPS",
+      "email": "Notificação por E-mail",
+      "emailDesc": "Receber atualizações de resumo via e-mail",
+      "pagerduty": "PagerDuty",
+      "pagerdutyDesc": "Acionar alertas no PagerDuty para problemas críticos do sistema",
+      "teams": "Microsoft Teams",
+      "teamsDesc": "Encaminhar notificações do sistema para canais do Microsoft Teams"
+    },
+    "testPayloadSent": "Carga de Teste Enviada",
+    "testResponse": "Resposta de Teste",
+    "validateUrl": {
+      "checking": "Verificando URL...",
+      "ok": "URL é válida",
+      "blockedPrivate": "URL é um endereço privado bloqueado",
+      "invalidUrl": "Formato de URL inválido"
+    },
+    "custom": {
+      "endpointUrl": "URL do Endpoint",
+      "endpointUrlPlaceholder": "https://api.seudominio.com/webhook",
+      "secretKey": "Chave Secreta",
+      "secretKeyPlaceholder": "Insira a chave secreta ou deixe em branco para gerar automaticamente",
+      "secretKeyHint": "Usado para assinar o cabeçalho da carga para autenticação."
+    },
+    "discord": {
+      "webhookUrl": "URL do Webhook",
+      "webhookUrlPlaceholder": "https://...",
+      "webhookUrlHint": "A URL do webhook copiada das configurações de integração.",
+      "tutorial": "Tutorial"
+    },
+    "slack": {
+      "webhookUrl": "URL do Webhook",
+      "webhookUrlPlaceholder": "https://...",
+      "webhookUrlHint": "A URL do webhook copiada das configurações de integração.",
+      "tutorial": "Tutorial"
+    },
+    "telegram": {
+      "botToken": "Token do Bot Telegram",
+      "botTokenPlaceholder": "123456789:ABCdefGhIJKlmNoPQRsTUVwxyZ",
+      "botTokenHint": "O token da API HTTP recebido do @BotFather ao criar seu bot.",
+      "chatId": "ID do Chat / Canal do Telegram",
+      "chatIdPlaceholder": "-100123456789 ou @nomecanal",
+      "chatIdHint": "O identificador numérico único ou nome de usuário público do chat/canal.",
+      "tutorial": "Tutorial"
+    }
+  },
   "compliance": {
     "auditTitle": "Auditoria",
     "auditDescription": "Revise eventos de conformidade e chamadas de ferramentas MCP a partir de uma visão operacional.",
@@ -2512,126 +1356,1454 @@
       "sync.token.revoked": "Token de Sincronização Revogado"
     }
   },
-  "contextCaveman": {
-    "title": "Motor Caveman",
-    "description": "Compressao baseada em regras, language packs, analytics e output mode.",
-    "advancedConfig": "Configuração avançada",
-    "advancedConfigDesc": "Ajustar o comportamento da compactação",
-    "aggressiveSettings": "Configurações agressivas",
-    "aggressiveSettingsDesc": "Compressão máxima com potenciais compensações de qualidade",
-    "requests": "Requests",
-    "tokensSaved": "Tokens salvos",
-    "savingsPercent": "Economia %",
-    "avgLatency": "Latencia media",
-    "languagePacks": "Language Packs",
-    "languagePacksDesc": "Ative regras de compressao para idiomas especificos.",
-    "labelAutoTrigger": "Compactar automaticamente quando o contexto exceder",
-    "labelCompressionRate": "Força de compressão",
-    "labelMaxTokens": "Tokens de destino por mensagem",
-    "labelMinLength": "Comprimento mínimo da mensagem",
-    "labelMinSavings": "Tokens mínimos para salvar",
-    "enabled": "Ativo",
-    "autoDetect": "Auto-detectar idioma",
-    "rulesCount": "{count} regras",
-    "inputCompressionTitle": "Compressão de Entrada",
-    "inputCompressionDesc": "Reescreve o histórico do chat com termos mais curtos. Reduz os tokens de entrada em aproximadamente 50%.",
-    "analyticsTitle": "Analytics de Compressao",
-    "noAnalytics": "Sem analytics de compressao ainda.",
-    "outputMode": "Modo de saída",
-    "outputModeDesc": "Instrui o LLM a responder em formato curto e compacto.",
-    "outputModeTitle": "Output Mode",
-    "quickSettings": "Configurações rápidas",
-    "quickSettingsDesc": "Configurações básicas de compactação para começar",
-    "autoClarity": "Bypass Auto-Clarity",
-    "bypassConditions": "Condicoes de bypass",
-    "bypassConditionsList": "seguranca, irreversivel, clarificacao, sensivel a ordem",
-    "simpleMode": "Simples",
-    "advancedMode": "Avançado",
-    "tooltipAutoTrigger": "Compactar automaticamente quando o contexto exceder esse tamanho.",
-    "tooltipCompressionRate": "0,0 = nenhum, 1,0 = máximo. 0,5 = equilibrado.",
-    "tooltipMaxTokens": "Contagem de tokens de destino após a compactação. Menor = mais agressivo.",
-    "tooltipMinLength": "Mensagens menores que isso não são compactadas. Menor = mais compressão.",
-    "tooltipMinSavings": "Compacte apenas se salvar pelo menos esse número de tokens.",
-    "ultraSettings": "Configurações Ultra",
-    "ultraSettingsDesc": "Compressão semântica alimentada por SLM",
-    "preview": {
-      "lite": "Responda conciso. Preserve termos tecnicos, codigo, erros, URLs e identificadores.",
-      "full": "Responda seco e compacto. Preserve todo conteudo tecnico.",
-      "ultra": "Responda ultra compacto com abreviacoes tecnicas comuns. Preserve simbolos exatos."
-    }
+  "themesPage": {
+    "title": "Themes",
+    "description": "Choose a preset theme or create your own with a single color",
+    "presetColors": "Popular colors",
+    "customTheme": "Custom theme",
+    "customThemeDesc": "Click create theme and pick one color",
+    "createTheme": "Create theme",
+    "activePreset": "Active theme"
   },
-  "contextCombos": {
-    "title": "Combos de Compressao",
-    "description": "Defina como engines sao combinadas para diferentes cenarios de roteamento.",
-    "createCombo": "Criar Combo",
-    "editCombo": "Editar",
-    "deleteCombo": "Excluir",
-    "deleteConfirm": "Excluir este combo de compressao?",
-    "pipeline": "Pipeline",
-    "addStep": "Adicionar Step",
-    "removeStep": "Remover",
+  "header": {
+    "logout": "Sair",
+    "language": "Idioma",
+    "providers": "Provedores",
+    "providerDescription": "Gerencie suas conexões de provedores de IA",
+    "combos": "Combos",
+    "comboDescription": "Combos de modelos com fallback",
+    "usage": "Uso e Análises",
+    "usageDescription": "Monitore seu uso de API, consumo de tokens e logs de requisições",
+    "analytics": "Análises",
+    "analyticsDescription": "Gráficos, tendências e insights de avaliação",
+    "cliTools": "Ferramentas CLI",
+    "cliToolsDescription": "Configurar ferramentas de linha de comando",
+    "home": "Início",
+    "homeDescription": "Bem-vindo ao OmniRoute",
+    "endpoint": "Endpoints",
+    "endpointDescription": "Gerenciar endpoints proxy, MCP, A2A e endpoints de API",
+    "mcp": "MCP",
+    "mcpDescription": "Model Context Protocol server management and tools",
+    "a2a": "A2A",
+    "a2aDescription": "Agent-to-Agent protocol tasks and observability",
+    "settings": "Configurações",
+    "settingsDescription": "Gerencie suas preferências",
+    "openaiCompatible": "Compatível com OpenAI",
+    "anthropicCompatible": "Compatível com Anthropic",
+    "media": "Mídia",
+    "mediaDescription": "Gerar imagens, vídeos e músicas",
+    "themes": "Themes",
+    "themesDescription": "Choose a color theme for the whole dashboard panel",
+    "costsDescription": "Track spending, analyze trends, and manage your AI budget across all providers",
+    "cacheDescription": "Monitor provider prompt cache efficiency and local semantic response reuse.",
+    "limitsDescription": "Configure rate limits and quotas per API key and provider",
+    "runtimeDescription": "Observabilidade de runtime — circuit breakers, cooldowns, lockouts de modelo, sessões e alertas de quota",
+    "apiManagerDescription": "Manage API keys and access control for your OmniRoute instance",
+    "batchDescription": "Process large volumes of requests asynchronously with batched API calls",
+    "contextCavemanDescription": "Rule-based message compression, language packs, analytics and output mode controls.",
+    "contextRtkDescription": "Command-aware compression for tool output, terminal logs and build results.",
+    "contextCombosDescription": "Define how engines are combined for different routing scenarios.",
+    "changelogDescription": "Stay up to date with the latest platform features and announcements.",
+    "agentsDescription": "Manage and configure AI agent tools: Codex, Devin, Jules, and custom agents",
+    "cloudAgentsDescription": "Orchestrate cloud-based AI agents with live task tracking and plan approval",
+    "memoryDescription": "Persistent conversational memory with semantic search and FTS5 full-text indexing",
+    "skillsDescription": "Install and manage sandbox skills for automated prompt and tool execution",
+    "agentSkillsDescription": "Agent-ready skills catalog with one-click URL copy for AI client integration",
+    "translatorDescription": "Translate and test prompts across API formats: OpenAI ↔ Claude ↔ Gemini",
+    "playgroundDescription": "Test prompts interactively with live provider responses and format inspection",
+    "searchToolsDescription": "Search analytics, provider breakdown, cache hit rates, and cost tracking",
+    "logsDescription": "Real-time request logs, error traces, and streaming event inspector",
+    "auditDescription": "Compliance audit trail of API key usage, MCP tool calls, and policy events",
+    "webhooksDescription": "Configure webhook endpoints to receive real-time event notifications",
+    "healthDescription": "System health overview: providers, circuit breakers, rate limits, and database",
+    "proxyDescription": "Configure upstream proxy settings for outbound provider connections",
+    "apiEndpointsDescription": "Manage custom API endpoint configurations and routing overrides",
+    "batchFilesDescription": "Browse and manage batch job output files and results",
+    "analyticsEvalsDescription": "Model evaluation results and performance benchmarks",
+    "analyticsSearchDescription": "Search query analytics, cache hit rates, and cost tracking",
+    "analyticsUtilizationDescription": "Provider utilization metrics and capacity planning",
+    "analyticsComboHealthDescription": "Real-time health and performance of combo routing configurations",
+    "analyticsCompressionDescription": "Context compression analytics and token savings",
+    "costsBudgetDescription": "Budget limits and spending alerts per API key and provider",
+    "costsPricingDescription": "Custom pricing configuration for token cost calculations",
+    "logsProxyDescription": "Upstream proxy request logs and traffic inspection",
+    "logsConsoleDescription": "Application console output and debug logs",
+    "logsActivityDescription": "Audit trail of user actions and system events",
+    "auditMcpDescription": "MCP tool invocation audit trail and compliance records",
+    "auditA2a": "Auditoria A2A",
+    "auditA2aDescription": "Trilha de auditoria de execução de tarefas A2A, transições de estado e registros de invocação de habilidades",
+    "settingsGeneralDescription": "Storage, database, and general instance configuration",
+    "settingsAppearanceDescription": "Theme, branding, and visual customization",
+    "settingsAiDescription": "AI behaviors, thinking budgets, vision, and memory settings",
+    "settingsSecurityDescription": "Authentication, authorization, and access control settings",
+    "featureFlags": "Sinalizadores de recursos",
+    "featureFlagsDescription": "Capacidades do sistema de controle e recursos experimentais",
+    "featureFlagsActive": "{count} ativo",
+    "featureFlagsInactive": "{count} inativo",
+    "featureFlagsOverrides": "{count} Substituições de banco de dados",
+    "featureFlagsSearch": "Pesquisar sinalizadores...",
+    "featureFlagsCategoryAll": "Todos",
+    "featureFlagsCategorySecurity": "Segurança",
+    "featureFlagsCategoryNetwork": "Rede",
+    "featureFlagsCategoryPolicies": "Políticas",
+    "featureFlagsCategoryRuntime": "Tempo de execução",
+    "featureFlagsCategoryCli": "CLI",
+    "featureFlagsCategoryHealth": "Saúde",
+    "featureFlagsSourceDb": "BD",
+    "featureFlagsSourceEnv": "ENV",
+    "featureFlagsSourceDefault": "DEF",
+    "featureFlagsReset": "Redefinir",
+    "featureFlagsResetAll": "Redefinir todas as substituições",
+    "featureFlagsResetAllConfirm": "Tem certeza de que deseja redefinir todas as substituições de sinalizadores de recursos? Isso reverterá todos os sinalizadores para seus valores ENV ou padrão.",
+    "featureFlagsRestartRequired": "É necessário reiniciar para aplicar",
+    "featureFlagsNoResults": "Nenhuma sinalização corresponde à sua pesquisa",
+    "featureFlagsSaved": "Bandeira atualizada",
+    "featureFlagsError": "Falha ao atualizar sinalizador",
+    "settingsRoutingDescription": "Routing rules, model aliases, combo defaults, and degradation settings",
+    "settingsResilienceDescription": "Circuit breaker, retry, and fallback configuration",
+    "settingsAdvancedDescription": "Advanced payload rules, request limits, and proxy API settings",
+    "mitmProxyDescription": "Configure MITM proxy settings for traffic inspection and debugging",
+    "oneProxyDescription": "Configure 1Proxy settings for advanced proxy chaining",
+    "omniSkillsDescription": "Instale e gerencie skills sandbox para execução automatizada de prompts e ferramentas"
+  },
+  "home": {
+    "quickStart": "Início Rápido",
+    "quickStartDesc": "Comece em 4 passos. Conecte provedores, roteie modelos, monitore tudo.",
+    "fullDocs": "Docs Completa",
+    "step1Title": "1. Criar chave de API",
+    "step1Desc": "Vá em <endpoint>Endpoint</endpoint> -> Chaves Registradas. Gere uma chave por ambiente.",
+    "step2Title": "2. Conectar provedores",
+    "step2Desc": "Adicione contas em <providers>Provedores</providers>. Suporta OAuth, API Key e planos gratuitos.",
+    "step3Title": "3. Apontar seu cliente",
+    "step3Desc": "Defina a URL base como {url} no seu IDE ou cliente de API.",
+    "step4Title": "4. Monitorar e otimizar",
+    "step4Desc": "Acompanhe tokens, custos e erros em <logs>Logs de Requisições</logs> e <analytics>Análises</analytics>.",
+    "providersOverview": "Visão Geral dos Provedores",
+    "configuredOf": "{configured} configurados de {total} provedores disponíveis",
+    "noModelsAvailable": "Nenhum modelo disponível para este provedor.",
+    "noProvidersConfigured": "Nenhum provedor configurado ainda",
+    "addProvider": "Adicionar um provedor",
+    "configureFirst": "Configure uma conexão primeiro em {providers}",
+    "configureProvider": "Configurar Provedor",
+    "modelAvailable": "{count} modelo disponível",
+    "modelsAvailable": "{count} modelos disponíveis",
+    "connectionsActive": "{count} conexão ativa",
+    "connectionsActivePlural": "{count} conexões ativas",
+    "copyModelName": "Copiar nome do modelo",
+    "documentation": "Documentação",
+    "healthMonitor": "Monitor de Saúde",
+    "reportIssue": "Reportar problema",
+    "activeError": "{active} ativo · {errors} erro",
+    "oauthLabel": "OAuth",
+    "apiKeyLabel": "Chave de API",
+    "requestsShort": "{count} reqs",
+    "providerModelsTitle": "{provider} - Modelos",
+    "copiedModel": "Copiado: {model}",
+    "aliasLabel": "alias",
+    "updateNow": "Atualizar agora",
+    "updating": "Atualizando...",
+    "updateAvailableDesc": "Uma nova versão está disponível. Clique para atualizar.",
+    "updateStarted": "Atualização iniciada...",
+    "reloadingPageAutomatically": "Recarregando a página automaticamente...",
+    "providerTopology": "Topologia do provedor"
+  },
+  "analytics": {
+    "title": "Análises",
+    "usageAnalyticsTitle": "Análise de Uso",
+    "diversityScoreTitle": "Diversidade de Provedores",
+    "diversityScoreDesc": "Instantâneo da concentração de provedores para a janela de tráfego recente.",
+    "diversityShannonEntropy": "Entropia de Shannon",
+    "diversityWindow": "Janela: {count} reqs · Últimos {mins} mins",
+    "diversityHealthy": "Distribuição Saudável",
+    "diversityRiskHigh": "Alto Risco de Lock-in de Fornecedor",
+    "diversityRiskModerate": "Distribuição Moderada",
+    "diversityScoreLabel": "score",
+    "diversityHigherExplanation": "Valores mais altos significam que o tráfego está espalhado por múltiplos provedores.",
+    "diversityNoData": "Nenhum dado de uso recente disponível.",
+    "chartRequests": "Solicitações",
+    "chartInput": "Entrada",
+    "chartOutput": "Saída",
+    "chartTotal": "Total",
+    "chartCost": "Custo",
+    "chartShare": "Participação",
+    "chartServiceTier": "Nível de Serviço",
+    "chartServiceTierSplit": "Divisão de custo Fast / Standard",
+    "chartCostPct": "{pct}% do custo",
+    "chartUsageDetail": "Detalhes de Uso",
+    "chartCacheRead": "Leitura de cache",
+    "chartCostByProvider": "Custo por Provedor",
+    "chartNoCostData": "Sem dados de custo",
+    "chartModelUsageOverTime": "Uso de Modelos ao Longo do Tempo",
+    "chartNoData": "Sem dados",
+    "chartWeekly": "Semanal",
+    "chartModelBreakdown": "Detalhamento por Modelo",
+    "chartModel": "Modelo",
+    "chartProvider": "Provedor",
+    "chartProviderBreakdown": "Detalhamento por Provedor",
+    "filterAllKeys": "Todas as Chaves",
+    "filterSearchKeys": "Buscar chaves…",
+    "filterNoKeysMatch": "Nenhuma chave corresponde",
+    "filterOneKey": "1 chave",
+    "filterMultipleKeys": "{count} chaves",
+    "rangeToday": "Hoje",
+    "rangeYesterday": "Ontem",
+    "rangeLast3Days": "Últimos 3 dias",
+    "rangeThisWeek": "Esta semana",
+    "rangeLast14Days": "Últimos 14 dias",
+    "rangeThisMonth": "Este mês",
+    "rangeQuickSelect": "Seleção Rápida",
+    "rangeStart": "Início",
+    "rangeEnd": "Fim",
+    "rangeCancel": "Cancelar",
+    "rangeApply": "Aplicar",
+    "rangeErrorInvalid": "O início deve ser anterior ao fim",
+    "period1D": "1D",
+    "period7D": "7D",
+    "period30D": "30D",
+    "period90D": "90D",
+    "periodYTD": "YTD",
+    "periodAll": "Tudo",
+    "totalTokens": "Total de Tokens",
+    "inputTokens": "Tokens de Entrada",
+    "outputTokens": "Tokens de Saída",
+    "estCost": "Custo Est.",
+    "infraTitle": "Infraestrutura",
+    "infraAccounts": "Contas",
+    "infraProviders": "Provedores",
+    "infraApiKeys": "Chaves de API",
+    "infraModels": "Modelos",
+    "perfTitle": "Desempenho",
+    "perfAvgTokens": "Média de Tokens/Req",
+    "perfCostReq": "Custo/Req",
+    "perfIoRatio": "Taxa E/S",
+    "perfFastReq": "Solicitações Rápidas",
+    "highlightsTitle": "Destaques",
+    "highlightsTopModel": "Modelo Top",
+    "highlightsTopProvider": "Provedor Top",
+    "highlightsBusiestDay": "Dia Mais Atarefado",
+    "highlightsDiversity": "Diversidade",
+    "highlightsFallbackRate": "Taxa de Fallback",
+    "customRange": "Personalizado",
+    "overviewDescription": "Monitore padrões de uso da API, consumo de tokens, custos e tendências de atividade em todos os provedores e modelos.",
+    "evalsDescription": "Execute suítes de avaliação para testar e validar seus endpoints LLM. Compare qualidade de modelos, detecte regressões e faça benchmarks de latência.",
+    "overview": "Visão Geral",
+    "evals": "Avaliações",
+    "utilization": "Utilização",
+    "utilizationDescription": "Tendências de uso de cota do provedor e rastreamento de limites de taxa",
+    "modelStatus": "Status do modelo",
+    "modelStatusCooldown": "Recarga",
+    "modelStatusUnavailable": "Indisponível",
+    "modelStatusError": "Erro",
+    "comboHealth": "Saúde do Combo",
+    "comboHealthDescription": "Cota em nível de combo, distribuição de uso e métricas de desempenho",
+    "compressionAnalyticsTitle": "Compression Analytics",
+    "compressionAnalyticsDescription": "Compression analytics — token savings, mode breakdown, and provider stats.",
+    "autoRoutingTotalAutoRequests": "Total de solicitações automáticas",
+    "autoRoutingAvgSelectionScore": "Pontuação média de seleção",
+    "autoRoutingExplorationRate": "Taxa de Exploração",
+    "autoRoutingLkgpHitRate": "Taxa de acerto LKGP",
+    "autoRoutingRequestsByVariant": "Solicitações por variante",
+    "autoRoutingTopRoutedProviders": "Principais provedores roteados",
+    "comboHealthWorstQuotaLeft": "Pior cota restante",
+    "comboHealthUsageSkew": "Distorção de uso",
+    "comboHealthSuccessRate": "Taxa de sucesso",
+    "comboHealthQuotaHealth": "Integridade da cota",
+    "comboHealthRequests": "Solicitações",
+    "comboHealthTokens": "Fichas",
+    "comboHealthAvgLatency": "Latência média",
+    "comboHealthTotalRequests": "Total de solicitações",
+    "comboHealthExecutionTargets": "Metas de execução",
+    "comboHealthSuccess": "Sucesso",
+    "comboHealthLatency": "Latência",
+    "comboHealthQuota": "Cota",
+    "comboHealthTitle": "Saúde combinada",
+    "comboHealthUnableToLoad": "Não foi possível carregar a saúde do combo",
+    "comboHealthGettingStarted": "Primeiros passos",
+    "compressionAnalyticsTotalRequests": "Total de solicitações",
+    "compressionAnalyticsTokensSaved": "Tokens salvos",
+    "compressionAnalyticsAvgSavings": "Economia média",
+    "compressionAnalyticsAvgDuration": "Duração média",
+    "compressionAnalyticsReceipts": "Recibos",
+    "compressionAnalyticsFallbacks": "Alternativos",
+    "compressionAnalyticsPromptTokens": "Tokens de prompt",
+    "compressionAnalyticsCompletionTokens": "Tokens de conclusão",
+    "compressionAnalyticsTotalTokens": "Totais de fichas",
+    "compressionAnalyticsCacheTokens": "Tokens de cache",
+    "compressionAnalyticsNoDataYet": "Ainda não há dados de compactação",
+    "searchAnalyticsTotalSearches": "Total de pesquisas",
+    "searchAnalyticsCacheHitRate": "Taxa de acertos do cache",
+    "searchAnalyticsTotalCost": "Custo total",
+    "searchAnalyticsAvgResponse": "Resposta média",
+    "searchAnalyticsNoSearchesYet": "Nenhuma pesquisa ainda",
+    "providerUtilizationTitle": "Utilização do provedor",
+    "providerUtilizationFailedToLoad": "Falha ao carregar dados de utilização",
+    "providerUtilizationNoData": "Não há dados de utilização disponíveis",
+    "providerUtilizationGettingStarted": "Primeiros passos",
+    "providerUtilizationLatestSnapshot": "Instantâneo de cota mais recente",
+    "providerUtilizationRemainingCapacity": "Capacidade restante"
+  },
+  "apiManager": {
+    "title": "Chaves de API",
+    "createKey": "Criar Chave de API",
+    "key": "Chave",
+    "revokeKey": "Revogar Chave",
+    "revokeConfirm": "Tem certeza que deseja revogar esta chave de API?",
+    "noKeys": "Nenhuma chave de API ainda",
+    "noKeysDesc": "Crie sua primeira chave de API para autenticar requisições ao seu endpoint",
+    "keyLabel": "Rótulo da Chave",
+    "permissions": "Permissões",
+    "expiresAt": "Expira",
+    "never": "Nunca",
+    "revoke": "Revogar",
+    "showKey": "Mostrar Chave",
+    "hideKey": "Ocultar Chave",
+    "copyKey": "Copiar Chave de API",
+    "allModels": "Todos os modelos",
+    "selectedModels": "Modelos Selecionados",
+    "readOnly": "Somente Leitura",
+    "fullAccess": "Acesso Total",
+    "keyManagement": "Gerenciamento de Chaves de API",
+    "keyManagementDesc": "Crie e gerencie chaves de API para autenticar requisições ao seu endpoint",
+    "totalKeys": "Total de Chaves",
+    "restricted": "Restrita",
+    "totalRequests": "Total de Requisições",
+    "modelsAvailable": "Modelos Disponíveis",
+    "registeredKeys": "Chaves Registradas",
+    "keysRegistered": "{count} chaves registradas",
+    "keyRegistered": "{count} chave registrada",
+    "keysSecurityNote": "Cada chave isola o rastreamento de uso e pode ser revogada independentemente. As chaves são mascaradas após a criação por segurança.",
+    "createFirstKey": "Crie Sua Primeira Chave",
     "name": "Nome",
-    "descriptionField": "Descricao",
-    "languagePacks": "Language Packs",
-    "outputMode": "Output Mode",
-    "assignToRouting": "Atribuir a Combos de Roteamento",
-    "noAssignments": "Nenhum combo de roteamento disponivel",
-    "default": "Default",
-    "setAsDefault": "Definir como default",
-    "save": "Salvar",
-    "cancel": "Cancelar",
-    "enabled": "Ativo"
+    "usage": "Uso",
+    "created": "Criado",
+    "actions": "Ações",
+    "reqs": "reqs",
+    "neverUsed": "Nunca usada",
+    "deleteConfirm": "Excluir esta chave de API?",
+    "usageTips": "Dicas de Uso",
+    "tipAuth": "Use chaves de API no cabeçalho Authorization como Bearer SUA_CHAVE",
+    "tipSecure": "As chaves são mostradas apenas uma vez durante a criação — armazene-as com segurança",
+    "tipSeparate": "Crie chaves separadas para diferentes clientes ou ambientes",
+    "tipRestrict": "Restrinja chaves a modelos específicos para maior segurança e controle de custos",
+    "keyName": "Nome da Chave",
+    "keyNamePlaceholder": "ex: Chave de Produção",
+    "keyNameDesc": "Escolha um nome descritivo para identificar o propósito desta chave",
+    "managementAccessDesc": "Permitir que esta chave de API gerencie a configuração do OmniRoute.",
+    "selfServiceVisibility": "Visibilidade de autoatendimento",
+    "selfServiceVisibilityDesc": "Controla o que esta chave pode ver sobre o próprio uso e a cota upstream compartilhada.",
+    "ownUsageVisibility": "Custo próprio e uso de tokens",
+    "ownUsageVisibilityDesc": "Permitir que esta chave chame seu endpoint de status para ver o próprio uso em USD, percentual do orçamento e totais de tokens.",
+    "sharedAccountQuotaVisibility": "Cota de conta compartilhada",
+    "sharedAccountQuotaVisibilityDesc": "Permitir que esta chave veja a cota da conta upstream compartilhada quando uma conexão explícita estiver configurada.",
+    "localUsageCommand": "Permitir comando local de uso",
+    "localUsageCommandDesc": "Permite que esta API key use @@om-usage para consultar consumo e limites em cache, sem chamar provider externo.",
+    "localUsageCommandBadge": "Cmd uso",
+    "keyCreated": "Chave de API Criada",
+    "keyCreatedSuccess": "Chave criada com sucesso!",
+    "keyCreatedNote": "Copie e armazene esta chave agora — ela não será mostrada novamente.",
+    "done": "Pronto",
+    "savePermissions": "Salvar Permissões",
+    "endpointRestrictions": "Endpoints Permitidos",
+    "allEndpointsAllowed": "Esta chave pode acessar todos os endpoints de API.",
+    "endpointsRestricted": "Restrito a {count} endpoint{count, plural, one {} other {s}}.",
+    "autoResolve": "Auto-Resolve",
+    "autoResolveDesc": "Resolve automaticamente nomes ambíguos de modelo para o provedor nativo desta API key.",
+    "streamDefaultMode": "__MISSING__:Stream Default Compatibility",
+    "streamDefaultModeDesc": "__MISSING__:Controls omitted `stream` flags for this key. JSON mode returns non-streaming responses unless the client explicitly requests SSE.",
+    "streamDefaultLegacy": "__MISSING__:Legacy",
+    "streamDefaultJson": "__MISSING__:JSON Compatible",
+    "streamDefaultBadge": "__MISSING__:JSON stream default",
+    "keyActive": "Chave Ativa",
+    "keyActiveDesc": "Ativa ou desativa esta API key. Chaves desativadas são bloqueadas com 403.",
+    "accessSchedule": "Horário de Acesso",
+    "accessScheduleDesc": "Restrinja o acesso a horários e dias da semana específicos.",
+    "scheduleFrom": "Das",
+    "scheduleUntil": "Até",
+    "scheduleDays": "Dias",
+    "scheduleTimezone": "Fuso Horário",
+    "scheduleTimezoneHint": "Use nomes IANA, ex: America/Sao_Paulo",
+    "scheduleActive": "Agenda",
+    "disabled": "Desativada",
+    "daySun": "Dom",
+    "dayMon": "Seg",
+    "dayTue": "Ter",
+    "dayWed": "Qua",
+    "dayThu": "Qui",
+    "dayFri": "Sex",
+    "daySat": "Sáb",
+    "allowAll": "Permitir Tudo",
+    "restrict": "Restringir",
+    "allowAllInfo": "Esta chave pode acessar todos os modelos disponíveis.",
+    "restrictInfo": "Esta chave pode acessar {selected} de {total} modelos.",
+    "selected": "{count} selecionados",
+    "all": "Todos",
+    "clear": "Limpar",
+    "searchModels": "Buscar modelos por nome ou provedor...",
+    "noModelsFound": "Nenhum modelo encontrado",
+    "keyNameRequired": "Nome da chave é obrigatório",
+    "keyNameTooLong": "Nome da chave deve ter {max} caracteres ou menos",
+    "keyNameInvalid": "Nome da chave pode conter apenas letras, números, espaços, hífens e sublinhados",
+    "invalidKeyName": "Nome de chave inválido",
+    "failedCreateKey": "Falha ao criar chave",
+    "failedCreateKeyRetry": "Falha ao criar chave. Tente novamente.",
+    "invalidKeyId": "ID de chave inválido",
+    "failedDeleteKey": "Falha ao excluir chave",
+    "failedDeleteKeyRetry": "Falha ao excluir chave. Tente novamente.",
+    "invalidModelsSelection": "Seleção de modelos inválida",
+    "cannotSelectMoreThanModels": "Não é possível selecionar mais de {max} modelos",
+    "failedUpdatePermissions": "Falha ao atualizar permissões",
+    "failedUpdatePermissionsRetry": "Falha ao atualizar permissões. Tente novamente.",
+    "unknownProvider": "desconhecido",
+    "copyMaskedKey": "Copiar chave mascarada",
+    "keyOnlyAvailableAtCreation": "Full key available only at creation time — copy it when you first create the key",
+    "modelsCount": "{count, plural, one {# modelo} other {# modelos}}",
+    "lastUsedOn": "Último: {date}",
+    "viewCostsFor": "__MISSING__:View costs for {name}",
+    "editPermissions": "Editar permissões",
+    "deleteKey": "Excluir chave",
+    "regenerateKey": "Chave regenerada",
+    "regenerateConfirm": "Tem certeza de que deseja regenerar esta chave de API? A chave antiga será imediatamente invalidada.",
+    "failedRegenerateKey": "Falha ao regenerar a chave de API",
+    "failedRegenerateKeyRetry": "Falha ao regenerar a chave de API. Por favor, tente novamente.",
+    "model": "{count} modelo",
+    "models": "{count} modelos",
+    "permissionsTitle": "Permissões: {name}",
+    "allowAllDesc": "Esta chave pode acessar todos os modelos disponíveis.",
+    "restrictDesc": "Esta chave pode acessar {selectedCount} de {totalModels} modelos.",
+    "selectedCount": "{count} selecionados",
+    "maxActiveSessions": "Máximo de sessões ativas",
+    "apiManagerCustomRateLimits": "Limites de taxas personalizadas",
+    "apiManagerCustomRateLimitsDesc": "Substitua os limites padrão globais. Deixe em branco para usar os padrões.",
+    "apiManagerRateLimitRequestsPlaceholder": "Solicitações",
+    "apiManagerRateLimitReqPer": "solicitação /",
+    "apiManagerRateLimitSecondsPlaceholder": "Segundos",
+    "apiManagerRemoveLimitTitle": "Remover limite",
+    "apiManagerTimezonePlaceholder": "América/São_Paulo",
+    "noLogPayloadPrivacy": "Privacidade de carga útil sem registro",
+    "bannedStatus": "Status banido",
+    "managementApiAccess": "Acesso à API de gerenciamento",
+    "expirationDate": "Data de expiração",
+    "managementAccess": "Acesso de gerenciamento",
+    "allowedConnections": "Conexões permitidas",
+    "searchPlaceholder": "Buscar por nome ou token...",
+    "activeOnly": "Apenas ativas",
+    "filterStatus": "STATUS",
+    "filterType": "TIPO",
+    "filterAll": "Todas",
+    "filterStatusActive": "Ativa",
+    "filterStatusDisabled": "Desativada",
+    "filterStatusBanned": "Banida",
+    "filterStatusExpired": "Expirada",
+    "filterTypeStandard": "Padrão",
+    "filterTypeManage": "Gerenciamento",
+    "filterTypeRestricted": "Restrita",
+    "shownOf": "{shown} de {total} exibidas",
+    "emptyFilterTitle": "Nenhuma chave corresponde aos filtros",
+    "emptyFilterClear": "Limpar filtros",
+    "disableNonPublicModels": "__MISSING__:Disable Non-Public Models",
+    "disableNonPublicModelsDesc": "__MISSING__:Reject requests for models that are not discovered or not marked as public in the provider catalog",
+    "normalKeysSection": "Chaves normais",
+    "quotaKeysSection": "Chaves de cota",
+    "quotaPill": "QUOTA",
+    "quotaModeOnly": "só-qtSd"
   },
-  "contextRtk": {
-    "title": "Motor RTK",
-    "description": "Compressao sensivel a comandos para tool output, logs de terminal e builds.",
-    "enabled": "Ativo",
-    "intensity": "Intensidade",
-    "intensityMinimal": "Minima",
-    "intensityStandard": "Padrao",
-    "intensityAggressive": "Agressiva",
-    "toolResults": "Resultados de tools",
-    "assistantMessages": "Mensagens do assistente",
-    "codeBlocks": "Blocos de codigo",
-    "filterCatalog": "Catálogo de Filtros",
-    "filterCatalogDesc": "Filtros de saída disponíveis por categoria",
-    "guidedConfig": "Configuração",
-    "guidedConfigDesc": "Ajuste como o RTK filtra a saída do seu terminal",
-    "maxLines": "Max linhas",
-    "maxChars": "Max caracteres",
-    "deduplicateThreshold": "Limite de deduplicacao",
-    "customFilters": "Filtros customizados",
-    "detectedType": "Tipo detectado",
-    "confidence": "Confiança",
-    "beforeAfter": "Antes / Depois",
-    "trustProjectFilters": "Confiar em filtros do projeto",
-    "rawOutputRetention": "Retencao de raw output",
-    "rawOutputNever": "Nunca",
-    "rawOutputFailures": "Falhas",
-    "rawOutputAlways": "Sempre",
-    "rawOutputMaxBytes": "Max bytes de raw output",
-    "filterTesting": "Teste de filtros",
-    "pasteOutput": "Cole output de ferramenta para testar...",
-    "presetHigh": "Agressivo",
-    "presetLow": "Luz",
-    "presetMaxChars": "Máximo de caracteres de saída",
-    "presetMaxLines": "Máximo de linhas de saída",
-    "presetMedium": "Padrão",
-    "run": "Executar",
+  "auditLog": {
+    "title": "Log de Auditoria",
+    "searchPlaceholder": "Buscar ações...",
+    "action": "Ação",
+    "actor": "Autor",
+    "target": "Alvo",
+    "ipAddress": "Endereço IP",
+    "timestamp": "Data/Hora",
+    "noEntries": "Nenhum registro de auditoria",
+    "filterByAction": "Filtrar por ação...",
+    "filterByActor": "Filtrar por autor...",
+    "filterEntriesAria": "Filtrar entradas do log de auditoria",
+    "filterByActionTypeAria": "Filtrar por tipo de ação",
+    "filterByActorAria": "Filtrar por autor",
+    "refreshAuditLogAria": "Atualizar log de auditoria",
+    "tableAria": "Entradas do log de auditoria",
+    "failedFetchAuditLog": "Falha ao carregar log de auditoria",
+    "notAvailable": "—",
+    "description": "Ações administrativas e eventos de segurança",
+    "showing": "Mostrando {count} entradas (offset {offset})",
+    "previous": "Anterior"
+  },
+  "media": {
+    "title": "Playground de Mídia",
+    "subtitle": "Gere imagens, vídeos e música",
+    "model": "Modelo",
+    "prompt": "Prompt",
+    "generate": "Gerar",
+    "generating": "Gerando...",
+    "loadingModels": "Carregando modelos disponíveis...",
+    "noModels": "Nenhum modelo disponível. Configure provedores com suporte a mídia primeiro.",
+    "error": "Falha na Geração",
     "result": "Resultado",
-    "previewEmpty": "Execute um exemplo para visualizar o RTK.",
+    "imageDescription": "Gere imagens a partir de prompts de texto usando OpenAI, xAI, Together, Hyperbolic, SD WebUI, ComfyUI e mais.",
+    "videoDescription": "Crie vídeos com AnimateDiff, Stable Video Diffusion via ComfyUI ou SD WebUI.",
+    "musicDescription": "Componha músicas usando Stable Audio Open ou MusicGen via ComfyUI.",
+    "kinds": {
+      "embedding": "Embedding",
+      "image": "Imagem",
+      "imageToText": "Imagem para Texto",
+      "tts": "Texto para Fala",
+      "stt": "Fala para Texto",
+      "webSearch": "Busca Web",
+      "webFetch": "Web Fetch",
+      "video": "Vídeo",
+      "music": "Música"
+    },
+    "noProviders": "Nenhum provedor configurado para este tipo.",
+    "addConnection": "Adicionar Conexão",
+    "backToProviders": "Voltar para Provedores",
+    "connections": "{count} Conexões",
+    "noConnections": "Nenhuma conexão ainda — adicione uma na página do provedor.",
+    "loading": "Carregando..."
+  },
+  "search": {
+    "searchQuery": "Search Query",
+    "searchResults": "Search Results",
+    "cachedResult": "Cached",
+    "searchCost": "Cost",
+    "searchTools": "Search Tools",
+    "searchToolsDesc": "Advanced search testing with provider comparison",
+    "compareProviders": "Compare Providers",
+    "rerankResults": "Rerank Results",
+    "searchHistory": "Search History",
+    "urlOverlap": "URL Overlap",
+    "noSearchProviders": "No search providers configured. Add providers in Settings.",
+    "noRerankModels": "No rerank model available",
+    "webSearch": "Web Search",
+    "provider": "Provider",
+    "searchType": "Search Type",
+    "maxResults": "Max Results",
+    "filters": "Filters",
+    "country": "Country",
+    "language": "Language",
+    "timeRange": "Time Range",
+    "includeDomains": "Include Domains",
+    "excludeDomains": "Exclude Domains",
+    "safeSearch": "Safe Search",
+    "safeSearchOff": "Off",
+    "safeSearchModerate": "Moderate",
+    "safeSearchStrict": "Strict",
+    "queryPlaceholder": "Enter search query...",
+    "providerAuto": "auto (cheapest)",
+    "searchTypeWeb": "web",
+    "searchTypeNews": "news",
+    "optionAny": "any",
+    "timeRangeDay": "Past day",
+    "timeRangeWeek": "Past week",
+    "timeRangeMonth": "Past month",
+    "timeRangeYear": "Past year",
+    "domainPlaceholder": "example.com",
+    "requestTimedOut": "Request timed out ({seconds}s)",
+    "networkError": "Network error",
+    "formatted": "Formatted",
+    "rawJson": "JSON",
+    "cacheMiss": "cache miss",
+    "cacheHit": "cache hit",
+    "latency": "Latency",
+    "cost": "Cost",
+    "results": "Results",
+    "rerank": "Rerank",
+    "rerankModel": "Rerank Model",
+    "positionDelta": "Position Change",
+    "emptyState": "Send a search query to see results",
+    "copy": "Copiar",
+    "resetToDefault": "Redefinir para o padrão",
+    "tabSearch": "Buscar",
+    "tabScrape": "Scrape",
+    "tabCompare": "Comparar",
+    "modalitiesGuide": "Guia de modalidades",
+    "searchConceptTitle": "Busca",
+    "searchConceptDesc": "Busca = retorna uma lista de resultados web (título, URL, snippet, score de relevância)",
+    "scrapeConceptTitle": "Scrape",
+    "scrapeConceptDesc": "Scrape = extrai o conteúdo completo de uma URL (markdown, texto ou HTML)",
+    "compareConceptTitle": "Comparar",
+    "compareConceptDesc": "Comparar = executa a mesma query em N providers lado a lado para comparar latência, custo e overlap de resultados",
+    "rerankConceptTitle": "Rerank",
+    "rerankConceptDesc": "Rerank = reordena resultados via LLM para melhorar relevância baseada na query",
+    "autoConceptTitle": "Auto (mais barato)",
+    "autoConceptDesc": "Auto (mais barato) = escolhe automaticamente o provider mais barato disponível com credenciais configuradas",
+    "providerCatalogTitle": "Catálogo de Provedores",
+    "kindSearch": "Busca",
+    "kindFetch": "Fetch/Scrape",
+    "statusConfigured": "Configurado",
+    "statusMissing": "Sem credencial",
+    "statusRateLimited": "Rate limited",
+    "configureProvider": "Configurar em Provedores",
+    "loadingProviders": "Carregando provedores…",
+    "failedToLoadProviders": "Falha ao carregar provedores",
+    "costPerQuery": "Custo/consulta",
+    "freeQuota": "Cota gratuita/mês",
+    "scrapeUrl": "URL para extrair",
+    "scrapeUrlPlaceholder": "https://exemplo.com",
+    "scrapeUrlRequired": "__MISSING__:URL is required",
+    "scrapeUrlInvalid": "__MISSING__:Invalid URL — it must start with http:// or https://",
+    "scrapeExtract": "Extrair",
+    "scrapeExtracting": "Extraindo…",
+    "scrapeFullPage": "Página completa",
+    "scrapeFormat": "Formato",
+    "formatMarkdown": "Markdown",
+    "formatHtml": "HTML",
+    "formatText": "Texto",
+    "scrapePreview": "Visualização",
+    "scrapeRaw": "Raw",
+    "scrapeContentTruncated": "(truncado, ver raw)",
+    "scrapeMetadata": "Metadados",
+    "scrapeProvider": "Provedor",
+    "scrapeSize": "Tamanho",
+    "scrapeEmptyState": "__MISSING__:Enter a URL to extract its content",
+    "scrapeProvidersAvailable": "__MISSING__:Available providers: Firecrawl, Jina Reader, Tavily.",
+    "compareRun": "Comparar",
+    "compareRunning": "Comparando…",
+    "autoProvider": "Auto (mais barato)",
+    "configuredStatus": "Configurado",
+    "rateLimitedStatus": "Rate limited",
+    "noCredential": "Sem credencial",
+    "searchTypeLabel": "Tipo",
+    "rerankModelLabel": "Modelo de rerank",
+    "noneOption": "Nenhum",
+    "size": "Tamanho"
+  },
+  "cliTools": {
+    "title": "Ferramentas CLI",
+    "noActiveProviders": "Nenhum provedor ativo",
+    "noActiveProvidersDesc": "Adicione e conecte provedores primeiro para configurar as ferramentas CLI.",
+    "mapModels": "Mapear Modelos",
+    "testConnection": "Testar Conexão",
+    "connectionStatus": "Status da Conexão",
+    "configureEndpoint": "Configurar Endpoint",
+    "instructions": "Instruções",
+    "modelMapping": "Mapeamento de Modelos",
+    "baseUrl": "URL Base",
+    "apiKey": "Chave de API",
+    "configured": "Configurado",
+    "notConfigured": "Não configurado",
+    "notInstalled": "Não instalado",
+    "custom": "Customizado",
+    "unknown": "Desconhecido",
+    "lastSavedAt": "Último salvamento: {date}",
+    "never": "Nunca",
+    "justNow": "agora mesmo",
+    "minutesAgoShort": "{count} min atrás",
+    "hoursAgoShort": "{count} h atrás",
+    "daysAgoShort": "{count} d atrás",
+    "monthsAgoShort": "{count} mês(es) atrás",
+    "yearsAgoShort": "{count} ano(s) atrás",
+    "runtimeCheckFailed": "Falha ao verificar runtime",
+    "yourApiKeyPlaceholder": "sua-api-key",
+    "modelPlaceholder": "provedor/modelo-id",
+    "configurationSaved": "Configuração salva com sucesso.",
+    "failedToSave": "Falha ao salvar configuração.",
+    "noApiKeysCreateOne": "Sem chaves de API - crie uma na página Chaves",
+    "defaultOmnirouteKey": "sk_omniroute (padrão)",
+    "selectModel": "Selecionar Modelo",
+    "selectModelForAlias": "Selecionar modelo para {alias}",
+    "selectModelForTool": "Selecionar Modelo para {tool}",
+    "select": "Selecionar",
+    "clear": "Limpar",
+    "comingSoon": "Em breve",
+    "checkingRuntime": "Verificando status de runtime...",
+    "guideOnlyIntegration": "Integração apenas por guia (não requer runtime local)",
+    "cliRuntimeDetected": "Runtime de CLI detectado e pronto",
+    "cliFoundNotRunnable": "CLI encontrado, mas não executável{reason}",
+    "cliRuntimeNotDetected": "Runtime de CLI não detectado",
+    "binary": "Binário",
+    "configPath": "Caminho de config",
+    "configPathShort": "Config",
+    "failedCheckRuntimeStatus": "Falha ao verificar status de runtime.",
+    "copy": "Copiar",
+    "copied": "Copiado",
+    "copyConfig": "Copiar Config",
+    "saveConfig": "Salvar Config",
+    "selectionSaved": "Seleção salva",
+    "guide": "Guia",
     "detected": "Detectado",
-    "masterSwitchOffAlert": "O interruptor mestre do Token Saver está DESLIGADO — estas configurações não afetarão as solicitações até que você o ligue na página de Endpoint.",
-    "tokensFiltered": "Tokens filtrados",
-    "filtersActive": "Filtros ativos",
-    "requests": "Requests",
-    "avgSavings": "Economia media",
-    "simpleMode": "Simples",
-    "advancedMode": "Avançado",
-    "searchFilters": "Filtros de pesquisa...",
-    "tooltipDedup": "Quão agressivamente remover linhas repetidas.",
-    "tooltipMaxChars": "Máximo de caracteres por bloco de saída.",
-    "tooltipMaxLines": "Máximo de linhas a serem mantidas na saída do comando. O excesso é truncado."
+    "notReady": "Não pronto",
+    "active": "Ativo",
+    "inactive": "Inativo",
+    "startMitm": "Iniciar MITM",
+    "stopMitm": "Parar MITM",
+    "mitmStarted": "MITM iniciado com sucesso!",
+    "mitmStopped": "MITM parado com sucesso!",
+    "failedStart": "Falha ao iniciar MITM",
+    "failedStop": "Falha ao parar MITM",
+    "saveMappings": "Salvar Mapeamentos",
+    "mappingsSaved": "Mapeamentos salvos!",
+    "failedSaveMappings": "Falha ao salvar mapeamentos",
+    "howItWorks": "Como funciona:",
+    "antigravityHowWorksDesc": "O Antigravity envia requisições para o endpoint do Google. O MITM intercepta e redireciona para o OmniRoute.",
+    "antigravityStep1": "1. Inicie o MITM para rotear as requisições pelo OmniRoute.",
+    "antigravityStep2Prefix": "2. Adicione",
+    "antigravityStep2Suffix": "ao arquivo hosts como 127.0.0.1.",
+    "antigravityStep3": "3. Abra o Antigravity e as requisições serão proxyadas.",
+    "mitmHowWorksDesc": "{toolName} sends requests to its provider endpoint. MITM intercepts and redirects them to OmniRoute.",
+    "mitmStep1": "1. Start MITM to route requests through OmniRoute.",
+    "mitmStep2Prefix": "2. Add",
+    "mitmStep2Suffix": "to your hosts file as 127.0.0.1.",
+    "mitmStep3": "3. Open {toolName} and requests will be proxied.",
+    "sudoPasswordRequiredTitle": "Senha sudo necessária",
+    "sudoPasswordHint": "A senha de administrador é necessária para modificar hosts e configurações de proxy do sistema.",
+    "enterSudoPassword": "Digite a senha sudo",
+    "sudoPasswordRequiredError": "A senha sudo é obrigatória.",
+    "cancel": "Cancelar",
+    "confirm": "Confirmar",
+    "settingsApplied": "Configurações aplicadas com sucesso!",
+    "failedApplySettings": "Falha ao aplicar configurações",
+    "settingsReset": "Configurações resetadas com sucesso!",
+    "failedResetSettings": "Falha ao resetar configurações",
+    "backupRestored": "Backup restaurado!",
+    "failedRestore": "Falha ao restaurar",
+    "checkingCli": "Verificando CLI {tool}...",
+    "cliNotRunnable": "CLI {tool} instalado, mas não executável",
+    "cliNotInstalled": "CLI {tool} não instalado",
+    "cliNotDetected": "CLI {tool} não detectado",
+    "cliDetectedReady": "CLI {tool} detectado e pronto",
+    "cliFoundFailedHealthcheck": "CLI {tool} foi encontrado, mas falhou no healthcheck de runtime{reason}.",
+    "installCliPrompt": "Instale o CLI {tool} para usar este recurso.",
+    "installCodexPrompt": "Instale o Codex CLI para usar a aplicação automática.",
+    "hide": "Ocultar",
+    "howToInstall": "Como instalar",
+    "installationGuide": "Guia de instalação",
+    "platforms": "macOS / Linux / Windows:",
+    "afterInstallationRun": "Após a instalação, execute",
+    "toVerify": "para verificar.",
+    "current": "Atual",
+    "baseUrlPlaceholder": "https://.../v1",
+    "resetToDefault": "Redefinir para padrão",
+    "providerModelPlaceholder": "provedor/modelo-id",
+    "apply": "Aplicar",
+    "reset": "Resetar",
+    "manualConfig": "Configuração manual",
+    "backups": "Backups",
+    "configBackups": "Backups de configuração",
+    "noBackupsYet": "Ainda não há backups. Backups são criados automaticamente antes de cada Aplicar ou Resetar.",
+    "restore": "Restaurar",
+    "backupRestoredReloading": "Backup restaurado! Recarregando status...",
+    "failedRestoreBackup": "Falha ao restaurar backup",
+    "applied": "Aplicado!",
+    "failed": "Falhou",
+    "resetDone": "Resetado!",
+    "omnirouteConfiguredOpenAiCompatible": "OmniRoute está configurado como provedor compatível com OpenAI",
+    "provider": "Provedor",
+    "model": "Modelo",
+    "providers": "Provedores",
+    "auth": "Autenticação",
+    "noApiKeysAvailable": "Nenhuma chave de API disponível",
+    "usingDefaultOmniroute": "Usando padrão: sk_omniroute",
+    "updateConfig": "Atualizar config",
+    "applyConfig": "Aplicar config",
+    "noBackupsAvailable": "Nenhum backup disponível.",
+    "profileSaved": "Perfil \"{name}\" salvo!",
+    "failedSaveProfile": "Falha ao salvar perfil",
+    "profileActivated": "Perfil ativado!",
+    "failedActivateProfile": "Falha ao ativar perfil",
+    "profiles": "Perfis",
+    "savedProfiles": "Perfis salvos",
+    "noProfilesYet": "Nenhum perfil salvo ainda. Salve a configuração atual como perfil abaixo.",
+    "activate": "Ativar",
+    "deleteProfile": "Excluir perfil",
+    "profileNamePlaceholder": "Nome do perfil (ex: Conta Pessoal)",
+    "saveCurrent": "Salvar atual",
+    "codexAuthNotePrefix": "Codex usa",
+    "codexAuthNoteMiddle": "com",
+    "codexAuthNoteSuffix": "Clique em \"Aplicar\" para configurar automaticamente.",
+    "claudeManualConfiguration": "Claude CLI - Configuração manual",
+    "codexManualConfiguration": "Codex CLI - Configuração manual",
+    "droidManualConfiguration": "Factory Droid - Configuração manual",
+    "openClawManualConfiguration": "Open Claw - Configuração manual",
+    "clineManualConfiguration": "Configuração manual do Cline",
+    "kiloManualConfiguration": "Configuração manual do Kilo Code",
+    "whenToUseLabel": "Quando usar",
+    "openToolDocs": "Abrir documentos de ferramentas",
+    "toolUseCases": {
+      "claude": "Use quando desejar fluxos de trabalho de planejamento robustos e refatorações longas de vários arquivos com Claude Code.",
+      "codex": "Use quando sua equipe estiver padronizada em fluxos OpenAI Codex CLI e autenticação baseada em perfil.",
+      "droid": "Use quando precisar de um agente de terminal leve focado em codificação rápida e loops de execução de comandos.",
+      "openclaw": "Use quando desejar um agente de codificação no estilo Open Claw, mas roteado por meio de políticas OmniRoute.",
+      "cline": "Use quando você configura agentes de codificação dentro de editores e deseja configuração guiada com modelos OmniRoute.",
+      "kilo": "Use quando seu fluxo de trabalho depender de comandos Kilo Code e edições iterativas rápidas.",
+      "cursor": "Use ao codificar no Cursor e você precisar de modelos personalizados compatíveis com OpenAI por meio do OmniRoute.",
+      "continue": "Use ao executar Continue em IDEs e você precisar de uma configuração de provedor portátil baseada em JSON.",
+      "opencode": "Use quando preferir execuções de agentes nativos de terminal e automação com script via OpenCode.",
+      "kiro": "Use ao integrar o Kiro e controlar o roteamento do modelo centralmente no OmniRoute.",
+      "windsurf": "Use when you want an AI-first IDE with Codeium/Windsurf models routed through OmniRoute.",
+      "antigravity": "Use quando o tráfego Antigravity/Kiro deve ser interceptado através do MITM e roteado para OmniRoute.",
+      "copilot": "Use quando desejar UX no estilo de bate-papo do Copilot enquanto impõe chaves OmniRoute e regras de roteamento.",
+      "amp": "Use when you want Amp CLI routed through OmniRoute with stable shorthand aliases and OpenAI-compatible setup.",
+      "qwen": "Use quando precisar do Alibaba Qwen Code CLI para tarefas de programação.",
+      "hermes": "Use quando precisar de um assistente leve de IA nativo do terminal para tarefas rápidas.",
+      "hermes-agent": "Use quando precisar do Hermes Agent (pela Nousresearch) com modelos padrão, delegação, visão e auxiliares roteados pelo OmniRoute.",
+      "custom": "Use quando seu CLI ou SDK não estiver hardcoded no OmniRoute, mas ainda aceitar base URL, chave de API e model string compatíveis com OpenAI."
+    },
+    "toolDescriptions": {
+      "antigravity": "Google Antigravity IDE com MITM",
+      "claude": "CLI Claude Code da Anthropic",
+      "codex": "CLI Codex da OpenAI",
+      "droid": "Assistente de IA Factory Droid",
+      "openclaw": "Assistente de IA Open Claw",
+      "cline": "CLI assistente de codificação Cline",
+      "kilo": "CLI assistente de IA Kilo Code",
+      "cursor": "Editor de código com IA Cursor",
+      "continue": "Assistente de IA Continue",
+      "opencode": "OpenCode AI coding agent (Terminal)",
+      "kiro": "Amazon Kiro — IDE com IA",
+      "windsurf": "Windsurf — Editor de Código com IA",
+      "copilot": "GitHub Copilot — Assistente de IA",
+      "qwen": "Alibaba Qwen Code CLI",
+      "amp": "CLI do assistente de codificação Sourcegraph Amp",
+      "hermes": "Assistente de Terminal Hermes AI",
+      "hermes-agent": "Hermes Agent (by Nousresearch) - IA de terminal avançada com suporte multi-modelo (delegação, visão, compressão, etc.)",
+      "custom": "Gerador genérico de configuração para CLI ou SDK OpenAI-compatible"
+    },
+    "guides": {
+      "cursor": {
+        "notes": {
+          "0": "Requer conta Cursor Pro para usar este recurso.",
+          "1": "O Cursor roteia requisições pelo próprio servidor, então endpoint local não é suportado. Ative o Cloud Endpoint em Configurações."
+        },
+        "steps": {
+          "1": {
+            "title": "Abrir Configurações",
+            "desc": "Vá em Configurações -> Modelos"
+          },
+          "2": {
+            "title": "Ativar OpenAI API",
+            "desc": "Ative a opção \"OpenAI API key\""
+          },
+          "3": {
+            "title": "URL Base"
+          },
+          "4": {
+            "title": "Chave de API"
+          },
+          "5": {
+            "title": "Adicionar Modelo Customizado",
+            "desc": "Clique em \"View All Model\" -> \"Add Custom Model\""
+          },
+          "6": {
+            "title": "Selecionar Modelo"
+          }
+        }
+      },
+      "continue": {
+        "steps": {
+          "1": {
+            "title": "Abrir Config",
+            "desc": "Abra o arquivo de configuração do Continue"
+          },
+          "2": {
+            "title": "Chave de API"
+          },
+          "3": {
+            "title": "Selecionar Modelo"
+          },
+          "4": {
+            "title": "Adicionar Config de Modelo",
+            "desc": "Adicione a configuração abaixo ao array de modelos:"
+          }
+        },
+        "notes": {
+          "0": "Continuar usa o arquivo de configuração JSON."
+        }
+      },
+      "opencode": {
+        "steps": {
+          "1": {
+            "title": "Install OpenCode",
+            "desc": "Install via npm: npm install -g opencode-ai"
+          },
+          "2": {
+            "title": "API Key"
+          },
+          "3": {
+            "title": "Set Base URL",
+            "desc": "opencode config set baseUrl {baseUrl}"
+          },
+          "4": {
+            "title": "Select Model"
+          },
+          "5": {
+            "title": "Use Thinking Variant",
+            "desc": "For thinking models, run with --variant high/low/max (example command below)."
+          }
+        },
+        "notes": {
+          "0": "OpenCode requer configuração de chave API.",
+          "1": "Configure a URL base para seu endpoint do OmniRoute."
+        }
+      },
+      "kiro": {
+        "steps": {
+          "1": {
+            "title": "Open Kiro Settings",
+            "desc": "Go to Settings → AI Provider"
+          },
+          "2": {
+            "title": "Base URL",
+            "desc": "Paste your OmniRoute endpoint URL"
+          },
+          "3": {
+            "title": "API Key"
+          },
+          "4": {
+            "title": "Select Model"
+          }
+        },
+        "notes": {
+          "0": "Kiro requer uma conta Amazon."
+        }
+      },
+      "windsurf": {
+        "steps": {
+          "1": {
+            "title": "Open AI Settings",
+            "desc": "Click the AI Settings icon in Windsurf or go to Settings"
+          },
+          "2": {
+            "title": "Add Custom Provider",
+            "desc": "Select \"Add custom provider\" (OpenAI-compatible)"
+          },
+          "3": {
+            "title": "Base URL",
+            "desc": "http://127.0.0.1:20128/v1"
+          },
+          "4": {
+            "title": "API Key",
+            "desc": "Select your OmniRoute API key"
+          },
+          "5": {
+            "title": "Select Model",
+            "desc": "Choose a model from the dropdown"
+          }
+        }
+      }
+    },
+    "autoConfiguredTab": "Auto-configurados",
+    "toolCategoriesDesc": "Agrupe CLIs pelo modo como o OmniRoute os configura ou intercepta para deixar esta página mais fácil de escanear.",
+    "allToolsTab": "Todas as ferramentas",
+    "guidedClientsTab": "Clientes guiados",
+    "mitmClientsTab": "Clientes MITM",
+    "customCliTab": "Custom CLI",
+    "toolCategories": "Categorias de Ferramentas",
+    "visibleToolsCount": "{count} ferramentas visíveis",
+    "customCliBuilderTitle": "Construtor CLI compatível com OpenAI",
+    "customCliBuilderDescription": "Gere env vars e snippets JSON para qualquer CLI ou SDK que aceite um URL base, chave de API e ID de modelo compatível com OpenAI.",
+    "customCliNoModels": "Conecte pelo menos um provedor para preencher os seletores de modelo.",
+    "customCliNameLabel": "Nome da CLI",
+    "customCliNamePlaceholder": "por exemplo Minha equipe CLI",
+    "customCliDefaultModelLabel": "Modelo padrão",
+    "customCliDefaultModelHelp": "Use qualquer ID de modelo ou combinação do OmniRoute. A maioria das CLIs compatíveis com OpenAI só precisa da URL base /v1 mais uma string de modelo.",
+    "customCliKeyHelper": "Para instalações locais, o OmniRoute pode usar sk_omniroute. No modo nuvem, escolha uma das suas chaves de API de gerenciamento.",
+    "customCliAliasMappingsLabel": "Mapeamentos de alias",
+    "customCliAliasMappingsHelp": "Aliases auxiliares opcionais para scripts wrapper ou arquivos de configuração que desejam nomes abreviados estáveis.",
+    "customCliAddAlias": "Adicionar alias",
+    "customCliNoMappings": "Ainda não há mapeamentos de alias. Adicione um se seu wrapper ou scripts de equipe usarem nomes abreviados estáveis.",
+    "customCliAliasPlaceholder": "por exemplo revisão",
+    "customCliTargetModelLabel": "Modelo de destino",
+    "customCliEndpointHintLabel": "Como conectar o endpoint",
+    "customCliEndpointHint": "Aponte qualquer cliente compatível com OpenAI para a URL base OmniRoute /v1. O endpoint bruto de conclusões do chat é {endpoint}. Use o bloco JSON quando a ferramenta desejar um objeto provedor ou o script env quando ler variáveis ​​OPENAI_*.",
+    "customCliEnvBlockTitle": "Fragmento de ambiente/shell",
+    "customCliJsonBlockTitle": "Bloco JSON do provedor",
+    "copilotConfigGenerator": "Gerador de configuração do GitHub Copilot",
+    "copilotApiKey": "Chave de API",
+    "copilotFilterModelsPlaceholder": "Filtrar modelos...",
+    "copilotMaxInputTokens": "Máximo de tokens de entrada",
+    "copilotMaxOutputTokens": "Máximo de tokens de saída",
+    "copilotToolCalling": "Chamada de ferramenta",
+    "copilotPasteInto": "Cole em: ",
+    "wireApiChatCompletions": "Conclusões de bate-papo (/chat/completions)",
+    "wireApiResponses": "API de respostas (/respostas)"
+  },
+  "combos": {
+    "title": "Combos",
+    "description": "Crie combos de modelos com roteamento ponderado e suporte a fallback",
+    "autoCatalogTitle": "Catálogo de roteamento automático",
+    "autoCatalogTemplateCount": "{count} modelos",
+    "autoCatalogDescription": "Combos automáticos/* integrados resolvidos dinamicamente a partir de provedores conectados. Use qualquer um desses IDs como campo de modelo — nenhuma configuração é necessária.",
+    "autoCatalogExpand": "Expanda o catálogo de roteamento automático",
+    "autoCatalogCollapse": "Recolher catálogo de roteamento automático",
+    "createCombo": "Criar Combo",
+    "editCombo": "Editar Combo",
+    "deleteCombo": "Excluir Combo",
+    "noModels": "Sem modelos",
+    "noModelsYet": "Nenhum modelo adicionado",
+    "addModel": "Adicionar Modelo",
+    "addModelToCombo": "Adicionar Modelo ao Combo",
+    "routingStrategy": "Estratégia de Roteamento",
+    "maxRetries": "Máximo de Tentativas",
+    "timeout": "Timeout (ms)",
+    "healthcheck": "Verificação de Saúde",
+    "priority": "Prioridade",
+    "fallback": "Fallback",
+    "roundRobin": "Round Robin",
+    "random": "Aleatório",
+    "leastLatency": "Menor Latência",
+    "comboName": "Nome do Combo",
+    "comboNamePlaceholder": "meu-combo",
+    "comboDescription": "__MISSING__:Description",
+    "comboDescriptionPlaceholder": "__MISSING__:Optional note describing this combo",
+    "deleteConfirm": "Excluir este combo?",
+    "noCombosYet": "Nenhum combo ainda",
+    "comboCreated": "Combo criado com sucesso",
+    "comboUpdated": "Combo atualizado com sucesso",
+    "comboDeleted": "Combo excluído",
+    "failedCreate": "Falha ao criar combo",
+    "failedUpdate": "Falha ao atualizar combo",
+    "errorCreating": "Erro ao criar combo",
+    "errorUpdating": "Erro ao atualizar combo",
+    "errorDeleting": "Erro ao excluir combo",
+    "testFailed": "Requisição de teste falhou",
+    "failedToggle": "Falha ao alternar combo",
+    "testResults": "Resultados do Teste — {name}",
+    "resolvedBy": "Resolvido por:",
+    "more": "+{count} mais",
+    "reqs": "reqs",
+    "success": "sucesso",
+    "proxyConfigured": "Proxy configurado",
+    "copyComboName": "Copiar nome do combo",
+    "enableCombo": "Ativar combo",
+    "disableCombo": "Desativar combo",
+    "testCombo": "Testar combo",
+    "duplicate": "Duplicar",
+    "proxyConfig": "Configuração de proxy",
+    "nameRequired": "Nome é obrigatório",
+    "nameInvalid": "Apenas letras, números, -, _, / e . permitidos",
+    "nameHint": "Letras, números, -, _, / e . permitidos",
+    "priorityDesc": "Fallback sequencial: tenta modelo 1 primeiro, depois 2, etc.",
+    "weightedDesc": "Distribui tráfego por porcentagem de peso com fallback",
+    "roundRobinDesc": "Distribuição circular: cada requisição vai para o próximo modelo na rotação",
+    "contextRelay": "Context Relay",
+    "contextRelayDesc": "Preserva a continuidade da sessão com resumos de handoff quando as contas giram",
+    "randomDesc": "Seleção aleatória uniforme, depois fallback para modelos restantes",
+    "leastUsedDesc": "Escolhe o modelo com menos requisições, equilibrando carga ao longo do tempo",
+    "costOptimizedDesc": "Roteia para o modelo mais barato primeiro baseado em preços",
+    "resetAware": "RR com reconhecimento de redefinição",
+    "resetAwareDesc": "Equilibra a cota restante com redefinições de 5h e semanais e, em seguida, faz um round-robin de pontuações semelhantes",
+    "strictRandom": "Aleatório Estrito",
+    "strictRandomDesc": "Baralho embaralhado — usa cada modelo uma vez antes de reembaralhar",
+    "fusion": "__MISSING__:Fusion",
+    "fusionDesc": "__MISSING__:Fans the prompt to every panel model in parallel, then a judge model synthesizes one final answer",
+    "models": "Modelos",
+    "autoBalance": "Auto-balancear",
+    "advancedSettings": "Configurações Avançadas",
+    "retryDelay": "Intervalo de Tentativa (ms)",
+    "concurrencyPerModel": "Concorrência / Modelo",
+    "queueTimeout": "Timeout da Fila (ms)",
+    "contextRelayHandoffThreshold": "Limite de Handoff",
+    "contextRelayHandoffThresholdHelp": "Quando o uso de quota atinge este limite, o OmniRoute gera um resumo estruturado antes de a conta ativa esgotar.",
+    "contextRelayMaxMessages": "Máx. de Mensagens no Resumo",
+    "contextRelayMaxMessagesHelp": "Limita quanto histórico recente será condensado no resumo de relay.",
+    "contextRelaySummaryModel": "Modelo do Resumo",
+    "contextRelaySummaryModelHelp": "Modelo opcional usado apenas para gerar o resumo de handoff. Deixe vazio para reutilizar o modelo ativo do combo.",
+    "contextRelayProviderNote": "O Context Relay atualmente gera handoffs para rotação de contas Codex. Combine com múltiplas contas do mesmo provedor para melhor continuidade.",
+    "advancedHint": "Deixe vazio para usar padrões globais. Estes substituem configurações por provedor.",
+    "failoverBeforeRetry": "Failover antes de tentar novamente",
+    "maxSetRetries": "Máximo de tentativas definidas",
+    "setRetryDelayMs": "Definir atraso de nova tentativa (ms)",
+    "moveUp": "Mover para cima",
+    "moveDown": "Mover para baixo",
+    "removeModel": "Remover",
+    "saving": "Salvando...",
+    "weighted": "Ponderado",
+    "leastUsed": "Menos Usado",
+    "costOpt": "Custo-Otim",
+    "strategyGuideTitle": "Como usar esta estratégia",
+    "strategyGuideWhen": "Quando usar",
+    "strategyGuideAvoid": "Evite quando",
+    "strategyGuideExample": "Exemplo",
+    "strategyGuide": {
+      "priority": {
+        "when": "Você tem um modelo principal e quer fallback apenas em falha.",
+        "avoid": "Você precisa distribuir requisições entre modelos.",
+        "example": "Modelo principal para código e backup mais barato para indisponibilidade."
+      },
+      "weighted": {
+        "when": "Você precisa dividir tráfego com percentuais controlados.",
+        "avoid": "Você não consegue manter os pesos atualizados.",
+        "example": "80% modelo estável + 20% modelo canário."
+      },
+      "round-robin": {
+        "when": "Você quer distribuição previsível e equilibrada.",
+        "avoid": "Os modelos têm custo ou latência muito diferentes.",
+        "example": "Mesmo modelo em múltiplas contas para espalhar throughput."
+      },
+      "random": {
+        "when": "Você quer distribuição simples com baixa configuração.",
+        "avoid": "Você precisa de garantias rígidas de distribuição.",
+        "example": "Protótipos rápidos com modelos equivalentes."
+      },
+      "least-used": {
+        "when": "Você quer balanceamento adaptativo baseado no uso recente.",
+        "avoid": "Seu volume é baixo e não se beneficia dessa adaptação.",
+        "example": "Workloads mistos onde um modelo tende a ficar sobrecarregado."
+      },
+      "cost-optimized": {
+        "when": "Redução de custo é a prioridade principal.",
+        "avoid": "A base de preços está ausente ou desatualizada.",
+        "example": "Jobs em lote ou segundo plano focados em menor custo."
+      },
+      "reset-aware": {
+        "when": "Você roteia várias contas com telemetria de cota e diferentes janelas de redefinição.",
+        "avoid": "A telemetria de cota não está disponível para a maioria das contas.",
+        "example": "Prefira uma redefinição semanal de 60% da conta amanhã a uma redefinição de 80% da conta mais tarde."
+      },
+      "strict-random": {
+        "when": "Você quer distribuição perfeitamente uniforme — cada modelo é usado uma vez antes de repetir.",
+        "avoid": "Os modelos têm qualidade ou latência muito diferentes e a ordem importa.",
+        "example": "Múltiplas contas do mesmo modelo para distribuir uso de forma equilibrada."
+      },
+      "p2c": {
+        "when": "Use when you want low-latency selection using Power-of-Two-Choices algorithm.",
+        "avoid": "Avoid for small combos with 2 or fewer models — no benefit over round-robin.",
+        "example": "Example: High-throughput inference across 4+ equivalent model endpoints."
+      },
+      "context-relay": {
+        "when": "Use when long sessions must survive account rotation without losing the working context.",
+        "avoid": "Avoid when account switching is rare or when you do not want extra summarization requests.",
+        "example": "Example: Codex sessions that rotate across multiple accounts near quota exhaustion."
+      },
+      "fill-first": {
+        "when": "Use quando quiser esgotar totalmente a cota de um provedor antes de passar para o próximo.",
+        "avoid": "Evite quando precisar de balanceamento de carga em nível de solicitação entre provedores.",
+        "example": "Exemplo: Use todos os créditos Deepgram de $ 200 antes de voltar para Groq."
+      },
+      "auto": {
+        "when": "Use quando precisar de roteamento de pontuação multifatorial com base em custo, latência e qualidade.",
+        "avoid": "Evite quando precisar de ordem de prioridade estrita ou persistência histórica.",
+        "example": "Exemplo: equilibre solicitações entre modelos com diferentes intensidades."
+      },
+      "lkgp": {
+        "when": "Use quando desejar rotear com base em taxas de sucesso e desempenho históricos.",
+        "avoid": "Evite quando os dados históricos são limitados ou não confiáveis.",
+        "example": "Exemplo: Direcione para modelos com bom histórico em tarefas específicas."
+      },
+      "context-optimized": {
+        "when": "Use quando precisar otimizar o uso da janela de contexto entre modelos.",
+        "avoid": "Evite quando os modelos têm comprimentos de contexto semelhantes ou as tarefas são simples.",
+        "example": "Exemplo: Distribua longas conversas entre modelos com janelas de contexto maiores."
+      }
+    },
+    "advancedHelp": {
+      "maxRetries": "Quantas tentativas serão feitas antes de falhar a requisição.",
+      "retryDelay": "Espera inicial entre tentativas. Valores maiores reduzem picos.",
+      "timeout": "Tempo máximo da requisição antes de cancelar.",
+      "healthcheck": "Ignora modelos/provedores não saudáveis no roteamento.",
+      "concurrencyPerModel": "Máximo de requisições simultâneas por modelo no round-robin.",
+      "queueTimeout": "Tempo máximo em fila antes de expirar no round-robin.",
+      "failoverBeforeRetry": "Quando ativado, qualquer erro upstream aciona o failover imediato para o próximo destino combinado, ignorando todas as novas tentativas e URLs substitutos.",
+      "maxSetRetries": "Número de vezes para tentar novamente o destino completo definido quando todos os alvos falharem. 0 = nenhuma nova tentativa de nível definido.",
+      "setRetryDelayMs": "Atraso entre novas tentativas de nível definido, dando tempo para que problemas transitórios sejam resolvidos."
+    },
+    "templatesTitle": "Templates rápidos",
+    "templatesDescription": "Aplique um perfil inicial e depois ajuste modelos e configuração.",
+    "templateApply": "Aplicar template",
+    "templateHighAvailability": "Alta disponibilidade",
+    "templateHighAvailabilityDesc": "Roteamento por prioridade com healthcheck e retries seguros.",
+    "templateCostSaver": "Economia de custo",
+    "templateCostSaverDesc": "Roteamento custo-otimizado para workloads com foco em orçamento.",
+    "templateBalanced": "Carga balanceada",
+    "templateBalancedDesc": "Roteamento por menos uso para distribuir demanda ao longo do tempo.",
+    "usageGuideHide": "Ocultar",
+    "usageGuideDontShowAgain": "Não mostrar novamente",
+    "usageGuideShow": "Mostrar guia",
+    "quickTestTitle": "Combo pronto para validar",
+    "quickTestDescription": "Rode um teste agora para confirmar fallback e latência.",
+    "testNow": "Testar agora",
+    "pricingCoverage": "Cobertura de preços",
+    "pricingCoverageHint": "Custo-otimizado funciona melhor quando todos os modelos têm preço configurado.",
+    "pricingAvailable": "Preço disponível",
+    "pricingMissing": "Sem preço",
+    "pricingAvailableShort": "com-preço",
+    "pricingMissingShort": "sem-preço",
+    "warningRoundRobinSingleModel": "Round-robin é mais útil com pelo menos 2 modelos.",
+    "warningCostOptimizedPartialPricing": "Apenas {priced} de {total} modelos têm preço. O roteamento pode ficar parcialmente orientado a custo.",
+    "warningCostOptimizedNoPricing": "Não há dados de preço para este combo. Custo-otimizado pode rotear de forma inesperada.",
+    "filterAll": "All",
+    "filterIntelligent": "Intelligent",
+    "filterDeterministic": "Deterministic",
+    "filterEmptyTitle": "No combos match this strategy filter.",
+    "filterEmptyIntelligentDescription": "Create an auto or LKGP combo to populate the intelligent routing dashboard.",
+    "filterEmptyDeterministicDescription": "Only auto and LKGP combos exist right now. Switch back to All or create a deterministic combo.",
+    "readinessTitle": "Pronto para salvar?",
+    "readinessDescription": "Revise a lista de verificação antes de criar ou atualizar este combo.",
+    "readinessCheckName": "O nome do combo é válido",
+    "readinessCheckModels": "Pelo menos um modelo está selecionado",
+    "readinessCheckWeights": "O total dos pesos é 100%",
+    "readinessCheckWeightsOptional": "Regra de pesos não obrigatória",
+    "readinessCheckPricing": "Dados de preços disponíveis",
+    "readinessCheckPricingOptional": "Regra de preços não obrigatória",
+    "saveBlockedTitle": "O salvamento está bloqueado até corrigir os itens abaixo:",
+    "saveBlockName": "Defina um nome para o combo.",
+    "saveBlockModels": "Adicione pelo menos um modelo.",
+    "saveBlockWeighted": "Ajuste os pesos para 100% (atual: {total}%).",
+    "saveBlockPricing": "Adicione preço para pelo menos um modelo ou escolha outra estratégia.",
+    "recommendationsLabel": "Recommended setup",
+    "applyRecommendations": "Apply recommendations",
+    "recommendationsUpdated": "Recommendations updated for {strategy}.",
+    "recommendationsApplied": "Recommendations applied to this combo.",
+    "intelligentPanelTitle": "Intelligent Routing Dashboard",
+    "intelligentPanelDesc": "Real-time scoring and health status for this auto-routing combo.",
+    "configOnlyStatus": "Visualização de Configuração",
+    "configOnlyHint": "Este painel mostra apenas as entradas de roteamento. O estado em tempo real do disjuntor está disponível na página de Saúde.",
+    "routingInputs": "Entradas de Roteamento",
+    "routingInputsHint": "Pacote de modo e ponderação ficam aqui; o estado em tempo real do disjuntor fica na página de Saúde.",
+    "emailVisibilityHint": "Os emails da conta aqui seguem a opção de privacidade global.",
+    "emailVisibilityTooltip": "Use o ícone de olho para revelar ou ocultar os emails da conta globalmente nas telas de combos, provedores e cotas.",
+    "manualModel": "Modelo manual",
+    "manualModelInvalid": "Insira um modelo como provedor/modelo.",
+    "manualModelUnknownProvider": "Prefixo de provedor desconhecido.",
+    "builderDynamicAccountShort": "Conta dinâmica",
+    "builderNeedValidName": "Defina um nome de combo válido antes de continuar.",
+    "statusOverview": "Status Overview",
+    "normalOperation": "Normal Operation",
+    "allProvidersHealthy": "Providers are reporting healthy routing conditions.",
+    "incidentMode": "Incident Mode",
+    "highCircuitBreakerRate": "High circuit breaker trip rate detected.",
+    "activeModePack": "Active Mode Pack",
+    "modePackUpdated": "Mode pack updated to {pack}.",
+    "modePackHint": "Switch presets to bias the routing engine without rebuilding the combo.",
+    "providerScores": "Provider Scores",
+    "allProvidersEvaluated": "No candidate pool configured. All active providers are evaluated at runtime.",
+    "excludedProviders": "Excluded Providers",
+    "excludedProvidersHint": "Providers with an OPEN circuit breaker are temporarily excluded from routing.",
+    "noExcludedProviders": "No providers are currently excluded.",
+    "cooldownMinutes": "Cooldown: {minutes}m",
+    "builderIntelligentTitle": "Intelligent Routing Configuration",
+    "builderIntelligentDesc": "Configure the multi-factor scoring engine for this auto-routing combo.",
+    "candidatePoolLabel": "Candidate Pool",
+    "candidatePoolHint": "Select which providers this engine should evaluate. Leave empty to use all active providers.",
+    "candidatePoolEmpty": "No active providers available yet.",
+    "candidatePoolAllProviders": "All providers",
+    "modePackLabel": "Mode Pack",
+    "routerStrategyLabel": "Router Strategy",
+    "strategyRules": "Rules (6-Factor Scoring)",
+    "explorationRateLabel": "Exploration Rate",
+    "explorationRateHint": "{percent}% of requests can explore non-optimal providers.",
+    "budgetCapLabel": "Budget Cap (USD / request)",
+    "budgetCapPlaceholder": "No limit",
+    "advancedWeightsTitle": "Advanced: Scoring Weights",
+    "weightQuota": "Quota",
+    "weightHealth": "Health",
+    "weightCostInv": "Cost",
+    "weightLatencyInv": "Latency",
+    "weightTaskFit": "Task Fit",
+    "weightStability": "Stability",
+    "weightTierPriority": "Tier",
+    "reviewIntelligentTitle": "Intelligent Routing Config",
+    "strategyRecommendations": {
+      "priority": {
+        "title": "Fail-safe básico",
+        "description": "Use um modelo principal e mantenha a cadeia de fallback curta e confiável.",
+        "tip1": "Coloque o modelo mais confiável em primeiro.",
+        "tip2": "Mantenha 1-2 modelos de backup com qualidade similar.",
+        "tip3": "Use retries seguros para absorver falhas transitórias do provedor."
+      },
+      "weighted": {
+        "title": "Divisão controlada de tráfego",
+        "description": "Ótimo para rollouts canário e migração gradual entre modelos.",
+        "tip1": "Comece com divisão conservadora tipo 90/10.",
+        "tip2": "Mantenha o total em 100% e rebalanceie após mudanças.",
+        "tip3": "Monitore sucesso e latência antes de aumentar o peso canário."
+      },
+      "round-robin": {
+        "title": "Distribuição previsível de carga",
+        "description": "Melhor quando os modelos são equivalentes e você precisa de distribuição uniforme.",
+        "tip1": "Use pelo menos 2 modelos.",
+        "tip2": "Configure limites de concorrência para evitar sobrecarga.",
+        "tip3": "Use timeout de fila para falhar rápido sob saturação."
+      },
+      "random": {
+        "title": "Distribuição rápida com baixa configuração",
+        "description": "Use quando precisar de distribuição simples sem garantias rígidas.",
+        "tip1": "Use modelos com perfis de latência semelhantes.",
+        "tip2": "Mantenha retries habilitados para absorver falhas aleatórias.",
+        "tip3": "Prefira para experimentação, não para SLAs rígidos."
+      },
+      "least-used": {
+        "title": "Balanceamento adaptativo",
+        "description": "Roteia para modelos menos usados para reduzir hotspots ao longo do tempo.",
+        "tip1": "Funciona melhor sob tráfego contínuo.",
+        "tip2": "Combine com health checks para balanceamento mais seguro.",
+        "tip3": "Acompanhe uso por modelo para validar ganhos na distribuição."
+      },
+      "cost-optimized": {
+        "title": "Roteamento por orçamento",
+        "description": "Roteia para modelos mais baratos quando metadados de preço estão disponíveis.",
+        "tip1": "Garanta cobertura de preços para todos os modelos selecionados.",
+        "tip2": "Mantenha um fallback de qualidade para prompts difíceis.",
+        "tip3": "Use para jobs em lote/background onde custo é o KPI principal."
+      },
+      "reset-aware": {
+        "title": "Rotação de conta com reconhecimento de redefinição",
+        "description": "Equilibra a cota restante do provedor em relação ao tempo de redefinição.",
+        "tip1": "Use etapas de conta explícitas ou roteamento de tags de conta para provedores com telemetria de cota.",
+        "tip2": "Ajuste a sessão versus pesos semanais quando a exaustão de curto prazo for mais arriscada.",
+        "tip3": "Mantenha a faixa de amarração pequena para que contas equivalentes ainda girem de forma justa."
+      },
+      "strict-random": {
+        "title": "Distribuição estritamente uniforme",
+        "description": "Cada modelo é usado exatamente uma vez antes de reembaralhar o baralho.",
+        "tip1": "Ideal para múltiplas contas do mesmo modelo.",
+        "tip2": "Garante que nenhuma conta é repetida antes de todas serem usadas.",
+        "tip3": "Combine com health checks para pular contas indisponíveis sem quebrar o ciclo."
+      },
+      "fill-first": {
+        "description": "Esgotar as cotas do provedor sequencialmente antes de voltar atrás.",
+        "tip1": "Use para roteamento baseado em cotas com cadeias de fallback claras.",
+        "tip2": "Defina cotas com precisão para evitar retrocessos prematuros.",
+        "tip3": "Funciona melhor com provedores que oferecem níveis gratuitos ou pacotes de crédito.",
+        "title": "Esgotamento de cotas"
+      },
+      "auto": {
+        "description": "Rota baseada na pontuação em tempo real de custo, latência, qualidade e integridade.",
+        "tip1": "Deixe o motor equilibrar vários fatores automaticamente.",
+        "tip2": "Monitore quais fatores orientam as decisões de roteamento nos logs.",
+        "tip3": "Use para cargas de trabalho complexas onde nenhum fator único domina.",
+        "title": "Otimização multifatorial"
+      },
+      "lkgp": {
+        "description": "Rota baseada em desempenho histórico e padrões de sucesso.",
+        "tip1": "Requer histórico de solicitações suficiente para previsões precisas.",
+        "tip2": "Bom para cargas de trabalho com padrões de desempenho de modelo consistentes.",
+        "tip3": "Monitore a precisão da previsão e ajuste os pesos conforme necessário.",
+        "title": "Roteamento baseado em histórico"
+      },
+      "context-optimized": {
+        "description": "Otimize o roteamento com base no uso da janela de contexto e na eficiência do token.",
+        "tip1": "Encaminhe conversas longas para modelos com janelas de contexto maiores.",
+        "tip2": "Monitore a utilização do contexto para evitar desperdício de tokens.",
+        "tip3": "Melhor para IA conversacional que exige ampla retenção de contexto.",
+        "title": "Otimização de Contexto"
+      },
+      "context-relay": {
+        "description": "Melhor quando a rotação de conta é esperada e a próxima conta deve herdar um resumo de tarefa simplificado.",
+        "tip1": "Use com provedores que alternam contas para a mesma família de modelos.",
+        "tip2": "Defina o limite de transferência abaixo dos limites rígidos de cota para o tempo de geração do resumo.",
+        "tip3": "Defina um modelo de resumo dedicado apenas se o primário for muito caro ou instável.",
+        "title": "Prioridade de continuidade da sessão"
+      },
+      "p2c": {
+        "description": "Direcione para o provedor com a carga atual mais baixa com base em métricas em tempo real.",
+        "tip1": "Monitore as métricas de integridade do provedor para uma avaliação precisa da carga.",
+        "tip2": "Funciona melhor com pools de provedores homogêneos.",
+        "tip3": "Ajuste a sensibilidade para evitar oscilações durante picos de tráfego.",
+        "title": "Poder de Duas Escolhas"
+      }
+    },
+    "templateFreeStack": "Free Stack ($0)",
+    "templateFreeStackDesc": "Round-robin across all free providers: Kiro (Claude), Qoder (5 models), Qwen (4 models), Gemini CLI. Zero cost, never stops coding.",
+    "auto": "Auto Combo",
+    "autoDesc": "Pool de roteamento inteligente (Otimizado)",
+    "lkgp": "Modo LKGP",
+    "lkgpDesc": "Último Provedor Bom Conhecido (Resiliência previsível)",
+    "wizardGuideTitle": "Getting Started with Combos",
+    "wizardGuideDesc": "Create model combos to route AI traffic intelligently",
+    "wizardGuideHint": "or click + Create Combo above",
+    "createFirstCombo": "Create Your First Combo",
+    "wizardStep1Title": "Name Your Combo",
+    "wizardStep1Desc": "Give your combo a unique name to identify it in routing rules",
+    "wizardStep2Title": "Add Models",
+    "wizardStep2Desc": "Select AI models and arrange their fallback priority order",
+    "wizardStep3Title": "Choose Strategy",
+    "wizardStep3Desc": "Pick how requests are distributed across your models - 13 strategies available",
+    "wizardStep4Title": "Review & Save",
+    "wizardStep4Desc": "Review your configuration and activate the combo",
+    "emailVisibilityStateOn": "On",
+    "emailVisibilityStateOff": "Off",
+    "reorderHandle": "Drag to reorder",
+    "failedReorder": "Failed to reorder models",
+    "builderFlowTitle": "Combo Builder Flow",
+    "builderStage": {
+      "basics": {
+        "label": "Basics",
+        "description": "Name and starting template"
+      },
+      "steps": {
+        "label": "Steps",
+        "description": "Provider, model, and account selection"
+      },
+      "strategy": {
+        "label": "Strategy",
+        "description": "Routing behavior and advanced settings"
+      },
+      "intelligent": {
+        "label": "Smart Routing",
+        "description": "Auto-routing candidate pool, presets, and scoring"
+      },
+      "review": {
+        "label": "Review",
+        "description": "Final validation before saving"
+      }
+    },
+    "builderStageVisited": "Stage completed",
+    "builderStageCurrent": "Current stage",
+    "builderStagePending": "Pending",
+    "builderStageLocked": "Locked — complete previous stage first",
+    "builderTitle": "Build a Combo",
+    "builderBrowseCatalog": "Browse catalog",
+    "builderProvider": "Provider",
+    "builderLoadingProviders": "Loading providers...",
+    "builderSelectProvider": "Select provider",
+    "builderModel": "Model",
+    "builderSelectModel": "Select model",
+    "builderProviderFirst": "Pick provider first",
+    "builderAccount": "Account",
+    "builderPreview": "Preview",
+    "builderAddStep": "Add step",
+    "builderDuplicateExact": "Esta etapa exata de provedor/modelo/conta já está no combo.",
+    "builderComboRef": "Combo Ref",
+    "builderAddComboRef": "Add combo reference",
+    "builderComboRefStep": "Add combo reference",
+    "builderPinnedAccount": "Pinned Account",
+    "builderLegacyEntry": "Legacy entry",
+    "reviewName": "Name",
+    "reviewStrategy": "Strategy",
+    "reviewSteps": "Steps",
+    "reviewAccounts": "Accounts",
+    "reviewProviders": "Providers",
+    "reviewComboRefs": "Combo References",
+    "reviewAdvanced": "Advanced Settings",
+    "reviewAgentFlags": "Agent Flags",
+    "reviewSequence": "Model Sequence",
+    "reviewNoSteps": "No steps configured",
+    "builderStagesDescription": "Conclua cada etapa para definir combos, construir etapas, selecionar estratégia de roteamento e revisar resultados.",
+    "builderStepsDescription": "Crie cada etapa do combo em ordem: provedor, modelo e conta. Isso permite reutilizar o mesmo provedor e modelo em contas diferentes.",
+    "selectProvider": "Selecione o provedor",
+    "selectProviderPlaceholder": "Selecione um provedor",
+    "selectModel": "Selecione o modelo",
+    "selectModelPlaceholder": "Selecione um provedor primeiro",
+    "selectAccount": "Selecione a conta",
+    "selectComboToReference": "Selecione o combo para referência",
+    "comboReference": "Referência de combinação",
+    "addComboReference": "Adicionar referência de combinação",
+    "addStepBeforeContinue": "Adicione pelo menos uma etapa antes de prosseguir para a próxima etapa.",
+    "previewNextStep": "Pré-visualizar o próximo passo",
+    "autoSelectAccount": "Selecionar conta automaticamente em tempo de execução",
+    "modePackBalanced": "Equilibrado",
+    "modePackBudget": "Orçamento",
+    "modePackPerformance": "Desempenho",
+    "modePackCustom": "Personalizado",
+    "browseLegacyCatalog": "Navegue pelo catálogo combinado legado",
+    "agentFeaturesTitle": "Recursos do agente",
+    "agentFeaturesDescription": "Habilite recursos avançados para agentes usando esta combinação",
+    "agentFeaturesSystemMessageOverride": "Substituir mensagem do sistema",
+    "agentFeaturesSystemMessagePlaceholder": "Você é um assistente especialista...",
+    "agentFeaturesSystemMessageHint": "Substituição de mensagens do sistema para agentes",
+    "agentFeaturesToolFilterRegex": "/padrão-regex/",
+    "agentFeaturesToolFilterHint": "Regex de filtro de ferramenta para agentes",
+    "agentFeaturesContextCacheHint": "Habilitar cache no contexto para ferramentas de agente",
+    "agentFeaturesContextCacheProtection": "Proteja o cache contra mutações da ferramenta do agente",
+    "agentFeaturesContextLength": "Comprimento do contexto",
+    "agentFeaturesContextLengthPlaceholder": "por exemplo 128.000",
+    "agentFeaturesContextLengthHint": "Define a janela de contexto para este combo em /v1/models.",
+    "agentFeaturesContextLengthErrorInteger": "O comprimento do contexto precisa ser um número inteiro válido",
+    "agentFeaturesContextLengthErrorRange": "O comprimento do contexto precisa estar entre 1.000 e 2.000.000",
+    "compressionOverride": "Substituição de compactação",
+    "modePack": "Pacote de modos"
   },
   "costs": {
     "title": "Custos",
@@ -2722,235 +2894,6 @@
     "showingCostRows": "Mostrando {shown} de {total} linhas correspondentes.",
     "showingTopCostRows": "Mostrando {shown} de {total} linhas correspondentes (top 50)."
   },
-  "cursorAuthModal": {
-    "title": "Conecte o Cursor IDE",
-    "autoDetecting": "Detecção automática de tokens...",
-    "readingFromCursor": "Lendo do Cursor IDE ou cursor-agent",
-    "tokensAutoDetected": "Tokens detectados automaticamente com sucesso no Cursor IDE!",
-    "cursorNotDetected": "Cursor IDE não detectado. Cole manualmente seu token.",
-    "accessToken": "Token de acesso",
-    "required": "*",
-    "accessTokenPlaceholder": "O token de acesso será preenchido automaticamente...",
-    "machineId": "ID da máquina",
-    "optional": "(opcional)",
-    "machineIdPlaceholder": "O ID da máquina será preenchido automaticamente...",
-    "importing": "Importando...",
-    "importToken": "Token de importação",
-    "cancel": "Cancelar",
-    "errorAutoDetect": "Não foi possível detectar tokens automaticamente",
-    "errorAutoDetectFailed": "Falha na detecção automática de tokens",
-    "errorEnterToken": "Por favor insira o token de acesso",
-    "errorImportFailed": "Falha na importação"
-  },
-  "docs": {
-    "title": "Documentação",
-    "quickStart": "Início Rápido",
-    "deploymentGuides": "Guias de implantação",
-    "features": "Recursos",
-    "supportedProviders": "Provedores Suportados",
-    "supportedProvidersToc": "Provedores",
-    "commonUseCases": "Casos de Uso Comuns",
-    "clientCompatibility": "Compatibilidade de Clientes",
-    "protocolsToc": "Protocolos",
-    "apiReference": "Referência da API",
-    "managementApiReference": "Management API Reference",
-    "managementApiDescription": "Automation endpoints for proxy registry, scope assignments, and legacy proxy migration.",
-    "method": "Método",
-    "path": "Caminho",
-    "notes": "Notas",
-    "modelPrefixes": "Prefixos de Modelo",
-    "prefix": "Prefixo",
-    "troubleshooting": "Solução de Problemas",
-    "supportsChat": "Suporta endpoints de chat e responses.",
-    "oauthAutoRefresh": "Conexão OAuth com atualização automática de token.",
-    "fullStreaming": "Suporte completo a streaming para todos os modelos.",
-    "docsLabel": "Docs",
-    "docsHeroDescription": "Gateway de IA para LLMs multi-provedor. Um endpoint para OpenAI, Anthropic, Gemini, GitHub Copilot, Claude Code, Cursor e mais de 20 provedores.",
-    "openDashboard": "Abrir Painel",
-    "endpointPage": "Página de Endpoint",
-    "github": "GitHub",
-    "reportIssue": "Reportar Problema",
-    "onThisPage": "Nesta página",
-    "documentationVersion": "Documentação - v{version}",
-    "quickStartStep1Title": "1. Instale e execute",
-    "quickStartStep1Prefix": "Execute",
-    "quickStartStep1Middle": "ou clone do GitHub e execute",
-    "quickStartStep2Title": "2. Crie uma chave de API",
-    "quickStartStep2Text": "Vá em Endpoint -> Chaves Registradas. Gere uma chave por ambiente.",
-    "quickStartStep3Title": "3. Conecte provedores",
-    "quickStartStep3Text": "Adicione contas de provedores via login OAuth, chave de API ou conexão automática de plano gratuito.",
-    "quickStartStep4Title": "4. Defina a URL base do cliente",
-    "quickStartStep4Prefix": "Aponte sua IDE ou cliente de API para",
-    "quickStartStep4Suffix": "Use prefixo de provedor, por exemplo",
-    "deploySetupTitle": "Guia de configuração",
-    "deploySetupText": "Instalação passo a passo, configuração do ambiente e instruções de primeira execução do OmniRoute.",
-    "deployElectronTitle": "Área de Trabalho Eletrônica",
-    "deployElectronText": "Execute o OmniRoute como um aplicativo de desktop nativo no Windows, macOS e Linux.",
-    "deployDockerTitle": "Docker",
-    "deployDockerText": "Implantação conteinerizada com Docker Compose; pronto para pilhas de produção e Kubernetes.",
-    "deployVmTitle": "Máquina Virtual",
-    "deployVmText": "Auto-hospedagem em qualquer VM Linux. Inclui unidade systemd, rotação de log e ferramentas de backup.",
-    "deployFlyTitle": "Voar.io",
-    "deployFlyText": "Implante no tempo de execução do Fly.io edge com um fly.toml e um único comando de implantação.",
-    "deployPwaTitle": "PWA",
-    "deployPwaText": "Instale o OmniRoute como um aplicativo da Web progressivo em navegadores Android, iOS e desktop.",
-    "deployTermuxTitle": "Termux (Android)",
-    "deployTermuxText": "Run OmniRoute headless on Android via Termux. Access the dashboard from your mobile browser.",
-    "featureRoutingTitle": "Roteamento Multi-Provedor",
-    "featureRoutingText": "Roteie requisições para mais de 30 provedores de IA por um único endpoint compatível com OpenAI. Suporta APIs de chat, responses, áudio e imagem.",
-    "featureCombosTitle": "Combos e Balanceamento",
-    "featureCombosText": "Crie combos de modelos com cadeias de fallback e estratégias de balanceamento: round-robin, prioridade, aleatório, menos usado e otimizado por custo.",
-    "featureUsageTitle": "Rastreamento de Uso e Custo",
-    "featureUsageText": "Contagem de tokens em tempo real, cálculo de custo por provedor/modelo e detalhamento de uso por chave de API e conta.",
-    "featureAnalyticsTitle": "Painel de Analytics",
-    "featureAnalyticsText": "Análises visuais com gráficos de requisições, tokens, erros, latência, custos e popularidade de modelos ao longo do tempo.",
-    "featureHealthTitle": "Monitoramento de Saúde",
-    "featureHealthText": "Health checks em tempo real, status de provedores, estados de circuit breaker e detecção automática de rate limit com backoff exponencial.",
-    "featureCliTitle": "Ferramentas CLI",
-    "featureCliText": "Gerencie configurações de IDE, exporte/importe backups, descubra perfis de codex e configure opções pelo painel.",
-    "featureSecurityTitle": "Segurança e Políticas",
-    "featureSecurityText": "Autenticação por chave de API, filtragem de IP, proteção contra prompt injection, políticas de domínio, gerenciamento de sessões e auditoria.",
-    "featureCloudSyncTitle": "Sincronização em Nuvem",
-    "featureCloudSyncText": "Sincronize sua configuração com Cloudflare Workers para acesso remoto com credenciais criptografadas e failover automático.",
-    "providersAcrossConnectionTypes": "{count} provedores em três tipos de conexão.",
-    "manageProviders": "Gerenciar Provedores",
-    "providersCount": "{count} provedores",
-    "providerTypeFree": "Plano Gratuito",
-    "providerTypeOAuth": "OAuth",
-    "providerTypeApiKey": "Chave de API",
-    "useCaseSingleEndpointTitle": "Um endpoint para muitos provedores",
-    "useCaseSingleEndpointText": "Aponte clientes para uma única URL base e roteie por prefixo de modelo (por exemplo: gh/, cc/, kr/, openai/).",
-    "useCaseFallbackTitle": "Fallback e troca de modelo com combos",
-    "useCaseFallbackText": "Crie modelos combo no painel e mantenha a configuração do cliente estável enquanto os provedores giram internamente.",
-    "useCaseUsageVisibilityTitle": "Visibilidade de uso, custo e debug",
-    "useCaseUsageVisibilityText": "Acompanhe tokens e custo por provedor, conta e chave de API nas abas de Uso e Analytics.",
-    "clientCherryStudioTitle": "Cherry Studio",
-    "baseUrlLabel": "URL Base",
-    "chatEndpointLabel": "Endpoint de chat",
-    "modelRecommendationLabel": "Recomendação de modelo: prefixo explícito",
-    "clientCodexTitle": "Modelos Codex / GitHub Copilot",
-    "clientCodexBullet1": "Use IDs de modelo com prefixo",
-    "clientCodexBullet2": "Modelos da família Codex são roteados automaticamente para",
-    "clientCodexBullet3": "Modelos não-Codex continuam em",
-    "clientCursorTitle": "Cursor IDE",
-    "clientCursorBullet1": "Use o prefixo",
-    "clientCursorBullet1Suffix": "para modelos do Cursor.",
-    "clientCursorBullet2": "Conexão OAuth - faça login na página de Provedores.",
-    "clientClaudeTitle": "Claude Code / Antigravity",
-    "clientClaudeBullet1Prefix": "Use",
-    "clientClaudeBullet1Middle": "(Claude) ou",
-    "clientClaudeBullet1Suffix": "(Antigravity) como prefixo.",
-    "clientWindsurfTitle": "Windsurf",
-    "clientWindsurfBullet1": "Use o OmniRoute como base URL compatível com OpenAI e mantenha prefixos explícitos de provedor para roteamento determinístico.",
-    "clientWindsurfBullet2": "Aponte modelos para `/v1/chat/completions` no tráfego geral e preserve `/v1/responses` para fluxos tipo Codex.",
-    "clientWindsurfBullet3": "Use Painel -> CLI Tools quando quiser um guia pronto de configuração focado em Windsurf.",
-    "clientClineTitle": "Cline",
-    "clientClineBullet1": "O Cline funciona melhor com prefixos explícitos de provedor/modelo para o roteador nunca precisar adivinhar o backend.",
-    "clientClineBullet2": "Use `/v1/chat/completions` para modelos gerais e reutilize a mesma base URL do OmniRoute entre contas diferentes.",
-    "clientClineBullet3": "Use o dashboard de Providers para validar OAuth/API key antes de depurar problemas do runtime do Cline.",
-    "clientKimiTitle": "Kimi Coding",
-    "clientKimiBullet1": "Use o OmniRoute como base URL estável enquanto gira contas ou combos de provedores por baixo.",
-    "clientKimiBullet2": "Prefira modelos com prefixo em fluxos de coding para fallback e trilha de auditoria ficarem explícitos.",
-    "clientKimiBullet3": "Use `/v1/responses` quando quiser roteamento nativo estilo Responses para clientes com tools.",
-    "protocolsTitle": "Protocolos: MCP e A2A",
-    "protocolsDescription": "O OmniRoute expõe dois protocolos operacionais além das APIs compatíveis com OpenAI: MCP para execução de ferramentas e A2A para fluxos agente-para-agente.",
-    "protocolMcpTitle": "MCP (Model Context Protocol)",
-    "protocolMcpDesc": "Use MCP via stdio para permitir descoberta e execução de ferramentas OmniRoute com visibilidade de auditoria.",
-    "protocolMcpStep1": "Inicie o transporte MCP com `omniroute --mcp`.",
-    "protocolMcpStep2": "Aponte seu cliente MCP para transporte stdio.",
-    "protocolMcpStep3": "Chame `omniroute_get_health` e `omniroute_list_combos` para validar conectividade.",
-    "protocolA2aTitle": "A2A (Agent2Agent)",
-    "protocolA2aDesc": "Use A2A JSON-RPC para submeter tarefas de forma síncrona ou via SSE streaming.",
-    "protocolA2aStep1": "Leia `/.well-known/agent.json` para descoberta do agente.",
-    "protocolA2aStep2": "Envie `message/send` ou `message/stream` para `POST /a2a`.",
-    "protocolA2aStep3": "Gerencie ciclo de vida das tarefas com `tasks/get` e `tasks/cancel`.",
-    "protocolTroubleshootingTitle": "Troubleshooting de protocolos",
-    "protocolTroubleshooting1": "Se o status MCP estiver offline, verifique se o processo stdio está rodando e atualizando o heartbeat.",
-    "protocolTroubleshooting2": "Se tarefas A2A ficarem em `working`, inspecione `/api/a2a/tasks/:id` e os eventos de stream até estado terminal.",
-    "protocolTroubleshooting3": "Use `/dashboard/mcp` e `/dashboard/a2a` para controles operacionais e visibilidade de auditoria.",
-    "endpointChatNote": "Endpoint de chat compatível com OpenAI (padrão).",
-    "endpointResponsesNote": "Endpoint da API Responses (Codex, o-series).",
-    "endpointModelsNote": "Catálogo de modelos para todos os provedores conectados.",
-    "endpointAudioNote": "Transcrição de áudio (Deepgram, AssemblyAI).",
-    "endpointSpeechNote": "Geração de texto para fala (ElevenLabs, OpenAI TTS).",
-    "endpointEmbeddingsNote": "Geração de incorporação de texto (OpenAI, Cohere, Voyage).",
-    "endpointImagesNote": "Geração de imagens (NanoBanana).",
-    "endpointRewriteChatNote": "Auxiliar de reescrita para clientes sem /v1.",
-    "endpointRewriteResponsesNote": "Auxiliar de reescrita para Responses sem /v1.",
-    "endpointRewriteModelsNote": "Auxiliar de reescrita para descoberta de modelos sem /v1.",
-    "mgmtProxiesListNote": "List saved proxy registry items (supports pagination).",
-    "mgmtProxiesCreateNote": "Create a reusable proxy item in the registry.",
-    "mgmtProxiesHealthNote": "Get 24h/rolling health metrics per saved proxy from proxy logs.",
-    "mgmtProxiesBulkAssignNote": "Assign or clear one proxy across many scope IDs in one request.",
-    "mgmtAssignmentsListNote": "List proxy assignments by scope, scope_id, or proxy_id.",
-    "mgmtAssignmentsUpdateNote": "Assign or clear proxy for global/provider/account/combo scope.",
-    "mgmtLegacyMigrationNote": "Import legacy proxyConfig maps into registry assignments.",
-    "modelPrefixesDescriptionStart": "Use o prefixo do provedor antes do nome do modelo para rotear para um provedor específico. Exemplo:",
-    "modelPrefixesDescriptionEnd": "roteia para o GitHub Copilot.",
-    "provider": "Provedor",
-    "type": "Tipo",
-    "troubleshootingModelRouting": "Se o cliente falhar no roteamento de modelo, use provedor/modelo explícito (por exemplo: gh/gpt-5.1-codex).",
-    "troubleshootingAmbiguousModels": "Se você receber erros de modelo ambíguo, escolha um prefixo de provedor em vez de um ID de modelo sem prefixo.",
-    "troubleshootingCodexFamily": "Para modelos da família GitHub Codex, mantenha o modelo como gh/codex-model; o roteador seleciona /responses automaticamente.",
-    "troubleshootingTestConnection": "Use Painel > Provedores > Testar Conexão antes de testar por IDEs ou clientes externos.",
-    "troubleshootingCircuitBreaker": "Se um provedor mostrar circuit breaker aberto, aguarde o cooldown ou verifique a página Health para detalhes.",
-    "troubleshootingOAuth": "Para provedores OAuth, autentique novamente se os tokens expirarem. Verifique o indicador de status no card do provedor.",
-    "endpointCompletionsNote": "Endpoint legado de completions para clientes que ainda enviam payloads de text-completions.",
-    "endpointModerationsNote": "Moderação e scoring de segurança de conteúdo em provedores compatíveis.",
-    "endpointRerankNote": "Reranking de documentos para retrieval e pós-processamento de busca.",
-    "endpointSearchNote": "Busca web unificada com fallback de provedor, analytics e rastreamento de custo.",
-    "endpointSearchAnalyticsNote": "Telemetria de busca e analytics de provedores do pipeline unificado de search.",
-    "endpointVideoNote": "Geração de vídeo para backends compatíveis com ComfyUI e SD WebUI.",
-    "endpointMusicNote": "Geração de música via integrações de workflow do ComfyUI.",
-    "endpointMessagesNote": "Endpoint de compatibilidade estilo Anthropic Messages para clientes que falam payload nativo de mensagens.",
-    "endpointCountTokensNote": "Helper de contagem de tokens para planejar requisições antes da execução.",
-    "endpointFilesNote": "Upload de arquivos e armazenamento de artefatos para batches e workflows maiores.",
-    "endpointBatchesNote": "Criação e consulta de jobs em lote para execução enfileirada.",
-    "endpointWsNote": "Caminho compatível com upgrade WebSocket para clientes de protocolo em tempo real.",
-    "mgmtProvidersListNote": "Lista conexões de provedores configuradas e o status atual de cada uma.",
-    "mgmtProvidersCreateNote": "Cria uma nova conexão gerenciada de provedor a partir do plano de controle do dashboard.",
-    "mgmtProvidersUpdateNote": "Atualiza credenciais, metadados e flags operacionais de um provedor.",
-    "mgmtProvidersDeleteNote": "Remove uma conexão de provedor do runtime e do roteamento.",
-    "mgmtProvidersTestNote": "Executa um teste real de conexão contra a conta de provedor selecionada.",
-    "mgmtProvidersModelsNote": "Descobre, faz cache ou inspeciona modelos expostos por uma conexão específica.",
-    "mgmtSettingsGetNote": "Lê as configurações principais de runtime usadas pelo dashboard e pelo roteador.",
-    "mgmtSettingsUpdateNote": "Atualiza configurações compartilhadas de runtime sem editar arquivos de ambiente manualmente.",
-    "mgmtPayloadRulesGetNote": "Lê a configuração de normalização de payload e payload rules específicas por provedor.",
-    "mgmtPayloadRulesUpdateNote": "Atualiza as regras de rewrite de payload antes do dispatch para o provedor.",
-    "mcpToolsTitle": "Catálogo de Ferramentas MCP",
-    "mcpToolsDescription": "O OmniRoute entrega {count} ferramentas MCP agrupadas entre roteamento, operações, cache, memória e skills.",
-    "mcpToolsCount": "{count} ferramentas documentadas",
-    "mcpToolsToc": "Ferramentas MCP",
-    "mcpToolsRoutingTitle": "Roteamento e Catálogo",
-    "mcpToolsRoutingDesc": "Leia o health do runtime, inspecione combos, confira cotas, descubra modelos e chame web search a partir de clientes MCP.",
-    "mcpToolsOperationsTitle": "Operações e Controle",
-    "mcpToolsOperationsDesc": "Simule roteamento, troque estratégias, teste combos, sincronize pricing, inspecione sessão e diagnostique problemas de runtime.",
-    "mcpToolsCacheTitle": "Controles de Cache",
-    "mcpToolsCacheDesc": "Inspecione hit rates e limpe o estado do cache sem sair do cliente MCP.",
-    "mcpToolsCompressionTitle": "Motores de compressão",
-    "mcpToolsCompressionDesc": "Configure a compactação RTK/Brotli, troque mecanismos e inspecione a análise de compactação por combinação.",
-    "mcpToolsOneProxyTitle": "1Proxy / Túneis",
-    "mcpToolsOneProxyDesc": "Gerencie proxies de saída, alterne IPs residenciais e inspecione a integridade do proxy.",
-    "mcpToolsMemoryTitle": "Memória",
-    "mcpToolsMemoryDesc": "Busque, adicione e limpe entradas persistidas de memória do OmniRoute na mesma superfície de protocolo.",
-    "mcpToolsSkillsTitle": "Skills",
-    "mcpToolsSkillsDesc": "Liste skills habilitadas, ative, execute e inspecione histórico de execuções a partir do MCP.",
-    "featureAutoComboTitle": "Roteamento AutoCombo",
-    "featureAutoComboText": "Use roteamento por intenção, fallback emergencial, seleção por contexto e perfis de resiliência sem mudar o payload do cliente.",
-    "featureSearchTitle": "APIs de Busca, Rerank e Multimodal",
-    "featureSearchText": "Exponha endpoints de search, rerank, moderação, imagem, vídeo, música, voz e transcrição atrás da mesma base URL do OmniRoute.",
-    "featureMemoryTitle": "Memória e Handoffs de Contexto",
-    "featureMemoryText": "Persista fatos reutilizáveis, injete contexto recuperado nas requisições e carregue contexto entre sessões e fluxos de agentes.",
-    "featureSkillsTitle": "Skills e Execução de Ferramentas",
-    "featureSkillsText": "Execute skills registradas, intercepte tool calls e exponha a execução por dashboard, MCP e fluxos de agentes.",
-    "featureAcpTitle": "Workers ACP e Agentes Locais",
-    "featureAcpText": "Detecte binários locais que o OmniRoute pode iniciar como workers ACP e coordene-os pelas telas de Agents e CLI Tools.",
-    "protocolAcpTitle": "ACP (Workers do Agent Communication Protocol)",
-    "protocolAcpDesc": "Use workers locais com ACP quando o OmniRoute deve iniciar e supervisionar um binário local em vez de encaminhar por HTTP.",
-    "protocolAcpStep1": "Abra Painel -> Agents para verificar quais binários locais estão instalados e disponíveis como workers.",
-    "protocolAcpStep2": "Use Painel -> CLI Tools quando você precisa de configuração de cliente em vez de spawn de worker.",
-    "protocolAcpStep3": "Combine workers ACP com logs de auditoria e health para entender o que o OmniRoute iniciou e por quê."
-  },
   "endpoint": {
     "title": "Endpoint da API",
     "available": "Endpoints Disponíveis",
@@ -3142,14 +3085,19 @@
     "ngrokStarted": "Túnel ngrok iniciado",
     "ngrokStopped": "Túnel ngrok parado",
     "ngrokRequestFailed": "Falha ao atualizar túnel ngrok",
-    "tokenSaverSubtitle": "Gaste menos tokens em cada solicitação.",
-    "tokenSaverToolOutput": "Saída da ferramenta",
-    "tokenSaverLlmOutput": "Saída LLM",
-    "tokenSaverInputCompression": "Compressão de entrada",
     "apiEndpointsCatalogUnavailable": "Catálogo de API indisponível",
     "apiEndpointsSearchPlaceholder": "Pesquisar pontos de extremidade...",
     "apiEndpointsRequiresAuth": "Requer autenticação",
     "apiEndpointsNoMatch": "Nenhum endpoint corresponde ao seu filtro",
+    "vscodeAliasTitle": "Alias de Token do VS Code",
+    "vscodeAliasDescriptionReady": "URLs de compatibilidade prontas para colar usando o endpoint /api/v1/vscode/TOKEN/... .",
+    "vscodeAliasDescriptionError": "Mostrando URLs com placeholder porque as chaves de CLI não puderam ser carregadas nesta sessão.",
+    "vscodeAliasDescriptionLoading": "Carregando chaves de CLI. As URLs com placeholder serão mostradas até que uma chave esteja disponível.",
+    "vscodeAliasDescriptionPlaceholder": "Mostrando URLs com placeholder. Crie ou ative uma chave de API em CLI Tools para substituir TOKEN.",
+    "vscodeAliasManage": "CLI Tools",
+    "vscodeAliasBaseLabel": "Base do VS Code",
+    "vscodeAliasModelsLabel": "Modelos do VS Code",
+    "vscodeAliasChatLabel": "Chat do VS Code",
     "localServer": "Servidor local",
     "cloudOmniroute": "Cloud OmniRoute",
     "copyUrl": "Copiar URL",
@@ -3163,27 +3111,9 @@
     "tierPublic": "Público",
     "hideInternal": "Ocultar Internos",
     "showInternal": "Mostrar Internos",
-    "vscodeAliasTitle": "Alias de Token do VS Code",
-    "vscodeAliasDescriptionReady": "URLs de compatibilidade prontas para colar usando o endpoint /api/v1/vscode/TOKEN/... .",
-    "vscodeAliasDescriptionError": "Mostrando URLs com placeholder porque as chaves de CLI não puderam ser carregadas nesta sessão.",
-    "vscodeAliasDescriptionLoading": "Carregando chaves de CLI. As URLs com placeholder serão mostradas até que uma chave esteja disponível.",
-    "vscodeAliasDescriptionPlaceholder": "Mostrando URLs com placeholder. Crie ou ative uma chave de API em CLI Tools para substituir TOKEN.",
-    "vscodeAliasManage": "CLI Tools",
-    "vscodeAliasBaseLabel": "Base do VS Code",
-    "vscodeAliasModelsLabel": "Modelos do VS Code",
-    "vscodeAliasChatLabel": "Chat do VS Code"
-  },
-  "endpointOptions": {
-    "speech": "Speech",
-    "search": "Search",
-    "images": "Images",
-    "chat": "Chat",
-    "music": "Music",
-    "responses": "Responses",
-    "rerank": "Rerank",
-    "video": "Video",
-    "embeddings": "Embeddings",
-    "transcription": "Transcription"
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
@@ -3197,518 +3127,6 @@
     "featureSwagger": "Geração automática de specs OpenAPI / Swagger",
     "featureAuth": "Gestão de chaves API e escopos OAuth por endpoint"
   },
-  "header": {
-    "logout": "Sair",
-    "language": "Idioma",
-    "providers": "Provedores",
-    "providerDescription": "Gerencie suas conexões de provedores de IA",
-    "combos": "Combos",
-    "comboDescription": "Combos de modelos com fallback",
-    "usage": "Uso e Análises",
-    "usageDescription": "Monitore seu uso de API, consumo de tokens e logs de requisições",
-    "analytics": "Análises",
-    "analyticsDescription": "Gráficos, tendências e insights de avaliação",
-    "cliTools": "Ferramentas CLI",
-    "cliToolsDescription": "Configurar ferramentas de linha de comando",
-    "home": "Início",
-    "homeDescription": "Bem-vindo ao OmniRoute",
-    "endpoint": "Endpoints",
-    "endpointDescription": "Gerenciar endpoints proxy, MCP, A2A e endpoints de API",
-    "mcp": "MCP",
-    "mcpDescription": "Model Context Protocol server management and tools",
-    "a2a": "A2A",
-    "a2aDescription": "Agent-to-Agent protocol tasks and observability",
-    "settings": "Configurações",
-    "settingsDescription": "Gerencie suas preferências",
-    "openaiCompatible": "Compatível com OpenAI",
-    "anthropicCompatible": "Compatível com Anthropic",
-    "media": "Mídia",
-    "mediaDescription": "Gerar imagens, vídeos e músicas",
-    "themes": "Themes",
-    "themesDescription": "Choose a color theme for the whole dashboard panel",
-    "costsDescription": "Track spending, analyze trends, and manage your AI budget across all providers",
-    "cacheDescription": "Monitor provider prompt cache efficiency and local semantic response reuse.",
-    "limitsDescription": "Configure rate limits and quotas per API key and provider",
-    "runtimeDescription": "Observabilidade de runtime — circuit breakers, cooldowns, lockouts de modelo, sessões e alertas de quota",
-    "apiManagerDescription": "Manage API keys and access control for your OmniRoute instance",
-    "batchDescription": "Process large volumes of requests asynchronously with batched API calls",
-    "contextCavemanDescription": "Rule-based message compression, language packs, analytics and output mode controls.",
-    "contextRtkDescription": "Command-aware compression for tool output, terminal logs and build results.",
-    "contextCombosDescription": "Define how engines are combined for different routing scenarios.",
-    "changelogDescription": "Stay up to date with the latest platform features and announcements.",
-    "agentsDescription": "Manage and configure AI agent tools: Codex, Devin, Jules, and custom agents",
-    "cloudAgentsDescription": "Orchestrate cloud-based AI agents with live task tracking and plan approval",
-    "memoryDescription": "Persistent conversational memory with semantic search and FTS5 full-text indexing",
-    "skillsDescription": "Install and manage sandbox skills for automated prompt and tool execution",
-    "agentSkillsDescription": "Agent-ready skills catalog with one-click URL copy for AI client integration",
-    "translatorDescription": "Translate and test prompts across API formats: OpenAI ↔ Claude ↔ Gemini",
-    "playgroundDescription": "Test prompts interactively with live provider responses and format inspection",
-    "searchToolsDescription": "Search analytics, provider breakdown, cache hit rates, and cost tracking",
-    "logsDescription": "Real-time request logs, error traces, and streaming event inspector",
-    "auditDescription": "Compliance audit trail of API key usage, MCP tool calls, and policy events",
-    "webhooksDescription": "Configure webhook endpoints to receive real-time event notifications",
-    "healthDescription": "System health overview: providers, circuit breakers, rate limits, and database",
-    "proxyDescription": "Configure upstream proxy settings for outbound provider connections",
-    "apiEndpointsDescription": "Manage custom API endpoint configurations and routing overrides",
-    "batchFilesDescription": "Browse and manage batch job output files and results",
-    "analyticsEvalsDescription": "Model evaluation results and performance benchmarks",
-    "analyticsSearchDescription": "Search query analytics, cache hit rates, and cost tracking",
-    "analyticsUtilizationDescription": "Provider utilization metrics and capacity planning",
-    "analyticsComboHealthDescription": "Real-time health and performance of combo routing configurations",
-    "analyticsCompressionDescription": "Context compression analytics and token savings",
-    "costsBudgetDescription": "Budget limits and spending alerts per API key and provider",
-    "costsPricingDescription": "Custom pricing configuration for token cost calculations",
-    "logsProxyDescription": "Upstream proxy request logs and traffic inspection",
-    "logsConsoleDescription": "Application console output and debug logs",
-    "logsActivityDescription": "Audit trail of user actions and system events",
-    "auditMcpDescription": "MCP tool invocation audit trail and compliance records",
-    "auditA2a": "Auditoria A2A",
-    "auditA2aDescription": "Trilha de auditoria de execução de tarefas A2A, transições de estado e registros de invocação de habilidades",
-    "settingsGeneralDescription": "Storage, database, and general instance configuration",
-    "settingsAppearanceDescription": "Theme, branding, and visual customization",
-    "settingsAiDescription": "AI behaviors, thinking budgets, vision, and memory settings",
-    "settingsSecurityDescription": "Authentication, authorization, and access control settings",
-    "featureFlags": "Sinalizadores de recursos",
-    "featureFlagsDescription": "Capacidades do sistema de controle e recursos experimentais",
-    "featureFlagsActive": "{count} ativo",
-    "featureFlagsInactive": "{count} inativo",
-    "featureFlagsOverrides": "{count} Substituições de banco de dados",
-    "featureFlagsSearch": "Pesquisar sinalizadores...",
-    "featureFlagsCategoryAll": "Todos",
-    "featureFlagsCategorySecurity": "Segurança",
-    "featureFlagsCategoryNetwork": "Rede",
-    "featureFlagsCategoryPolicies": "Políticas",
-    "featureFlagsCategoryRuntime": "Tempo de execução",
-    "featureFlagsCategoryCli": "CLI",
-    "featureFlagsCategoryHealth": "Saúde",
-    "featureFlagsSourceDb": "BD",
-    "featureFlagsSourceEnv": "ENV",
-    "featureFlagsSourceDefault": "DEF",
-    "featureFlagsReset": "Redefinir",
-    "featureFlagsResetAll": "Redefinir todas as substituições",
-    "featureFlagsResetAllConfirm": "Tem certeza de que deseja redefinir todas as substituições de sinalizadores de recursos? Isso reverterá todos os sinalizadores para seus valores ENV ou padrão.",
-    "featureFlagsRestartRequired": "É necessário reiniciar para aplicar",
-    "featureFlagsNoResults": "Nenhuma sinalização corresponde à sua pesquisa",
-    "featureFlagsSaved": "Bandeira atualizada",
-    "featureFlagsError": "Falha ao atualizar sinalizador",
-    "settingsRoutingDescription": "Routing rules, model aliases, combo defaults, and degradation settings",
-    "settingsResilienceDescription": "Circuit breaker, retry, and fallback configuration",
-    "settingsAdvancedDescription": "Advanced payload rules, request limits, and proxy API settings",
-    "mitmProxyDescription": "Configure MITM proxy settings for traffic inspection and debugging",
-    "oneProxyDescription": "Configure 1Proxy settings for advanced proxy chaining",
-    "omniSkillsDescription": "Instale e gerencie skills sandbox para execução automatizada de prompts e ferramentas"
-  },
-  "health": {
-    "title": "Saúde do Sistema",
-    "description": "Monitoramento em tempo real da sua instância OmniRoute",
-    "healthy": "Saudável",
-    "degraded": "Degradado",
-    "down": "Offline",
-    "uptime": "Tempo Ativo",
-    "memory": "Memória",
-    "memoryRss": "Memória (RSS)",
-    "heap": "Heap",
-    "cpu": "CPU",
-    "database": "Banco de Dados",
-    "version": "Versão",
-    "lastCheck": "Última Verificação",
-    "providerHealth": "Saúde dos Provedores",
-    "systemMetrics": "Métricas do Sistema",
-    "tokenHealth": "Saúde dos Tokens",
-    "refreshAll": "Atualizar Tudo",
-    "checkNow": "Verificar Agora",
-    "loadingHealth": "Carregando dados de saúde...",
-    "failedToLoad": "Falha ao carregar dados de saúde: {error}",
-    "retry": "Tentar Novamente",
-    "allOperational": "Todos os sistemas operacionais",
-    "issuesDetected": "Problemas detectados no sistema",
-    "updatedAt": "Atualizado {time}",
-    "latency": "Latência",
-    "latencyP50": "p50",
-    "latencyP95": "p95",
-    "latencyP99": "p99",
-    "millisecondsShort": "{value}ms",
-    "notAvailable": "—",
-    "totalRequests": "Total de requisições",
-    "noDataYet": "Sem dados ainda",
-    "promptCache": "Cache de Prompt",
-    "entries": "Entradas",
-    "hitRate": "Taxa de Acerto",
-    "hitsMisses": "Acertos / Erros",
-    "signatureCache": "Cache de Assinatura",
-    "signatureDefaults": "Padrões",
-    "signatureTool": "Ferramenta",
-    "signatureFamily": "Família",
-    "signatureSession": "Sessão",
-    "recovering": "Recuperando",
-    "noCBData": "Nenhum dado de circuit breaker disponível. Faça algumas requisições primeiro.",
-    "providerHealthStatusAria": "Status de saúde dos provedores",
-    "issuesLabel": "Problemas Detectados",
-    "operational": "Operacional",
-    "providers": "Provedores",
-    "configuredProvidersLabel": "Configurado no painel",
-    "configuredProvidersHint": "Provedores com credenciais salvas em /dashboard/providers, independentemente do estado do tempo de execução.",
-    "activeProviders": "{count} active",
-    "activeProvidersHint": "Provedores configurados atualmente habilitados para solicitações de roteamento.",
-    "monitoredProviders": "{count} monitored",
-    "monitoredProvidersHint": "Provedores atualmente monitorados por monitores de integridade dos disjuntores.",
-    "healthyCount": "{count} saudáveis",
-    "nodeVersion": "Node {version}",
-    "failures": "{count} falha",
-    "failuresPlural": "{count} falhas",
-    "lastFailure": "Última",
-    "rateLimitStatus": "Status de Limite de Taxa",
-    "activeLimiters": "{count} limitador ativo",
-    "activeLimitersPlural": "{count} limitadores ativos",
-    "queued": "Na Fila",
-    "queuedCount": "{count} na fila",
-    "running": "executando",
-    "runningCount": "{count} executando",
-    "ok": "OK",
-    "activeLockouts": "Bloqueios Ativos",
-    "resetConfirm": "Resetar todos os circuit breakers para estado saudável? Isso limpará todos os contadores de falha e restaurará todos os provedores ao status operacional.",
-    "resetAllTitle": "Resetar todos os circuit breakers para estado saudável",
-    "resetting": "Resetando...",
-    "resetAll": "Resetar Tudo",
-    "until": "Até {time}",
-    "limitExhausted": "Esgotado",
-    "learnedFromHeaders": "Aprendido a partir dos headers do provedor",
-    "remainingOfLimit": "{remaining} / {limit} RPM restantes",
-    "throttleStatus": "Acelerador: {value}",
-    "lastHeaderUpdate": "Atualização do header: há {age}",
-    "databaseHealth": "Integridade do banco de dados",
-    "stickyBoundSessions": "Sessões fixas",
-    "sessionsByApiKey": "Sessões por chave API",
-    "noActiveSessionsTracked": "Nenhuma sessão ativa rastreada ainda.",
-    "noSessionQuotaMonitorsActive": "Nenhum monitor de cota de sessão ativo.",
-    "gracefulDegradationStatus": "Status de degradação elegante",
-    "additionalModels": "+{count} mais modelos",
-    "providerHealthMatrixTitle": "Matriz de Saúde do Provedor",
-    "providerHealthMatrixDescription": "Estados de provedor × conta × modelo a partir de disjuntores, cooldowns, bloqueios e logs.",
-    "healthMatrixRange": "Intervalo da matriz de saúde",
-    "providerFilter": "Filtro de provedor",
-    "onlyIssues": "Apenas problemas",
-    "refresh": "Atualizar",
-    "accounts": "Contas",
-    "models": "Modelos",
-    "issues": "Problemas",
-    "loadingProviderHealthMatrix": "Carregando matriz de saúde do provedor...",
-    "failedProviderHealthMatrix": "Falha ao carregar Matriz de Saúde do Provedor: {error}",
-    "noProvidersMatchedFilters": "Nenhum provedor corresponde aos filtros atuais.",
-    "modelPillSummary": "{requests} req · {successRate} sucesso · {latency} média",
-    "modelLockoutSummary": "{reason} · {duration} restante",
-    "locked": "bloqueado",
-    "inferred": "inferido",
-    "inactive": "Inativo",
-    "noConnectionId": "sem id de conexão",
-    "accountModelSummary": "{connectionId} · {count} modelos",
-    "cooldown": "cooldown",
-    "durationRemaining": "{duration} restante",
-    "noSyncedModelsOrTraffic": "Nenhum modelo sincronizado ou tráfego recente ainda.",
-    "providerRowSummary": "{active}/{total} contas ativas · {requests} req · {successRate} sucesso · {latency} média",
-    "cooldownCount": "{count} cooldown",
-    "lockoutCount": "{count} bloqueios",
-    "issueCount": "{count} problemas",
-    "score": "Pontuação",
-    "lastRequest": "Última requisição",
-    "lastError": "Último erro"
-  },
-  "home": {
-    "quickStart": "Início Rápido",
-    "quickStartDesc": "Comece em 4 passos. Conecte provedores, roteie modelos, monitore tudo.",
-    "fullDocs": "Docs Completa",
-    "step1Title": "1. Criar chave de API",
-    "step1Desc": "Vá em <endpoint>Endpoint</endpoint> -> Chaves Registradas. Gere uma chave por ambiente.",
-    "step2Title": "2. Conectar provedores",
-    "step2Desc": "Adicione contas em <providers>Provedores</providers>. Suporta OAuth, API Key e planos gratuitos.",
-    "step3Title": "3. Apontar seu cliente",
-    "step3Desc": "Defina a URL base como {url} no seu IDE ou cliente de API.",
-    "step4Title": "4. Monitorar e otimizar",
-    "step4Desc": "Acompanhe tokens, custos e erros em <logs>Logs de Requisições</logs> e <analytics>Análises</analytics>.",
-    "providersOverview": "Visão Geral dos Provedores",
-    "configuredOf": "{configured} configurados de {total} provedores disponíveis",
-    "noModelsAvailable": "Nenhum modelo disponível para este provedor.",
-    "noProvidersConfigured": "Nenhum provedor configurado ainda",
-    "addProvider": "Adicionar um provedor",
-    "configureFirst": "Configure uma conexão primeiro em {providers}",
-    "configureProvider": "Configurar Provedor",
-    "modelAvailable": "{count} modelo disponível",
-    "modelsAvailable": "{count} modelos disponíveis",
-    "connectionsActive": "{count} conexão ativa",
-    "connectionsActivePlural": "{count} conexões ativas",
-    "copyModelName": "Copiar nome do modelo",
-    "documentation": "Documentação",
-    "healthMonitor": "Monitor de Saúde",
-    "reportIssue": "Reportar problema",
-    "activeError": "{active} ativo · {errors} erro",
-    "oauthLabel": "OAuth",
-    "apiKeyLabel": "Chave de API",
-    "requestsShort": "{count} reqs",
-    "providerModelsTitle": "{provider} - Modelos",
-    "copiedModel": "Copiado: {model}",
-    "aliasLabel": "alias",
-    "updateNow": "Atualizar agora",
-    "updating": "Atualizando...",
-    "updateAvailableDesc": "Uma nova versão está disponível. Clique para atualizar.",
-    "updateStarted": "Atualização iniciada...",
-    "reloadingPageAutomatically": "Recarregando a página automaticamente...",
-    "providerTopology": "Topologia do provedor"
-  },
-  "landing": {
-    "brandName": "OmniRoute",
-    "navigateHome": "Navegar para a página inicial",
-    "toggleMenu": "Alternar menu",
-    "featuresLink": "Recursos",
-    "docsLink": "Docs",
-    "github": "GitHub",
-    "versionLive": "v1.0 já está no ar",
-    "oneEndpoint": "Um Endpoint para",
-    "allProviders": "Todos os Provedores de IA",
-    "heroDescription": "Proxy de endpoint de IA com painel web - uma versão em JavaScript do CLIProxyAPI. Funciona perfeitamente com Claude Code, OpenAI Codex, Cline, RooCode e outras ferramentas CLI.",
-    "getStarted": "Começar",
-    "viewOnGithub": "Ver no GitHub",
-    "powerfulFeatures": "Recursos Poderosos",
-    "featuresSubtitle": "Tudo que você precisa para gerenciar sua infraestrutura de IA em um só lugar, preparado para escala.",
-    "featureUnifiedEndpointTitle": "Endpoint Unificado",
-    "featureUnifiedEndpointDesc": "Acesse todos os provedores por uma única URL de API padrão.",
-    "featureEasySetupTitle": "Configuração Fácil",
-    "featureEasySetupDesc": "Fique pronto em minutos com o comando npx.",
-    "featureModelFallbackTitle": "Fallback de Modelo",
-    "featureModelFallbackDesc": "Alterne automaticamente entre provedores em caso de falha ou alta latência.",
-    "featureUsageTrackingTitle": "Rastreamento de Uso",
-    "featureUsageTrackingDesc": "Análises detalhadas e monitoramento de custos em todos os modelos.",
-    "featureOAuthApiKeysTitle": "OAuth e Chaves de API",
-    "featureOAuthApiKeysDesc": "Gerencie credenciais com segurança em um único cofre.",
-    "featureCloudSyncTitle": "Sincronização em Nuvem",
-    "featureCloudSyncDesc": "Sincronize suas configurações entre dispositivos instantaneamente.",
-    "featureCliSupportTitle": "Suporte a CLI",
-    "featureCliSupportDesc": "Funciona com Claude Code, Codex, Cline, Cursor e mais.",
-    "featureDashboardTitle": "Painel",
-    "featureDashboardDesc": "Painel visual para análise de tráfego em tempo real.",
-    "howItWorks": "Como o OmniRoute Funciona",
-    "howItWorksDescription": "Os dados fluem de forma contínua da sua aplicação pela nossa camada de roteamento inteligente até o melhor provedor para cada tarefa.",
-    "howItWorksStep1Title": "1. CLI e SDKs",
-    "howItWorksStep1Description": "Suas requisições começam nas suas ferramentas favoritas ou no nosso SDK unificado. Basta trocar a URL base.",
-    "howItWorksStep2Title": "2. Hub OmniRoute",
-    "howItWorksStep2Description": "Nosso mecanismo analisa o prompt, verifica a saúde dos provedores e roteia para menor latência ou custo.",
-    "howItWorksStep3Title": "3. Provedores de IA",
-    "howItWorksStep3Description": "A requisição é atendida por OpenAI, Anthropic, Gemini ou outros provedores instantaneamente.",
-    "getStartedIn30Seconds": "Comece em 30 segundos",
-    "getStartedDescription": "Instale o OmniRoute, configure seus provedores pelo painel web e comece a rotear requisições de IA.",
-    "installOmniRoute": "Instalar o OmniRoute",
-    "installStepDescription": "Execute o comando npx para iniciar o servidor instantaneamente",
-    "openDashboard": "Abrir Painel",
-    "openDashboardStepDescription": "Configure provedores e chaves de API pela interface web",
-    "routeRequests": "Rotear Requisições",
-    "routeRequestsStepDescription": "Aponte suas ferramentas CLI para {endpoint}",
-    "terminal": "terminal",
-    "copy": "Copiar",
-    "copied": "✓ Copiado",
-    "startingOmniRoute": "Iniciando OmniRoute...",
-    "serverRunningOnLabel": "Servidor em execução em",
-    "dashboardLabel": "Painel",
-    "readyToRoute": "Pronto para rotear! ✓",
-    "configureProvidersNote": "📝 Configure provedores no painel ou use variáveis de ambiente",
-    "dataLocation": "Local dos Dados:",
-    "dataLocationMacLinux": " macOS/Linux:",
-    "dataLocationWindows": " Windows:",
-    "product": "Produto",
-    "dashboardLink": "Painel",
-    "changelog": "Changelog",
-    "resources": "Recursos",
-    "documentation": "Documentação",
-    "npm": "NPM",
-    "legal": "Legal",
-    "mitLicense": "Licença MIT",
-    "footerTagline": "O endpoint unificado para geração de IA. Conecte, roteie e gerencie seus provedores de IA com facilidade.",
-    "copyright": "© {year} OmniRoute. Todos os direitos reservados.",
-    "flowToolClaudeCode": "Claude Code",
-    "flowToolOpenAICodex": "OpenAI Codex",
-    "flowToolCline": "Cline",
-    "flowToolCursor": "Cursor",
-    "flowProviderOpenAI": "OpenAI",
-    "flowProviderAnthropic": "Anthropic",
-    "flowProviderGemini": "Gemini",
-    "flowProviderGithubCopilot": "GitHub Copilot",
-    "interactiveDiagram": "Diagrama interativo visível no desktop",
-    "ctaTitle": "Pronto para simplificar sua infraestrutura de IA?",
-    "ctaDescription": "Junte-se a desenvolvedores que estão simplificando suas integrações de IA com o OmniRoute. Open source e grátis para começar.",
-    "startFree": "Começar grátis",
-    "readDocumentation": "Ler documentação"
-  },
-  "legal": {
-    "privacyPolicy": "Política de Privacidade",
-    "termsOfService": "Termos de Serviço",
-    "providerConfigurations": "Configurações de provedores",
-    "apiKeys": "Chaves de API",
-    "usageLogs": "Logs de uso",
-    "applicationSettings": "Configurações do aplicativo",
-    "viewExportAnalytics": "Visualizar e exportar análises de uso",
-    "clearHistory": "Limpar histórico de uso a qualquer momento",
-    "configureRetention": "Configurar políticas de retenção de logs",
-    "backupRestore": "Fazer backup e restaurar seu banco de dados",
-    "privacyMetadataTitle": "Política de Privacidade | OmniRoute",
-    "privacyMetadataDescription": "Política de privacidade do roteador proxy de API de IA OmniRoute.",
-    "termsMetadataTitle": "Termos de Serviço | OmniRoute",
-    "termsMetadataDescription": "Termos de serviço do roteador proxy de API de IA OmniRoute.",
-    "backToHome": "Voltar para a home",
-    "lastUpdated": "Última atualização: {date}",
-    "policyLastUpdatedDate": "13 de fevereiro de 2026",
-    "listSeparator": "-",
-    "questionsVisit": "Dúvidas? Visite nosso",
-    "githubRepository": "repositório no GitHub",
-    "privacySection1Title": "1. Arquitetura Local-First",
-    "privacySection1Text": "O OmniRoute foi projetado como uma aplicação local-first. Todo processamento e armazenamento de dados ocorre inteiramente na sua máquina. Não existe servidor centralizado coletando suas informações.",
-    "privacySection2Title": "2. Dados que Armazenamos",
-    "privacyDataStoredIn": "Os dados a seguir são armazenados localmente em",
-    "privacyDataProviderConfigurationsDesc": "URLs de conexão, tipos de provedor e configurações de prioridade",
-    "privacyDataApiKeysDesc": "criptografadas e armazenadas localmente para autenticar com provedores de IA",
-    "privacyDataUsageLogsDesc": "contagem de requisições, uso de tokens, nomes de modelos, timestamps e tempos de resposta",
-    "privacyDataApplicationSettingsDesc": "preferências de tema, estratégia de roteamento e configurações de combos",
-    "privacySection3Title": "3. Sem Telemetria",
-    "privacySection3Text": "O OmniRoute não coleta telemetria, analytics ou relatórios de falha. Nenhum dado é enviado para nós ou para terceiros. Seus padrões de uso, chamadas de API e configurações permanecem totalmente privados.",
-    "privacySection4Title": "4. Provedores de IA de Terceiros",
-    "privacySection4Text": "Quando você faz chamadas de API pelo OmniRoute, suas requisições são encaminhadas aos provedores de IA configurados (por exemplo: OpenAI, Anthropic, Google). Esses provedores possuem suas próprias políticas de privacidade que regem como tratam seus dados. Consulte:",
-    "privacyOpenAiPolicy": "Política de Privacidade da OpenAI",
-    "privacyAnthropicPolicy": "Política de Privacidade da Anthropic",
-    "privacyGooglePolicy": "Política de Privacidade do Google",
-    "privacySection5Title": "5. Sincronização em Nuvem (Opcional)",
-    "privacySection5Text": "Se você ativar o recurso opcional de sincronização em nuvem, configurações de provedores e chaves de API podem ser transmitidas para um endpoint de nuvem configurado. Esse recurso vem desativado por padrão e exige opt-in explícito.",
-    "privacySection6Title": "6. Logs",
-    "privacyLoggingIntro": "Os logs de requisição podem ser configurados nas configurações do painel. Você pode:",
-    "privacySection7Title": "7. Seus Direitos",
-    "privacySection7TextStart": "Como todos os dados são armazenados localmente, você tem controle total. Você pode excluir seus dados a qualquer momento removendo o diretório",
-    "privacySection7TextEnd": "ou usando os recursos de backup e restauração do banco de dados no painel.",
-    "termsSection1Title": "1. Visão Geral",
-    "termsSection1Text": "O OmniRoute é um roteador proxy de API de IA local-first que roda inteiramente na sua máquina. Ele roteia requisições para múltiplos provedores de IA com balanceamento de carga, failover e rastreamento de uso.",
-    "termsSection2Title": "2. Responsabilidades do Usuário",
-    "termsResponsibilityApiKeys": "Você é o único responsável por gerenciar suas próprias chaves de API e credenciais para provedores de IA de terceiros (OpenAI, Anthropic, Google etc.).",
-    "termsResponsibilityCompliance": "Você deve cumprir os termos de serviço de cada provedor de IA cuja API acessar através do OmniRoute.",
-    "termsResponsibilitySecurity": "Você é responsável pela segurança da sua instalação local do OmniRoute, incluindo definir uma senha e restringir acesso de rede.",
-    "termsSection3Title": "3. Como Funciona",
-    "termsSection3Text": "O OmniRoute atua como um proxy intermediário. As chamadas de API enviadas ao OmniRoute são traduzidas e encaminhadas para seus provedores de IA configurados. O OmniRoute não modifica o conteúdo das suas requisições ou respostas além da tradução de protocolo necessária.",
-    "termsSection4Title": "4. Tratamento de Dados",
-    "termsDataStoredLocally": "Todos os dados são armazenados localmente na sua máquina em um banco SQLite.",
-    "termsNoTransmission": "O OmniRoute não transmite dados para servidores externos, a menos que você ative explicitamente recursos de sincronização em nuvem.",
-    "termsDataLocationText": "Logs de uso, chaves de API e configurações são armazenados em",
-    "termsSection5Title": "5. Isenção de Responsabilidade",
-    "termsSection5Text": "O OmniRoute é fornecido \"como está\", sem garantia de qualquer tipo. Não somos responsáveis por custos incorridos por uso de API, interrupções de serviço ou perda de dados. Sempre mantenha backups da sua configuração.",
-    "termsSection6Title": "6. Código Aberto",
-    "termsSection6Text": "O OmniRoute é um software de código aberto. Você pode inspecionar, modificar e distribuí-lo de acordo com os termos da licença."
-  },
-  "limits": {
-    "title": "Limites e Cotas",
-    "rateLimit": "Limite de Taxa",
-    "remaining": "Restante",
-    "requestsPerMinute": "Requisições/min",
-    "tokensPerMinute": "Tokens/min",
-    "dailyLimit": "Limite Diário"
-  },
-  "loggers": {
-    "allProviders": "Todos os Provedores",
-    "allModels": "Todos os Modelos",
-    "allAccounts": "Todas as Contas",
-    "allApiKeys": "Todas as Chaves de API",
-    "allTypes": "Todos os Tipos",
-    "allLevels": "Todos os Níveis",
-    "modelAZ": "Modelo A-Z",
-    "modelZA": "Modelo Z-A",
-    "loadingLogs": "Carregando logs...",
-    "loadingProxyLogs": "Carregando logs do proxy...",
-    "noLogEntries": "Nenhuma entrada de log encontrada",
-    "noPayloadData": "Nenhum dado de payload disponível para esta entrada.",
-    "proxyEvent": "Evento do Proxy",
-    "proxy": "Proxy",
-    "level": "Nível",
-    "directNative": "Direto (nativo)",
-    "combo": "Combo",
-    "inputTokens": "E:",
-    "outputTokens": "S:"
-  },
-  "logs": {
-    "title": "Logs",
-    "requestLogs": "Logs de Requisições",
-    "proxyLogs": "Logs do Proxy",
-    "auditLog": "Log de Auditoria",
-    "console": "Console",
-    "auditLogDesc": "Ações administrativas e eventos de segurança",
-    "loading": "Carregando...",
-    "refresh": "Atualizar",
-    "filterByAction": "Filtrar por ação...",
-    "filterByActor": "Filtrar por ator...",
-    "filterEntriesAria": "Filtrar entradas do log de auditoria",
-    "filterByActionTypeAria": "Filtrar por tipo de ação",
-    "filterByActorAria": "Filtrar por ator",
-    "refreshAuditLogAria": "Atualizar log de auditoria",
-    "tableAria": "Entradas do log de auditoria",
-    "failedFetchAuditLog": "Falha ao carregar log de auditoria",
-    "showing": "Mostrando {count} entradas (offset {offset})",
-    "search": "Buscar",
-    "timestamp": "Data/Hora",
-    "action": "Ação",
-    "actor": "Ator",
-    "target": "Alvo",
-    "details": "Detalhes",
-    "ipAddress": "Endereço IP",
-    "notAvailable": "—",
-    "noEntries": "Nenhuma entrada de log de auditoria encontrada",
-    "previous": "Anterior",
-    "next": "Próximo",
-    "providerWarningTitle": "Aviso de provedor capturado",
-    "viewDetails": "Ver Detalhes",
-    "eventMetadata": "Metadados do Evento",
-    "eventPayload": "Payload do Evento",
-    "requestId": "Request ID",
-    "providerWarningDesc": "Esta requisição terminou com um aviso do provedor ou alerta do sanitizador em vez de uma falha dura.",
-    "a": "A",
-    "offset": "Offset",
-    "limit": "Limit",
-    "status": "Status",
-    "resourceType": "Tipo de Recurso",
-    "totalEntries": "{count} eventos no total",
-    "tab": "Tab",
-    "auditModalSubtitle": "Ator: {actor} • Alvo: {target}",
-    "close": "Fechar",
-    "runningRequests": "Requisições em Execução",
-    "runningRequestsDesc": "Requisições ainda em voo entre provedores e contas, com previews sanitizados dos payloads.",
-    "clearAll": "Limpar tudo",
-    "confirmClearActiveRequests": "Limpar todas as solicitações ativas?",
-    "model": "Modelo",
-    "provider": "Provedor",
-    "account": "Conta",
-    "elapsed": "Tempo",
-    "activeStage": "Estágio",
-    "activeStageUnknown": "Ainda não enviado para o upstream",
-    "activeStageRegistered": "Registrado",
-    "activeStagePayloadPrepared": "Carga preparada",
-    "activeStageWaitingAccountSlot": "Aguardando slot de conta",
-    "activeStageWaitingRateLimit": "Aguardando limitador de taxa",
-    "activeStageRateLimitSlotAcquired": "Slot de limite de taxa adquirido",
-    "activeStageSendingToProvider": "Enviando para o upstream",
-    "activeStageProviderResponseStarted": "Resposta do upstream iniciada",
-    "count": "Qtd.",
-    "payloads": "Payloads",
-    "viewPayloads": "Ver Payloads",
-    "activeCount": "{count} ativas",
-    "clientPayload": "Requisição do Cliente",
-    "upstreamPayload": "Requisição Upstream",
-    "upstreamNotSentYet": "Requisição upstream ainda não foi enviada",
-    "runningRequestDetailMeta": "Conta: {account} • Tempo: {elapsed}",
-    "export": "Export",
-    "exporting": "Exporting...",
-    "exportFailed": "Export failed",
-    "timeRange": "Time Range",
-    "lastNHours": "Last {hours}",
-    "defaultRange": "default",
-    "consoleViewer": {
-      "fetchFailed": "Failed to fetch logs",
-      "copyFailed": "Failed to copy log entry",
-      "copyLogEntry": "Copy log entry"
-    },
-    "compressionLogTitle": "Compression Log",
-    "compressionLogEmpty": "No compressed requests yet. Compression stats will appear here when requests are processed with compression enabled.",
-    "tokens": "tokens"
-  },
   "mcpDashboard": {
     "loading": "Carregando painel MCP...",
     "activate": "ativar",
@@ -3795,37 +3213,80 @@
     "limit": "Limit",
     "tool": "Tool"
   },
-  "media": {
-    "title": "Playground de Mídia",
-    "subtitle": "Gere imagens, vídeos e música",
-    "model": "Modelo",
-    "prompt": "Prompt",
-    "generate": "Gerar",
-    "generating": "Gerando...",
-    "loadingModels": "Carregando modelos disponíveis...",
-    "noModels": "Nenhum modelo disponível. Configure provedores com suporte a mídia primeiro.",
-    "error": "Falha na Geração",
-    "result": "Resultado",
-    "imageDescription": "Gere imagens a partir de prompts de texto usando OpenAI, xAI, Together, Hyperbolic, SD WebUI, ComfyUI e mais.",
-    "videoDescription": "Crie vídeos com AnimateDiff, Stable Video Diffusion via ComfyUI ou SD WebUI.",
-    "musicDescription": "Componha músicas usando Stable Audio Open ou MusicGen via ComfyUI.",
-    "kinds": {
-      "embedding": "Embedding",
-      "image": "Imagem",
-      "imageToText": "Imagem para Texto",
-      "tts": "Texto para Fala",
-      "stt": "Fala para Texto",
-      "webSearch": "Busca Web",
-      "webFetch": "Web Fetch",
-      "video": "Vídeo",
-      "music": "Música"
+  "a2aDashboard": {
+    "loading": "Carregando painel A2A...",
+    "confirmCancelTask": "Cancelar tarefa {taskId}?",
+    "cancelTaskFailed": "Falha ao cancelar tarefa.",
+    "cancelTaskSuccess": "Tarefa {taskId} cancelada.",
+    "smokeSendFailed": "Falha no smoke test de message/send.",
+    "smokeSendSuccessWithTask": "message/send ok (tarefa {taskId}).",
+    "smokeSendSuccess": "message/send ok.",
+    "smokeStreamFailed": "Falha no smoke test de message/stream.",
+    "smokeStreamSuccessWithTask": "message/stream ok (tarefa {taskId}{stateSuffix}).",
+    "smokeStreamNoTaskId": "message/stream finalizado sem task id.",
+    "health": "Saúde",
+    "ok": "ok",
+    "totalTasks": "Total de tarefas",
+    "activeStreams": "Streams ativos",
+    "lastTask": "Última tarefa",
+    "taskStateOverview": "Visão de estados das tarefas",
+    "state": {
+      "submitted": "submetida",
+      "working": "executando",
+      "completed": "concluída",
+      "failed": "falhou",
+      "cancelled": "cancelada"
     },
-    "noProviders": "Nenhum provedor configurado para este tipo.",
-    "addConnection": "Adicionar Conexão",
-    "backToProviders": "Voltar para Provedores",
-    "connections": "{count} Conexões",
-    "noConnections": "Nenhuma conexão ainda — adicione uma na página do provedor.",
-    "loading": "Carregando..."
+    "agentCard": "Cartão do agente",
+    "agentCardPath": "/.well-known/agent.json",
+    "version": "Versão",
+    "url": "URL",
+    "capabilities": "Capacidades",
+    "agentCardNotAvailable": "Cartão do agente indisponível.",
+    "quickValidation": "Validação rápida",
+    "quickValidationDescription": "Executa chamadas de smoke pelo endpoint `/a2a` em produção.",
+    "runMessageSend": "Executar message/send",
+    "runMessageStream": "Executar message/stream",
+    "taskManagement": "Gestão de tarefas",
+    "taskSummary": "{total} tarefas | página {page} de {totalPages}",
+    "allStates": "todos",
+    "allSkills": "todas as skills",
+    "loadingTasks": "Carregando tarefas...",
+    "noTasksForFilters": "Nenhuma tarefa encontrada para os filtros atuais.",
+    "tableTask": "Tarefa",
+    "tableSkill": "Skill",
+    "tableState": "Estado",
+    "tableUpdated": "Atualizada",
+    "tableActions": "Ações",
+    "view": "Ver",
+    "cancel": "Cancelar",
+    "previous": "Anterior",
+    "next": "Próxima",
+    "taskDetail": "Detalhe da tarefa",
+    "close": "Fechar",
+    "metadata": "Metadados",
+    "events": "Eventos",
+    "artifacts": "Artefatos",
+    "tablePhase": "Table Phase",
+    "offset": "Offset",
+    "limit": "Limit",
+    "skill": "Skill",
+    "rpcEndpoint": "POSTAR /a2a",
+    "rpcMethodSend": "mensagem/enviar",
+    "rpcMethodStream": "mensagem/fluxo",
+    "rpcMethodGet": "tarefas/obter",
+    "rpcMethodCancel": "tarefas/cancelar",
+    "serviceLabel": "A2A",
+    "online": "Online",
+    "offline": "Offline",
+    "disableLabel": "Desativar {label}",
+    "enableLabel": "Ativar {label}",
+    "a2aDisabledTitle": "O A2A está desativado",
+    "a2aDisabledDesc": "Ative o A2A acima para visualizar a telemetria de tarefas, detalhes do agente e ferramentas de validação.",
+    "a2aIntro": "Endpoint Agent2Agent JSON-RPC 2.0 — envie tarefas, transmita respostas, cancele trabalhos em andamento.",
+    "a2aStep1": "Descubra o cartão do agente em {code}.",
+    "a2aStep2": "Envie JSON-RPC para {code1} usando {code2} ou {code3}.",
+    "a2aStep3": "Rastreie e cancele tarefas com {code1} and {code2}."
   },
   "memory": {
     "a": "A",
@@ -4010,42 +3471,205 @@
     "type": "Tipo",
     "memoryEnabled": "Memória ativada"
   },
-  "miniPlayground": {
-    "endpoint": "Endpoint",
-    "apiKey": "Chave API",
-    "model": "Modelo",
-    "voice": "Voz",
-    "speed": "Velocidade",
-    "input": "Entrada",
-    "url": "URL",
-    "format": "Formato",
-    "depth": "Profundidade",
-    "copyCurl": "Copiar cURL",
-    "copied": "Copiado!",
-    "run": "Executar",
-    "running": "Executando...",
-    "response": "Resposta",
-    "tunnel": "Tunnel",
-    "send": "Enviar",
-    "selectKey": "Selecionar chave",
-    "testLabel": "Testar",
-    "expandTest": "Expandir teste",
-    "collapseTest": "Recolher teste",
-    "revealKey": "Revelar chave",
-    "hideKey": "Ocultar chave",
-    "download": "Baixar",
-    "play": "Reproduzir",
-    "query": "Consulta",
-    "numResults": "Máx. resultados",
-    "prompt": "Prompt",
-    "size": "Tamanho",
+  "skills": {
+    "title": "Skills",
+    "description": "Gerencie e monitore skills de IA",
+    "skillsTab": "Skills",
+    "executionsTab": "Execuções",
+    "sandboxTab": "Sandbox",
+    "loading": "Carregando skills...",
+    "noSkills": "Nenhuma skill encontrada",
+    "noExecutions": "Nenhuma execução encontrada",
+    "enabled": "Ativado",
+    "disabled": "Desativado",
+    "version": "Versão",
+    "tableDescription": "Descrição",
+    "skill": "Skill",
+    "status": "Status",
     "duration": "Duração",
-    "question": "Pergunta",
-    "audioFile": "Arquivo de áudio",
-    "noKeysFound": "Nenhuma chave API encontrada. Adicione uma na seção Chaves.",
-    "exampleLabel": "Exemplo",
-    "latency": "{ms}ms",
-    "statsLine": "{ms}ms · {tokensIn} entrada / {tokensOut} saída tokens"
+    "time": "Tempo",
+    "sandboxConfig": "Configuração da Sandbox",
+    "cpuLimit": "Limite de CPU",
+    "cpuLimitDesc": "Tempo máximo de execução por skill",
+    "memoryLimit": "Limite de Memória",
+    "memoryLimitDesc": "Alocação máxima de memória",
+    "timeout": "Timeout",
+    "timeoutDesc": "Tempo máximo de espera por resposta",
+    "networkAccess": "Acesso à Rede",
+    "networkAccessDesc": "Permitir requisições de rede de saída",
+    "mode": "Mode",
+    "q": "Q",
+    "filterSkillsPlaceholder": "Filtre habilidades por nome, descrição ou tag",
+    "allModes": "Todos os modos",
+    "totalSkills": "Total de Habilidades",
+    "enabledSkills": "Ativadas",
+    "totalExecutions": "Execuções",
+    "successRate": "Taxa de Sucesso",
+    "marketplaceTab": "Marketplace",
+    "applyFilters": "Aplicar filtros",
+    "popularDefaultsLabel": "Populares por padrão para o provedor selecionado:",
+    "onMode": "LIGADO",
+    "offMode": "DESLIGADO",
+    "autoMode": "AUTO",
+    "installSkillButton": "Instalar Habilidade",
+    "installSkillModalTitle": "Instalar Habilidade",
+    "installJsonPlaceholder": "Cole o JSON do manifesto da habilidade aqui...",
+    "installing": "Instalando...",
+    "installSuccess": "Habilidade instalada ({id})",
+    "installError": "Falha na instalação",
+    "invalidJson": "JSON inválido",
+    "searchMarketplacePlaceholder": "Buscar habilidades...",
+    "searchMarketplace": "Buscar no Marketplace",
+    "marketplaceEmpty": "Nenhuma habilidade encontrada no marketplace",
+    "marketplaceError": "Falha na busca",
+    "installingFromMarketplace": "Instalando do marketplace...",
+    "popularSkills": "Habilidades Populares",
+    "skillsMarketplace": "Mercado de habilidades",
+    "searching": "Buscando...",
+    "pageInfo": "Página {page} de {totalPages} ({total} total)",
+    "previous": "Anterior",
+    "next": "Próximo",
+    "activeProvider": "Provedor ativo:",
+    "changeInSettings": "Altere isso em Configurações → Memória e Habilidades.",
+    "installs": "instalações",
+    "marketplaceSkillsMpHint": "Configure sua chave de API do SkillsMP nas Configurações para navegar no marketplace.",
+    "marketplaceSkillsShHint": "Pesquise no diretório aberto skills.sh para descobrir e instalar habilidades de agentes.",
+    "installSkillModalDesc": "Cole um JSON de manifesto de habilidade ou carregue um arquivo .json.",
+    "uploadJson": "Carregar JSON",
+    "cancel": "Cancelar",
+    "installSkill": "Instalar habilidade"
+  },
+  "health": {
+    "title": "Saúde do Sistema",
+    "description": "Monitoramento em tempo real da sua instância OmniRoute",
+    "healthy": "Saudável",
+    "degraded": "Degradado",
+    "down": "Offline",
+    "uptime": "Tempo Ativo",
+    "memory": "Memória",
+    "memoryRss": "Memória (RSS)",
+    "heap": "Heap",
+    "cpu": "CPU",
+    "database": "Banco de Dados",
+    "version": "Versão",
+    "lastCheck": "Última Verificação",
+    "providerHealth": "Saúde dos Provedores",
+    "systemMetrics": "Métricas do Sistema",
+    "tokenHealth": "Saúde dos Tokens",
+    "refreshAll": "Atualizar Tudo",
+    "checkNow": "Verificar Agora",
+    "loadingHealth": "Carregando dados de saúde...",
+    "failedToLoad": "Falha ao carregar dados de saúde: {error}",
+    "retry": "Tentar Novamente",
+    "allOperational": "Todos os sistemas operacionais",
+    "issuesDetected": "Problemas detectados no sistema",
+    "updatedAt": "Atualizado {time}",
+    "latency": "Latência",
+    "latencyP50": "p50",
+    "latencyP95": "p95",
+    "latencyP99": "p99",
+    "millisecondsShort": "{value}ms",
+    "notAvailable": "—",
+    "totalRequests": "Total de requisições",
+    "noDataYet": "Sem dados ainda",
+    "promptCache": "Cache de Prompt",
+    "entries": "Entradas",
+    "hitRate": "Taxa de Acerto",
+    "hitsMisses": "Acertos / Erros",
+    "signatureCache": "Cache de Assinatura",
+    "signatureDefaults": "Padrões",
+    "signatureTool": "Ferramenta",
+    "signatureFamily": "Família",
+    "signatureSession": "Sessão",
+    "recovering": "Recuperando",
+    "noCBData": "Nenhum dado de circuit breaker disponível. Faça algumas requisições primeiro.",
+    "providerHealthStatusAria": "Status de saúde dos provedores",
+    "issuesLabel": "Problemas Detectados",
+    "operational": "Operacional",
+    "providers": "Provedores",
+    "configuredProvidersLabel": "Configurado no painel",
+    "configuredProvidersHint": "Provedores com credenciais salvas em /dashboard/providers, independentemente do estado do tempo de execução.",
+    "activeProviders": "{count} active",
+    "activeProvidersHint": "Provedores configurados atualmente habilitados para solicitações de roteamento.",
+    "monitoredProviders": "{count} monitored",
+    "monitoredProvidersHint": "Provedores atualmente monitorados por monitores de integridade dos disjuntores.",
+    "healthyCount": "{count} saudáveis",
+    "nodeVersion": "Node {version}",
+    "failures": "{count} falha",
+    "failuresPlural": "{count} falhas",
+    "lastFailure": "Última",
+    "rateLimitStatus": "Status de Limite de Taxa",
+    "activeLimiters": "{count} limitador ativo",
+    "activeLimitersPlural": "{count} limitadores ativos",
+    "queued": "Na Fila",
+    "queuedCount": "{count} na fila",
+    "running": "executando",
+    "runningCount": "{count} executando",
+    "ok": "OK",
+    "activeLockouts": "Bloqueios Ativos",
+    "resetConfirm": "Resetar todos os circuit breakers para estado saudável? Isso limpará todos os contadores de falha e restaurará todos os provedores ao status operacional.",
+    "resetAllTitle": "Resetar todos os circuit breakers para estado saudável",
+    "resetting": "Resetando...",
+    "resetAll": "Resetar Tudo",
+    "until": "Até {time}",
+    "limitExhausted": "Esgotado",
+    "learnedFromHeaders": "Aprendido a partir dos headers do provedor",
+    "remainingOfLimit": "{remaining} / {limit} RPM restantes",
+    "throttleStatus": "Acelerador: {value}",
+    "lastHeaderUpdate": "Atualização do header: há {age}",
+    "databaseHealth": "Integridade do banco de dados",
+    "stickyBoundSessions": "Sessões fixas",
+    "sessionsByApiKey": "Sessões por chave API",
+    "noActiveSessionsTracked": "Nenhuma sessão ativa rastreada ainda.",
+    "noSessionQuotaMonitorsActive": "Nenhum monitor de cota de sessão ativo.",
+    "gracefulDegradationStatus": "Status de degradação elegante",
+    "additionalModels": "+{count} mais modelos",
+    "providerHealthMatrixTitle": "Matriz de Saúde do Provedor",
+    "providerHealthMatrixDescription": "Estados de provedor × conta × modelo a partir de disjuntores, cooldowns, bloqueios e logs.",
+    "healthMatrixRange": "Intervalo da matriz de saúde",
+    "providerFilter": "Filtro de provedor",
+    "onlyIssues": "Apenas problemas",
+    "refresh": "Atualizar",
+    "accounts": "Contas",
+    "models": "Modelos",
+    "issues": "Problemas",
+    "loadingProviderHealthMatrix": "Carregando matriz de saúde do provedor...",
+    "failedProviderHealthMatrix": "Falha ao carregar Matriz de Saúde do Provedor: {error}",
+    "noProvidersMatchedFilters": "Nenhum provedor corresponde aos filtros atuais.",
+    "modelPillSummary": "{requests} req · {successRate} sucesso · {latency} média",
+    "modelLockoutSummary": "{reason} · {duration} restante",
+    "locked": "bloqueado",
+    "inferred": "inferido",
+    "inactive": "Inativo",
+    "noConnectionId": "sem id de conexão",
+    "accountModelSummary": "{connectionId} · {count} modelos",
+    "cooldown": "cooldown",
+    "durationRemaining": "{duration} restante",
+    "noSyncedModelsOrTraffic": "Nenhum modelo sincronizado ou tráfego recente ainda.",
+    "providerRowSummary": "{active}/{total} contas ativas · {requests} req · {successRate} sucesso · {latency} média",
+    "cooldownCount": "{count} cooldown",
+    "lockoutCount": "{count} bloqueios",
+    "issueCount": "{count} problemas",
+    "score": "Pontuação",
+    "lastRequest": "Última requisição",
+    "lastError": "Último erro"
+  },
+  "telemetry": {
+    "title": "Telemetria do Sistema",
+    "description": "Sinais contínuos de solicitação, tempo de execução, sessão e memória deste processo OmniRoute.",
+    "uptime": "Tempo de atividade",
+    "totalRequests": "Total de solicitações",
+    "avgLatency": "Latência média",
+    "errorRate": "Taxa de erro",
+    "activeConnections": "Conexões Ativas",
+    "memoryUsage": "Uso de memória",
+    "latencyTrend": "Tendência de latência",
+    "throughputTrend": "Tendência de rendimento",
+    "memoryTrend": "Tendência de memória",
+    "refresh": "Atualizar",
+    "updatedAt": "{time} atualizado",
+    "loadFailed": "Falha ao carregar a telemetria.",
+    "partialData": "A telemetria está parcialmente disponível: {error}"
   },
   "mitm": {
     "title": "Proxy MITM",
@@ -4096,57 +3720,109 @@
     "no": "Não",
     "noTargets": "Nenhuma rota de destino configurada."
   },
-  "modals": {
-    "waitingAuth": "Aguardando Autorização",
-    "verificationUrl": "URL de Verificação",
-    "yourCode": "Seu Código",
-    "remoteAccess": "Acesso remoto:",
-    "connectedSuccess": "Conectado com Sucesso!",
-    "connectionFailed": "Falha na Conexão",
-    "chooseAuthMethod": "Escolha seu método de autenticação:",
-    "awsBuilderId": "AWS Builder ID",
-    "awsIamIdentity": "AWS IAM Identity Center",
-    "googleAccount": "Conta Google",
-    "githubAccount": "Conta GitHub",
-    "importToken": "Importar Token",
-    "pasteToken": "Cole o refresh token do Kiro IDE.",
-    "awsRegion": "Região AWS",
-    "autoDetecting": "Detectando tokens automaticamente...",
-    "readingFromCache": "Lendo do cache AWS SSO",
-    "readingFromCursor": "Lendo do banco de dados do Cursor IDE",
-    "initializing": "Inicializando...",
-    "pricingConfig": "Configuração de Preços",
-    "loadingPricing": "Carregando dados de preços...",
-    "pricingRatesFormat": "Formato de Taxas de Preço",
-    "noPricingData": "Nenhum dado de preço disponível",
-    "noModelsFound": "Nenhum modelo encontrado"
+  "limits": {
+    "title": "Limites e Cotas",
+    "rateLimit": "Limite de Taxa",
+    "remaining": "Restante",
+    "requestsPerMinute": "Requisições/min",
+    "tokensPerMinute": "Tokens/min",
+    "dailyLimit": "Limite Diário"
   },
-  "oauthModal": {
-    "title": "Conectar {providerName}",
-    "waiting": "Aguardando autorização",
-    "completeAuthInPopup": "Autorização completa no pop-up.",
-    "popupClosedHint": "Se o pop-up for fechado sem redirecionamento de volta (por exemplo, Qoder), esta caixa de diálogo mudará automaticamente para o modo de entrada manual de URL.",
-    "popupBlocked": "Pop-up bloqueado? Insira o URL manualmente",
-    "deviceCodeVisitUrl": "Visite o URL abaixo e insira o código:",
-    "deviceCodeVerificationUrl": "URL de verificação",
-    "deviceCodeYourCode": "Seu código",
-    "deviceCodeWaiting": "Aguardando autorização...",
-    "googleOAuthWarning": "Acesso remoto + Google OAuth: as credenciais padrão aceitam apenas redirecionamentos para <code>localhost</code>. Após a autorização, seu navegador tentará abrir <code>localhost</code> — copie o URL completo e cole-o abaixo. Para uso totalmente remoto sem esta etapa manual, <a>configure suas próprias credenciais OAuth</a>.",
-    "remoteAccessInfo": "Acesso remoto: Como você está acessando o OmniRoute remotamente, após a autorização você verá uma página de erro (localhost não encontrado). Isso é normal – basta copiar o URL completo da barra de endereço do seu navegador e colá-lo abaixo.",
-    "step1OpenUrl": "Etapa 1: abra este URL em seu navegador",
-    "copy": "Copiar",
-    "step2PasteCallback": "Etapa 2: cole o URL de retorno de chamada ou o código de autorização aqui",
-    "step2Hint": "Após a autorização, cole o URL de retorno de chamada completo. Para Claude Code e Cline, você também pode colar o código de autenticação diretamente, por exemplo. <code>código#estado</code>.",
-    "connect": "Conectar",
-    "cancel": "Cancelar",
-    "success": "Conexão bem-sucedida!",
-    "successMessage": "Sua conta {providerName} foi conectada.",
-    "done": "Concluído",
-    "error": "Falha na conexão",
-    "tryAgain": "Tente novamente"
+  "logs": {
+    "title": "Logs",
+    "requestLogs": "Logs de Requisições",
+    "proxyLogs": "Logs do Proxy",
+    "auditLog": "Log de Auditoria",
+    "console": "Console",
+    "auditLogDesc": "Ações administrativas e eventos de segurança",
+    "loading": "Carregando...",
+    "refresh": "Atualizar",
+    "filterByAction": "Filtrar por ação...",
+    "filterByActor": "Filtrar por ator...",
+    "filterEntriesAria": "Filtrar entradas do log de auditoria",
+    "filterByActionTypeAria": "Filtrar por tipo de ação",
+    "filterByActorAria": "Filtrar por ator",
+    "refreshAuditLogAria": "Atualizar log de auditoria",
+    "tableAria": "Entradas do log de auditoria",
+    "failedFetchAuditLog": "Falha ao carregar log de auditoria",
+    "showing": "Mostrando {count} entradas (offset {offset})",
+    "search": "Buscar",
+    "timestamp": "Data/Hora",
+    "action": "Ação",
+    "actor": "Ator",
+    "target": "Alvo",
+    "details": "Detalhes",
+    "ipAddress": "Endereço IP",
+    "notAvailable": "—",
+    "noEntries": "Nenhuma entrada de log de auditoria encontrada",
+    "previous": "Anterior",
+    "next": "Próximo",
+    "providerWarningTitle": "Aviso de provedor capturado",
+    "viewDetails": "Ver Detalhes",
+    "eventMetadata": "Metadados do Evento",
+    "eventPayload": "Payload do Evento",
+    "requestId": "Request ID",
+    "providerWarningDesc": "Esta requisição terminou com um aviso do provedor ou alerta do sanitizador em vez de uma falha dura.",
+    "a": "A",
+    "offset": "Offset",
+    "limit": "Limit",
+    "status": "Status",
+    "resourceType": "Tipo de Recurso",
+    "totalEntries": "{count} eventos no total",
+    "tab": "Tab",
+    "auditModalSubtitle": "Ator: {actor} • Alvo: {target}",
+    "close": "Fechar",
+    "runningRequests": "Requisições em Execução",
+    "runningRequestsDesc": "Requisições ainda em voo entre provedores e contas, com previews sanitizados dos payloads.",
+    "clearAll": "Limpar tudo",
+    "confirmClearActiveRequests": "Limpar todas as solicitações ativas?",
+    "model": "Modelo",
+    "provider": "Provedor",
+    "account": "Conta",
+    "elapsed": "Tempo",
+    "activeStage": "Estágio",
+    "activeStageUnknown": "Ainda não enviado para o upstream",
+    "activeStageRegistered": "Registrado",
+    "activeStagePayloadPrepared": "Carga preparada",
+    "activeStageWaitingAccountSlot": "Aguardando slot de conta",
+    "activeStageWaitingRateLimit": "Aguardando limitador de taxa",
+    "activeStageRateLimitSlotAcquired": "Slot de limite de taxa adquirido",
+    "activeStageSendingToProvider": "Enviando para o upstream",
+    "activeStageProviderResponseStarted": "Resposta do upstream iniciada",
+    "count": "Qtd.",
+    "payloads": "Payloads",
+    "viewPayloads": "Ver Payloads",
+    "activeCount": "{count} ativas",
+    "clientPayload": "Requisição do Cliente",
+    "upstreamPayload": "Requisição Upstream",
+    "upstreamNotSentYet": "Requisição upstream ainda não foi enviada",
+    "runningRequestDetailMeta": "Conta: {account} • Tempo: {elapsed}",
+    "export": "Export",
+    "exporting": "Exporting...",
+    "exportFailed": "Export failed",
+    "cleanHistoryButton": "__MISSING__:Clean history",
+    "cleanHistoryTitle": "__MISSING__:Clean log history?",
+    "cleanHistoryMessage": "__MISSING__:This permanently clears all request log rows, legacy detail rows, and local artifact files under DATA_DIR/call_logs. The live page will refresh after cleanup.",
+    "cleanHistoryConfirm": "__MISSING__:Clean history",
+    "cleanHistoryCancel": "__MISSING__:Cancel",
+    "cleanHistorySuccess": "__MISSING__:Cleaned {deleted} log entries, {deletedArtifacts} artifacts, and {deletedDetailedLogs} legacy detail rows.",
+    "cleanHistoryEmpty": "__MISSING__:No request log history was found.",
+    "cleanHistoryFailed": "__MISSING__:Failed to clean log history.",
+    "timeRange": "Time Range",
+    "lastNHours": "Last {hours}",
+    "defaultRange": "default",
+    "consoleViewer": {
+      "fetchFailed": "Failed to fetch logs",
+      "copyFailed": "Failed to copy log entry",
+      "copyLogEntry": "Copy log entry"
+    },
+    "compressionLogTitle": "Compression Log",
+    "compressionLogEmpty": "No compressed requests yet. Compression stats will appear here when requests are processed with compression enabled.",
+    "tokens": "tokens"
   },
   "onboarding": {
     "welcome": "Bem-vindo",
+    "tiers": "__MISSING__:Tiers",
     "security": "Segurança",
     "test": "Teste",
     "ready": "Pronto!",
@@ -4206,161 +3882,9 @@
     "tierFlowDiagramAlt": "Diagrama de fallback de 3 camadas do OmniRoute",
     "apiKeyMgmt": "Ger. de Chaves API"
   },
-  "playground": {
-    "title": "Title",
-    "description": "Description",
-    "endpoint": "Endpoint",
-    "provider": "Provider",
-    "model": "Model",
-    "accountKey": "Account Key",
-    "autoAccounts": "Automático ({count} contas)",
-    "noAccounts": "Sem contas",
-    "send": "Enviar",
-    "cancel": "Cancelar",
-    "audioFile": "Arquivo de áudio",
-    "attachImages": "Anexar imagens",
-    "multipartFormData": "Multipart Form Data",
-    "upToImages": "Até {count} imagens",
-    "selectAudioFile": "Selecionar arquivo de áudio",
-    "clearAll": "Limpar tudo",
-    "request": "Requisição",
-    "response": "Resposta",
-    "transcription": "Transcrição",
-    "copy": "Copiar",
-    "resetToDefault": "Restaurar padrão",
-    "downloadAudio": "Baixar áudio",
-    "copyText": "Copiar texto",
-    "transcriptionHint": "Dica de transcrição",
-    "imagesGenerated": "{count} imagens geradas",
-    "generatedImage": "Imagem gerada {index}",
-    "save": "Salvar",
-    "endpointOptions": {
-      "chat": "Chat",
-      "responses": "Responses",
-      "images": "Images",
-      "embeddings": "Embeddings",
-      "speech": "Speech",
-      "transcription": "Transcription",
-      "video": "Video",
-      "music": "Music",
-      "rerank": "Rerank",
-      "search": "Search"
-    },
-    "conversationalChat": "Bate-papo conversacional",
-    "clearChat": "Limpar bate-papo",
-    "typeMessagePlaceholder": "Digite uma mensagem... (Shift+Enter para nova linha)",
-    "tabChat": "Chat",
-    "tabCompare": "Comparar",
-    "tabApi": "API",
-    "tabBuild": "Construir",
-    "configPane": "Config",
-    "systemPrompt": "System prompt",
-    "systemPromptPlaceholder": "Você é um assistente útil.",
-    "modelPlaceholder": "ex.: openai/gpt-4o",
-    "endpointLabel": "Endpoint",
-    "parametersLabel": "Parâmetros",
-    "collapseConfig": "Recolher painel de config",
-    "expandConfig": "Expandir painel de config",
-    "temperature": "Temperatura",
-    "maxTokens": "Máx. tokens",
-    "topP": "Top-p",
-    "presencePenalty": "Penalidade de presença",
-    "frequencyPenalty": "Penalidade de frequência",
-    "seedPlaceholder": "Aleatório (deixar vazio)",
-    "presetsLabel": "Presets",
-    "loadPreset": "Carregar preset",
-    "savePreset": "Salvar preset",
-    "noPresets": "Nenhum preset",
-    "presetNamePlaceholder": "Nome do preset",
-    "savingPreset": "Salvando…",
-    "nameRequired": "Nome é obrigatório",
-    "failedToSavePreset": "Falha ao salvar preset",
-    "improvePrompt": "Melhorar prompt",
-    "improvingPrompt": "Melhorando…",
-    "improvePromptTitle": "Melhorar seu prompt com IA",
-    "setModelFirst": "Defina um modelo primeiro",
-    "improveQuotaWarning": "Isso consumirá cota do modelo configurado no painel Config.",
-    "improveConfirm": "Melhorar",
-    "exportCode": "Exportar código",
-    "exportCodeTitle": "Exportar Código",
-    "exportShort": "Exportar",
-    "noStateToExport": "Nenhum estado de playground disponível para exportar.",
-    "closeExportModal": "Fechar modal de exportação",
-    "close": "Fechar",
-    "exportRealKeyWarning": "Aviso de segurança: exportação bloqueada — uma API key real foi detectada na saída. Por favor, redefina sua API key e tente novamente.",
-    "placeholderHintPrefix": "Substitua",
-    "placeholderHintSuffix": "pela sua API key real, ou defina como variável de ambiente.",
-    "copyLangCode": "Copiar código {language}",
-    "loadingPresets": "Carregando…",
-    "loadPresetPlaceholder": "Carregar preset…",
-    "copyCode": "Copiar",
-    "copiedCode": "Copiado!",
-    "addModel": "+ Adicionar modelo",
-    "runAll": "Executar todos",
-    "cancelAll": "Cancelar todos",
-    "maxColumnsReached": "Máximo de {max} colunas",
-    "modelPlaceholderCompare": "Modelo (Cmd+K)…",
-    "ttft": "TTFT",
-    "tps": "TPS",
-    "metricsDisclaimer": "estimativa do cliente",
-    "tokensLabel": "Tokens",
-    "costLabel": "Custo",
-    "costEstimated": "(estimado)",
-    "toolsLabel": "Ferramentas",
-    "addTool": "Adicionar ferramenta",
-    "toolNamePlaceholder": "Nome da função",
-    "toolDescPlaceholder": "Descrição (opcional)",
-    "toolParamsInvalid": "Parâmetros devem ser JSON válido",
-    "structuredOutputLabel": "Saída Estruturada",
-    "enableJsonMode": "Ativar modo JSON",
-    "disableJsonMode": "Desativar modo JSON",
-    "invalidJson": "JSON inválido",
-    "running": "Executando…",
-    "runLabel": "Executar",
-    "enterToolResult": "Insira o resultado da ferramenta…",
-    "build": {
-      "step1Label": "O que testar?",
-      "step2Label": "Configurar",
-      "step3Label": "Rodar",
-      "step1Title": "O que você quer testar?",
-      "step1Subtitle": "Escolha a funcionalidade que deseja explorar nesta sessão.",
-      "step2Title": "Configurar",
-      "step2Subtitle": "Configure as ferramentas ou o esquema JSON que serão usados na requisição.",
-      "step3Title": "Rodar",
-      "modeToolsTitle": "Ferramentas",
-      "modeToolsDesc": "Teste function calling — defina ferramentas e veja como o modelo as invoca.",
-      "modeJsonTitle": "JSON",
-      "modeJsonDesc": "Teste saída estruturada — restrinja a resposta a um esquema JSON.",
-      "modeBothTitle": "Ferramentas + JSON",
-      "modeBothDesc": "Combine function calling e saída estruturada em uma única requisição.",
-      "backButton": "Voltar",
-      "nextButton": "Próximo",
-      "runButton": "Executar",
-      "promptPlaceholder": "Digite sua mensagem… (Enter para enviar, Shift+Enter para nova linha)"
-    }
-  },
-  "pricingModal": {
-    "title": "Configuração de preços",
-    "loading": "Carregando dados de preços...",
-    "pricingRatesFormat": "Formato de taxas de preços",
-    "ratesDescription": "Todas as taxas estão em <strong>dólares por milhão de tokens</strong> (US$/1 milhão de tokens). Exemplo: taxa de entrada de 2,50 significa US$ 2,50 por 1.000.000 de tokens de entrada.",
-    "model": "Modelo",
-    "input": "Entrada",
-    "output": "Saída",
-    "cached": "Em cache",
-    "reasoning": "Raciocínio",
-    "cacheCreation": "Criação de Cache",
-    "noPricingData": "Não há dados de preços disponíveis",
-    "resetToDefaults": "Redefinir para os padrões",
-    "cancel": "Cancelar",
-    "saving": "Salvando...",
-    "saveChanges": "Salvar alterações",
-    "resetConfirm": "Redefinir todos os preços para os padrões? Isto não pode ser desfeito.",
-    "errorSaveFailed": "Falha ao salvar o preço",
-    "errorResetFailed": "Falha ao redefinir o preço"
-  },
   "providers": {
     "title": "Provedores",
+    "Account Deactivated": "__MISSING__:Account Deactivated",
     "allProviders": "Todos os provedores",
     "audioProviders": "Provedores de áudio",
     "showFreeOnly": "Somente grátis",
@@ -4368,6 +3892,33 @@
     "addFirstProvider": "Adicione seu primeiro provedor",
     "addFirstProviderDesc": "Conecte um provedor de IA para começar a rotear solicitações por meio do OmniRoute. Você pode usar provedores gratuitos, chaves de API ou contas OAuth.",
     "learnMore": "Saiba mais",
+    "adaptaTutorial": {
+      "title": "__MISSING__:How to connect Adapta Web",
+      "introPrefix": "__MISSING__:Adapta authenticates through Clerk. The token",
+      "introSuffix": "__MISSING__:is a long-lived JWT that lets OmniRoute refresh sessions automatically.",
+      "or": "__MISSING__:or",
+      "step1Title": "__MISSING__:Open Adapta chat",
+      "step1DescPrefix": "__MISSING__:Open",
+      "step1DescSuffix": "__MISSING__:and sign in with your Gold or Business account.",
+      "step2Title": "__MISSING__:Open DevTools",
+      "step2DescPrefix": "__MISSING__:Press",
+      "step2DescSuffix": "__MISSING__:to open Developer Tools.",
+      "step3Title": "__MISSING__:Go to Application → Cookies",
+      "step3DescPrefix": "__MISSING__:In the",
+      "step3DescMiddle": "__MISSING__:expand",
+      "step3DescSuffix": "__MISSING__:and click",
+      "step4Title": "__MISSING__:Copy the cookie value for",
+      "step4DescPrefix": "__MISSING__:Find the cookie named",
+      "step4DescMiddle": "__MISSING__:in the list. Click it and copy the content from the",
+      "step4DescSuffix": "__MISSING__:column. It starts with",
+      "step5Title": "__MISSING__:Paste it here and save",
+      "step5DescPrefix": "__MISSING__:Click",
+      "step5DescMiddle": "__MISSING__:paste the",
+      "step5DescSuffix": "__MISSING__:value into the API Key field, then save. OmniRoute will refresh the session automatically.",
+      "tipLabel": "__MISSING__:Tip:",
+      "tipPrefix": "__MISSING__:The",
+      "tipSuffix": "__MISSING__:cookie is long-lived, usually for months. You only need to renew it if you sign out or Adapta invalidates the session."
+    },
     "editProvider": "Editar Provedor",
     "deleteProvider": "Excluir Provedor",
     "noProviders": "Nenhum provedor configurado",
@@ -4393,7 +3944,6 @@
     "apiKeyProviders": "Provedores por Chave de API",
     "compatibleProviders": "Provedores Compatíveis por Chave de API",
     "testAll": "Testar Todos",
-    "freeBadge": "Grátis",
     "distributeProxies": "Distribuir proxies",
     "distributing": "Distribuindo...",
     "selectedCount": "{count, plural, one {# selecionada} other {# selecionadas}}",
@@ -4402,9 +3952,30 @@
     "testAllFree": "Testar todas as conexões gratuitas",
     "testAllApiKey": "Testar todas as conexões por chave de API",
     "testAllCompatible": "Testar todas as conexões compatíveis",
+    "testAllModels": "__MISSING__:Test all models",
+    "testAllModelsConfirm": "__MISSING__:Test all visible models? Failed models will be hidden if auto-hide is enabled.",
+    "testingAllModels": "__MISSING__:Testing {done}/{total}...",
+    "testAllResults": "__MISSING__:{ok} of {total} models working",
+    "noModelsToTest": "__MISSING__:No models match the current filter",
+    "showAllModels": "__MISSING__:All",
+    "showVisibleOnly": "__MISSING__:Visible only",
+    "freeFilterAll": "__MISSING__:All",
+    "freeFilterFreeOnly": "__MISSING__:Free only",
+    "freeFilterPaidOnly": "__MISSING__:Paid only",
+    "sortFreeFirst": "__MISSING__:Free first",
+    "showHiddenOnly": "__MISSING__:Hidden only",
+    "filterByVisibility": "__MISSING__:Filter by visibility",
+    "autoHideFailed": "__MISSING__:Auto-hide failed models",
+    "autoHideFailedHint": "__MISSING__:When enabled, Test all hides non-transient failures from public catalogs such as /v1/models. Single-model tests never auto-hide.",
     "connected": "{count} Conectado(s)",
     "errorCount": "{count} Erro ({code})",
     "errorCountNoCode": "{count} Erro",
+    "testAllCompleted": "__MISSING__:Tested {total} models: {ok} OK, {failed} failed",
+    "modelAutoHidden": "__MISSING__:Model {model} auto-hidden (test failed)",
+    "filterAll": "__MISSING__:All",
+    "filterVisible": "__MISSING__:Visible only",
+    "filterHidden": "__MISSING__:Hidden only",
+    "modelsHiddenCount": "__MISSING__:{count} hidden",
     "warningCount": "{count} Aviso",
     "noConnections": "Sem conexões",
     "expiredBadge": "Expired",
@@ -4514,7 +4085,16 @@
     "batchUpdateNone": "Nenhuma conexão foi atualizada (podem não existir mais)",
     "batchRetestLimit": "Reteste até {max} conexões por vez",
     "noConnectionsToTest": "Nenhuma conexão correspondente para testar",
+    "batchDeleteConfirmTitle": "__MISSING__:Delete connections",
+    "batchDeleteConfirmButton": "__MISSING__:Delete",
+    "filterActive": "__MISSING__:Active",
+    "filterError": "__MISSING__:Error",
+    "filterBanned": "__MISSING__:Banned",
+    "filterCreditsExhausted": "__MISSING__:Credits Exhausted",
+    "noFilteredConnections": "__MISSING__:No connections match the current filter.",
     "failedSetAlias": "Falha ao definir alias",
+    "setAliasSuccess": "__MISSING__:Alias {alias} set",
+    "deleteAliasSuccess": "__MISSING__:Alias {alias} deleted",
     "failedSaveConnection": "Falha ao salvar conexão",
     "failedSaveConnectionRetry": "Falha ao salvar conexão. Tente novamente.",
     "failedRetestConnection": "Falha ao retestar conexão",
@@ -4549,6 +4129,8 @@
     "fetchingModels": "Buscando modelos disponíveis...",
     "failedFetchModels": "Falha ao buscar modelos",
     "noFreeModelsFound": "Nenhum modelo gratuito encontrado para este provedor — nada importado.",
+    "fetchModelsSuccess": "__MISSING__:Found {count} new models",
+    "fetchModelsFailed": "__MISSING__:Could not auto-fetch models (you can retry from settings)",
     "noModelsFound": "Nenhum modelo encontrado",
     "importFailed": "Falha na importação",
     "noNewModelsAdded": "Nenhum novo modelo foi adicionado.",
@@ -4557,6 +4139,10 @@
     "importingModelsTitle": "Importando Modelos",
     "copyModel": "Copiar modelo",
     "filterModels": "Filtrar modelos...",
+    "testAllRateLimited": "__MISSING__:Rate limit reached, stopped early",
+    "hideFailedAuto": "__MISSING__:Auto-hide failed models",
+    "selectAllModels": "Selecionar todos",
+    "hideAllModels": "__MISSING__:Hide all",
     "modelsActive": "ativos",
     "showModel": "Mostrar modelo",
     "hideModel": "Ocultar modelo",
@@ -4565,6 +4151,9 @@
     "rateLimitUnprotected": "Desprotegido",
     "enableRateLimitProtection": "Clique para habilitar proteção de limite de taxa",
     "disableRateLimitProtection": "Clique para desabilitar proteção de limite de taxa",
+    "testAllProgress": "__MISSING__:Tested {done}/{total}",
+    "testAllFailedHidden": "__MISSING__:{count} failed models hidden",
+    "testAllDone": "__MISSING__:All models tested",
     "productionKey": "Chave de Produção",
     "enterNewApiKey": "Insira a nova chave API",
     "codexApplyModalTitle": "Inscreva-se no Codex Local",
@@ -4607,15 +4196,6 @@
     "configured": "configurado",
     "providerProxyConfigureHint": "Configurar proxy para todas as conexões deste provedor",
     "providerProxy": "Proxy do Provedor",
-    "proxyConfiguredBySource": "Proxy ({source}): {host}",
-    "proxyOn": "Proxy ligado",
-    "proxyOff": "Proxy desligado",
-    "proxyEnabledTitle": "Proxy ativado para esta conta",
-    "proxyDisabledTitle": "Proxy desativado para esta conta",
-    "perKeyProxyOn": "Por chave",
-    "perKeyProxyOff": "Por conta",
-    "perKeyProxyEnabledTitle": "Distribuição de proxy por chave ativada para este provedor",
-    "perKeyProxyDisabledTitle": "Distribuição de proxy por conta ativada para este provedor",
     "repairEnv": "Repair env",
     "repairEnvWorking": "Repairing...",
     "repairEnvHint": "Restore missing OAuth defaults into .env without overwriting existing values.",
@@ -4649,9 +4229,20 @@
     "errorTypeNetworkError": "Erro de rede",
     "errorTypeTestUnsupported": "Teste não suportado",
     "errorTypeUpstreamError": "Erro upstream",
+    "errorTypeCreditsExhausted": "__MISSING__:No credits",
+    "errorTypeBanned": "__MISSING__:403 Banned",
     "proxySourceGlobal": "Global",
     "proxySourceProvider": "Provedor",
     "proxySourceKey": "Chave",
+    "proxyConfiguredBySource": "Proxy ({source}): {host}",
+    "proxyOn": "Proxy ligado",
+    "proxyOff": "Proxy desligado",
+    "proxyEnabledTitle": "Proxy ativado para esta conta",
+    "proxyDisabledTitle": "Proxy desativado para esta conta",
+    "perKeyProxyOn": "Por chave",
+    "perKeyProxyOff": "Por conta",
+    "perKeyProxyEnabledTitle": "Distribuição de proxy por chave ativada para este provedor",
+    "perKeyProxyDisabledTitle": "Distribuição de proxy por conta ativada para este provedor",
     "autoPriority": "Auto: {priority}",
     "proxy": "Proxy",
     "retestAuthentication": "Retestar autenticação",
@@ -4679,6 +4270,12 @@
     "compatProtocolOpenAI": "OpenAI Chat Completions",
     "compatProtocolOpenAIResponses": "OpenAI Responses API",
     "compatProtocolClaude": "Anthropic Messages",
+    "targetFormatLabel": "__MISSING__:Target Format",
+    "targetFormatHint": "__MISSING__:Override the upstream wire format. Use 'Anthropic Messages' to route OpenAI-compatible providers (e.g. opencode-go) through the /v1/messages endpoint.",
+    "targetFormatAuto": "__MISSING__:Default (auto)",
+    "targetFormatGemini": "__MISSING__:Gemini",
+    "targetFormatGeminiCli": "__MISSING__:Gemini CLI",
+    "targetFormatAntigravity": "__MISSING__:Antigravity",
     "compatUpstreamHeadersLabel": "Extra upstream headers",
     "compatUpstreamHeadersHint": "High-privilege setting — same trust level as editing provider API credentials; only trusted admins should use it. Merged after OmniRoute adds auth from the provider API key. If a custom header uses the same name as an existing one (e.g. Authorization), your value fully replaces the auto-generated header (including the Bearer token) — the upstream only sees what you typed, not the key from settings. Misconfiguration can cause 401 or broken upstream auth. One row per header (e.g. extra Authentication for some gateways). Hover or focus the value to preview. Saves on blur, outside click, or closing this panel.",
     "compatUpstreamHeaderName": "Header name",
@@ -4725,7 +4322,6 @@
     "email": "Email",
     "healthCheckMinutes": "Health Check (min)",
     "healthCheckHint": "Intervalo proativo de renovação de token. 0 = desativado.",
-    "selectAllModels": "Selecionar todos",
     "deselectAllModels": "Desmarcar todos",
     "modelsActiveCount": "{active}/{total} ativos",
     "noModelsMatch": "Nenhum modelo corresponde a \"{filter}\"",
@@ -4737,6 +4333,9 @@
     "editCompatibleTitle": "Editar Compatível {type}",
     "compatibleBaseUrlHint": "Root URL of your {type}-compatible API. Use Advanced Settings for custom endpoint paths.",
     "apiKeyForCheck": "Chave de API (para verificação)",
+    "testModelIdLabel": "__MISSING__:Model ID (optional)",
+    "testModelIdPlaceholder": "__MISSING__:e.g. my-model-id",
+    "testModelIdHint": "__MISSING__:If the provider lacks a /models endpoint, enter a model ID to validate via /chat/completions instead.",
     "compatibleProdPlaceholder": "{type} Compatível (Prod)",
     "tokenRefreshed": "Token refreshed successfully",
     "tokenRefreshFailed": "Token refresh failed",
@@ -4830,6 +4429,19 @@
     "codexAuthApplyFailed": "Falha ao aplicar o auth.json do Codex localmente",
     "codexAuthExported": "auth.json do Codex exportado",
     "codexAuthExportFailed": "Falha ao exportar o auth.json do Codex",
+    "codexCliGuideButton": "__MISSING__:Codex CLI Guide",
+    "codexCliGuideTitle": "__MISSING__:Codex CLI Guide",
+    "codexCliGuideLoading": "__MISSING__:Loading guide...",
+    "codexCliGuideLoadFailed": "__MISSING__:Could not load the guide.",
+    "codexExternalLinkButton": "__MISSING__:External Codex link",
+    "codexExternalLinkModalTitle": "__MISSING__:External Codex link",
+    "codexExternalLinkModalDescription": "__MISSING__:Share this single-use link with the person who will authenticate the Codex account. They open it in their own browser, complete the OpenAI login, and the connection is registered here. The link expires in 15 minutes.",
+    "codexExternalLinkGenerating": "__MISSING__:Generating link...",
+    "codexExternalLinkWaiting": "__MISSING__:Waiting for browser authentication. This window refreshes automatically.",
+    "codexExternalLinkCreateFailed": "__MISSING__:Failed to generate the link.",
+    "codexExternalLinkNetworkError": "__MISSING__:Could not contact the server.",
+    "codexExternalLinkConnected": "__MISSING__:Codex account connected through the external link.",
+    "codexExternalLinkExpired": "__MISSING__:The link expired before completion.",
     "importCodexAuth": "Importar autenticação",
     "codexImportModalTitle": "Importar autenticação do Codex",
     "codexImportTabSingle": "Solteiro",
@@ -4907,6 +4519,8 @@
     "t3ChatWebCookiePlaceholder": "id-de-sessão-convexa=abc123...",
     "blockClaudeExtraUsageDescription": "Quando habilitado, o OmniRoute marca esta conta do Claude Code como indisponível assim que a API de usage reporta `extra_usage.queued`, para que o fallback troque para outra conta antes de continuar com cobranças extras pay-as-you-go.",
     "blockClaudeExtraUsageLabel": "Bloquear Claude Extra Usage",
+    "disableCoolingDescription": "__MISSING__:Skip the transient cooldown so this connection stays eligible even after recoverable errors (terminal states like banned/expired still apply).",
+    "disableCoolingLabel": "__MISSING__:Disable cooldown for this connection",
     "bulkPasteAdded": "{count, plural, one {1 chave adicionada} other {# chaves adicionadas}}",
     "bulkPasteDuplicatesIgnored": "{count, plural, one {1 duplicata ignorada} other {# duplicatas ignoradas}}",
     "bulkPasteHint": "Cole uma chave de API por linha. Linhas vazias são ignoradas e chaves duplicadas são puladas.",
@@ -5004,6 +4618,17 @@
     "personalAccessTokenLabel": "Personal Access Token",
     "qoderPatHint": "Fluxo suportado: PAT via qodercli. OAuth pelo navegador continua experimental.",
     "qoderPatPlaceholder": "Cole seu Personal Access Token do Qoder",
+    "rateLimitOverridesSection": "__MISSING__:Rate Limit Overrides",
+    "rateLimitOverridesMaxConcurrentHint": "__MISSING__:Max concurrent requests override for this connection. Overrides the account-level cap.",
+    "rateLimitOverridesMaxConcurrentLabel": "__MISSING__:Max Concurrent (Rate Limit)",
+    "rateLimitOverridesMinTimeHint": "__MISSING__:Minimum time (ms) between requests. Overrides the default rate limiter delay.",
+    "rateLimitOverridesMinTimeLabel": "__MISSING__:Min Interval (ms)",
+    "rateLimitOverridesRpmHint": "__MISSING__:Max requests per minute for this connection. Overrides the provider default.",
+    "rateLimitOverridesRpmLabel": "__MISSING__:RPM (Requests/min)",
+    "rateLimitOverridesTpdHint": "__MISSING__:Max tokens per day for this connection. Overrides the provider default.",
+    "rateLimitOverridesTpdLabel": "__MISSING__:TPD (Tokens/day)",
+    "rateLimitOverridesTpmHint": "__MISSING__:Max tokens per minute for this connection. Overrides the provider default.",
+    "rateLimitOverridesTpmLabel": "__MISSING__:TPM (Tokens/min)",
     "refreshOauthTokenTitle": "Atualizar token OAuth manualmente",
     "regionHint": "ex.: us-central1 ou europe-west4. Modelos partner usam a região global automaticamente.",
     "regionLabel": "Região",
@@ -5184,537 +4809,21 @@
     "webNoAuthGuideBody": "{provider} não precisa de chave de API ou cookie. Salve a conexão para usar seu endpoint web gratuito.",
     "webSessionCredentialValidationFailed": "Falha na validação da credencial da sessão. Faça login novamente, copie uma nova credencial e tente novamente.",
     "checkCookie": "Verifique o cookie",
-    "checkWebToken": "Verifique o token"
-  },
-  "proxyConfigModal": {
-    "levelGlobal": "Globais",
-    "levelProvider": "Provedor",
-    "levelCombo": "Combinação",
-    "levelKey": "Chave",
-    "levelDirect": "Direto (sem proxy)",
-    "titleGlobal": "Configuração de proxy global",
-    "titleLevel": "{level} Proxy — {label}",
-    "loading": "Carregando configuração de proxy...",
-    "inheritingFrom": "Herdando de",
-    "source": "Fonte",
-    "savedProxy": "Proxy salvo",
-    "custom": "Personalizado",
-    "selectSavedProxyPlaceholder": "Selecione o proxy salvo...",
-    "proxyType": "Tipo de proxy",
-    "host": "Anfitrião",
-    "hostPlaceholder": "1.2.3.4 ou proxy.example.com",
-    "port": "Porto",
-    "authOptional": "Autenticação (opcional)",
-    "username": "Nome de usuário",
-    "usernamePlaceholder": "Nome de usuário",
-    "password": "Senha",
-    "passwordPlaceholder": "Senha",
-    "connected": "Conectado",
-    "ip": "IP:",
-    "connectionFailed": "Falha na conexão",
-    "testConnection": "Conexão de teste",
-    "clear": "Limpar",
-    "cancel": "Cancelar",
-    "save": "Salvar",
-    "errorSelectSavedProxy": "Selecione primeiro um proxy salvo.",
-    "errorSelectProxyFirst": "Selecione um proxy primeiro.",
-    "errorProxyNotFound": "Proxy selecionado não encontrado.",
-    "errorClearSavedProxy": "Falha ao limpar o proxy salvo",
-    "errorSaveProxy": "Falha ao salvar a configuração do proxy",
-    "errorClearProxy": "Falha ao limpar a configuração do proxy",
-    "errorSocks5Hidden": "SOCKS5 está configurado, mas oculto porque NEXT_PUBLIC_ENABLE_SOCKS5_PROXY=false."
-  },
-  "proxyLogger": {
-    "filterAll": "All",
-    "filterErrors": "Errors",
-    "filterSuccess": "Success",
-    "filterTimeout": "Timeout",
-    "colStatus": "Status",
-    "colProxy": "Proxy",
-    "colTls": "TLS",
-    "colType": "Type",
-    "colLevel": "Level",
-    "colProvider": "Provider",
-    "colTarget": "Target",
-    "colLatency": "Latency",
-    "colPublicIp": "Public IP",
-    "colTime": "Time",
-    "recording": "Recording",
-    "paused": "Paused",
-    "searchPlaceholder": "Search host, provider, target, IP...",
-    "allTypes": "All Types",
-    "allLevels": "All Levels",
-    "allProviders": "All Providers",
-    "total": "total",
-    "ok": "OK",
-    "err": "ERR",
-    "timeoutShort": "TMO",
-    "direct": "direct",
-    "newest": "Newest",
-    "oldest": "Oldest",
-    "latencyDesc": "Latency ↓",
-    "latencyAsc": "Latency ↑",
-    "refresh": "Refresh",
-    "columns": "Columns",
-    "loadingProxyLogs": "Loading proxy logs...",
-    "noProxyLogs": "No proxy logs yet. Configure proxies and make API calls to see them here.",
-    "noMatchingLogs": "No logs match the current filters.",
-    "tlsFingerprint": "Chrome 124 TLS Fingerprint"
-  },
-  "proxyRegistry": {
-    "title": "Title",
-    "description": "Description",
-    "importLegacy": "Import Legacy",
-    "bulkAssign": "Bulk Assign",
-    "addProxy": "Add Proxy",
-    "loading": "Loading",
-    "noProxies": "No Proxies",
-    "tableName": "Table Name",
-    "tableEndpoint": "Table Endpoint",
-    "tableStatus": "Table Status",
-    "tableHealth": "Table Health",
-    "tableUsage": "Table Usage",
-    "tableActions": "Table Actions",
-    "test": "Test",
-    "edit": "Edit",
-    "delete": "Delete",
-    "modalCreateTitle": "Modal Create Title",
-    "modalEditTitle": "Modal Edit Title",
-    "labelName": "Label Name",
-    "labelType": "Tipo",
-    "labelHost": "Anfitrião",
-    "labelPort": "Porto",
-    "labelUsername": "Nome de usuário",
-    "labelPassword": "Senha",
-    "labelRegion": "Região",
-    "labelStatus": "Estado",
-    "labelNotes": "Notas",
-    "usernamePlaceholderEdit": "Deixe em branco para manter o nome de usuário atual",
-    "passwordPlaceholderEdit": "Deixe em branco para manter a senha atual",
-    "statusActive": "Ativo",
-    "statusInactive": "Inativo",
-    "cancel": "Cancelar",
-    "save": "Salvar",
-    "bulkModalTitle": "Atribuição de proxy em massa",
-    "bulkLabelScope": "Escopo",
-    "bulkLabelProxy": "Procurador",
-    "bulkClearAssignment": "(Limpar tarefa)",
-    "bulkLabelScopeIds": "IDs de escopo (separados por vírgula ou nova linha)",
-    "bulkScopeIdsPlaceholder": "provedor-openai,provedor-antrópico",
-    "bulkApply": "Aplicar",
-    "labelScope": "Escopo",
-    "labelProxy": "Proxy",
-    "scopeGlobal": "global",
-    "scopeProvider": "provedor",
-    "scopeAccount": "conta",
-    "scopeCombo": "combo",
-    "bulkImportErrorMissingName": "NOME ausente",
-    "bulkImportErrorMissingHost": "HOST ausente",
-    "bulkImportErrorInvalidPort": "PORTA inválida (deve ser 1-65535)",
-    "bulkImportErrorInvalidType": "TYPE inválido (use http, https ou meias5)",
-    "bulkImportErrorInvalidStatus": "STATUS inválido (use ativo ou inativo)",
-    "errorLoadFailed": "Error Load Failed",
-    "errorNameHostRequired": "Error Name Host Required",
-    "errorSaveFailed": "Error Save Failed",
-    "errorDeleteFailed": "Error Delete Failed",
-    "errorForceDeleteConfirm": "Error Force Delete Confirm",
-    "errorMigrateFailed": "Error Migrate Failed",
-    "errorBulkFailed": "Error Bulk Failed",
-    "success": "✓",
-    "failure": "✗",
-    "failed": "Failed",
-    "successRate": "{rate}% de sucesso",
-    "avgLatency": "Média de {latency}ms",
-    "assignmentsCount": "{count} atribuições",
-    "noData": "No Data",
-    "testSuccess": "✓ {ip}",
-    "testLatency": "{latency}ms",
-    "testFailure": "✗ {error}",
-    "bulkImport": "Importação em massa",
-    "bulkImportTitle": "Proxies de importação em massa",
-    "bulkImportDescription": "Cole perfis de proxy usando formato delimitado por barras verticais. Um proxy por linha. Os proxies existentes (mesmo host + porta) serão atualizados.",
-    "bulkImportParse": "Analisar",
-    "bulkImportImport": "Importar proxies {count}",
-    "bulkImportImporting": "Importando...",
-    "bulkImportParsed": "{count} proxies analisados",
-    "bulkImportSkipped": "{count} linhas ignoradas",
-    "bulkImportParseErrors": "{count} erros",
-    "bulkImportNoValidEntries": "Nenhuma entrada válida encontrada. Verifique o formato e tente novamente.",
-    "bulkImportSuccess": "Importação concluída: {created} criado, {updated} atualizado, {failed} falhou",
-    "bulkImportErrorLine": "Linha {line}: {reason}",
-    "bulkImportMaxExceeded": "Máximo de 100 proxies por importação",
-    "bulkImportPreview": "Visualização",
-    "clearAssignment": "(atribuição clara)",
-    "bulkProxyAssignment": "Atribuição de proxy em massa"
-  },
-  "quotaShare": {
-    "title": "Compartilhamento de Cota",
-    "description": "Compartilhe cotas de provedores entre API keys com limites %",
-    "newPool": "Novo pool",
-    "betaTitle": "Beta",
-    "betaDescription": "A configuração é salva em localStorage (ainda não persistida no servidor). A aplicação dos caps por request ainda não está conectada ao pipeline da proxy. Esta tela permite desenhar e visualizar a divisão de cota; a aplicação real virá em uma próxima iteração com persistência no banco e interceptação na chamada upstream.",
-    "kpiActivePools": "Pools ativos",
-    "kpiKeysAllocated": "Keys alocadas",
-    "kpiAvgUnallocated": "Média não alocada",
-    "kpiProvidersWithQuota": "Providers c/ cota",
-    "emptyTitle": "Nenhum pool configurado",
-    "emptyDescription": "Crie um pool para atribuir API keys e compartilhar uma janela de cota do provedor com alocações %.",
-    "loading": "Carregando…",
-    "removePool": "Remover pool",
-    "removeConfirm": "Remover este pool?",
-    "pool": "Pool",
-    "used": "usado",
-    "allocationsCount": "Alocações ({count})",
-    "allocatedFree": "{allocated}% alocado · {free}% livre",
-    "noAllocations": "Nenhuma key alocada ainda",
-    "capLabel": "cap {value}",
-    "notTrackedYet": "(ainda não rastreado)",
-    "policy": "Política",
-    "policyHard": "hard",
-    "policySoft": "soft",
-    "policyBurst": "burst",
-    "policyHardHint": "Bloqueia quando key esgota alocação",
-    "policySoftHint": "Permite overflow, apenas alerta",
-    "policyBurstHint": "Permite burst para o pool livre",
-    "editAllocations": "Editar alocações",
-    "newPoolTitle": "Novo pool de cota",
-    "providerConnection": "Conexão de provider (conta)",
-    "selectConnection": "Selecione uma conexão…",
-    "noEligibleConnections": "Nenhuma conexão com dados de cota. Atualize em /dashboard/quota primeiro.",
-    "quotaWindow": "Janela de cota",
-    "selectWindow": "Selecione uma janela…",
-    "alreadyUsedSuffix": "(já utilizada)",
-    "windowReset": "Reset",
-    "duplicatePoolError": "Já existe um pool para esta conexão + janela",
-    "cancel": "Cancelar",
-    "createPool": "Criar pool",
-    "editTitle": "Editar alocações",
-    "noKeysAdded": "Nenhuma key alocada. Adicione uma abaixo.",
-    "totalLabel": "Total: {percent}%",
-    "totalExceeded": "⚠ excede 100%",
-    "addKey": "+ Adicionar key…",
-    "equalSplit": "Divisão igual",
-    "save": "Salvar alocações",
-    "betaPreviewLabel": "Beta – visualização da IU.",
-    "betaConfigSavedPrefix": "A configuração é salva em",
-    "betaConfigSavedSuffix": "(ainda não persistido no servidor). A aplicação do limite por solicitação ainda não está conectada ao pipeline do proxy. Esta tela permite desenhar e visualizar a divisão de cotas; a aplicação real chegará em uma iteração futura com persistência de banco de dados e interceptação de chamadas upstream.",
-    "policyLabel": "Política:",
-    "resetIn": "redefinir em",
-    "quotaTotal": "total",
-    "kpiAvgUtilization": "Util média",
-    "kpiBorrowingNow": "Em empréstimo agora",
-    "conceptTitle": "Como funciona o Quota Share",
-    "conceptIntro": "O Quota Share divide a cota de um provider entre múltiplas API keys usando fair-share work-conserving: cada key recebe uma fatia proporcional, mas pode tomar emprestado do saldo livre sem estourar o teto global.",
-    "conceptFairShare": "Fair-share: cada key recebe proporcionalmente ao peso configurado",
-    "conceptBorrowing": "Empréstimo: keys podem usar saldo livre de outras sem ultrapassar o teto",
-    "conceptGlobalCap": "Teto intransponível: o cap absoluto do provider nunca é excedido",
-    "conceptWindows": "Janelas: 5h, horária, diária, semanal, mensal — cada uma rastreada independentemente",
-    "conceptKeyHowTitle": "Habilitando uma key para cota",
-    "conceptKeyHowDesc": "Crie a key normalmente no Gerenciador de APIs — ela aparece automaticamente na etapa de keys do wizard. Marque Exclusiva lá para torná-la somente-cota. Não há etapa de ativação separada.",
-    "conceptExclusiveTitle": "O que \"Exclusiva\" faz",
-    "conceptExclusiveDesc": "Uma key exclusiva enxerga/usa apenas os modelos quotaShared-* do pool — todos os outros modelos ficam ocultos no seu /v1/models e bloqueados.",
-    "burnRateTitle": "Taxa de consumo",
-    "burnRateExhaustsIn": "Esgota em",
-    "dimensionResetIn": "Reset em",
-    "realConsumedColumn": "Consumido",
-    "deficitColumn": "Déficit",
-    "borrowingIndicator": "empréstimo",
-    "migratedFromLocalStorageNotice": "Pools migrados do localStorage com sucesso.",
-    "policyCapAbsoluteLabel": "Cap absoluto",
-    "policyCapAbsolutePlaceholder": "Limite numérico (opcional)",
-    "multiDimensionLabel": "Multi-dimensão",
-    "stackedBarTitle": "Fatias por API key",
-    "usedSuffix": "usou {percent}%",
-    "wizardTitle": "Novo pool de cota",
-    "editPoolTitle": "Editar pool",
-    "saveChanges": "Salvar alterações",
-    "wizardStep1Label": "Conta",
-    "wizardStep2Label": "Limite",
-    "wizardStep3Label": "Chaves",
-    "wizardStep1Title": "Escolha a conexão de provider",
-    "wizardStep1Subtitle": "Selecione a conta do provider cuja cota este pool compartilhará, defina um nome e a política padrão.",
-    "wizardStep2Title": "Configure as dimensões de cota",
-    "wizardStep2Subtitle": "Defina as dimensões do plano de cota (unidade, janela, limite) para a conexão escolhida. Deixe sem alteração para manter as configurações atuais.",
-    "wizardStep3Title": "Aloque API keys",
-    "wizardStep3Subtitle": "Atribua API keys a este pool com alocações de peso % e caps opcionais.",
-    "wizardPoolNameLabel": "Nome do pool",
-    "wizardPoolNamePlaceholder": "Meu pool de cota",
-    "wizardNext": "Avançar",
-    "wizardBack": "Voltar",
-    "wizardCreatePool": "Criar pool",
-    "wizardDimensionsEditedNotice": "Dimensões editadas — serão salvas como override manual quando o pool for criado.",
-    "wizardExclusiveLabel": "Cota exclusiva",
-    "wizardExclusiveHint": "Quando ativado, estas API keys só poderão usar os modelos virtuais deste pool (reconciliação de allowedQuotas aplicada ao salvar).",
-    "wizardPreviewLabel": "Prévia dos nomes de modelos virtuais",
-    "wizardConnectionsLabel": "Conexões de provider",
-    "wizardPrimaryBadge": "principal",
-    "wizardAdditionalConnectionsNote": "Conexões adicionais usam os limites padrão do catálogo (editáveis posteriormente).",
-    "wizardSingleProviderNote": "Um pool usa um provedor só",
-    "wizardPreviewMoreModels": "+{count} mais",
-    "accountQuotaTitle": "Cota da conta",
-    "accountQuotaNone": "—",
-    "logTitle": "Log de uso",
-    "logEmpty": "Sem uso ainda",
-    "groupLabel": "Grupo",
-    "newGroup": "Novo grupo",
-    "renameGroup": "Renomear grupo",
-    "groupSelectHint": "Filtrar pools por grupo",
-    "groupAllocationNote": "As alocações se aplicam a todos os pools deste grupo através da camada de cota compartilhada.",
-    "groupNamePrompt": "Digite o nome do grupo",
-    "wizardGroupLabel": "Grupo",
-    "allGroups": "Todos os grupos",
-    "endpointsTitle": "Endpoints disponíveis",
-    "endpointsHint": "Chame estes modelos virtuais com qualquer chave alocada — roteamento + cota são tratados por grupo.",
-    "previewForKey": "Pré-visualizar p/ chave",
-    "previewKeyNone": "(todos os endpoints)",
-    "endpointsBaseUrl": "URL base",
-    "endpointsCollapse": "Recolher",
-    "endpointsExpand": "Expandir",
-    "endpointsAnthropicNote": "nativo Anthropic",
-    "endpointsResponsesNote": "OpenAI Responses — codex/github",
-    "endpointsWsNote": "WebSocket — somente codex",
-    "betaText": "O Quota Share está funcional, mas bugs são esperados. Encontrou um? Reporte, por favor.",
-    "betaReportLink": "Abrir uma issue",
-    "deleteGroup": "Excluir grupo",
-    "deleteGroupConfirm": "Excluir este grupo? Os pools dele precisam ser reatribuídos ou removidos antes.",
-    "deleteGroupHasPools": "Este grupo ainda tem pools — reatribua ou exclua-os primeiro.",
-    "ungroupedTitle": "Sem grupo",
-    "ungroupedHint": "Estes pools não estão atribuídos a um grupo conhecido. Edite um pool para movê-lo para um grupo real."
-  },
-  "requestLogger": {
-    "recording": "Recording",
-    "paused": "Paused",
-    "pipelineLogsOn": "Pipeline logs on",
-    "pipelineLogsOff": "Pipeline logs off",
-    "updatingPipelineLogs": "Updating pipeline logs...",
-    "updatePipelineFailed": "Failed to update pipeline logging",
-    "capturePipeline": "Capture pipeline payloads for new requests",
-    "searchPlaceholder": "Search models, providers, accounts, API keys, combos...",
-    "allProviders": "All providers",
-    "allModels": "All models",
-    "allAccounts": "All accounts",
-    "allApiKeys": "All API keys",
-    "total": "Total",
-    "ok": "Success",
-    "err": "Error",
-    "combo": "Combo",
-    "keys": "Keys",
-    "shown": "Shown",
-    "sortNewest": "Newest",
-    "sortOldest": "Oldest",
-    "sortTokensDesc": "Tokens ↓",
-    "sortTokensAsc": "Tokens ↑",
-    "sortDurationDesc": "Duration ↓",
-    "sortDurationAsc": "Duration ↑",
-    "sortStatusDesc": "Status ↓",
-    "sortStatusAsc": "Status ↑",
-    "sortModelAsc": "Model A-Z",
-    "sortModelDesc": "Model Z-A",
-    "sortLogs": "Sort logs",
-    "refresh": "Refresh",
-    "columnsLabel": "Columns",
-    "cacheSem": "SEM",
-    "cacheUp": "UP",
-    "semantic": "Semantic",
-    "upstream": "Upstream",
-    "semanticCacheHit": "Semantic cache hit (served by OmniRoute)",
-    "upstreamResponse": "Upstream provider response",
-    "noApiKey": "No API key",
-    "requestedRoutedTitle": "Requested {requested}, routed as {routed}",
-    "statusFilters": {
-      "all": "All",
-      "error": "Errors",
-      "success": "Success",
-      "combo": "Combo"
-    },
-    "columns": {
-      "status": "Status",
-      "cacheSource": "Cache Source",
-      "model": "Model",
-      "requested": "Requested",
-      "provider": "Provider",
-      "protocol": "Request Protocol",
-      "account": "Account",
-      "apiKey": "API Key",
-      "combo": "Combo",
-      "tokens": "Tokens",
-      "compressed": "Compressão",
-      "tps": "TPS",
-      "duration": "Duration",
-      "time": "Time"
-    },
-    "loadingLogs": "Loading logs...",
-    "noLogs": "No logs yet. Make some API calls to see them here.",
-    "noMatchingLogs": "No logs matching current filters.",
-    "callLogsInfo": "Call logs are also saved as JSON files to {dataDir} and rotated based on {retentionDays} and {maxEntries}."
-  },
-  "runtime": {
-    "title": "Runtime",
-    "description": "Observabilidade em tempo real — 3 camadas de resiliência + sessões + alertas de quota",
-    "pause": "Pausar",
-    "resume": "Retomar",
-    "refreshNow": "Atualizar agora",
-    "kpiSessions": "Sessões",
-    "kpiCircuits": "Circuits",
-    "kpiCooldowns": "Cooldowns",
-    "kpiLockouts": "Lockouts",
-    "hintStickyBound": "{count} sticky-bound",
-    "hintRecovering": "{count} recuperando",
-    "hintAllHealthy": "tudo saudável",
-    "hintOpen": "aberto",
-    "hintConnsCooling": "conexões em cooldown",
-    "hintModelsBlocked": "modelos bloqueados",
-    "resilienceTitle": "Resiliência em 3 Camadas",
-    "resilienceSubtitle": "Espelha o modelo de resiliência documentado",
-    "providersHealthy": "{percent}% dos providers saudáveis",
-    "layer": "Camada {n}",
-    "layer1Title": "Provider Circuit Breakers",
-    "layer1Desc": "Bloqueia tráfego para providers falhando no upstream",
-    "layer2Title": "Cooldown de Conexões",
-    "layer2Desc": "Pula uma conta/key ruim; outras conexões continuam atendendo",
-    "layer3Title": "Lockout de Modelos",
-    "layer3Desc": "Travas de rate-limit por modelo; a mesma conexão ainda atende outros modelos",
-    "badgeAffectedOf": "{affected} de {total} afetados",
-    "badgeCooling": "{count} em cooldown",
-    "badgeLocked": "{count} travados",
-    "emptyCircuits": "Nenhum circuit breaker ativo",
-    "emptyCooldowns": "Nenhum cooldown de conexão ativo",
-    "emptyLockouts": "Nenhum lockout de modelo",
-    "moreCooldowns": "+{count} cooldowns adicionais",
-    "moreLockouts": "+{count} lockouts adicionais",
-    "feedTitle": "Feed ao Vivo",
-    "feedSubtitle": "Últimos {count} eventos",
-    "feedFilterAll": "Todos",
-    "feedFilterCircuits": "Circuits",
-    "feedFilterCooldowns": "Cooldowns",
-    "feedFilterLockouts": "Lockouts",
-    "feedFilterSessions": "Sessões",
-    "feedFilterQuotas": "Quotas",
-    "feedClear": "Limpar",
-    "feedEmptyWaiting": "Aguardando eventos... (poll a cada 5s)",
-    "feedEmptyFiltered": "Nenhum evento corresponde ao filtro",
-    "sessionsTitle": "Sessões Ativas",
-    "sessionsSubtitle": "Fingerprints de requisições sticky-bound (live)",
-    "sessionsActive": "{count} ativas",
-    "sessionsEmptyTitle": "Nenhuma sessão ativa",
-    "sessionsEmptyHint": "Sessões aparecem conforme as requisições passam pela proxy",
-    "tblSession": "Sessão",
-    "tblAge": "Idade",
-    "tblIdle": "Ocioso",
-    "tblReqs": "Reqs",
-    "tblBoundTo": "Vinculada a",
-    "topApiKeys": "Top API keys",
-    "quotaMonitorsTitle": "Monitores de Quota",
-    "quotaMonitorsSubtitle": "Estado live de quota por janela de conta",
-    "openQuota": "Abrir Quota",
-    "allQuotasHealthy": "Todas as quotas saudáveis",
-    "statusExhausted": "ESGOTADO",
-    "statusAlerting": "ALERTANDO",
-    "statusError": "ERRO",
-    "moreSuffix": "+{count} mais"
-  },
-  "search": {
-    "searchQuery": "Search Query",
-    "searchResults": "Search Results",
-    "cachedResult": "Cached",
-    "searchCost": "Cost",
-    "searchTools": "Search Tools",
-    "searchToolsDesc": "Advanced search testing with provider comparison",
-    "compareProviders": "Compare Providers",
-    "rerankResults": "Rerank Results",
-    "searchHistory": "Search History",
-    "urlOverlap": "URL Overlap",
-    "noSearchProviders": "No search providers configured. Add providers in Settings.",
-    "noRerankModels": "No rerank model available",
-    "webSearch": "Web Search",
-    "provider": "Provider",
-    "searchType": "Search Type",
-    "maxResults": "Max Results",
-    "filters": "Filters",
-    "country": "Country",
-    "language": "Language",
-    "timeRange": "Time Range",
-    "includeDomains": "Include Domains",
-    "excludeDomains": "Exclude Domains",
-    "safeSearch": "Safe Search",
-    "safeSearchOff": "Off",
-    "safeSearchModerate": "Moderate",
-    "safeSearchStrict": "Strict",
-    "queryPlaceholder": "Enter search query...",
-    "providerAuto": "auto (cheapest)",
-    "searchTypeWeb": "web",
-    "searchTypeNews": "news",
-    "optionAny": "any",
-    "timeRangeDay": "Past day",
-    "timeRangeWeek": "Past week",
-    "timeRangeMonth": "Past month",
-    "timeRangeYear": "Past year",
-    "domainPlaceholder": "example.com",
-    "requestTimedOut": "Request timed out ({seconds}s)",
-    "networkError": "Network error",
-    "formatted": "Formatted",
-    "rawJson": "JSON",
-    "cacheMiss": "cache miss",
-    "cacheHit": "cache hit",
-    "latency": "Latency",
-    "cost": "Cost",
-    "results": "Results",
-    "rerank": "Rerank",
-    "rerankModel": "Rerank Model",
-    "positionDelta": "Position Change",
-    "emptyState": "Send a search query to see results",
-    "copy": "Copiar",
-    "resetToDefault": "Redefinir para o padrão",
-    "tabSearch": "Buscar",
-    "tabScrape": "Scrape",
-    "tabCompare": "Comparar",
-    "modalitiesGuide": "Guia de modalidades",
-    "searchConceptTitle": "Busca",
-    "searchConceptDesc": "Busca = retorna uma lista de resultados web (título, URL, snippet, score de relevância)",
-    "scrapeConceptTitle": "Scrape",
-    "scrapeConceptDesc": "Scrape = extrai o conteúdo completo de uma URL (markdown, texto ou HTML)",
-    "compareConceptTitle": "Comparar",
-    "compareConceptDesc": "Comparar = executa a mesma query em N providers lado a lado para comparar latência, custo e overlap de resultados",
-    "rerankConceptTitle": "Rerank",
-    "rerankConceptDesc": "Rerank = reordena resultados via LLM para melhorar relevância baseada na query",
-    "autoConceptTitle": "Auto (mais barato)",
-    "autoConceptDesc": "Auto (mais barato) = escolhe automaticamente o provider mais barato disponível com credenciais configuradas",
-    "providerCatalogTitle": "Catálogo de Provedores",
-    "kindSearch": "Busca",
-    "kindFetch": "Fetch/Scrape",
-    "statusConfigured": "Configurado",
-    "statusMissing": "Sem credencial",
-    "statusRateLimited": "Rate limited",
-    "configureProvider": "Configurar em Provedores",
-    "loadingProviders": "Carregando provedores…",
-    "failedToLoadProviders": "Falha ao carregar provedores",
-    "costPerQuery": "Custo/consulta",
-    "freeQuota": "Cota gratuita/mês",
-    "scrapeUrl": "URL para extrair",
-    "scrapeUrlPlaceholder": "https://exemplo.com",
-    "scrapeExtract": "Extrair",
-    "scrapeExtracting": "Extraindo…",
-    "scrapeFullPage": "Página completa",
-    "scrapeFormat": "Formato",
-    "formatMarkdown": "Markdown",
-    "formatHtml": "HTML",
-    "formatText": "Texto",
-    "scrapePreview": "Visualização",
-    "scrapeRaw": "Raw",
-    "scrapeContentTruncated": "(truncado, ver raw)",
-    "scrapeMetadata": "Metadados",
-    "scrapeProvider": "Provedor",
-    "scrapeSize": "Tamanho",
-    "compareRun": "Comparar",
-    "compareRunning": "Comparando…",
-    "autoProvider": "Auto (mais barato)",
-    "configuredStatus": "Configurado",
-    "rateLimitedStatus": "Rate limited",
-    "noCredential": "Sem credencial",
-    "searchTypeLabel": "Tipo",
-    "rerankModelLabel": "Modelo de rerank",
-    "noneOption": "Nenhum",
-    "size": "Tamanho"
+    "checkWebToken": "Verifique o token",
+    "huggingchatLabel": "__MISSING__:HuggingChat (Free)",
+    "huggingchatDesc": "__MISSING__:Free LLM chat via huggingface.co/chat",
+    "phindLabel": "__MISSING__:Phind (Free)",
+    "phindDesc": "__MISSING__:Free dev-focused AI chat",
+    "poeWebLabel": "__MISSING__:Poe Web",
+    "poeWebDesc": "__MISSING__:Multi-model chat via poe.com",
+    "veniceWebLabel": "__MISSING__:Venice Web",
+    "veniceWebDesc": "__MISSING__:Privacy-focused AI chat",
+    "v0VercelWebLabel": "__MISSING__:v0 Vercel Web",
+    "v0VercelWebDesc": "__MISSING__:AI code generation via v0.dev",
+    "kimiWebLabel": "__MISSING__:Kimi Web",
+    "kimiWebDesc": "__MISSING__:Chinese market AI chat via kimi.moonshot.cn",
+    "doubaoWebLabel": "__MISSING__:Doubao Web",
+    "doubaoWebDesc": "__MISSING__:ByteDance AI chat via doubao.com"
   },
   "settings": {
     "title": "Configurações",
@@ -5820,6 +4929,7 @@
     "memoryDesc": "Memória conversacional persistente entre sessões",
     "memoryEnabled": "Ativar Memória",
     "memoryEnabledDesc": "Quando ativado, injetará o contexto passado relevante de forma dinâmica.",
+    "memoryTokenCostWarning": "__MISSING__:Heads up: with memory enabled, OmniRoute injects up to {tokens} tokens of retrieved context into every chat request — this increases token usage and cost. To skip injection for a specific request, send the \"x-omniroute-no-memory: true\" header.",
     "maxTokens": "Tokens Máximos",
     "retentionDays": "Retenção",
     "recent": "Recente",
@@ -5858,6 +4968,15 @@
     "modelsDevInfoOrder": "User Override → models.dev → LiteLLM → Hardcoded Default",
     "systemTheme": "Tema do Sistema",
     "debugToggle": "Enable Debug Mode",
+    "homePinProviderQuotaToHome": "Fixar informações na página inicial",
+    "homeProviderQuotaLimits": "Limites de cota dos provedores",
+    "homeProviderQuotaLimitsDesc": "Fixe o painel de status de cotas dos provedores (com botão Atualizar tudo) no topo da página inicial.",
+    "homeQuickStart": "Início rápido",
+    "homeQuickStartDesc": "Mostrar o painel de início rápido na página inicial.",
+    "homeProviderTopology": "Topologia dos provedores",
+    "homeProviderTopologyDesc": "Mostrar a topologia dos provedores na página inicial.",
+    "accountEmailVisibility": "__MISSING__:Account email visibility",
+    "accountEmailVisibilityDesc": "__MISSING__:Show full account emails across providers, combos, logs, quota, and playground screens. Turn this off to mask them by default.",
     "sidebarVisibilityToggle": "Show Sidebar Items",
     "enableCache": "Ativar Cache",
     "cacheTTL": "TTL do Cache",
@@ -5891,11 +5010,17 @@
     "autoDisableDescription": "Marca permanentemente conexões de provedor como desativadas quando retornam sinais terminais de banimento (ex.: HTTP 403 'verify your account'). Isso remove a conexão da rotação de combos.",
     "autoDisableThreshold": "Limite de banimento",
     "autoDisableThresholdDesc": "Quantidade de sinais consecutivos de banimento antes da desativação permanente.",
+    "customBannedSignals": "__MISSING__:Banned Keywords",
+    "customBannedSignalsDesc": "__MISSING__:Additional keywords that trigger permanent account ban detection. Built-in keywords always apply.",
+    "customBannedSignalsPlaceholder": "__MISSING__:e.g. api key revoked",
+    "noCustomBannedSignals": "__MISSING__:No custom keywords. Only built-in keywords are active.",
     "resilienceStructureTitle": "Estrutura de resiliência",
     "resilienceStructureDesc": "Esta página configura apenas o comportamento. O estado ao vivo de circuit breaker aparece na página Saúde. Controle de retry específico por combo e slot de round-robin continuam nas configurações de combos.",
     "enableThinking": "Ativar Raciocínio",
     "maxThinkingTokens": "Máximo de Tokens de Raciocínio",
     "enableProxy": "Ativar Proxy",
+    "perKeyProxyEnabled": "__MISSING__:Enable per-key proxy assignment",
+    "perKeyProxyEnabledDesc": "__MISSING__:When enabled, each provider connection can use its own proxy assignment",
     "proxyUrl": "URL do Proxy",
     "pricingRates": "Formato de Taxas de Preço",
     "currentPricing": "Visão Geral de Preços Atual",
@@ -5975,6 +5100,13 @@
     "globalProxy": "Proxy Global",
     "globalProxyDesc": "Configure um proxy de saída global para todas as chamadas de API. Provedores individuais, combos e chaves podem sobrescrever.",
     "noGlobalProxy": "Nenhum proxy global configurado",
+    "proxyPool": "Pool de Proxies",
+    "freePool": "Pool Gratuito",
+    "proxyDocumentation": "Documentação de Proxy",
+    "proxyGlobalConfigTab": "Configuração Global",
+    "proxyPoolTab": "Pool de Proxy",
+    "freePoolTab": "Pool Gratuito",
+    "proxyDocumentationTab": "Documentação",
     "bulkHealthcheck": "Verificação de integridade em massa",
     "bulkHealthcheckDesc": "Teste todos os proxies configurados contra uma URL de destino para encontrar quais funcionam.",
     "healthcheckTesting": "Testando...",
@@ -5987,6 +5119,51 @@
     "healthcheckStatus": "Status",
     "healthcheckProxyUrl": "URL do proxy",
     "healthcheckLatency": "Latência",
+    "proxyDocumentationScopeTitle": "Resolução de escopo de proxy",
+    "proxyDocumentationScopeDescBefore": "O OmniRoute resolve o proxy de saída na seguinte ordem de prioridade: ",
+    "proxyDocumentationScopeOrder": "combo → conta → provedor → global",
+    "proxyDocumentationScopeDescAfter": ". O escopo mais específico vence.",
+    "proxyDocumentationAddTitle": "Adicionando um proxy personalizado",
+    "proxyDocumentationAddDescBefore": "Vá para a aba ",
+    "proxyDocumentationAddDescMiddle": " → clique em ",
+    "proxyDocumentationAddCta": "+ Adicionar proxy",
+    "proxyDocumentationAddDescAfter": ". Preencha tipo (http/https/socks5), host e porta. Opcionalmente, atribua-o a um escopo.",
+    "proxyDocumentationBulkTitle": "Formato de importação em massa",
+    "proxyDocumentationBulkDesc": "Campos delimitados por pipe:",
+    "proxyDocumentationSocks5DescBefore": "Proxies SOCKS5 vêm desativados por padrão. Defina",
+    "proxyDocumentationFreePoolDesc": "A aba Pool Gratuito agrega proxies do 1proxy, Proxifly e IPLocate. Use ⊕ para testar e promover um proxy ao seu registro. Somente proxies que passarem no teste de conectividade serão adicionados.",
+    "proxyDocumentationVercelRelayDescBefore": "O Vercel Relay é um relay de borda de saída, não um túnel de entrada. Fazer deploy dele envia chamadas de API de LLM pelos IPs dinâmicos da Vercel, contornando bloqueios geográficos de datacenter e limites de taxa. O relay é protegido por um header secreto gerado",
+    "proxyDocumentationVercelRelayDescAfter": "Seu token da Vercel é usado apenas durante o deploy e nunca é armazenado.",
+    "vercelRelayTokenRequired": "Token obrigatório",
+    "vercelRelayDeployFailed": "Falha no deploy",
+    "vercelRelayTokenHint": "O token é usado apenas durante o deploy e nunca é armazenado.",
+    "denoRelayTokenRequired": "__MISSING__:Deno Deploy token is required",
+    "denoRelayOrgDomainRequired": "__MISSING__:Organization domain is required",
+    "denoRelayDeployFailed": "__MISSING__:Deno Deploy failed",
+    "denoRelayTokenHint": "__MISSING__:Organization token (prefix ddo_) from console.deno.com → Organization → Settings → Organization Tokens. Used once for deploy and never stored.",
+    "denoRelayOrgDomainHint": "__MISSING__:Your Deno Deploy organization's default domain (e.g. acme.deno.net). The relay will be reachable at https://<app-name>.<org-slug>.deno.net.",
+    "proxyFreePoolFilterProtocol": "Filtrar por protocolo",
+    "proxyFreePoolProtocol": "Protocolo",
+    "proxyFreePoolCountryPlaceholder": "País (ex.: US)",
+    "proxyFreePoolFilterCountry": "Filtrar por país",
+    "proxyFreePoolMinQualityPlaceholder": "Qualidade mín.",
+    "proxyFreePoolMinQualityLabel": "Pontuação mínima de qualidade",
+    "proxyFreePoolSyncAll": "Sincronizar tudo",
+    "proxyFreePoolTotal": "Total",
+    "proxyFreePoolInPool": "No pool",
+    "proxyFreePoolAvgQuality": "Qualidade média",
+    "proxyFreePoolSelected": "{count} selecionados",
+    "proxyFreePoolAddSelected": "Adicionar selecionados ao pool",
+    "proxyFreePoolAddVisible": "Adicionar todos os visíveis ao pool",
+    "proxyFreePoolSource": "Origem",
+    "proxyFreePoolHostPort": "Host:Porta",
+    "proxyFreePoolType": "Tipo",
+    "proxyFreePoolCountry": "País",
+    "proxyFreePoolQuality": "Qualidade",
+    "proxyFreePoolLatency": "Latência",
+    "proxyFreePoolEmpty": "Nenhum proxy encontrado. Clique em Sincronizar tudo para buscar nas fontes.",
+    "close": "Fechar",
+    "cancel": "Cancelar",
     "globalLabel": "Global",
     "configure": "Configurar",
     "globalSystemPrompt": "Prompt de Sistema Global",
@@ -6243,6 +5420,7 @@
     "systemStorage": "Sistema e Armazenamento",
     "allDataLocal": "Todos os dados armazenados localmente na sua máquina",
     "databasePath": "Caminho do Banco de Dados",
+    "export": "__MISSING__:Export",
     "exportDatabase": "Exportar Banco de Dados",
     "exportAll": "Exportar Tudo (.tar.gz)",
     "importDatabase": "Importar Banco de Dados",
@@ -6330,6 +5508,11 @@
     "adaptiveVolumeRoutingDesc": "Escala conexões dinamicamente com base no volume e pressão na taxa de transferência.",
     "lkgpToggleTitle": "Last Known Good Provider (LKGP)",
     "lkgpToggleDesc": "When enabled, the router remembers which provider last served a successful response and tries it first on subsequent requests.",
+    "echoRequestedModelTitle": "__MISSING__:Echo requested model name in responses",
+    "echoRequestedModelDesc": "__MISSING__:When enabled, the response `model` field echoes the alias or combo name the client requested instead of the upstream model name. Fixes strict clients (e.g. Claude Desktop) that reject a response whose model does not match the request.",
+    "webSearchRouteTitle": "__MISSING__:Web search routing",
+    "webSearchRouteDesc": "__MISSING__:When a request includes a native web_search tool, route the whole request to this model instead of the default — useful for providers that don't implement Anthropic's web_search server tool. Leave blank to disable.",
+    "webSearchRoutePlaceholder": "__MISSING__:e.g. openrouter,anthropic/claude-3.5-sonnet",
     "clearLkgpCache": "Clear LKGP Cache",
     "lkgpCacheCleared": "LKGP cache cleared successfully",
     "lkgpCacheClearFailed": "Failed to clear LKGP cache",
@@ -6394,6 +5577,16 @@
     "clearSyncedPricing": "Limpar Sync",
     "compressionTitle": "Prompt Compression",
     "compressionDesc": "Reduce token usage by compressing prompts before sending to providers",
+    "tokenSaverTitle": "__MISSING__:Token Saver",
+    "tokenSaverSubtitle": "__MISSING__:Spend fewer tokens on every request.",
+    "tokenSaverToolOutput": "__MISSING__:Tool output",
+    "tokenSaverToolOutputDesc": "__MISSING__:Clean git, grep, ls, tree, and log output before it reaches the provider.",
+    "tokenSaverLlmOutput": "__MISSING__:LLM output",
+    "tokenSaverLlmOutputDesc": "__MISSING__:Inject terse response instructions without rewriting provider output.",
+    "tokenSaverInputCompression": "__MISSING__:Input compression",
+    "tokenSaverInputCompressionDesc": "__MISSING__:Rewrite eligible chat history while preserving code, URLs, and intent.",
+    "tokenSaverFineTunePrefix": "__MISSING__:Fine-tune each engine on",
+    "tokenSaverFineTuneSuffix": "__MISSING__:or combine engines per request on",
     "compressionMode": "Compression Mode",
     "compressionModeOff": "Off",
     "compressionModeOffDesc": "No compression applied",
@@ -6413,6 +5606,11 @@
     "compressionUltraMinScore": "Minimum Score Threshold",
     "compressionUltraSlmFallback": "Fallback to Aggressive",
     "compressionUltraModelPath": "SLM Model Path",
+    "compressionUltraEngine": "__MISSING__:Ultra tier",
+    "compressionUltraEngineHeuristic": "__MISSING__:Heuristic (Tier-A, default)",
+    "compressionUltraEngineSlm": "__MISSING__:SLM (LLMLingua-2, opt-in)",
+    "compressionUltraSlmHint": "__MISSING__:SLM downloads a small ONNX model on first use (cold-start) and transparently falls back to the heuristic on timeout or if unavailable.",
+    "compressionUltraSlmPrewarm": "__MISSING__:Pre-warm SLM model on enable",
     "compressionSummarizerEnabled": "Enable Summarizer",
     "compressionMaxTokensPerMessage": "Max Tokens Per Message",
     "compressionMinSavings": "Min Savings Threshold",
@@ -6600,13 +5798,22 @@
     "resilienceNo": "Não",
     "resilienceDefault": "Default",
     "storageDatabaseBackupRetention": "Retenção de backup de banco de dados",
+    "storageDatabaseBackups": "__MISSING__:Database backups",
     "storagePurgeData": "Limpar dados",
+    "storagePurgeDataDesc": "__MISSING__:Immediately delete all records without applying retention checks. Use with caution.",
+    "storageRetentionCleanup": "__MISSING__:Retention Settings",
+    "storageRetentionCleanupDesc": "__MISSING__:Configure operational record retention and database backup cleanup.",
+    "retentionCallDays": "__MISSING__:Call {count}d",
+    "retentionAppDays": "__MISSING__:App {count}d",
+    "retentionRows": "__MISSING__:{count} rows",
     "retentionQuotaSnapshots": "Instantâneos de cota (dias)",
+    "retentionCompressionAnalytics": "__MISSING__:Compression Analytics (days)",
     "retentionMcpAudit": "Auditoria MCP (dias)",
     "retentionA2aEvents": "Eventos A2A (dias)",
     "retentionCallLogs": "Registros de chamadas (dias)",
     "retentionUsageHistory": "Histórico de uso (dias)",
     "retentionMemoryEntries": "Entradas de memória (dias)",
+    "saveRetentionSettings": "__MISSING__:Save retention settings",
     "storageAutoVacuumMode": "Modo de vácuo automático",
     "storageScheduledVacuum": "Vácuo programado",
     "storageVacuumHour": "Hora de Vácuo (0-23)",
@@ -6620,10 +5827,16 @@
     "storageIntegrityOk": "✓ OK",
     "storageIntegrityError": "✗ Erro",
     "storageUsageTokenBuffer": "Buffer de token de uso",
+    "storageUsageTokenBufferDesc": "__MISSING__:Extra tokens added to reported usage to account for system prompt overhead.",
+    "storageUsageTokenBufferHint": "__MISSING__:Set to 0 to report raw provider token counts. Default: 2000.",
+    "storageUsageTokenBufferCurrent": "__MISSING__:Current: {value}",
     "compressionSettingsAutoTriggerMode": "Modo de disparo automático",
     "compressionSettingsMcpDescriptionCompression": "Compressão de descrição MCP",
+    "mcpAccessibilityTitle": "__MISSING__:MCP accessibility output",
     "compressionSettingsCavemanIntensity": "Intensidade do homem das cavernas",
     "compressionSettingsCavemanOutputMode": "Modo de saída do homem das cavernas",
+    "compressionSettingsOutputStyles": "__MISSING__:Output styles",
+    "compressionStylesTileTitle": "__MISSING__:Output styles",
     "compressionSettingsOutputIntensity": "Intensidade de saída",
     "compressionSettingsAutoClarityBypass": "Desvio de clareza automática",
     "resilienceWaitForCooldown": "Aguarde o resfriamento",
@@ -6639,6 +5852,9 @@
     "cliproxyapiUrl": "URL CLIProxyAPI",
     "cliproxyapiStatus": "Status CLIProxyAPI",
     "cliproxyapiNotDetected": "Não detectado",
+    "cliproxyapiImportAuthTitle": "__MISSING__:Import accounts from CLIProxyAPI",
+    "cliproxyapiImportAuthDesc": "__MISSING__:Import the OAuth accounts CLIProxyAPI already saved in ~/.cli-proxy-api/ as OmniRoute connections, so you don't have to log in to each account again. Supported account types (Gemini, Codex, Claude, Antigravity, Qwen, Kimi) are imported; others are skipped.",
+    "cliproxyapiImportAuthButton": "__MISSING__:Import accounts",
     "payloadRulesTitle": "Regras de carga útil",
     "payloadRulesDesc": "Configure mutações de carga útil de solicitação por modelo e protocolo. As alterações são persistidas nas configurações e recarregadas no runtime imediatamente após o salvamento.",
     "payloadRuleDefaultTitle": "padrão (default)",
@@ -6671,6 +5887,14 @@
     "maxResponseTokensDesc": "Total máximo de tokens permitidos em uma única resposta.",
     "modelCooldownsTitle": "Modelos em espera",
     "modelCooldownsEmpty": "Nenhum modelo em espera no momento.",
+    "responsesStateTitle": "__MISSING__:Responses State",
+    "responsesStateDesc": "__MISSING__:Control how OmniRoute forwards previous_response_id.",
+    "responsesStateModeLabel": "__MISSING__:previous_response_id handling",
+    "responsesStateModeAuto": "__MISSING__:Auto",
+    "responsesStateModeStrip": "__MISSING__:Strip",
+    "responsesStateModePreserve": "__MISSING__:Preserve",
+    "responsesStateHint": "__MISSING__:Auto strips previous_response_id unless a connection explicitly enables OpenAI Responses storage. Strip is safest for stateless clients such as VS Code Custom Endpoint; context then depends on the client sending full history.",
+    "responsesStateSaveError": "__MISSING__:Failed to update Responses state setting",
     "codexFastTierTitle": "Camada rápida do Codex",
     "codexFastTierDesc": "Injete globalmente service_tier=priority para solicitações do OpenAI Codex.",
     "codexFastTierHint": "Quando habilitado, o OmniRoute adiciona service_tier=priority às solicitações de saída do Codex para conexões que ainda não especificam uma camada. O nível de prioridade requer uma chave de API OpenAI Enterprise ou o caminho ChatGPT-auth Codex; outros tipos de chave receberão um erro relacionado ao nível do OpenAI. As configurações por conexão na página do provedor Codex têm precedência.",
@@ -6777,6 +6001,15 @@
     "resilienceEnableServerWaitDesc": "Quando ativado, o OmniRoute aguarda o primeiro resfriamento expirar e tenta novamente automaticamente.",
     "resilienceMaxAttempts": "Máximo de tentativas",
     "resilienceMaxWaitPerAttempt": "Espera máxima por tentativa",
+    "resilienceProviderCooldownTitle": "__MISSING__:Provider Cooldown",
+    "resilienceProviderCooldownScope": "__MISSING__:All combo requests",
+    "resilienceProviderCooldownTrigger": "__MISSING__:When a provider/connection fails",
+    "resilienceProviderCooldownEffect": "__MISSING__:Skips the failed provider for a cooldown period before retrying",
+    "resilienceProviderCooldownDesc": "__MISSING__:Prevents subsequent requests from re-walking the same failing providers. Cooldown scales exponentially with consecutive failures.",
+    "resilienceProviderCooldownEnabled": "__MISSING__:Enable global provider cooldown",
+    "resilienceProviderCooldownEnabledDesc": "__MISSING__:When enabled, failed providers are tracked globally and skipped for a cooldown period.",
+    "resilienceProviderCooldownMin": "__MISSING__:Minimum cooldown",
+    "resilienceProviderCooldownMax": "__MISSING__:Maximum cooldown",
     "forcedFingerprintTitle": "Sempre ativado para {provider} — necessário para a segurança da conta OAuth; não pode ser desativado.",
     "forcedFingerprintBadge": "Obrigatório",
     "codexSessionAffinityTitle": "Afinidade de sessão do Codex",
@@ -6798,482 +6031,181 @@
     "vercelRelayFreeTierNote": "Relays são endpoints de proxy leves implantados no plano gratuito da Vercel para contornar limitações de rede local/região.",
     "vercelRelayDeploying": "Implantando...",
     "vercelRelayDeploy": "Implantar",
-    "homePinProviderQuotaToHome": "Fixar informações na página inicial",
-    "homeProviderQuotaLimits": "Limites de cota dos provedores",
-    "homeProviderQuotaLimitsDesc": "Fixe o painel de status de cotas dos provedores (com botão Atualizar tudo) no topo da página inicial.",
-    "homeQuickStart": "Início rápido",
-    "homeQuickStartDesc": "Mostrar o painel de início rápido na página inicial.",
-    "homeProviderTopology": "Topologia dos provedores",
-    "homeProviderTopologyDesc": "Mostrar a topologia dos provedores na página inicial.",
-    "proxyGlobalConfigTab": "Configuração Global",
-    "proxyPoolTab": "Pool de Proxy",
-    "freePoolTab": "Pool Gratuito",
-    "proxyDocumentationTab": "Documentação",
-    "proxyPool": "Pool de Proxies",
-    "freePool": "Pool Gratuito",
-    "proxyDocumentation": "Documentação de Proxy",
-    "proxyDocumentationScopeTitle": "Resolução de escopo de proxy",
-    "proxyDocumentationScopeDescBefore": "O OmniRoute resolve o proxy de saída na seguinte ordem de prioridade: ",
-    "proxyDocumentationScopeOrder": "combo → conta → provedor → global",
-    "proxyDocumentationScopeDescAfter": ". O escopo mais específico vence.",
-    "proxyDocumentationAddTitle": "Adicionando um proxy personalizado",
-    "proxyDocumentationAddDescBefore": "Vá para a aba ",
-    "proxyDocumentationAddDescMiddle": " → clique em ",
-    "proxyDocumentationAddCta": "+ Adicionar proxy",
-    "proxyDocumentationAddDescAfter": ". Preencha tipo (http/https/socks5), host e porta. Opcionalmente, atribua-o a um escopo.",
-    "proxyDocumentationBulkTitle": "Formato de importação em massa",
-    "proxyDocumentationBulkDesc": "Campos delimitados por pipe:",
-    "proxyDocumentationSocks5DescBefore": "Proxies SOCKS5 vêm desativados por padrão. Defina",
-    "proxyDocumentationFreePoolDesc": "A aba Pool Gratuito agrega proxies do 1proxy, Proxifly e IPLocate. Use ⊕ para testar e promover um proxy ao seu registro. Somente proxies que passarem no teste de conectividade serão adicionados.",
-    "proxyDocumentationVercelRelayDescBefore": "O Vercel Relay é um relay de borda de saída, não um túnel de entrada. Fazer deploy dele envia chamadas de API de LLM pelos IPs dinâmicos da Vercel, contornando bloqueios geográficos de datacenter e limites de taxa. O relay é protegido por um header secreto gerado",
-    "proxyDocumentationVercelRelayDescAfter": "Seu token da Vercel é usado apenas durante o deploy e nunca é armazenado.",
-    "vercelRelayTokenRequired": "Token obrigatório",
-    "vercelRelayDeployFailed": "Falha no deploy",
-    "vercelRelayTokenHint": "O token é usado apenas durante o deploy e nunca é armazenado.",
-    "proxyFreePoolFilterProtocol": "Filtrar por protocolo",
-    "proxyFreePoolProtocol": "Protocolo",
-    "proxyFreePoolCountryPlaceholder": "País (ex.: US)",
-    "proxyFreePoolFilterCountry": "Filtrar por país",
-    "proxyFreePoolMinQualityPlaceholder": "Qualidade mín.",
-    "proxyFreePoolMinQualityLabel": "Pontuação mínima de qualidade",
-    "proxyFreePoolSyncAll": "Sincronizar tudo",
-    "proxyFreePoolTotal": "Total",
-    "proxyFreePoolInPool": "No pool",
-    "proxyFreePoolAvgQuality": "Qualidade média",
-    "proxyFreePoolSelected": "{count} selecionados",
-    "proxyFreePoolAddSelected": "Adicionar selecionados ao pool",
-    "proxyFreePoolAddVisible": "Adicionar todos os visíveis ao pool",
-    "proxyFreePoolSource": "Origem",
-    "proxyFreePoolHostPort": "Host:Porta",
-    "proxyFreePoolType": "Tipo",
-    "proxyFreePoolCountry": "País",
-    "proxyFreePoolQuality": "Qualidade",
-    "proxyFreePoolLatency": "Latência",
-    "proxyFreePoolEmpty": "Nenhum proxy encontrado. Clique em Sincronizar tudo para buscar nas fontes.",
-    "close": "Fechar",
-    "cancel": "Cancelar"
+    "deployRelayButton": "__MISSING__:Deploy Relay",
+    "denoRelayButton": "__MISSING__:Deploy Deno Relay",
+    "denoRelayModalTitle": "__MISSING__:Deploy Deno Relay",
+    "denoRelayWarning": "__MISSING__:Warning: A Deno Deploy organization token is required. This token will only be used to create the relay app and will never be stored by OmniRoute.",
+    "denoRelayTokenLabel": "__MISSING__:Deno Deploy Organization Token",
+    "denoRelayOrgDomainLabel": "__MISSING__:Organization Domain",
+    "denoRelayProjectNameLabel": "__MISSING__:Deno App Name",
+    "denoRelayFreeTierNote": "__MISSING__:Deno Deploy v2 runs on a global edge network. Free tier: 1M requests & 100GiB outbound traffic per month, no per-request CPU limits, up to 20 active apps & 50 custom domains.",
+    "denoRelayDeploying": "__MISSING__:Deploying...",
+    "denoRelayDeploy": "__MISSING__:Deploy",
+    "cloudflareRelaySuccess": "__MISSING__:Cloudflare Relay deployed successfully",
+    "cloudflareRelayButton": "__MISSING__:Deploy Cloudflare Relay",
+    "cloudflareRelayModalTitle": "__MISSING__:Deploy Cloudflare Worker Relay",
+    "cloudflareRelayWarning": "__MISSING__:Deploys a Cloudflare Worker that proxies LLM requests through Cloudflare's edge network — masking the host IP behind dynamic Cloudflare addresses. The Worker enforces a one-time auth secret so the public workers.dev URL cannot be reused as an open relay.",
+    "cloudflareRelayTokenHowto": "__MISSING__:Create the API token under My Profile -> API Tokens -> Create Token -> Custom Token -> Account / Workers Scripts / Edit.",
+    "cloudflareRelayAccountIdLabel": "__MISSING__:Cloudflare Account ID",
+    "cloudflareRelayAccountIdHint": "__MISSING__:Found on the right side of the Cloudflare dashboard overview page.",
+    "cloudflareRelayApiTokenLabel": "__MISSING__:Cloudflare API Token",
+    "cloudflareRelayApiTokenHint": "__MISSING__:Requires 'Workers Scripts: Edit' permission. The token is used only at deploy time and is never stored.",
+    "cloudflareRelayProjectNameLabel": "__MISSING__:Worker Name",
+    "cloudflareRelayFreeTierNote": "__MISSING__:Free tier: 100,000 requests/day per Cloudflare account.",
+    "cloudflareRelayDeploying": "__MISSING__:Deploying...",
+    "cloudflareRelayDeploy": "__MISSING__:Deploy",
+    "cloudflareRelayCredsRequired": "__MISSING__:Account ID and API Token are required",
+    "cloudflareRelayDeployFailed": "__MISSING__:Deploy failed",
+    "modelLockout": "__MISSING__:Model Lockout",
+    "modelLockoutPageDescription": "__MISSING__:Configure which HTTP error codes trigger per-model lockout and control the cooldown behavior.",
+    "modelLockoutEnabled": "__MISSING__:Enable Model Lockout",
+    "modelLockoutEnabledDescription": "__MISSING__:When enabled, models that fail with configured error codes are temporarily locked to prevent retry loops.",
+    "modelLockoutErrorCodes": "__MISSING__:Error Codes",
+    "modelLockoutErrorCodesDescription": "__MISSING__:HTTP status codes that trigger model lockout. Type a code and click Add, or select from suggestions.",
+    "modelLockoutBaseCooldown": "__MISSING__:Base Cooldown (ms)",
+    "modelLockoutBaseCooldownDescription": "__MISSING__:Initial cooldown duration in milliseconds before a model can be retried.",
+    "modelLockoutMaxCooldown": "__MISSING__:Max Cooldown (ms)",
+    "modelLockoutMaxCooldownDescription": "__MISSING__:Maximum cooldown duration in milliseconds. Prevents excessively long lockouts.",
+    "modelLockoutExponentialBackoff": "__MISSING__:Exponential Backoff",
+    "modelLockoutExponentialBackoffDescription": "__MISSING__:When enabled, each consecutive failure increases the cooldown duration exponentially.",
+    "modelLockoutMaxBackoffSteps": "__MISSING__:Max Backoff Steps",
+    "modelLockoutMaxBackoffStepsDescription": "__MISSING__:Maximum number of backoff steps before the cooldown stops growing. The Max Cooldown cap is reached first in most configurations, making this a safety ceiling for when Max Cooldown is raised."
   },
-  "sidebar": {
-    "home": "Início",
-    "dashboard": "Painel",
-    "providers": "Provedores",
-    "combos": "Combos",
-    "usage": "Uso",
-    "analytics": "Análises",
-    "costs": "Custos",
-    "health": "Saúde",
-    "proxy": "Proxy",
-    "limits": "Limites e Cotas",
-    "cliTools": "Ferramentas CLI",
-    "media": "Mídia",
-    "settings": "Configurações",
-    "translator": "Tradutor",
-    "playground": "Playground",
-    "searchTools": "Search Tools",
-    "agents": "Agentes",
-    "cloudAgents": "Agentes de nuvem",
-    "memory": "Memória",
-    "skills": "Habilidades",
-    "omniSkills": "OmniSkills",
-    "agentSkills": "Habilidades do agente",
-    "docs": "Documentação",
-    "issues": "Problemas",
-    "endpoints": "Endpoints",
-    "endpointsSubtitle": "Seus URLs de conexão de IA",
-    "apiManager": "Gerenciador API",
-    "apiManagerSubtitle": "Gerenciar chaves de API e acesso",
-    "embeddedServices": "Serviços Embarcados",
-    "embeddedServicesSubtitle": "Gerenciar serviços de proxy locais",
-    "logs": "Logs",
-    "webhooks": "Webhooks",
-    "webhooksSubtitle": "Seja notificado sobre eventos",
-    "combosSubtitle": "Provedores de grupo para failover",
-    "batchSubtitle": "Processar várias solicitações",
-    "contextCavemanSubtitle": "Compactação imediata",
-    "contextRtkSubtitle": "Filtragem de saída",
-    "auditLog": "Log de Auditoria",
-    "shutdown": "Desligar",
-    "restart": "Reiniciar",
-    "shutdownConfirm": "Desligar o OmniRoute?",
-    "restartConfirm": "Reiniciar o OmniRoute?",
-    "version": "v{version}",
-    "debug": "Depuração",
-    "system": "Sistema",
-    "help": "Ajuda",
-    "primarySection": "Main",
-    "cliSection": "CLI",
-    "debugSection": "Debug",
-    "systemSection": "System",
-    "helpSection": "Help",
-    "serverDisconnected": "Servidor Desconectado",
-    "serverDisconnectedMsg": "O servidor proxy foi parado ou está reiniciando.",
-    "expandSidebar": "Expandir barra lateral",
-    "collapseSidebar": "Recolher barra lateral",
-    "themes": "Themes",
-    "presetColors": "Popular colors",
-    "createTheme": "Create theme",
-    "chooseColor": "Pick one color",
-    "themeCoral": "Coral",
-    "themeBlue": "Blue",
-    "themeRed": "Red",
-    "themeGreen": "Green",
-    "themeViolet": "Violet",
-    "themeOrange": "Orange",
-    "themeCyan": "Cyan",
-    "cliToolsShort": "Ferramentas",
-    "cache": "Cache",
-    "cacheShort": "Cache",
-    "batch": "Testes em Lote",
-    "themeSystem": "Theme System",
-    "whitelabelingDesc": "Whitelabeling Desc",
-    "switchThemes": "Switch Themes",
-    "themeAccentDesc": "Theme Accent Desc",
-    "uploadFavicon": "Upload Favicon",
-    "themeDark": "Theme Dark",
-    "customLogoDesc": "Custom Logo Desc",
-    "sidebarVisibilityToggle": "Sidebar Visibility Toggle",
-    "themeAccent": "Theme Accent",
-    "resetFavicon": "Reset Favicon",
-    "whitelabeling": "Whitelabeling",
-    "darkMode": "Dark Mode",
-    "uploadLogo": "Upload Logo",
-    "themeLight": "Theme Light",
-    "appName": "App Name",
-    "appNameDesc": "App Name Desc",
-    "resetLogo": "Reset Logo",
-    "customFavicon": "Custom Favicon",
-    "hideHealthLogs": "Hide Health Logs",
-    "customLogo": "Custom Logo",
-    "appearance": "Appearance",
-    "themeSelectionAria": "Theme Selection Aria",
-    "themeCreate": "Theme Create",
-    "customFaviconDesc": "Custom Favicon Desc",
-    "logoPreview": "Logo Preview",
-    "themeCustom": "Theme Custom",
-    "hideHealthLogsDesc": "Hide Health Logs Desc",
-    "faviconPreview": "Favicon Preview",
-    "changelog": "Changelog",
-    "contextSection": "Context & Cache",
-    "contextCaveman": "Caveman",
-    "contextRtk": "RTK",
-    "contextCombos": "Combos de Engines",
-    "contextLite": "Lite",
-    "contextAggressive": "Aggressive",
-    "contextUltra": "Ultra",
-    "contextSettings": "Compression Settings",
-    "contextHeadroom": "Headroom",
-    "contextSessionDedup": "Session Dedup",
-    "contextCcr": "CCR",
-    "contextLlmlingua": "LLMLingua",
-    "combosLive": "Combo Studio",
-    "compressionStudio": "Compression Studio",
-    "routingSection": "Routing",
-    "protocolsSection": "Protocols",
-    "agentsAiSection": "Agents & AI",
-    "cacheContextSection": "Cache & Context",
-    "analyticsSection": "Analytics",
-    "costsSection": "Custos",
-    "monitoringSection": "Monitoring",
-    "auditSecuritySection": "Audit & Security",
-    "devtoolsSection": "Dev Tools",
-    "configurationSection": "Configuration",
-    "aiFeaturesSection": "AI Features",
-    "mcp": "MCP",
-    "a2a": "A2A",
-    "apiEndpoints": "API Endpoints",
-    "batchFiles": "Files",
-    "analyticsEvals": "Evals",
-    "analyticsSearch": "Search",
-    "analyticsUtilization": "Utilization",
-    "analyticsComboHealth": "Combo Health",
-    "analyticsCompression": "Compression",
-    "costsBudget": "Budget",
-    "costsQuotaShare": "Compartilhamento de Cota",
-    "costsPricing": "Pricing",
-    "logsProxy": "Proxy Logs",
-    "logsConsole": "Console",
-    "logsActivity": "Activity",
-    "auditMcp": "MCP Audit",
-    "auditA2a": "Auditoria A2A",
-    "settingsGeneral": "General",
-    "settingsAppearance": "Appearance",
-    "settingsAi": "AI Settings",
-    "settingsSecurity": "Security",
-    "settingsAccessTokens": "Tokens de Acesso",
-    "settingsFeatureFlags": "Sinalizadores de recursos",
-    "settingsAuthz": "Autorização",
-    "settingsRouting": "Routing",
-    "settingsResilience": "Resilience",
-    "settingsAdvanced": "Advanced",
-    "omniProxySection": "OmniProxy",
-    "quotaTracker": "Provider Quota",
-    "providerQuota": "Provider Quota",
-    "runtime": "Runtime",
-    "consoleLogs": "Console Logs",
-    "globalRouting": "Global Routing",
-    "mitmProxy": "MITM Proxy",
-    "oneProxy": "1Proxy",
-    "agenticFeaturesSection": "Agentic Features",
-    "otherFeaturesSection": "Other Features",
-    "compressionContextGroup": "Compression Context",
-    "toolsGroup": "Tools",
-    "integrationsGroup": "Integrations",
-    "proxyGroup": "Proxy",
-    "costsParametersGroup": "Costs Parameters",
-    "auditGroup": "Audit",
-    "batchGroup": "Batch",
-    "homeSubtitle": "Visão geral do painel",
-    "providersSubtitle": "Gerenciar provedores de IA",
-    "quotaTrackerSubtitle": "Acompanhar limites de uso",
-    "providerQuotaSubtitle": "Acompanhar limites de uso por provedor",
-    "runtimeSubtitle": "Resiliência e sessões em tempo real",
-    "contextCombosSubtitle": "Combinar engines de compressão",
-    "cliToolsSubtitle": "Configurar runtimes CLI",
-    "agentsSubtitle": "Gerenciar agentes locais",
-    "cloudAgentsSubtitle": "Gerenciar agentes na nuvem",
-    "apiEndpointsSubtitle": "Expor endpoints customizados",
-    "proxySubtitle": "Configurações do proxy HTTP",
-    "mitmProxySubtitle": "Interceptação MITM",
-    "oneProxySubtitle": "Gateway proxy público",
-    "leaderboard": "Leaderboard",
-    "profile": "Profile",
-    "tokens": "Tokens",
-    "leaderboardSubtitle": "Rankings and achievements",
-    "profileSubtitle": "Account and preferences",
-    "tokensSubtitle": "Token usage and budgets",
-    "usageSubtitle": "Estatísticas de tráfego e uso",
-    "analyticsComboHealthSubtitle": "Confiabilidade dos targets do combo",
-    "analyticsUtilizationSubtitle": "Utilização de provedores",
-    "costsSubtitle": "Detalhamento de gastos",
-    "cacheSubtitle": "Taxa de acertos do cache",
-    "analyticsCompressionSubtitle": "Estatísticas de economia de tokens",
-    "analyticsSearchSubtitle": "Analytics das ferramentas de busca",
-    "analyticsEvalsSubtitle": "Resultados das suites de avaliação",
-    "logsSubtitle": "Logs da aplicação",
-    "logsProxySubtitle": "Logs de tráfego do proxy",
-    "consoleLogsSubtitle": "Saída do console",
-    "logsActivitySubtitle": "Log de atividade do usuário",
-    "healthSubtitle": "Verificação de saúde do sistema",
-    "costsPricingSubtitle": "Regras de preço por modelo",
-    "costsBudgetSubtitle": "Limites de orçamento",
-    "costsQuotaShareSubtitle": "Compartilhe cotas de provedor entre chaves",
-    "auditLogSubtitle": "Auditoria de autorização",
-    "auditMcpSubtitle": "Auditoria do servidor MCP",
-    "auditA2aSubtitle": "Auditoria do protocolo A2A",
-    "translatorSubtitle": "Conversão de formatos",
-    "playgroundSubtitle": "Testar prompts ao vivo",
-    "searchToolsSubtitle": "Registro de ferramentas de busca",
-    "memorySubtitle": "Memória persistente do agente",
-    "omniSkillsSubtitle": "Registro de skills sandbox",
-    "agentSkillsSubtitle": "Registro de skills A2A",
-    "mcpSubtitle": "Controles do servidor MCP",
-    "a2aSubtitle": "Servidor do protocolo A2A",
-    "mediaSubtitle": "Arquivos de mídia em cache",
-    "batchFilesSubtitle": "Arquivos de entrada/saída de batch",
-    "settingsSubtitle": "Todas as configurações",
-    "settingsGeneralSubtitle": "Básicos do app",
-    "settingsAppearanceSubtitle": "Tema e layout",
-    "settingsAiSubtitle": "Padrões de comportamento da IA",
-    "globalRoutingSubtitle": "Regras de roteamento global",
-    "settingsResilienceSubtitle": "Retries e circuit breakers",
-    "settingsAdvancedSubtitle": "Opções avançadas",
-    "settingsSecuritySubtitle": "Auth e criptografia",
-    "settingsAccessTokensSubtitle": "Tokens de CLI com escopo para modo remoto",
-    "settingsFeatureFlagsSubtitle": "Alternar recursos do sistema",
-    "settingsSidebar": "Sidebar",
-    "settingsSidebarSubtitle": "Customize sidebar layout",
-    "settingsAuthzSubtitle": "Inventário de rotas e política de bypass",
-    "docsSubtitle": "Documentação",
-    "issuesSubtitle": "Reportar um bug",
-    "changelogSubtitle": "Notas de versão",
-    "costsQuotaPlans": "Planos & Cotas",
-    "costsQuotaPlansSubtitle": "Configurar planos por provider",
-    "activity": "Atividade",
-    "activitySubtitle": "Feed amigável de eventos recentes",
-    "logsGroup": "Logs",
-    "systemGroup": "Sistema",
-    "costsOverview": "Visão geral",
-    "costsOverviewSubtitle": "Análise consolidada de custos",
-    "agentBridge": "Agent Bridge",
-    "agentBridgeSubtitle": "Interceptar tráfego de agentes IDE",
-    "trafficInspector": "Inspector de Tráfego",
-    "trafficInspectorSubtitle": "Monitorar chamadas LLM + debugar tráfego HTTPS",
-    "cliCode": "CLI Code's",
-    "cliCodeSubtitle": "Ferramentas de código que apontam para o OmniRoute",
-    "cliAgents": "CLI Agents",
-    "cliAgentsSubtitle": "Agentes autônomos com CLI",
-    "acpAgents": "ACP Agents",
-    "acpAgentsSubtitle": "CLIs spawnadas pelo OmniRoute"
+  "contextRtk": {
+    "title": "Motor RTK",
+    "description": "Compressao sensivel a comandos para tool output, logs de terminal e builds.",
+    "enabled": "Ativo",
+    "intensity": "Intensidade",
+    "intensityMinimal": "Minima",
+    "intensityStandard": "Padrao",
+    "intensityAggressive": "Agressiva",
+    "toolResults": "Resultados de tools",
+    "assistantMessages": "Mensagens do assistente",
+    "codeBlocks": "Blocos de codigo",
+    "filterCatalog": "Catálogo de Filtros",
+    "filterCatalogDesc": "Filtros de saída disponíveis por categoria",
+    "guidedConfig": "Configuração",
+    "guidedConfigDesc": "Ajuste como o RTK filtra a saída do seu terminal",
+    "maxLines": "Max linhas",
+    "maxChars": "Max caracteres",
+    "deduplicateThreshold": "Limite de deduplicacao",
+    "customFilters": "Filtros customizados",
+    "detectedType": "Tipo detectado",
+    "confidence": "Confiança",
+    "beforeAfter": "Antes / Depois",
+    "trustProjectFilters": "Confiar em filtros do projeto",
+    "rawOutputRetention": "Retencao de raw output",
+    "rawOutputNever": "Nunca",
+    "rawOutputFailures": "Falhas",
+    "rawOutputAlways": "Sempre",
+    "rawOutputMaxBytes": "Max bytes de raw output",
+    "filterTesting": "Teste de filtros",
+    "pasteOutput": "Cole output de ferramenta para testar...",
+    "presetHigh": "Agressivo",
+    "presetLow": "Luz",
+    "presetMaxChars": "Máximo de caracteres de saída",
+    "presetMaxLines": "Máximo de linhas de saída",
+    "presetMedium": "Padrão",
+    "run": "Executar",
+    "result": "Resultado",
+    "previewEmpty": "Execute um exemplo para visualizar o RTK.",
+    "detected": "Detectado",
+    "masterSwitchOffAlert": "O interruptor mestre do Token Saver está DESLIGADO — estas configurações não afetarão as solicitações até que você o ligue na página de Endpoint.",
+    "tokensFiltered": "Tokens filtrados",
+    "filtersActive": "Filtros ativos",
+    "requests": "Requests",
+    "avgSavings": "Economia media",
+    "simpleMode": "Simples",
+    "advancedMode": "Avançado",
+    "searchFilters": "Filtros de pesquisa...",
+    "tooltipDedup": "Quão agressivamente remover linhas repetidas.",
+    "tooltipMaxChars": "Máximo de caracteres por bloco de saída.",
+    "tooltipMaxLines": "Máximo de linhas a serem mantidas na saída do comando. O excesso é truncado.",
+    "learnDiscoverTitle": "__MISSING__:Learn & Discover filters",
+    "learnDiscoverDesc": "__MISSING__:Mine your captured command output (Raw Output retention must be on) to suggest new RTK filters. Suggestions only — you review and save them.",
+    "discoverHeading": "__MISSING__:Discover repeated noise",
+    "discoverButton": "__MISSING__:Scan samples",
+    "discoverScanning": "__MISSING__:Scanning…",
+    "discoverEmpty": "__MISSING__:No repeated noise found. Enable Raw Output retention and run a few commands first.",
+    "discoverSamples": "__MISSING__:{count} sample(s) scanned",
+    "discoverHits": "__MISSING__:{hits}× across samples",
+    "learnHeading": "__MISSING__:Learn a filter for a command",
+    "learnCommandPlaceholder": "__MISSING__:e.g. npm install",
+    "learnButton": "__MISSING__:Suggest filter",
+    "learnEmpty": "__MISSING__:No suggestion yet. Type a command you have run and scan.",
+    "learnSamplesUsed": "__MISSING__:Learned from {count} matching sample(s)",
+    "suggestionError": "__MISSING__:Could not load suggestions. Check management auth and try again."
   },
-  "skills": {
-    "title": "Skills",
-    "description": "Gerencie e monitore skills de IA",
-    "skillsTab": "Skills",
-    "executionsTab": "Execuções",
-    "sandboxTab": "Sandbox",
-    "loading": "Carregando skills...",
-    "noSkills": "Nenhuma skill encontrada",
-    "noExecutions": "Nenhuma execução encontrada",
-    "enabled": "Ativado",
-    "disabled": "Desativado",
-    "version": "Versão",
-    "tableDescription": "Descrição",
-    "skill": "Skill",
-    "status": "Status",
-    "duration": "Duração",
-    "time": "Tempo",
-    "sandboxConfig": "Configuração da Sandbox",
-    "cpuLimit": "Limite de CPU",
-    "cpuLimitDesc": "Tempo máximo de execução por skill",
-    "memoryLimit": "Limite de Memória",
-    "memoryLimitDesc": "Alocação máxima de memória",
-    "timeout": "Timeout",
-    "timeoutDesc": "Tempo máximo de espera por resposta",
-    "networkAccess": "Acesso à Rede",
-    "networkAccessDesc": "Permitir requisições de rede de saída",
-    "mode": "Mode",
-    "q": "Q",
-    "filterSkillsPlaceholder": "Filtre habilidades por nome, descrição ou tag",
-    "allModes": "Todos os modos",
-    "totalSkills": "Total de Habilidades",
-    "enabledSkills": "Ativadas",
-    "totalExecutions": "Execuções",
-    "successRate": "Taxa de Sucesso",
-    "marketplaceTab": "Marketplace",
-    "applyFilters": "Aplicar filtros",
-    "popularDefaultsLabel": "Populares por padrão para o provedor selecionado:",
-    "onMode": "LIGADO",
-    "offMode": "DESLIGADO",
-    "autoMode": "AUTO",
-    "installSkillButton": "Instalar Habilidade",
-    "installSkillModalTitle": "Instalar Habilidade",
-    "installJsonPlaceholder": "Cole o JSON do manifesto da habilidade aqui...",
-    "installing": "Instalando...",
-    "installSuccess": "Habilidade instalada ({id})",
-    "installError": "Falha na instalação",
-    "invalidJson": "JSON inválido",
-    "searchMarketplacePlaceholder": "Buscar habilidades...",
-    "searchMarketplace": "Buscar no Marketplace",
-    "marketplaceEmpty": "Nenhuma habilidade encontrada no marketplace",
-    "marketplaceError": "Falha na busca",
-    "installingFromMarketplace": "Instalando do marketplace...",
-    "popularSkills": "Habilidades Populares",
-    "skillsMarketplace": "Mercado de habilidades",
-    "searching": "Buscando...",
-    "pageInfo": "Página {page} de {totalPages} ({total} total)",
-    "previous": "Anterior",
-    "next": "Próximo",
-    "activeProvider": "Provedor ativo:",
-    "changeInSettings": "Altere isso em Configurações → Memória e Habilidades.",
-    "installs": "instalações",
-    "marketplaceSkillsMpHint": "Configure sua chave de API do SkillsMP nas Configurações para navegar no marketplace.",
-    "marketplaceSkillsShHint": "Pesquise no diretório aberto skills.sh para descobrir e instalar habilidades de agentes.",
-    "installSkillModalDesc": "Cole um JSON de manifesto de habilidade ou carregue um arquivo .json.",
-    "uploadJson": "Carregar JSON",
+  "contextCombos": {
+    "title": "Combos de Compressao",
+    "description": "Defina como engines sao combinadas para diferentes cenarios de roteamento.",
+    "createCombo": "Criar Combo",
+    "editCombo": "Editar",
+    "deleteCombo": "Excluir",
+    "deleteConfirm": "Excluir este combo de compressao?",
+    "pipeline": "Pipeline",
+    "addStep": "Adicionar Step",
+    "removeStep": "Remover",
+    "name": "Nome",
+    "descriptionField": "Descricao",
+    "languagePacks": "Language Packs",
+    "outputMode": "Output Mode",
+    "assignToRouting": "Atribuir a Combos de Roteamento",
+    "noAssignments": "Nenhum combo de roteamento disponivel",
+    "default": "Default",
+    "setAsDefault": "Definir como default",
+    "save": "Salvar",
     "cancel": "Cancelar",
-    "installSkill": "Instalar habilidade"
+    "enabled": "Ativo"
   },
-  "stats": {
-    "usageOverview": "Visão Geral de Uso",
-    "outputTokens": "Tokens de Saída",
-    "totalCost": "Custo Total",
-    "usageByModel": "Uso por Modelo",
-    "usageByAccount": "Uso por Conta",
-    "failedToLoad": "Falha ao carregar estatísticas de uso.",
-    "tokenHealth": "Saúde dos Tokens",
-    "totalOAuth": "Total OAuth",
-    "healthy": "Saudável",
-    "warning": "Aviso",
-    "errored": "Com Erro",
-    "lastCheck": "Última verificação",
-    "noData": "Sem dados",
-    "share": "Compartilhar",
-    "unableToLoad": "Não foi possível carregar métricas do sistema",
-    "product": "Produto",
-    "resources": "Recursos",
-    "company": "Empresa"
-  },
-  "telemetry": {
-    "title": "Telemetria do Sistema",
-    "description": "Sinais contínuos de solicitação, tempo de execução, sessão e memória deste processo OmniRoute.",
-    "uptime": "Tempo de atividade",
-    "totalRequests": "Total de solicitações",
-    "avgLatency": "Latência média",
-    "errorRate": "Taxa de erro",
-    "activeConnections": "Conexões Ativas",
-    "memoryUsage": "Uso de memória",
-    "latencyTrend": "Tendência de latência",
-    "throughputTrend": "Tendência de rendimento",
-    "memoryTrend": "Tendência de memória",
-    "refresh": "Atualizar",
-    "updatedAt": "{time} atualizado",
-    "loadFailed": "Falha ao carregar a telemetria.",
-    "partialData": "A telemetria está parcialmente disponível: {error}"
-  },
-  "templateDescriptions": {
-    "simple-chat": "Modelo básico de chat com mensagem do sistema",
-    "streaming": "Modelo para streaming de respostas",
-    "system-prompt": "Modelo com prompt de sistema personalizado",
-    "thinking": "Modelo com orçamento de raciocínio/pensamento",
-    "tool-calling": "Modelo para chamada de ferramenta/função",
-    "multi-turn": "Modelo para conversas múltiplas",
-    "vision": "Modelo multimodal com entrada de imagem",
-    "schema-coercion": "Aplicação de esquema de saída estruturada/JSON"
-  },
-  "templateNames": {
-    "simple-chat": "Bate-papo simples",
-    "streaming": "Transmissão",
-    "system-prompt": "Alerta do sistema",
-    "thinking": "Pensando",
-    "tool-calling": "Chamada de ferramenta",
-    "multi-turn": "Multivoltas",
-    "vision": "Visão",
-    "schema-coercion": "Coerção de esquema"
-  },
-  "templatePayloads": {
-    "simpleChat": {
-      "system": "Você é um assistente de IA útil.",
-      "userGreeting": "Olá! Como posso ajudá-lo hoje?"
-    },
-    "streaming": {
-      "prompt": "Escreva uma história sobre"
-    },
-    "systemPrompt": {
-      "question": "Qual é o sentido da vida?",
-      "systemInstruction": "Forneça uma resposta ponderada e filosófica."
-    },
-    "thinking": {
-      "question": "Explique a computação quântica"
-    },
-    "toolCalling": {
-      "cityNameDescription": "O nome da cidade para obter o clima",
-      "toolDescription": "Obtenha o clima atual para um local",
-      "userWeather": "Qual é o clima em Tóquio?"
-    },
-    "multiTurn": {
-      "system": "Você é um assistente útil.",
-      "assistantExample": "Ficarei feliz em ajudá-lo com isso.",
-      "userInitial": "preciso de ajuda com",
-      "userFollowUp": "Você pode explicar isso?"
+  "contextCaveman": {
+    "title": "Motor Caveman",
+    "description": "Compressao baseada em regras, language packs, analytics e output mode.",
+    "advancedConfig": "Configuração avançada",
+    "advancedConfigDesc": "Ajustar o comportamento da compactação",
+    "aggressiveSettings": "Configurações agressivas",
+    "aggressiveSettingsDesc": "Compressão máxima com potenciais compensações de qualidade",
+    "requests": "Requests",
+    "tokensSaved": "Tokens salvos",
+    "savingsPercent": "Economia %",
+    "avgLatency": "Latencia media",
+    "languagePacks": "Language Packs",
+    "languagePacksDesc": "Ative regras de compressao para idiomas especificos.",
+    "labelAutoTrigger": "Compactar automaticamente quando o contexto exceder",
+    "labelCompressionRate": "Força de compressão",
+    "labelMaxTokens": "Tokens de destino por mensagem",
+    "labelMinLength": "Comprimento mínimo da mensagem",
+    "labelMinSavings": "Tokens mínimos para salvar",
+    "enabled": "Ativo",
+    "autoDetect": "Auto-detectar idioma",
+    "rulesCount": "{count} regras",
+    "inputCompressionTitle": "Compressão de Entrada",
+    "inputCompressionDesc": "Reescreve o histórico do chat com termos mais curtos. Reduz os tokens de entrada em aproximadamente 50%.",
+    "analyticsTitle": "Analytics de Compressao",
+    "noAnalytics": "Sem analytics de compressao ainda.",
+    "outputMode": "Modo de saída",
+    "outputModeDesc": "Instrui o LLM a responder em formato curto e compacto.",
+    "outputModeTitle": "Output Mode",
+    "quickSettings": "Configurações rápidas",
+    "quickSettingsDesc": "Configurações básicas de compactação para começar",
+    "autoClarity": "Bypass Auto-Clarity",
+    "bypassConditions": "Condicoes de bypass",
+    "bypassConditionsList": "seguranca, irreversivel, clarificacao, sensivel a ordem",
+    "simpleMode": "Simples",
+    "advancedMode": "Avançado",
+    "tooltipAutoTrigger": "Compactar automaticamente quando o contexto exceder esse tamanho.",
+    "tooltipCompressionRate": "0,0 = nenhum, 1,0 = máximo. 0,5 = equilibrado.",
+    "tooltipMaxTokens": "Contagem de tokens de destino após a compactação. Menor = mais agressivo.",
+    "tooltipMinLength": "Mensagens menores que isso não são compactadas. Menor = mais compressão.",
+    "tooltipMinSavings": "Compacte apenas se salvar pelo menos esse número de tokens.",
+    "ultraSettings": "Configurações Ultra",
+    "ultraSettingsDesc": "Compressão semântica alimentada por SLM",
+    "preview": {
+      "lite": "Responda conciso. Preserve termos tecnicos, codigo, erros, URLs e identificadores.",
+      "full": "Responda seco e compacto. Preserve todo conteudo tecnico.",
+      "ultra": "Responda ultra compacto com abreviacoes tecnicas comuns. Preserve simbolos exatos."
     }
   },
-  "themesPage": {
-    "title": "Themes",
-    "description": "Choose a preset theme or create your own with a single color",
-    "presetColors": "Popular colors",
-    "customTheme": "Custom theme",
-    "customThemeDesc": "Click create theme and pick one color",
-    "createTheme": "Create theme",
-    "activePreset": "Active theme"
-  },
-  "toolDescriptions": {
-    "cline": "Cline",
-    "openclaw": "Openclaw",
-    "droid": "Droid",
-    "codex": "Codex",
-    "claude": "Claude",
-    "kilo": "Kilo"
-  },
   "translator": {
     "title": "Tradutor",
     "metaTitle": "Playground do Tradutor | OmniRoute",
@@ -7561,7 +6493,11 @@
     "conceptDiagramExampleHub": "OpenAI",
     "conceptDiagramHubTooltip": "Hub intermediário usado pelo translator para converter entre formatos que não têm mapeamento direto.",
     "conceptDiagramSourceTooltip": "O formato de API que sua app fala (ex: SDK Anthropic = claude).",
-    "conceptDiagramTargetTooltip": "O provider para onde a requisição será realmente enviada."
+    "conceptDiagramTargetTooltip": "O provider para onde a requisição será realmente enviada.",
+    "compressionEmptyHint": "__MISSING__:Fill in the input field on the Translate tab (Simple Controls or Raw JSON) to enable the preview.",
+    "compressionModeLabel": "__MISSING__:Compression mode",
+    "compressionPreviewButton": "__MISSING__:Preview Compression",
+    "compressionPreviewing": "__MISSING__:Previewing…"
   },
   "usage": {
     "title": "Uso",
@@ -7894,6 +6830,7 @@
     "budgetColDailyLim": "Limite diário",
     "budgetColMonthlyLim": "Limite mensal",
     "budgetColUsedPct": "% usado",
+    "percentUsed": "__MISSING__:{pct}% used",
     "budgetLoading": "Carregando…",
     "budgetNoKeysMatch": "Nenhuma chave corresponde aos filtros",
     "budgetLinearExtrapolation": "extrapolação linear",
@@ -7912,139 +6849,1499 @@
     "providerQuota": "Cota do Provedor",
     "providerQuotaHomeHint": "Status em tempo real nas contas conectadas"
   },
-  "webhooks": {
-    "title": "Webhooks",
-    "description": "Configure retornos de chamada HTTP para eventos do sistema.",
-    "configuredWebhooks": "Webhooks configurados",
-    "configuredWebhooksDesc": "Gerencie endpoints de entrega, eventos assinados, status e envios de teste.",
-    "addWebhook": "Adicionar webhook",
-    "editWebhook": "Editar webhook",
-    "name": "Nome",
-    "namePlaceholder": "Monitoramento de produção",
-    "unnamedWebhook": "Webhook sem nome",
-    "url": "URL do terminal",
-    "events": "Eventos",
-    "allEvents": "Todos os eventos",
-    "secret": "Segredo",
-    "secretPlaceholder": "Deixe em branco para gerar automaticamente um segredo",
-    "secretEditPlaceholder": "Deixe em branco para manter o segredo atual",
-    "status": "Estado",
-    "active": "Ativo",
-    "inactive": "Inativo",
-    "errored": "Erro",
-    "total": "Total",
-    "lastTriggered": "Último acionado",
-    "actions": "Ações",
-    "enabled": "Habilitado",
-    "enabledDesc": "Webhooks desativados permanecem salvos, mas não recebem entregas.",
+  "modals": {
+    "waitingAuth": "Aguardando Autorização",
+    "verificationUrl": "URL de Verificação",
+    "yourCode": "Seu Código",
+    "remoteAccess": "Acesso remoto:",
+    "connectedSuccess": "Conectado com Sucesso!",
+    "connectionFailed": "Falha na Conexão",
+    "chooseAuthMethod": "Escolha seu método de autenticação:",
+    "awsBuilderId": "AWS Builder ID",
+    "awsIamIdentity": "AWS IAM Identity Center",
+    "googleAccount": "Conta Google",
+    "githubAccount": "Conta GitHub",
+    "importToken": "Importar Token",
+    "pasteToken": "Cole o refresh token do Kiro IDE.",
+    "awsRegion": "Região AWS",
+    "autoDetecting": "Detectando tokens automaticamente...",
+    "readingFromCache": "Lendo do cache AWS SSO",
+    "readingFromCursor": "Lendo do banco de dados do Cursor IDE",
+    "initializing": "Inicializando...",
+    "pricingConfig": "Configuração de Preços",
+    "loadingPricing": "Carregando dados de preços...",
+    "pricingRatesFormat": "Formato de Taxas de Preço",
+    "noPricingData": "Nenhum dado de preço disponível",
+    "noModelsFound": "Nenhum modelo encontrado"
+  },
+  "loggers": {
+    "allProviders": "Todos os Provedores",
+    "allModels": "Todos os Modelos",
+    "allAccounts": "Todas as Contas",
+    "allApiKeys": "Todas as Chaves de API",
+    "allTypes": "Todos os Tipos",
+    "allLevels": "Todos os Níveis",
+    "modelAZ": "Modelo A-Z",
+    "modelZA": "Modelo Z-A",
+    "loadingLogs": "Carregando logs...",
+    "loadingProxyLogs": "Carregando logs do proxy...",
+    "noLogEntries": "Nenhuma entrada de log encontrada",
+    "noPayloadData": "Nenhum dado de payload disponível para esta entrada.",
+    "proxyEvent": "Evento do Proxy",
+    "proxy": "Proxy",
+    "level": "Nível",
+    "directNative": "Direto (nativo)",
+    "combo": "Combo",
+    "inputTokens": "E:",
+    "outputTokens": "S:"
+  },
+  "stats": {
+    "usageOverview": "Visão Geral de Uso",
+    "outputTokens": "Tokens de Saída",
+    "totalCost": "Custo Total",
+    "usageByModel": "Uso por Modelo",
+    "usageByAccount": "Uso por Conta",
+    "failedToLoad": "Falha ao carregar estatísticas de uso.",
+    "tokenHealth": "Saúde dos Tokens",
+    "totalOAuth": "Total OAuth",
+    "healthy": "Saudável",
+    "warning": "Aviso",
+    "errored": "Com Erro",
+    "lastCheck": "Última verificação",
+    "noData": "Sem dados",
+    "share": "Compartilhar",
+    "unableToLoad": "Não foi possível carregar métricas do sistema",
+    "product": "Produto",
+    "resources": "Recursos",
+    "company": "Empresa"
+  },
+  "auth": {
+    "welcome": "Bem-vindo",
+    "signIn": "Entrar",
+    "enterPassword": "Digite sua senha para continuar",
+    "password": "Senha",
+    "unifiedProxy": "Proxy Unificado de API de IA",
+    "unifiedAiApiProxy": "Proxy Unificado de API de IA",
+    "unifiedAiApiProxyDesc": "Roteie requisições para múltiplos provedores de IA por um único endpoint. Balanceamento de carga, failover e rastreamento de uso integrados.",
+    "passwordNotEnabled": "Proteção por senha não está ativada",
+    "loading": "Carregando...",
+    "invalidPassword": "Senha inválida",
+    "errorOccurredRetry": "Ocorreu um erro. Tente novamente.",
+    "configureInstance": "Vamos configurar sua instância OmniRoute",
+    "runOnboardingWizard": "Execute o assistente de onboarding para definir sua senha e conectar seu primeiro provedor de IA.",
+    "startOnboarding": "Iniciar Onboarding",
+    "secureYourInstance": "Proteja sua Instância",
+    "setPasswordDescription": "Defina uma senha para proteger seu painel e garantir que seus endpoints de API não sejam acessados sem autorização.",
+    "configurePassword": "Configurar Senha",
+    "continue": "Continuar",
+    "windowWillClose": "Esta janela será fechada automaticamente...",
+    "closeTabNow": "Você já pode fechar esta aba.",
+    "copyUrlManual": "Copie a URL da barra de endereços e cole no aplicativo.",
+    "accessDeniedDescription": "Você não tem permissão para acessar este recurso. Verifique sua chave de API ou contate o administrador.",
+    "goToDashboard": "Ir para o Painel",
+    "featureMultiProviderTitle": "Multi-Provedor",
+    "featureMultiProviderDesc": "OpenAI, Anthropic, Google e outros",
+    "featureLoadBalancingTitle": "Balanceamento de Carga",
+    "featureLoadBalancingDesc": "Distribua requisições de forma inteligente",
+    "featureUsageTrackingTitle": "Rastreamento de Uso",
+    "featureUsageTrackingDesc": "Monitore custos e tokens",
+    "resetPassword": "Redefinir Senha",
+    "resetDescription": "Escolha um método para recuperar acesso ao painel",
+    "stopServer": "Pare o servidor OmniRoute",
+    "processing": "Processando...",
+    "pleaseWait": "Aguarde enquanto completamos a autorização.",
+    "authSuccess": "Autorização bem-sucedida!",
+    "copyUrl": "Copiar esta URL",
+    "accessDenied": "Acesso Negado",
+    "methodCliTitle": "Método 1: Reset via CLI",
+    "methodCliDescription": "Execute o comando abaixo no servidor onde o OmniRoute está em execução:",
+    "methodCliHint": "Isso solicitará que você defina uma nova senha. O servidor deve ser parado antes.",
+    "methodManualTitle": "Método 2: Reset Manual",
+    "methodManualDescription": "Remova a senha do banco de dados e defina uma nova na inicialização:",
+    "setPasswordInYour": "Defina uma nova senha no seu",
+    "fileLabelSuffix": "arquivo:",
+    "newPasswordPlaceholder": "sua_nova_senha",
+    "deleteSettingsFile": "Exclua",
+    "orRemovePasswordHashField": "ou remova o campo passwordHash",
+    "restartServerWithNewPassword": "Reinicie o servidor - ele usará a nova senha",
+    "backToLogin": "Voltar para o Login",
+    "forgotPassword": "Esqueceu a senha?",
+    "defaultPasswordHint": "Default password: CHANGEME (unless INITIAL_PASSWORD was set)",
+    "Authorization": "Autorização",
+    "Content-Disposition": "Disposição de conteúdo",
+    "waitingForAuthorization": "Aguardando autorização...",
+    "waitingForGoogleAuthorization": "Aguardando autorização do Google...",
+    "waitingForOpenAIAuthorization": "Aguardando autorização do OpenAI...",
+    "waitingForAntigravityAuthorization": "Aguardando autorização antigravidade...",
+    "waitingForQoderAuthorization": "Aguardando autorização do Qoder...",
+    "exchangingCodeForTokens": "Trocando código por tokens...",
+    "nodeIncompatibleTitle": "Incompatible Node.js Version",
+    "nodeIncompatibleDesc": "You are running Node.js {version}, which is outside OmniRoute's supported secure runtime policy. Use a patched Node.js 20.x or 22.x LTS release.",
+    "nodeIncompatibleFixLabel": "Fix: install a patched Node.js 22 LTS release",
+    "nodeIncompatibleHint": "OmniRoute requires Node.js 20.20.2+ (20.x LTS), 22.22.2+ (22.x LTS) or 24.0.0+ (24.x LTS). Node 24 LTS is recommended."
+  },
+  "landing": {
+    "brandName": "OmniRoute",
+    "navigateHome": "Navegar para a página inicial",
+    "toggleMenu": "Alternar menu",
+    "featuresLink": "Recursos",
+    "docsLink": "Docs",
+    "github": "GitHub",
+    "versionLive": "v1.0 já está no ar",
+    "oneEndpoint": "Um Endpoint para",
+    "allProviders": "Todos os Provedores de IA",
+    "heroDescription": "Proxy de endpoint de IA com painel web - uma versão em JavaScript do CLIProxyAPI. Funciona perfeitamente com Claude Code, OpenAI Codex, Cline, RooCode e outras ferramentas CLI.",
+    "getStarted": "Começar",
+    "viewOnGithub": "Ver no GitHub",
+    "powerfulFeatures": "Recursos Poderosos",
+    "featuresSubtitle": "Tudo que você precisa para gerenciar sua infraestrutura de IA em um só lugar, preparado para escala.",
+    "featureUnifiedEndpointTitle": "Endpoint Unificado",
+    "featureUnifiedEndpointDesc": "Acesse todos os provedores por uma única URL de API padrão.",
+    "featureEasySetupTitle": "Configuração Fácil",
+    "featureEasySetupDesc": "Fique pronto em minutos com o comando npx.",
+    "featureModelFallbackTitle": "Fallback de Modelo",
+    "featureModelFallbackDesc": "Alterne automaticamente entre provedores em caso de falha ou alta latência.",
+    "featureUsageTrackingTitle": "Rastreamento de Uso",
+    "featureUsageTrackingDesc": "Análises detalhadas e monitoramento de custos em todos os modelos.",
+    "featureOAuthApiKeysTitle": "OAuth e Chaves de API",
+    "featureOAuthApiKeysDesc": "Gerencie credenciais com segurança em um único cofre.",
+    "featureCloudSyncTitle": "Sincronização em Nuvem",
+    "featureCloudSyncDesc": "Sincronize suas configurações entre dispositivos instantaneamente.",
+    "featureCliSupportTitle": "Suporte a CLI",
+    "featureCliSupportDesc": "Funciona com Claude Code, Codex, Cline, Cursor e mais.",
+    "featureDashboardTitle": "Painel",
+    "featureDashboardDesc": "Painel visual para análise de tráfego em tempo real.",
+    "howItWorks": "Como o OmniRoute Funciona",
+    "howItWorksDescription": "Os dados fluem de forma contínua da sua aplicação pela nossa camada de roteamento inteligente até o melhor provedor para cada tarefa.",
+    "howItWorksStep1Title": "1. CLI e SDKs",
+    "howItWorksStep1Description": "Suas requisições começam nas suas ferramentas favoritas ou no nosso SDK unificado. Basta trocar a URL base.",
+    "howItWorksStep2Title": "2. Hub OmniRoute",
+    "howItWorksStep2Description": "Nosso mecanismo analisa o prompt, verifica a saúde dos provedores e roteia para menor latência ou custo.",
+    "howItWorksStep3Title": "3. Provedores de IA",
+    "howItWorksStep3Description": "A requisição é atendida por OpenAI, Anthropic, Gemini ou outros provedores instantaneamente.",
+    "getStartedIn30Seconds": "Comece em 30 segundos",
+    "getStartedDescription": "Instale o OmniRoute, configure seus provedores pelo painel web e comece a rotear requisições de IA.",
+    "installOmniRoute": "Instalar o OmniRoute",
+    "installStepDescription": "Execute o comando npx para iniciar o servidor instantaneamente",
+    "openDashboard": "Abrir Painel",
+    "openDashboardStepDescription": "Configure provedores e chaves de API pela interface web",
+    "routeRequests": "Rotear Requisições",
+    "routeRequestsStepDescription": "Aponte suas ferramentas CLI para {endpoint}",
+    "terminal": "terminal",
+    "copy": "Copiar",
+    "copied": "✓ Copiado",
+    "startingOmniRoute": "Iniciando OmniRoute...",
+    "serverRunningOnLabel": "Servidor em execução em",
+    "dashboardLabel": "Painel",
+    "readyToRoute": "Pronto para rotear! ✓",
+    "configureProvidersNote": "📝 Configure provedores no painel ou use variáveis de ambiente",
+    "dataLocation": "Local dos Dados:",
+    "dataLocationMacLinux": " macOS/Linux:",
+    "dataLocationWindows": " Windows:",
+    "product": "Produto",
+    "dashboardLink": "Painel",
+    "changelog": "Changelog",
+    "resources": "Recursos",
+    "documentation": "Documentação",
+    "npm": "NPM",
+    "legal": "Legal",
+    "mitLicense": "Licença MIT",
+    "footerTagline": "O endpoint unificado para geração de IA. Conecte, roteie e gerencie seus provedores de IA com facilidade.",
+    "copyright": "© {year} OmniRoute. Todos os direitos reservados.",
+    "flowToolClaudeCode": "Claude Code",
+    "flowToolOpenAICodex": "OpenAI Codex",
+    "flowToolCline": "Cline",
+    "flowToolCursor": "Cursor",
+    "flowProviderOpenAI": "OpenAI",
+    "flowProviderAnthropic": "Anthropic",
+    "flowProviderGemini": "Gemini",
+    "flowProviderGithubCopilot": "GitHub Copilot",
+    "interactiveDiagram": "Diagrama interativo visível no desktop",
+    "ctaTitle": "Pronto para simplificar sua infraestrutura de IA?",
+    "ctaDescription": "Junte-se a desenvolvedores que estão simplificando suas integrações de IA com o OmniRoute. Open source e grátis para começar.",
+    "startFree": "Começar grátis",
+    "readDocumentation": "Ler documentação"
+  },
+  "docs": {
+    "title": "Documentação",
+    "quickStart": "Início Rápido",
+    "deploymentGuides": "Guias de implantação",
+    "features": "Recursos",
+    "supportedProviders": "Provedores Suportados",
+    "supportedProvidersToc": "Provedores",
+    "commonUseCases": "Casos de Uso Comuns",
+    "clientCompatibility": "Compatibilidade de Clientes",
+    "protocolsToc": "Protocolos",
+    "apiReference": "Referência da API",
+    "managementApiReference": "Management API Reference",
+    "managementApiDescription": "Automation endpoints for proxy registry, scope assignments, and legacy proxy migration.",
+    "method": "Método",
+    "path": "Caminho",
+    "notes": "Notas",
+    "modelPrefixes": "Prefixos de Modelo",
+    "prefix": "Prefixo",
+    "troubleshooting": "Solução de Problemas",
+    "supportsChat": "Suporta endpoints de chat e responses.",
+    "oauthAutoRefresh": "Conexão OAuth com atualização automática de token.",
+    "fullStreaming": "Suporte completo a streaming para todos os modelos.",
+    "docsLabel": "Docs",
+    "docsHeroDescription": "Gateway de IA para LLMs multi-provedor. Um endpoint para OpenAI, Anthropic, Gemini, GitHub Copilot, Claude Code, Cursor e mais de 20 provedores.",
+    "openDashboard": "Abrir Painel",
+    "endpointPage": "Página de Endpoint",
+    "github": "GitHub",
+    "reportIssue": "Reportar Problema",
+    "onThisPage": "Nesta página",
+    "documentationVersion": "Documentação - v{version}",
+    "quickStartStep1Title": "1. Instale e execute",
+    "quickStartStep1Prefix": "Execute",
+    "quickStartStep1Middle": "ou clone do GitHub e execute",
+    "quickStartStep2Title": "2. Crie uma chave de API",
+    "quickStartStep2Text": "Vá em Endpoint -> Chaves Registradas. Gere uma chave por ambiente.",
+    "quickStartStep3Title": "3. Conecte provedores",
+    "quickStartStep3Text": "Adicione contas de provedores via login OAuth, chave de API ou conexão automática de plano gratuito.",
+    "quickStartStep4Title": "4. Defina a URL base do cliente",
+    "quickStartStep4Prefix": "Aponte sua IDE ou cliente de API para",
+    "quickStartStep4Suffix": "Use prefixo de provedor, por exemplo",
+    "deploySetupTitle": "Guia de configuração",
+    "deploySetupText": "Instalação passo a passo, configuração do ambiente e instruções de primeira execução do OmniRoute.",
+    "deployElectronTitle": "Área de Trabalho Eletrônica",
+    "deployElectronText": "Execute o OmniRoute como um aplicativo de desktop nativo no Windows, macOS e Linux.",
+    "deployDockerTitle": "Docker",
+    "deployDockerText": "Implantação conteinerizada com Docker Compose; pronto para pilhas de produção e Kubernetes.",
+    "deployVmTitle": "Máquina Virtual",
+    "deployVmText": "Auto-hospedagem em qualquer VM Linux. Inclui unidade systemd, rotação de log e ferramentas de backup.",
+    "deployFlyTitle": "Voar.io",
+    "deployFlyText": "Implante no tempo de execução do Fly.io edge com um fly.toml e um único comando de implantação.",
+    "deployPwaTitle": "PWA",
+    "deployPwaText": "Instale o OmniRoute como um aplicativo da Web progressivo em navegadores Android, iOS e desktop.",
+    "deployTermuxTitle": "Termux (Android)",
+    "deployTermuxText": "Run OmniRoute headless on Android via Termux. Access the dashboard from your mobile browser.",
+    "featureRoutingTitle": "Roteamento Multi-Provedor",
+    "featureRoutingText": "Roteie requisições para mais de 30 provedores de IA por um único endpoint compatível com OpenAI. Suporta APIs de chat, responses, áudio e imagem.",
+    "featureCombosTitle": "Combos e Balanceamento",
+    "featureCombosText": "Crie combos de modelos com cadeias de fallback e estratégias de balanceamento: round-robin, prioridade, aleatório, menos usado e otimizado por custo.",
+    "featureUsageTitle": "Rastreamento de Uso e Custo",
+    "featureUsageText": "Contagem de tokens em tempo real, cálculo de custo por provedor/modelo e detalhamento de uso por chave de API e conta.",
+    "featureAnalyticsTitle": "Painel de Analytics",
+    "featureAnalyticsText": "Análises visuais com gráficos de requisições, tokens, erros, latência, custos e popularidade de modelos ao longo do tempo.",
+    "featureHealthTitle": "Monitoramento de Saúde",
+    "featureHealthText": "Health checks em tempo real, status de provedores, estados de circuit breaker e detecção automática de rate limit com backoff exponencial.",
+    "featureCliTitle": "Ferramentas CLI",
+    "featureCliText": "Gerencie configurações de IDE, exporte/importe backups, descubra perfis de codex e configure opções pelo painel.",
+    "featureSecurityTitle": "Segurança e Políticas",
+    "featureSecurityText": "Autenticação por chave de API, filtragem de IP, proteção contra prompt injection, políticas de domínio, gerenciamento de sessões e auditoria.",
+    "featureCloudSyncTitle": "Sincronização em Nuvem",
+    "featureCloudSyncText": "Sincronize sua configuração com Cloudflare Workers para acesso remoto com credenciais criptografadas e failover automático.",
+    "providersAcrossConnectionTypes": "{count} provedores em três tipos de conexão.",
+    "manageProviders": "Gerenciar Provedores",
+    "providersCount": "{count} provedores",
+    "providerTypeFree": "Plano Gratuito",
+    "providerTypeOAuth": "OAuth",
+    "providerTypeApiKey": "Chave de API",
+    "useCaseSingleEndpointTitle": "Um endpoint para muitos provedores",
+    "useCaseSingleEndpointText": "Aponte clientes para uma única URL base e roteie por prefixo de modelo (por exemplo: gh/, cc/, kr/, openai/).",
+    "useCaseFallbackTitle": "Fallback e troca de modelo com combos",
+    "useCaseFallbackText": "Crie modelos combo no painel e mantenha a configuração do cliente estável enquanto os provedores giram internamente.",
+    "useCaseUsageVisibilityTitle": "Visibilidade de uso, custo e debug",
+    "useCaseUsageVisibilityText": "Acompanhe tokens e custo por provedor, conta e chave de API nas abas de Uso e Analytics.",
+    "clientCherryStudioTitle": "Cherry Studio",
+    "baseUrlLabel": "URL Base",
+    "chatEndpointLabel": "Endpoint de chat",
+    "modelRecommendationLabel": "Recomendação de modelo: prefixo explícito",
+    "clientCodexTitle": "Modelos Codex / GitHub Copilot",
+    "clientCodexBullet1": "Use IDs de modelo com prefixo",
+    "clientCodexBullet2": "Modelos da família Codex são roteados automaticamente para",
+    "clientCodexBullet3": "Modelos não-Codex continuam em",
+    "clientCursorTitle": "Cursor IDE",
+    "clientCursorBullet1": "Use o prefixo",
+    "clientCursorBullet1Suffix": "para modelos do Cursor.",
+    "clientCursorBullet2": "Conexão OAuth - faça login na página de Provedores.",
+    "clientClaudeTitle": "Claude Code / Antigravity",
+    "clientClaudeBullet1Prefix": "Use",
+    "clientClaudeBullet1Middle": "(Claude) ou",
+    "clientClaudeBullet1Suffix": "(Antigravity) como prefixo.",
+    "clientWindsurfTitle": "Windsurf",
+    "clientWindsurfBullet1": "Use o OmniRoute como base URL compatível com OpenAI e mantenha prefixos explícitos de provedor para roteamento determinístico.",
+    "clientWindsurfBullet2": "Aponte modelos para `/v1/chat/completions` no tráfego geral e preserve `/v1/responses` para fluxos tipo Codex.",
+    "clientWindsurfBullet3": "Use Painel -> CLI Tools quando quiser um guia pronto de configuração focado em Windsurf.",
+    "clientClineTitle": "Cline",
+    "clientClineBullet1": "O Cline funciona melhor com prefixos explícitos de provedor/modelo para o roteador nunca precisar adivinhar o backend.",
+    "clientClineBullet2": "Use `/v1/chat/completions` para modelos gerais e reutilize a mesma base URL do OmniRoute entre contas diferentes.",
+    "clientClineBullet3": "Use o dashboard de Providers para validar OAuth/API key antes de depurar problemas do runtime do Cline.",
+    "clientKimiTitle": "Kimi Coding",
+    "clientKimiBullet1": "Use o OmniRoute como base URL estável enquanto gira contas ou combos de provedores por baixo.",
+    "clientKimiBullet2": "Prefira modelos com prefixo em fluxos de coding para fallback e trilha de auditoria ficarem explícitos.",
+    "clientKimiBullet3": "Use `/v1/responses` quando quiser roteamento nativo estilo Responses para clientes com tools.",
+    "protocolsTitle": "Protocolos: MCP e A2A",
+    "protocolsDescription": "O OmniRoute expõe dois protocolos operacionais além das APIs compatíveis com OpenAI: MCP para execução de ferramentas e A2A para fluxos agente-para-agente.",
+    "protocolMcpTitle": "MCP (Model Context Protocol)",
+    "protocolMcpDesc": "Use MCP via stdio para permitir descoberta e execução de ferramentas OmniRoute com visibilidade de auditoria.",
+    "protocolMcpStep1": "Inicie o transporte MCP com `omniroute --mcp`.",
+    "protocolMcpStep2": "Aponte seu cliente MCP para transporte stdio.",
+    "protocolMcpStep3": "Chame `omniroute_get_health` e `omniroute_list_combos` para validar conectividade.",
+    "protocolA2aTitle": "A2A (Agent2Agent)",
+    "protocolA2aDesc": "Use A2A JSON-RPC para submeter tarefas de forma síncrona ou via SSE streaming.",
+    "protocolA2aStep1": "Leia `/.well-known/agent.json` para descoberta do agente.",
+    "protocolA2aStep2": "Envie `message/send` ou `message/stream` para `POST /a2a`.",
+    "protocolA2aStep3": "Gerencie ciclo de vida das tarefas com `tasks/get` e `tasks/cancel`.",
+    "protocolTroubleshootingTitle": "Troubleshooting de protocolos",
+    "protocolTroubleshooting1": "Se o status MCP estiver offline, verifique se o processo stdio está rodando e atualizando o heartbeat.",
+    "protocolTroubleshooting2": "Se tarefas A2A ficarem em `working`, inspecione `/api/a2a/tasks/:id` e os eventos de stream até estado terminal.",
+    "protocolTroubleshooting3": "Use `/dashboard/mcp` e `/dashboard/a2a` para controles operacionais e visibilidade de auditoria.",
+    "endpointChatNote": "Endpoint de chat compatível com OpenAI (padrão).",
+    "endpointResponsesNote": "Endpoint da API Responses (Codex, o-series).",
+    "endpointModelsNote": "Catálogo de modelos para todos os provedores conectados.",
+    "endpointAudioNote": "Transcrição de áudio (Deepgram, AssemblyAI).",
+    "endpointSpeechNote": "Geração de texto para fala (ElevenLabs, OpenAI TTS).",
+    "endpointEmbeddingsNote": "Geração de incorporação de texto (OpenAI, Cohere, Voyage).",
+    "endpointImagesNote": "Geração de imagens (NanoBanana).",
+    "endpointRewriteChatNote": "Auxiliar de reescrita para clientes sem /v1.",
+    "endpointRewriteResponsesNote": "Auxiliar de reescrita para Responses sem /v1.",
+    "endpointRewriteModelsNote": "Auxiliar de reescrita para descoberta de modelos sem /v1.",
+    "mgmtProxiesListNote": "List saved proxy registry items (supports pagination).",
+    "mgmtProxiesCreateNote": "Create a reusable proxy item in the registry.",
+    "mgmtProxiesHealthNote": "Get 24h/rolling health metrics per saved proxy from proxy logs.",
+    "mgmtProxiesBulkAssignNote": "Assign or clear one proxy across many scope IDs in one request.",
+    "mgmtAssignmentsListNote": "List proxy assignments by scope, scope_id, or proxy_id.",
+    "mgmtAssignmentsUpdateNote": "Assign or clear proxy for global/provider/account/combo scope.",
+    "mgmtLegacyMigrationNote": "Import legacy proxyConfig maps into registry assignments.",
+    "modelPrefixesDescriptionStart": "Use o prefixo do provedor antes do nome do modelo para rotear para um provedor específico. Exemplo:",
+    "modelPrefixesDescriptionEnd": "roteia para o GitHub Copilot.",
+    "provider": "Provedor",
+    "type": "Tipo",
+    "troubleshootingModelRouting": "Se o cliente falhar no roteamento de modelo, use provedor/modelo explícito (por exemplo: gh/gpt-5.1-codex).",
+    "troubleshootingAmbiguousModels": "Se você receber erros de modelo ambíguo, escolha um prefixo de provedor em vez de um ID de modelo sem prefixo.",
+    "troubleshootingCodexFamily": "Para modelos da família GitHub Codex, mantenha o modelo como gh/codex-model; o roteador seleciona /responses automaticamente.",
+    "troubleshootingTestConnection": "Use Painel > Provedores > Testar Conexão antes de testar por IDEs ou clientes externos.",
+    "troubleshootingCircuitBreaker": "Se um provedor mostrar circuit breaker aberto, aguarde o cooldown ou verifique a página Health para detalhes.",
+    "troubleshootingOAuth": "Para provedores OAuth, autentique novamente se os tokens expirarem. Verifique o indicador de status no card do provedor.",
+    "endpointCompletionsNote": "Endpoint legado de completions para clientes que ainda enviam payloads de text-completions.",
+    "endpointModerationsNote": "Moderação e scoring de segurança de conteúdo em provedores compatíveis.",
+    "endpointRerankNote": "Reranking de documentos para retrieval e pós-processamento de busca.",
+    "endpointSearchNote": "Busca web unificada com fallback de provedor, analytics e rastreamento de custo.",
+    "endpointSearchAnalyticsNote": "Telemetria de busca e analytics de provedores do pipeline unificado de search.",
+    "endpointVideoNote": "Geração de vídeo para backends compatíveis com ComfyUI e SD WebUI.",
+    "endpointMusicNote": "Geração de música via integrações de workflow do ComfyUI.",
+    "endpointMessagesNote": "Endpoint de compatibilidade estilo Anthropic Messages para clientes que falam payload nativo de mensagens.",
+    "endpointCountTokensNote": "Helper de contagem de tokens para planejar requisições antes da execução.",
+    "endpointFilesNote": "Upload de arquivos e armazenamento de artefatos para batches e workflows maiores.",
+    "endpointBatchesNote": "Criação e consulta de jobs em lote para execução enfileirada.",
+    "endpointWsNote": "Caminho compatível com upgrade WebSocket para clientes de protocolo em tempo real.",
+    "mgmtProvidersListNote": "Lista conexões de provedores configuradas e o status atual de cada uma.",
+    "mgmtProvidersCreateNote": "Cria uma nova conexão gerenciada de provedor a partir do plano de controle do dashboard.",
+    "mgmtProvidersUpdateNote": "Atualiza credenciais, metadados e flags operacionais de um provedor.",
+    "mgmtProvidersDeleteNote": "Remove uma conexão de provedor do runtime e do roteamento.",
+    "mgmtProvidersTestNote": "Executa um teste real de conexão contra a conta de provedor selecionada.",
+    "mgmtProvidersModelsNote": "Descobre, faz cache ou inspeciona modelos expostos por uma conexão específica.",
+    "mgmtSettingsGetNote": "Lê as configurações principais de runtime usadas pelo dashboard e pelo roteador.",
+    "mgmtSettingsUpdateNote": "Atualiza configurações compartilhadas de runtime sem editar arquivos de ambiente manualmente.",
+    "mgmtPayloadRulesGetNote": "Lê a configuração de normalização de payload e payload rules específicas por provedor.",
+    "mgmtPayloadRulesUpdateNote": "Atualiza as regras de rewrite de payload antes do dispatch para o provedor.",
+    "mcpToolsTitle": "Catálogo de Ferramentas MCP",
+    "mcpToolsDescription": "O OmniRoute entrega {count} ferramentas MCP agrupadas entre roteamento, operações, cache, memória e skills.",
+    "mcpToolsCount": "{count} ferramentas documentadas",
+    "mcpToolsToc": "Ferramentas MCP",
+    "mcpToolsRoutingTitle": "Roteamento e Catálogo",
+    "mcpToolsRoutingDesc": "Leia o health do runtime, inspecione combos, confira cotas, descubra modelos e chame web search a partir de clientes MCP.",
+    "mcpToolsOperationsTitle": "Operações e Controle",
+    "mcpToolsOperationsDesc": "Simule roteamento, troque estratégias, teste combos, sincronize pricing, inspecione sessão e diagnostique problemas de runtime.",
+    "mcpToolsCacheTitle": "Controles de Cache",
+    "mcpToolsCacheDesc": "Inspecione hit rates e limpe o estado do cache sem sair do cliente MCP.",
+    "mcpToolsCompressionTitle": "Motores de compressão",
+    "mcpToolsCompressionDesc": "Configure a compactação RTK/Brotli, troque mecanismos e inspecione a análise de compactação por combinação.",
+    "mcpToolsOneProxyTitle": "1Proxy / Túneis",
+    "mcpToolsOneProxyDesc": "Gerencie proxies de saída, alterne IPs residenciais e inspecione a integridade do proxy.",
+    "mcpToolsMemoryTitle": "Memória",
+    "mcpToolsMemoryDesc": "Busque, adicione e limpe entradas persistidas de memória do OmniRoute na mesma superfície de protocolo.",
+    "mcpToolsSkillsTitle": "Skills",
+    "mcpToolsSkillsDesc": "Liste skills habilitadas, ative, execute e inspecione histórico de execuções a partir do MCP.",
+    "featureAutoComboTitle": "Roteamento AutoCombo",
+    "featureAutoComboText": "Use roteamento por intenção, fallback emergencial, seleção por contexto e perfis de resiliência sem mudar o payload do cliente.",
+    "featureSearchTitle": "APIs de Busca, Rerank e Multimodal",
+    "featureSearchText": "Exponha endpoints de search, rerank, moderação, imagem, vídeo, música, voz e transcrição atrás da mesma base URL do OmniRoute.",
+    "featureMemoryTitle": "Memória e Handoffs de Contexto",
+    "featureMemoryText": "Persista fatos reutilizáveis, injete contexto recuperado nas requisições e carregue contexto entre sessões e fluxos de agentes.",
+    "featureSkillsTitle": "Skills e Execução de Ferramentas",
+    "featureSkillsText": "Execute skills registradas, intercepte tool calls e exponha a execução por dashboard, MCP e fluxos de agentes.",
+    "featureAcpTitle": "Workers ACP e Agentes Locais",
+    "featureAcpText": "Detecte binários locais que o OmniRoute pode iniciar como workers ACP e coordene-os pelas telas de Agents e CLI Tools.",
+    "protocolAcpTitle": "ACP (Workers do Agent Communication Protocol)",
+    "protocolAcpDesc": "Use workers locais com ACP quando o OmniRoute deve iniciar e supervisionar um binário local em vez de encaminhar por HTTP.",
+    "protocolAcpStep1": "Abra Painel -> Agents para verificar quais binários locais estão instalados e disponíveis como workers.",
+    "protocolAcpStep2": "Use Painel -> CLI Tools quando você precisa de configuração de cliente em vez de spawn de worker.",
+    "protocolAcpStep3": "Combine workers ACP com logs de auditoria e health para entender o que o OmniRoute iniciou e por quê."
+  },
+  "legal": {
+    "privacyPolicy": "Política de Privacidade",
+    "termsOfService": "Termos de Serviço",
+    "providerConfigurations": "Configurações de provedores",
+    "apiKeys": "Chaves de API",
+    "usageLogs": "Logs de uso",
+    "applicationSettings": "Configurações do aplicativo",
+    "viewExportAnalytics": "Visualizar e exportar análises de uso",
+    "clearHistory": "Limpar histórico de uso a qualquer momento",
+    "configureRetention": "Configurar políticas de retenção de logs",
+    "backupRestore": "Fazer backup e restaurar seu banco de dados",
+    "privacyMetadataTitle": "Política de Privacidade | OmniRoute",
+    "privacyMetadataDescription": "Política de privacidade do roteador proxy de API de IA OmniRoute.",
+    "termsMetadataTitle": "Termos de Serviço | OmniRoute",
+    "termsMetadataDescription": "Termos de serviço do roteador proxy de API de IA OmniRoute.",
+    "backToHome": "Voltar para a home",
+    "lastUpdated": "Última atualização: {date}",
+    "policyLastUpdatedDate": "13 de fevereiro de 2026",
+    "listSeparator": "-",
+    "questionsVisit": "Dúvidas? Visite nosso",
+    "githubRepository": "repositório no GitHub",
+    "privacySection1Title": "1. Arquitetura Local-First",
+    "privacySection1Text": "O OmniRoute foi projetado como uma aplicação local-first. Todo processamento e armazenamento de dados ocorre inteiramente na sua máquina. Não existe servidor centralizado coletando suas informações.",
+    "privacySection2Title": "2. Dados que Armazenamos",
+    "privacyDataStoredIn": "Os dados a seguir são armazenados localmente em",
+    "privacyDataProviderConfigurationsDesc": "URLs de conexão, tipos de provedor e configurações de prioridade",
+    "privacyDataApiKeysDesc": "criptografadas e armazenadas localmente para autenticar com provedores de IA",
+    "privacyDataUsageLogsDesc": "contagem de requisições, uso de tokens, nomes de modelos, timestamps e tempos de resposta",
+    "privacyDataApplicationSettingsDesc": "preferências de tema, estratégia de roteamento e configurações de combos",
+    "privacySection3Title": "3. Sem Telemetria",
+    "privacySection3Text": "O OmniRoute não coleta telemetria, analytics ou relatórios de falha. Nenhum dado é enviado para nós ou para terceiros. Seus padrões de uso, chamadas de API e configurações permanecem totalmente privados.",
+    "privacySection4Title": "4. Provedores de IA de Terceiros",
+    "privacySection4Text": "Quando você faz chamadas de API pelo OmniRoute, suas requisições são encaminhadas aos provedores de IA configurados (por exemplo: OpenAI, Anthropic, Google). Esses provedores possuem suas próprias políticas de privacidade que regem como tratam seus dados. Consulte:",
+    "privacyOpenAiPolicy": "Política de Privacidade da OpenAI",
+    "privacyAnthropicPolicy": "Política de Privacidade da Anthropic",
+    "privacyGooglePolicy": "Política de Privacidade do Google",
+    "privacySection5Title": "5. Sincronização em Nuvem (Opcional)",
+    "privacySection5Text": "Se você ativar o recurso opcional de sincronização em nuvem, configurações de provedores e chaves de API podem ser transmitidas para um endpoint de nuvem configurado. Esse recurso vem desativado por padrão e exige opt-in explícito.",
+    "privacySection6Title": "6. Logs",
+    "privacyLoggingIntro": "Os logs de requisição podem ser configurados nas configurações do painel. Você pode:",
+    "privacySection7Title": "7. Seus Direitos",
+    "privacySection7TextStart": "Como todos os dados são armazenados localmente, você tem controle total. Você pode excluir seus dados a qualquer momento removendo o diretório",
+    "privacySection7TextEnd": "ou usando os recursos de backup e restauração do banco de dados no painel.",
+    "termsSection1Title": "1. Visão Geral",
+    "termsSection1Text": "O OmniRoute é um roteador proxy de API de IA local-first que roda inteiramente na sua máquina. Ele roteia requisições para múltiplos provedores de IA com balanceamento de carga, failover e rastreamento de uso.",
+    "termsSection2Title": "2. Responsabilidades do Usuário",
+    "termsResponsibilityApiKeys": "Você é o único responsável por gerenciar suas próprias chaves de API e credenciais para provedores de IA de terceiros (OpenAI, Anthropic, Google etc.).",
+    "termsResponsibilityCompliance": "Você deve cumprir os termos de serviço de cada provedor de IA cuja API acessar através do OmniRoute.",
+    "termsResponsibilitySecurity": "Você é responsável pela segurança da sua instalação local do OmniRoute, incluindo definir uma senha e restringir acesso de rede.",
+    "termsSection3Title": "3. Como Funciona",
+    "termsSection3Text": "O OmniRoute atua como um proxy intermediário. As chamadas de API enviadas ao OmniRoute são traduzidas e encaminhadas para seus provedores de IA configurados. O OmniRoute não modifica o conteúdo das suas requisições ou respostas além da tradução de protocolo necessária.",
+    "termsSection4Title": "4. Tratamento de Dados",
+    "termsDataStoredLocally": "Todos os dados são armazenados localmente na sua máquina em um banco SQLite.",
+    "termsNoTransmission": "O OmniRoute não transmite dados para servidores externos, a menos que você ative explicitamente recursos de sincronização em nuvem.",
+    "termsDataLocationText": "Logs de uso, chaves de API e configurações são armazenados em",
+    "termsSection5Title": "5. Isenção de Responsabilidade",
+    "termsSection5Text": "O OmniRoute é fornecido \"como está\", sem garantia de qualquer tipo. Não somos responsáveis por custos incorridos por uso de API, interrupções de serviço ou perda de dados. Sempre mantenha backups da sua configuração.",
+    "termsSection6Title": "6. Código Aberto",
+    "termsSection6Text": "O OmniRoute é um software de código aberto. Você pode inspecionar, modificar e distribuí-lo de acordo com os termos da licença."
+  },
+  "agents": {
+    "title": "Agentes CLI",
+    "description": "Descubra agentes CLI instalados no seu sistema. Adicione agentes customizados para auto-detecção.",
     "refresh": "Atualizar",
-    "loading": "Carregando webhooks...",
-    "never": "Nunca",
-    "failureCount": "{count, plural, =0 {no failures} one {# failure} other {# failures}}",
-    "testWebhook": "Enviar teste",
-    "testSuccess": "Webhook de teste enviado com sucesso.",
-    "testFailed": "O teste do webhook falhou.",
-    "saveSuccess": "Webhook salvo com sucesso.",
-    "saveFailed": "Falha ao salvar o webhook.",
-    "loadFailed": "Falha ao carregar webhooks.",
+    "installed": "Instalado",
+    "notFound": "Não encontrado",
+    "builtIn": "Nativo",
+    "custom": "Customizado",
+    "remove": "Remover",
+    "addCustomAgent": "Adicionar Agente Customizado",
+    "addCustomAgentDesc": "Registre qualquer ferramenta CLI para detecção. Ela será verificada automaticamente ao atualizar.",
+    "agentName": "Nome do Agente",
+    "binaryName": "Nome do Binário",
+    "versionCommand": "Comando de Versão",
+    "spawnArgs": "Argumentos",
+    "addAgent": "Adicionar Agente",
+    "scanning": "Scanning system for CLI agents...",
+    "opencodeIntegration": "OpenCode Integration",
+    "opencodeDetected": "opencode {version} detected",
+    "opencodeDesc": "Generate a ready-to-use {configFile} with your OmniRoute base URL and all available models — drop it in your project root and run {command}.",
+    "downloadConfig": "Download {file}",
+    "downloaded": "Downloaded!",
+    "setupGuideTitle": "Setup guide",
+    "openCliTools": "Open CLI Tools",
+    "setupGuideDetectCliTitle": "Detect installed CLIs",
+    "setupGuideDetectCliDesc": "Click Refresh after installing or updating a CLI so OmniRoute can rescan binaries and versions.",
+    "setupGuideCustomAgentTitle": "Register custom binary",
+    "setupGuideCustomAgentDesc": "Use Add Custom Agent when your CLI is not in the built-in list. Provide binary name and version command.",
+    "setupGuideCommandMissingTitle": "Fix 'command not found'",
+    "setupGuideCommandMissingDesc": "Ensure the CLI command exists in PATH, open a new terminal session, and rerun Refresh.",
+    "cliToolsRedirectTitle": "Procurando configuração de cliente?",
+    "cliToolsRedirectDesc": "Use CLI Tools quando quiser que seu editor ou cliente de terminal chame o OmniRoute por HTTP em vez de ser iniciado localmente.",
+    "spawnArgsPlaceholder": "ex.: --quiet, --json",
+    "binaryNamePlaceholder": "ex.: meu-worker",
+    "versionCommandPlaceholder": "ex.: meu-worker --version",
+    "architectureTitle": "Fluxo de execução ACP",
+    "flowLocalBinary": "Binário local",
+    "flowOmniRoute": "OmniRoute",
+    "agentNamePlaceholder": "ex.: Meu Worker Customizado",
+    "architectureDescription": "Esta tela é para binários que o OmniRoute inicia localmente como workers. O OmniRoute detecta o binário, faz o spawn e o usa como endpoint final de execução.",
+    "flowExecute": "Executa tarefa",
+    "flowSpawn": "Inicia worker",
+    "cliToolsRedirectCta": "Ir para CLI Tools",
+    "comparisonTitle": "Ferramentas CLI versus alvos de agente – Qual é a diferença?",
+    "comparisonCliToolsLabel": "Página de ferramentas CLI",
+    "comparisonCliToolsTitle": "Seu IDE envia solicitações através do OmniRoute",
+    "comparisonCliToolsDesc": "Configure Claude Code, Codex, Cursor e outros IDEs para usar OmniRoute como URL base da API. OmniRoute atua como um proxy, roteando solicitações para seus provedores configurados.",
+    "comparisonAgentsLabel": "Esta página (alvos do agente)",
+    "comparisonAgentsTitle": "OmniRoute envia solicitações para ferramentas CLI locais",
+    "comparisonAgentsDesc": "OmniRoute pode gerar binários CLI locais (claude, codex, goose) como backends de execução. A ferramenta CLI processa a solicitação usando sua própria autenticação e retorna o resultado.",
+    "comparisonSummary": "Resumindo: CLI Tools = você configura ferramentas para apontar para OmniRoute. Destinos do agente = OmniRoute usa ferramentas como pontos de extremidade.",
+    "agentUseCaseHint": "Pode ser usado como alvo de execução via protocolo ACP",
+    "flowDiagramClient": "Aplicativo cliente",
+    "flowDiagramClientDesc": "SDK, API ou serviço upstream",
+    "flowDiagramOmniRoute": "OmniRoute",
+    "flowDiagramOmniRouteDesc": "Recebe solicitação e seleciona alvo",
+    "flowDiagramSpawn": "Processo de geração",
+    "flowDiagramSpawnDesc": "Lança o binário CLI via stdio",
+    "flowDiagramCli": "Agente CLI",
+    "flowDiagramCliDesc": "Processos com autenticação/modelo próprio",
+    "fingerprintSettingsHint": "A correspondência de impressão digital CLI (solicitações disfarçadas como ferramentas CLI específicas) pode ser configurada em",
+    "settingsRoutingLink": "Configurações/Roteamento",
+    "openSettings": "Configurações",
+    "copyRawUrlTitle": "Copie o URL bruto para a área de transferência",
+    "copied": "Copiado!",
+    "copyUrl": "Copiar URL",
+    "startHere": "Comece aqui",
+    "badgeNew": "Novo",
+    "viewOnGithub": "Ver no GitHub",
+    "howToUse": "Como usar",
+    "browseAllSkillsOnGithub": "Procure todas as habilidades no GitHub",
+    "apiSkills": "Habilidades de API",
+    "cliSkills": "Habilidades CLI",
+    "apiSkillsSubtitle": "{count} skills — controle o OmniRoute via REST / HTTP",
+    "cliSkillsSubtitle": "{count} skills — controle o OmniRoute via o binário terminal omniroute",
+    "howToUseStep1": "Clique em <bold>{copyUrl}</bold> na habilidade que você deseja que seu agente conheça.",
+    "howToUseStep2": "No seu agente de IA (Claude, Cursor, Cline…), diga:",
+    "howToUseStep2Code": "Use a habilidade em [pasted-url]",
+    "howToUseStep3": "O agente busca o SKILL.md e aprende a API ou CLI do OmniRoute — sem necessidade de manuais."
+  },
+  "cloudAgents": {
+    "title": "Agentes de nuvem",
+    "description": "Gerenciar agentes de codificação autônomos (Jules, Devin, Codex Cloud)",
+    "loading": "Carregando tarefas...",
+    "aboutTitle": "Sobre agentes de nuvem",
+    "aboutDescription": "Os agentes de nuvem são assistentes remotos de codificação de IA que podem executar tarefas de forma autônoma. Eles funcionam de maneira diferente dos agentes CLI locais – você interage com eles por meio da API do OmniRoute.",
+    "howItWorksTitle": "Como funciona:",
+    "howItWorksDesc": "Crie uma tarefa → Agente analisa e propõe um plano → Você aprova → Agente executa → Resultados retornados",
+    "newTaskTitle": "Criar nova tarefa",
+    "newTaskDescription": "Inicie uma nova tarefa com um agente de nuvem",
+    "selectAgent": "Selecione Agente",
+    "taskDescription": "Descrição da tarefa",
+    "taskDescriptionPlaceholder": "Descreva o que você deseja que o agente faça...",
+    "startTask": "Iniciar tarefa",
+    "tasks": "Tarefas",
+    "taskDetail": "Detalhe da tarefa",
+    "noTasks": "Nenhuma tarefa ainda. Crie um para começar.",
+    "noTasksTitle": "Nenhuma tarefa ainda",
+    "noTasksDesc": "Crie sua primeira tarefa para começar.",
+    "tasksTab": "Tarefas",
+    "agentsTab": "Agentes",
+    "settingsTab": "Configurações",
+    "agentsEnabled": "Ativado",
+    "agentsDisabled": "Desativado",
+    "filterAllProviders": "Todos os Provedores",
+    "filterAll": "Todos",
+    "autoRefreshing": "Atualização automática",
+    "viewPR": "Ver Pull Request",
+    "connected": "Conectado",
+    "notConnected": "Não conectado",
+    "configure": "Configurar",
+    "settingsTitle": "Configurações de Agentes de Nuvem",
+    "settingsDesc": "Configure as preferências locais para agentes de nuvem.",
+    "settingEnableAgents": "Ativar agentes de nuvem",
+    "settingEnableAgentsDesc": "Permitir que o OmniRoute orquestre agentes de codificação autônomos.",
+    "settingAutoPR": "Criar PR automaticamente",
+    "settingAutoPRDesc": "Quando uma tarefa for concluída, cria automaticamente um Pull Request com as alterações.",
+    "settingRequireApproval": "Exigir aprovação de plano",
+    "settingRequireApprovalDesc": "Sempre aguardar aprovação manual antes que um agente execute um plano proposto.",
+    "untitledTask": "Tarefa sem título",
+    "created": "Criado",
+    "conversation": "Conversa",
+    "result": "Resultado",
+    "error": "Erro",
+    "planReady": "Plano pronto para aprovação",
+    "approvePlan": "Aprovar plano",
+    "rejectPlan": "Rejeitar e cancelar",
+    "sendMessagePlaceholder": "Envie uma mensagem para o agente...",
+    "cancel": "Cancelar",
     "delete": "Excluir",
-    "deleteConfirm": "Tem certeza de que deseja excluir este webhook?",
-    "deleteSuccess": "Webhook excluído com sucesso.",
-    "deleteFailed": "Falha ao excluir o webhook.",
-    "edit": "Editar",
-    "enable": "Habilitar",
-    "disable": "Desativar",
-    "noWebhooks": "Nenhum webhooks configurado ainda.",
-    "signatureTitle": "Assinaturas de webhook",
-    "signatureDescription": "Cada entrega inclui um cabeçalho X-Webhook-Signature assinado com HMAC-SHA256 usando o segredo do webhook. Verifique a assinatura antes de confiar na carga.",
-    "wizard": {
-      "cancel": "Cancelar",
-      "step1Title": "Selecionar Integração",
-      "step2Title": "Configurar Alvo",
-      "step3Title": "Eventos e Teste",
-      "back": "Voltar",
-      "next": "Próximo",
-      "finish": "Finalizar",
-      "step1Desc": "Selecione o sistema de integração de destino para este webhook."
+    "selectTaskPrompt": "Selecione uma tarefa para ver detalhes",
+    "statusPending": "Pendente",
+    "statusRunning": "Correndo",
+    "statusWaitingApproval": "Aguardando aprovação",
+    "statusCompleted": "Concluído",
+    "statusFailed": "Falha",
+    "statusCancelled": "Cancelado",
+    "repositoryName": "Nome do repositório",
+    "repositoryUrl": "URL do repositório",
+    "branch": "Filial"
+  },
+  "templateNames": {
+    "simple-chat": "Bate-papo simples",
+    "streaming": "Transmissão",
+    "system-prompt": "Alerta do sistema",
+    "thinking": "Pensando",
+    "tool-calling": "Chamada de ferramenta",
+    "multi-turn": "Multivoltas",
+    "vision": "Visão",
+    "schema-coercion": "Coerção de esquema"
+  },
+  "templateDescriptions": {
+    "simple-chat": "Modelo básico de chat com mensagem do sistema",
+    "streaming": "Modelo para streaming de respostas",
+    "system-prompt": "Modelo com prompt de sistema personalizado",
+    "thinking": "Modelo com orçamento de raciocínio/pensamento",
+    "tool-calling": "Modelo para chamada de ferramenta/função",
+    "multi-turn": "Modelo para conversas múltiplas",
+    "vision": "Modelo multimodal com entrada de imagem",
+    "schema-coercion": "Aplicação de esquema de saída estruturada/JSON"
+  },
+  "templatePayloads": {
+    "simpleChat": {
+      "system": "Você é um assistente de IA útil.",
+      "userGreeting": "Olá! Como posso ajudá-lo hoje?"
     },
-    "howItWorks": {
-      "step1": "Escolha um provedor de integração (ex: Slack, Discord, webhook personalizado) e configure os detalhes da conexão.",
-      "step2": "Configure os eventos do sistema para assinar (ex: erros de conclusão, fallbacks de modelo ou limites de uso).",
-      "step3": "Verifique a configuração enviando uma carga de teste para garantir que o endpoint a receba.",
-      "step4": "Proteja seu endpoint validando o cabeçalho X-Webhook-Signature HMAC-SHA256 usando o segredo do webhook.",
-      "title": "Como os Webhooks Funcionam",
-      "customOnly": "Aplicável apenas para integrações de endpoint personalizadas.",
-      "hmacRecipeTitle": "Receita de Verificação HMAC",
-      "hmacRecipe": "Para verificar cargas de webhook no Node.js, calcule o HMAC-SHA256 do corpo bruto da requisição usando sua chave secreta. Compare-o com o cabeçalho X-Webhook-Signature usando timingSafeEqual.",
-      "timeoutNote": "As entregas de webhook têm um tempo limite de 10 segundos.",
-      "retryNote": "Entregas falhas são tentadas até 5 vezes com backoff exponencial.",
-      "docsLink": "Leia o guia completo do desenvolvedor de Webhooks",
-      "hmacRecipePython": "Verificação HMAC em Python: hmac.new(secret, body, hashlib.sha256).hexdigest()",
-      "hmacRecipeBash": "Verificação HMAC em Bash: echo -n \"$body\" | openssl dgst -sha256 -hmac \"$secret\""
+    "streaming": {
+      "prompt": "Escreva uma história sobre"
     },
-    "deliveries": {
-      "title": "Como os Webhooks Funcionam",
-      "loadFailed": "Falha ao carregar logs de entrega do webhook.",
-      "empty": "Nenhuma entrega registrada ainda. Acione um evento ou envie uma carga de teste.",
-      "status": "Status",
-      "event": "Evento",
-      "latency": "Latência",
-      "at": "Enviado em"
+    "systemPrompt": {
+      "question": "Qual é o sentido da vida?",
+      "systemInstruction": "Forneça uma resposta ponderada e filosófica."
     },
-    "kinds": {
-      "comingSoon": "Em breve",
-      "slack": "Slack",
-      "slackDesc": "Postar eventos do sistema diretamente em um canal do Slack",
-      "telegram": "Telegram",
-      "telegramDesc": "Enviar mensagens de evento usando um bot do Telegram",
-      "discord": "Discord",
-      "discordDesc": "Entregar atualizações em tempo real diretamente para um servidor do Discord",
-      "custom": "Webhook Personalizado",
-      "customDesc": "Entregar cargas de eventos do sistema para qualquer endpoint HTTPS",
-      "email": "Notificação por E-mail",
-      "emailDesc": "Receber atualizações de resumo via e-mail",
-      "pagerduty": "PagerDuty",
-      "pagerdutyDesc": "Acionar alertas no PagerDuty para problemas críticos do sistema",
-      "teams": "Microsoft Teams",
-      "teamsDesc": "Encaminhar notificações do sistema para canais do Microsoft Teams"
+    "thinking": {
+      "question": "Explique a computação quântica"
     },
-    "testPayloadSent": "Carga de Teste Enviada",
-    "testResponse": "Resposta de Teste",
-    "validateUrl": {
-      "checking": "Verificando URL...",
-      "ok": "URL é válida",
-      "blockedPrivate": "URL é um endereço privado bloqueado",
-      "invalidUrl": "Formato de URL inválido"
+    "toolCalling": {
+      "cityNameDescription": "O nome da cidade para obter o clima",
+      "toolDescription": "Obtenha o clima atual para um local",
+      "userWeather": "Qual é o clima em Tóquio?"
     },
-    "custom": {
-      "endpointUrl": "URL do Endpoint",
-      "endpointUrlPlaceholder": "https://api.seudominio.com/webhook",
-      "secretKey": "Chave Secreta",
-      "secretKeyPlaceholder": "Insira a chave secreta ou deixe em branco para gerar automaticamente",
-      "secretKeyHint": "Usado para assinar o cabeçalho da carga para autenticação."
-    },
-    "discord": {
-      "webhookUrl": "URL do Webhook",
-      "webhookUrlPlaceholder": "https://...",
-      "webhookUrlHint": "A URL do webhook copiada das configurações de integração.",
-      "tutorial": "Tutorial"
-    },
-    "slack": {
-      "webhookUrl": "URL do Webhook",
-      "webhookUrlPlaceholder": "https://...",
-      "webhookUrlHint": "A URL do webhook copiada das configurações de integração.",
-      "tutorial": "Tutorial"
-    },
-    "telegram": {
-      "botToken": "Token do Bot Telegram",
-      "botTokenPlaceholder": "123456789:ABCdefGhIJKlmNoPQRsTUVwxyZ",
-      "botTokenHint": "O token da API HTTP recebido do @BotFather ao criar seu bot.",
-      "chatId": "ID do Chat / Canal do Telegram",
-      "chatIdPlaceholder": "-100123456789 ou @nomecanal",
-      "chatIdHint": "O identificador numérico único ou nome de usuário público do chat/canal.",
-      "tutorial": "Tutorial"
+    "multiTurn": {
+      "system": "Você é um assistente útil.",
+      "assistantExample": "Ficarei feliz em ajudá-lo com isso.",
+      "userInitial": "preciso de ajuda com",
+      "userFollowUp": "Você pode explicar isso?"
     }
   },
+  "cache": {
+    "title": "Cache Management",
+    "description": "Monitor and manage semantic response cache, hit rates, and token savings.",
+    "refresh": "Refresh",
+    "clearAll": "Clear All",
+    "memoryEntries": "Memory Entries",
+    "memoryEntriesSub": "In-memory LRU",
+    "dbEntries": "DB Entries",
+    "dbEntriesSub": "Persisted (SQLite)",
+    "cacheHits": "Cache Hits",
+    "cacheHitsSub": "of {total} total",
+    "tokensSaved": "Tokens Saved",
+    "tokensSavedSub": "Estimated from hits",
+    "hitRate": "Hit Rate",
+    "performance": "Cache Performance",
+    "autoRefresh": "Auto-refreshes every {seconds}s",
+    "hits": "Hits",
+    "misses": "Misses",
+    "total": "Total",
+    "behavior": "Cache Behavior",
+    "behaviorDeterministic": "Only non-streaming requests with temperature=0 are cached.",
+    "behaviorBypass": "Bypass with header {header}.",
+    "behaviorTwoTier": "Two-tier storage: in-memory LRU (fast) + SQLite (persistent across restarts).",
+    "behaviorTtl": "Default TTL: 30 minutes. Configure via {envVar}.",
+    "idempotency": "Idempotency Layer",
+    "activeDedupKeys": "Active Dedup Keys",
+    "dedupWindow": "Dedup Window",
+    "clearSuccess": "Cache cleared. {count} expired entries removed.",
+    "clearError": "Failed to clear cache.",
+    "unavailable": "Cache unavailable",
+    "unavailableDesc": "Could not fetch cache statistics. Make sure the server is running.",
+    "loadingCacheAria": "Carregando cache",
+    "promptCache": "Prompt Cache (Provider-Side)",
+    "semanticCache": "Semantic Cache",
+    "promptCacheSectionDesc": "Shows provider-side prompt caching activity from usage history so you can see where cache control is active and how much input reuse you are getting.",
+    "promptTrendDesc": "Hourly request volume, cache coverage, and cache read volume across the last 24 hours.",
+    "cachedRequests": "Cached Requests",
+    "cachedRequests24h": "Cached Requests (24h)",
+    "cacheHitRate": "Cache Hit Rate",
+    "cacheRate": "Cache Rate",
+    "cacheRateDesc": "of total requests",
+    "cachedTokens": "Cached Tokens",
+    "cacheCreationTokens": "Cache Creation Tokens",
+    "cacheMetrics": "Prompt Cache Metrics",
+    "withCacheControl": "With Cache Control",
+    "cachedTokensRead": "Cached Tokens (Read)",
+    "cacheCreationWrite": "Cache Creation (Write)",
+    "cacheReuseRatio": "Cache Reuse Ratio",
+    "cacheReuseRatioDesc": "Cached tokens / Total input tokens",
+    "estCostSaved": "Est. Cost Saved",
+    "lastUpdated": "Last updated",
+    "hoursTracked": "hours tracked",
+    "busiestHour": "Busiest Hour",
+    "peakCacheRate": "Peak Cache Rate",
+    "trendHour": "Hour",
+    "activityVolume": "Activity",
+    "requestsShort": "reqs",
+    "inputShort": "In",
+    "cachedShort": "Cached",
+    "writeShort": "Write",
+    "resetting": "Resetting...",
+    "resetMetrics": "Reset Metrics",
+    "byProvider": "Breakdown by Provider",
+    "providerCacheRateDesc": "Each provider exposes total input tokens, cache read tokens, and cache write tokens so you can verify the reuse ratio against raw totals.",
+    "provider": "Provider",
+    "requests": "Requests",
+    "inputTokens": "Input Tokens",
+    "cachedTokensCol": "Cached",
+    "cacheCreation": "Creation",
+    "trend24h": "Cache Trend (24h)",
+    "peakCached": "Peak cached",
+    "cached": "Cached",
+    "overview": "Overview",
+    "tableProvider": "Provedor",
+    "tableModel": "Modelo",
+    "performanceTitle": "Desempenho",
+    "semanticCacheSectionDesc": "OmniRoute's own deterministic response cache. When enabled, repeated non-streaming temperature=0 requests can be served locally without hitting the upstream provider.",
+    "semanticCacheDisabledDesc": "Semantic cache is disabled. OmniRoute will skip local response reuse until you turn it back on in Settings.",
+    "semanticEntriesDesc": "Persisted semantic cache records currently stored in SQLite. Provider-side prompt cache activity is not listed here.",
+    "searchEntries": "Search entries...",
+    "search": "Search",
+    "loading": "Loading...",
+    "entriesLoadError": "Failed to load semantic cache entries.",
+    "noEntries": "No cache entries found",
+    "noPromptCacheData": "No provider-side prompt cache activity has been recorded yet.",
+    "noTrendData": "No prompt cache activity has been recorded over the last 24 hours.",
+    "signature": "Signature",
+    "model": "Model",
+    "created": "Created",
+    "expires": "Expires",
+    "actions": "Actions",
+    "deduplicatedRequests": "Requisições Desduplicadas",
+    "savedCalls": "Chamadas API Poupadas",
+    "totalProcessed": "Total Processado",
+    "disabled": "Disabled",
+    "totalRequests": "Total Requests",
+    "reasoningCache": "Repetição do raciocínio",
+    "reasoningCacheDesc": "Preserva o pensamento do modelo para fluxos de chamada de ferramentas multivoltas",
+    "reasoningEntries": "Entradas ativas",
+    "reasoningReplayRate": "Taxa de repetição",
+    "reasoningReplays": "Total de repetições",
+    "reasoningCharsCached": "Personagens em cache",
+    "reasoningMisses": "Perdas de cache",
+    "reasoningByProvider": "Por provedor",
+    "reasoningByModel": "Por modelo",
+    "reasoningRecentEntries": "Entradas recentes",
+    "reasoningToolCallId": "ID de chamada da ferramenta",
+    "reasoningChars": "Personagens",
+    "reasoningAge": "Idade",
+    "reasoningView": "Ver",
+    "reasoningDetail": "Conteúdo de raciocínio",
+    "reasoningBehavior": "Comportamento",
+    "reasoningBehaviorCapture": "Captura reasoning_content de respostas de streaming",
+    "reasoningBehaviorReplay": "Reinjeta no próximo turno quando o cliente o omite",
+    "reasoningBehaviorFallback": "Memória em primeiro lugar com substituto SQLite para recuperação de falhas",
+    "reasoningBehaviorTtl": "TTL: 2 horas | Entradas máximas: 2.000 (memória)",
+    "reasoningBehaviorModels": "Suportado: DeepSeek, Kimi, Qwen-Thinking, GLM",
+    "reasoningClearAll": "Limpar cache de raciocínio",
+    "reasoningClearSuccess": "Entradas de cache de raciocínio {count} apagadas",
+    "reasoningClearError": "Falha ao limpar o cache de raciocínio",
+    "reasoningNoData": "Nenhuma entrada de raciocínio armazenada em cache ainda. As entradas aparecem quando os modelos de pensamento usam chamada de ferramenta.",
+    "cachePerformanceRetry": "Tentar novamente",
+    "cachePerformanceHitRate": "Taxa de acerto",
+    "cachePerformanceAvgLatency": "Latência média (ms)",
+    "cachePerformanceP95Latency": "Latência p95 (ms)",
+    "retry": "Tentar novamente",
+    "reasoningAvgChars": "Média de caracteres",
+    "tableShare": "Participação",
+    "justNow": "agora mesmo",
+    "minutesAgo": "{minutes}m atrás",
+    "hoursAgo": "{hours}h atrás",
+    "daysAgo": "{days}d atrás",
+    "entries": "Entries"
+  },
+  "proxyConfigModal": {
+    "levelGlobal": "Globais",
+    "levelProvider": "Provedor",
+    "levelCombo": "Combinação",
+    "levelKey": "Chave",
+    "levelDirect": "Direto (sem proxy)",
+    "titleGlobal": "Configuração de proxy global",
+    "titleLevel": "{level} Proxy — {label}",
+    "loading": "Carregando configuração de proxy...",
+    "inheritingFrom": "Herdando de",
+    "source": "Fonte",
+    "savedProxy": "Proxy salvo",
+    "custom": "Personalizado",
+    "selectSavedProxyPlaceholder": "Selecione o proxy salvo...",
+    "proxyType": "Tipo de proxy",
+    "host": "Anfitrião",
+    "hostPlaceholder": "1.2.3.4 ou proxy.example.com",
+    "port": "Porto",
+    "authOptional": "Autenticação (opcional)",
+    "username": "Nome de usuário",
+    "usernamePlaceholder": "Nome de usuário",
+    "password": "Senha",
+    "passwordPlaceholder": "Senha",
+    "connected": "Conectado",
+    "ip": "IP:",
+    "connectionFailed": "Falha na conexão",
+    "testConnection": "Conexão de teste",
+    "clear": "Limpar",
+    "cancel": "Cancelar",
+    "save": "Salvar",
+    "errorSelectSavedProxy": "Selecione primeiro um proxy salvo.",
+    "errorSelectProxyFirst": "Selecione um proxy primeiro.",
+    "errorProxyNotFound": "Proxy selecionado não encontrado.",
+    "errorClearSavedProxy": "Falha ao limpar o proxy salvo",
+    "errorSaveProxy": "Falha ao salvar a configuração do proxy",
+    "errorClearProxy": "Falha ao limpar a configuração do proxy",
+    "errorSocks5Hidden": "SOCKS5 está configurado, mas oculto porque NEXT_PUBLIC_ENABLE_SOCKS5_PROXY=false."
+  },
+  "oauthModal": {
+    "title": "Conectar {providerName}",
+    "waiting": "Aguardando autorização",
+    "completeAuthInPopup": "Autorização completa no pop-up.",
+    "popupClosedHint": "Se o pop-up for fechado sem redirecionamento de volta (por exemplo, Qoder), esta caixa de diálogo mudará automaticamente para o modo de entrada manual de URL.",
+    "popupBlocked": "Pop-up bloqueado? Insira o URL manualmente",
+    "deviceCodeVisitUrl": "Visite o URL abaixo e insira o código:",
+    "deviceCodeVerificationUrl": "URL de verificação",
+    "deviceCodeYourCode": "Seu código",
+    "deviceCodeWaiting": "Aguardando autorização...",
+    "googleOAuthWarning": "Acesso remoto + Google OAuth: as credenciais padrão aceitam apenas redirecionamentos para <code>localhost</code>. Após a autorização, seu navegador tentará abrir <code>localhost</code> — copie o URL completo e cole-o abaixo. Para uso totalmente remoto sem esta etapa manual, <a>configure suas próprias credenciais OAuth</a>.",
+    "remoteAccessInfo": "Acesso remoto: Como você está acessando o OmniRoute remotamente, após a autorização você verá uma página de erro (localhost não encontrado). Isso é normal – basta copiar o URL completo da barra de endereço do seu navegador e colá-lo abaixo.",
+    "step1OpenUrl": "Etapa 1: abra este URL em seu navegador",
+    "copy": "Copiar",
+    "step2PasteCallback": "Etapa 2: cole o URL de retorno de chamada ou o código de autorização aqui",
+    "step2Hint": "Após a autorização, cole o URL de retorno de chamada completo. Para Claude Code e Cline, você também pode colar o código de autenticação diretamente, por exemplo. <code>código#estado</code>.",
+    "connect": "Conectar",
+    "cancel": "Cancelar",
+    "success": "Conexão bem-sucedida!",
+    "successMessage": "Sua conta {providerName} foi conectada.",
+    "done": "Concluído",
+    "error": "Falha na conexão",
+    "tryAgain": "Tente novamente"
+  },
+  "cursorAuthModal": {
+    "title": "Conecte o Cursor IDE",
+    "autoDetecting": "Detecção automática de tokens...",
+    "readingFromCursor": "Lendo do Cursor IDE ou cursor-agent",
+    "tokensAutoDetected": "Tokens detectados automaticamente com sucesso no Cursor IDE!",
+    "cursorNotDetected": "Cursor IDE não detectado. Cole manualmente seu token.",
+    "accessToken": "Token de acesso",
+    "required": "*",
+    "accessTokenPlaceholder": "O token de acesso será preenchido automaticamente...",
+    "machineId": "ID da máquina",
+    "optional": "(opcional)",
+    "machineIdPlaceholder": "O ID da máquina será preenchido automaticamente...",
+    "importing": "Importando...",
+    "importToken": "Token de importação",
+    "cancel": "Cancelar",
+    "errorAutoDetect": "Não foi possível detectar tokens automaticamente",
+    "errorAutoDetectFailed": "Falha na detecção automática de tokens",
+    "errorEnterToken": "Por favor insira o token de acesso",
+    "errorImportFailed": "Falha na importação"
+  },
+  "pricingModal": {
+    "title": "Configuração de preços",
+    "loading": "Carregando dados de preços...",
+    "pricingRatesFormat": "Formato de taxas de preços",
+    "ratesDescription": "Todas as taxas estão em <strong>dólares por milhão de tokens</strong> (US$/1 milhão de tokens). Exemplo: taxa de entrada de 2,50 significa US$ 2,50 por 1.000.000 de tokens de entrada.",
+    "model": "Modelo",
+    "input": "Entrada",
+    "output": "Saída",
+    "cached": "Em cache",
+    "reasoning": "Raciocínio",
+    "cacheCreation": "Criação de Cache",
+    "noPricingData": "Não há dados de preços disponíveis",
+    "resetToDefaults": "Redefinir para os padrões",
+    "cancel": "Cancelar",
+    "saving": "Salvando...",
+    "saveChanges": "Salvar alterações",
+    "resetConfirm": "Redefinir todos os preços para os padrões? Isto não pode ser desfeito.",
+    "errorSaveFailed": "Falha ao salvar o preço",
+    "errorResetFailed": "Falha ao redefinir o preço"
+  },
+  "proxyRegistry": {
+    "title": "Title",
+    "description": "Description",
+    "importLegacy": "Import Legacy",
+    "bulkAssign": "Bulk Assign",
+    "addProxy": "Add Proxy",
+    "loading": "Loading",
+    "noProxies": "No Proxies",
+    "tableName": "Table Name",
+    "tableEndpoint": "Table Endpoint",
+    "tableStatus": "Table Status",
+    "tableHealth": "Table Health",
+    "tableUsage": "Table Usage",
+    "tableActions": "Table Actions",
+    "test": "Test",
+    "edit": "Edit",
+    "delete": "Delete",
+    "modalCreateTitle": "Modal Create Title",
+    "modalEditTitle": "Modal Edit Title",
+    "labelName": "Label Name",
+    "labelType": "Tipo",
+    "labelFamily": "__MISSING__:IP family",
+    "familyAuto": "__MISSING__:Auto (dual-stack)",
+    "familyIpv4": "__MISSING__:IPv4 only",
+    "familyIpv6": "__MISSING__:IPv6 only",
+    "familyHint": "__MISSING__:Egress address family. Auto keeps dual-stack; IPv4/IPv6 pin this proxy to that family (prevents a v4 leak under an IPv6-only proxy).",
+    "labelHost": "Anfitrião",
+    "labelPort": "Porto",
+    "labelUsername": "Nome de usuário",
+    "labelPassword": "Senha",
+    "labelRegion": "Região",
+    "labelStatus": "Estado",
+    "labelNotes": "Notas",
+    "usernamePlaceholderEdit": "Deixe em branco para manter o nome de usuário atual",
+    "passwordPlaceholderEdit": "Deixe em branco para manter a senha atual",
+    "statusActive": "Ativo",
+    "statusInactive": "Inativo",
+    "cancel": "Cancelar",
+    "save": "Salvar",
+    "bulkModalTitle": "Atribuição de proxy em massa",
+    "bulkLabelScope": "Escopo",
+    "bulkLabelProxy": "Procurador",
+    "bulkClearAssignment": "(Limpar tarefa)",
+    "bulkLabelScopeIds": "IDs de escopo (separados por vírgula ou nova linha)",
+    "bulkScopeIdsPlaceholder": "provedor-openai,provedor-antrópico",
+    "bulkApply": "Aplicar",
+    "labelScope": "Escopo",
+    "labelProxy": "Proxy",
+    "scopeGlobal": "global",
+    "scopeProvider": "provedor",
+    "scopeAccount": "conta",
+    "scopeCombo": "combo",
+    "bulkImportErrorMissingName": "NOME ausente",
+    "bulkImportErrorMissingHost": "HOST ausente",
+    "bulkImportErrorInvalidPort": "PORTA inválida (deve ser 1-65535)",
+    "bulkImportErrorInvalidType": "TYPE inválido (use http, https ou meias5)",
+    "bulkImportErrorInvalidStatus": "STATUS inválido (use ativo ou inativo)",
+    "errorLoadFailed": "Error Load Failed",
+    "errorNameHostRequired": "Error Name Host Required",
+    "errorSaveFailed": "Error Save Failed",
+    "errorDeleteFailed": "Error Delete Failed",
+    "errorForceDeleteConfirm": "Error Force Delete Confirm",
+    "errorMigrateFailed": "Error Migrate Failed",
+    "errorBulkFailed": "Error Bulk Failed",
+    "success": "✓",
+    "failure": "✗",
+    "failed": "Failed",
+    "successRate": "{rate}% de sucesso",
+    "avgLatency": "Média de {latency}ms",
+    "assignmentsCount": "{count} atribuições",
+    "noData": "No Data",
+    "testSuccess": "✓ {ip}",
+    "testLatency": "{latency}ms",
+    "testFailure": "✗ {error}",
+    "bulkImport": "Importação em massa",
+    "bulkImportTitle": "Proxies de importação em massa",
+    "bulkImportDescription": "Cole perfis de proxy usando formato delimitado por barras verticais. Um proxy por linha. Os proxies existentes (mesmo host + porta) serão atualizados.",
+    "bulkImportParse": "Analisar",
+    "bulkImportImport": "Importar proxies {count}",
+    "bulkImportImporting": "Importando...",
+    "bulkImportParsed": "{count} proxies analisados",
+    "bulkImportSkipped": "{count} linhas ignoradas",
+    "bulkImportParseErrors": "{count} erros",
+    "bulkImportNoValidEntries": "Nenhuma entrada válida encontrada. Verifique o formato e tente novamente.",
+    "bulkImportSuccess": "Importação concluída: {created} criado, {updated} atualizado, {failed} falhou",
+    "bulkImportErrorLine": "Linha {line}: {reason}",
+    "bulkImportMaxExceeded": "Máximo de 100 proxies por importação",
+    "bulkImportPreview": "Visualização",
+    "clearAssignment": "(atribuição clara)",
+    "bulkProxyAssignment": "Atribuição de proxy em massa"
+  },
+  "playground": {
+    "title": "Title",
+    "description": "Description",
+    "endpoint": "Endpoint",
+    "provider": "Provider",
+    "model": "Model",
+    "accountKey": "Account Key",
+    "autoAccounts": "Automático ({count} contas)",
+    "noAccounts": "Sem contas",
+    "send": "Enviar",
+    "cancel": "Cancelar",
+    "audioFile": "Arquivo de áudio",
+    "attachImages": "Anexar imagens",
+    "multipartFormData": "Multipart Form Data",
+    "upToImages": "Até {count} imagens",
+    "selectAudioFile": "Selecionar arquivo de áudio",
+    "clearAll": "Limpar tudo",
+    "request": "Requisição",
+    "response": "Resposta",
+    "transcription": "Transcrição",
+    "copy": "Copiar",
+    "resetToDefault": "Restaurar padrão",
+    "downloadAudio": "Baixar áudio",
+    "copyText": "Copiar texto",
+    "transcriptionHint": "Dica de transcrição",
+    "imagesGenerated": "{count} imagens geradas",
+    "generatedImage": "Imagem gerada {index}",
+    "save": "Salvar",
+    "endpointOptions": {
+      "chat": "Chat",
+      "responses": "Responses",
+      "images": "Images",
+      "embeddings": "Embeddings",
+      "speech": "Speech",
+      "transcription": "Transcription",
+      "video": "Video",
+      "music": "Music",
+      "rerank": "Rerank",
+      "search": "Search"
+    },
+    "conversationalChat": "Bate-papo conversacional",
+    "clearChat": "Limpar bate-papo",
+    "typeMessagePlaceholder": "Digite uma mensagem... (Shift+Enter para nova linha)",
+    "tabChat": "Chat",
+    "tabCompare": "Comparar",
+    "tabApi": "API",
+    "tabBuild": "Construir",
+    "configPane": "Config",
+    "systemPrompt": "System prompt",
+    "systemPromptPlaceholder": "Você é um assistente útil.",
+    "modelPlaceholder": "ex.: openai/gpt-4o",
+    "endpointLabel": "Endpoint",
+    "parametersLabel": "Parâmetros",
+    "collapseConfig": "Recolher painel de config",
+    "expandConfig": "Expandir painel de config",
+    "temperature": "Temperatura",
+    "maxTokens": "Máx. tokens",
+    "topP": "Top-p",
+    "presencePenalty": "Penalidade de presença",
+    "frequencyPenalty": "Penalidade de frequência",
+    "seedPlaceholder": "Aleatório (deixar vazio)",
+    "presetsLabel": "Presets",
+    "loadPreset": "Carregar preset",
+    "savePreset": "Salvar preset",
+    "noPresets": "Nenhum preset",
+    "presetNamePlaceholder": "Nome do preset",
+    "savingPreset": "Salvando…",
+    "nameRequired": "Nome é obrigatório",
+    "failedToSavePreset": "Falha ao salvar preset",
+    "improvePrompt": "Melhorar prompt",
+    "improvingPrompt": "Melhorando…",
+    "improvePromptTitle": "Melhorar seu prompt com IA",
+    "setModelFirst": "Defina um modelo primeiro",
+    "improveQuotaWarning": "Isso consumirá cota do modelo configurado no painel Config.",
+    "improveConfirm": "Melhorar",
+    "exportCode": "Exportar código",
+    "exportCodeTitle": "Exportar Código",
+    "exportShort": "Exportar",
+    "noStateToExport": "Nenhum estado de playground disponível para exportar.",
+    "closeExportModal": "Fechar modal de exportação",
+    "close": "Fechar",
+    "exportRealKeyWarning": "Aviso de segurança: exportação bloqueada — uma API key real foi detectada na saída. Por favor, redefina sua API key e tente novamente.",
+    "placeholderHintPrefix": "Substitua",
+    "placeholderHintSuffix": "pela sua API key real, ou defina como variável de ambiente.",
+    "copyLangCode": "Copiar código {language}",
+    "loadingPresets": "Carregando…",
+    "loadPresetPlaceholder": "Carregar preset…",
+    "copyCode": "Copiar",
+    "copiedCode": "Copiado!",
+    "addModel": "+ Adicionar modelo",
+    "runAll": "Executar todos",
+    "cancelAll": "Cancelar todos",
+    "maxColumnsReached": "Máximo de {max} colunas",
+    "modelPlaceholderCompare": "Modelo (Cmd+K)…",
+    "ttft": "TTFT",
+    "tps": "TPS",
+    "metricsDisclaimer": "estimativa do cliente",
+    "tokensLabel": "Tokens",
+    "costLabel": "Custo",
+    "costEstimated": "(estimado)",
+    "toolsLabel": "Ferramentas",
+    "addTool": "Adicionar ferramenta",
+    "toolNamePlaceholder": "Nome da função",
+    "toolDescPlaceholder": "Descrição (opcional)",
+    "toolParamsInvalid": "Parâmetros devem ser JSON válido",
+    "structuredOutputLabel": "Saída Estruturada",
+    "enableJsonMode": "Ativar modo JSON",
+    "disableJsonMode": "Desativar modo JSON",
+    "invalidJson": "JSON inválido",
+    "running": "Executando…",
+    "runLabel": "Executar",
+    "enterToolResult": "Insira o resultado da ferramenta…",
+    "build": {
+      "step1Label": "O que testar?",
+      "step2Label": "Configurar",
+      "step3Label": "Rodar",
+      "step1Title": "O que você quer testar?",
+      "step1Subtitle": "Escolha a funcionalidade que deseja explorar nesta sessão.",
+      "step2Title": "Configurar",
+      "step2Subtitle": "Configure as ferramentas ou o esquema JSON que serão usados na requisição.",
+      "step3Title": "Rodar",
+      "modeToolsTitle": "Ferramentas",
+      "modeToolsDesc": "Teste function calling — defina ferramentas e veja como o modelo as invoca.",
+      "modeJsonTitle": "JSON",
+      "modeJsonDesc": "Teste saída estruturada — restrinja a resposta a um esquema JSON.",
+      "modeBothTitle": "Ferramentas + JSON",
+      "modeBothDesc": "Combine function calling e saída estruturada em uma única requisição.",
+      "backButton": "Voltar",
+      "nextButton": "Próximo",
+      "runButton": "Executar",
+      "promptPlaceholder": "Digite sua mensagem… (Enter para enviar, Shift+Enter para nova linha)"
+    }
+  },
+  "miniPlayground": {
+    "endpoint": "Endpoint",
+    "apiKey": "Chave API",
+    "model": "Modelo",
+    "voice": "Voz",
+    "speed": "Velocidade",
+    "input": "Entrada",
+    "url": "URL",
+    "format": "Formato",
+    "depth": "Profundidade",
+    "copyCurl": "Copiar cURL",
+    "copied": "Copiado!",
+    "run": "Executar",
+    "running": "Executando...",
+    "response": "Resposta",
+    "tunnel": "Tunnel",
+    "send": "Enviar",
+    "selectKey": "Selecionar chave",
+    "testLabel": "Testar",
+    "expandTest": "Expandir teste",
+    "collapseTest": "Recolher teste",
+    "revealKey": "Revelar chave",
+    "hideKey": "Ocultar chave",
+    "download": "Baixar",
+    "play": "Reproduzir",
+    "query": "Consulta",
+    "numResults": "Máx. resultados",
+    "prompt": "Prompt",
+    "size": "Tamanho",
+    "duration": "Duração",
+    "question": "Pergunta",
+    "audioFile": "Arquivo de áudio",
+    "noKeysFound": "Nenhuma chave API encontrada. Adicione uma na seção Chaves.",
+    "exampleLabel": "Exemplo",
+    "latency": "{ms}ms",
+    "statsLine": "{ms}ms · {tokensIn} entrada / {tokensOut} saída tokens"
+  },
+  "requestLogger": {
+    "recording": "Recording",
+    "paused": "Paused",
+    "pipelineLogsOn": "Pipeline logs on",
+    "pipelineLogsOff": "Pipeline logs off",
+    "updatingPipelineLogs": "Updating pipeline logs...",
+    "updatePipelineFailed": "Failed to update pipeline logging",
+    "capturePipeline": "Capture pipeline payloads for new requests",
+    "searchPlaceholder": "Search models, providers, accounts, API keys, combos...",
+    "allProviders": "All providers",
+    "allModels": "All models",
+    "allAccounts": "All accounts",
+    "allApiKeys": "All API keys",
+    "total": "Total",
+    "ok": "Success",
+    "err": "Error",
+    "combo": "Combo",
+    "keys": "Keys",
+    "shown": "Shown",
+    "sortNewest": "Newest",
+    "sortOldest": "Oldest",
+    "sortTokensDesc": "Tokens ↓",
+    "sortTokensAsc": "Tokens ↑",
+    "sortDurationDesc": "Duration ↓",
+    "sortDurationAsc": "Duration ↑",
+    "sortStatusDesc": "Status ↓",
+    "sortStatusAsc": "Status ↑",
+    "sortModelAsc": "Model A-Z",
+    "sortModelDesc": "Model Z-A",
+    "sortLogs": "Sort logs",
+    "refresh": "Refresh",
+    "columnsLabel": "Columns",
+    "cacheSem": "SEM",
+    "cacheUp": "UP",
+    "semantic": "Semantic",
+    "upstream": "Upstream",
+    "semanticCacheHit": "Semantic cache hit (served by OmniRoute)",
+    "upstreamResponse": "Upstream provider response",
+    "noApiKey": "No API key",
+    "requestedRoutedTitle": "Requested {requested}, routed as {routed}",
+    "statusFilters": {
+      "all": "All",
+      "error": "Errors",
+      "success": "Success",
+      "combo": "Combo"
+    },
+    "columns": {
+      "status": "Status",
+      "cacheSource": "Cache Source",
+      "model": "Model",
+      "requested": "Requested",
+      "provider": "Provider",
+      "protocol": "Request Protocol",
+      "account": "Account",
+      "apiKey": "API Key",
+      "combo": "Combo",
+      "tokens": "Tokens",
+      "compressed": "Compressão",
+      "tps": "TPS",
+      "duration": "Duration",
+      "time": "Time"
+    },
+    "loadingLogs": "Loading logs...",
+    "noLogs": "No logs yet. Make some API calls to see them here.",
+    "noMatchingLogs": "No logs matching current filters.",
+    "callLogsInfo": "Call logs are also saved as JSON files to {dataDir} and rotated based on {retentionDays} and {maxEntries}.",
+    "loadMore": "__MISSING__:Load More",
+    "loadingMore": "__MISSING__:Loading more..."
+  },
+  "proxyLogger": {
+    "filterAll": "All",
+    "filterErrors": "Errors",
+    "filterSuccess": "Success",
+    "filterTimeout": "Timeout",
+    "colStatus": "Status",
+    "colProxy": "Proxy",
+    "colTls": "TLS",
+    "colType": "Type",
+    "colLevel": "Level",
+    "colProvider": "Provider",
+    "colTarget": "Target",
+    "colLatency": "Latency",
+    "colClientIp": "__MISSING__:Client IP",
+    "colTime": "Time",
+    "recording": "Recording",
+    "paused": "Paused",
+    "searchPlaceholder": "Search host, provider, target, IP...",
+    "allTypes": "All Types",
+    "allLevels": "All Levels",
+    "allProviders": "All Providers",
+    "total": "total",
+    "ok": "OK",
+    "err": "ERR",
+    "timeoutShort": "TMO",
+    "direct": "direct",
+    "newest": "Newest",
+    "oldest": "Oldest",
+    "latencyDesc": "Latency ↓",
+    "latencyAsc": "Latency ↑",
+    "refresh": "Refresh",
+    "columns": "Columns",
+    "loadingProxyLogs": "Loading proxy logs...",
+    "noProxyLogs": "No proxy logs yet. Configure proxies and make API calls to see them here.",
+    "noMatchingLogs": "No logs match the current filters.",
+    "tlsFingerprint": "Chrome 124 TLS Fingerprint",
+    "colPublicIp": "Public IP"
+  },
+  "endpointOptions": {
+    "speech": "Speech",
+    "search": "Search",
+    "images": "Images",
+    "chat": "Chat",
+    "music": "Music",
+    "responses": "Responses",
+    "rerank": "Rerank",
+    "video": "Video",
+    "embeddings": "Embeddings",
+    "transcription": "Transcription"
+  },
+  "toolDescriptions": {
+    "cline": "Cline",
+    "openclaw": "Openclaw",
+    "droid": "Droid",
+    "codex": "Codex",
+    "claude": "Claude",
+    "kilo": "Kilo"
+  },
+  "runtime": {
+    "title": "Runtime",
+    "description": "Observabilidade em tempo real — 3 camadas de resiliência + sessões + alertas de quota",
+    "pause": "Pausar",
+    "resume": "Retomar",
+    "refreshNow": "Atualizar agora",
+    "kpiSessions": "Sessões",
+    "kpiCircuits": "Circuits",
+    "kpiCooldowns": "Cooldowns",
+    "kpiLockouts": "Lockouts",
+    "hintStickyBound": "{count} sticky-bound",
+    "hintRecovering": "{count} recuperando",
+    "hintAllHealthy": "tudo saudável",
+    "hintOpen": "aberto",
+    "hintConnsCooling": "conexões em cooldown",
+    "hintModelsBlocked": "modelos bloqueados",
+    "resilienceTitle": "Resiliência em 3 Camadas",
+    "resilienceSubtitle": "Espelha o modelo de resiliência documentado",
+    "providersHealthy": "{percent}% dos providers saudáveis",
+    "layer": "Camada {n}",
+    "layer1Title": "Provider Circuit Breakers",
+    "layer1Desc": "Bloqueia tráfego para providers falhando no upstream",
+    "layer2Title": "Cooldown de Conexões",
+    "layer2Desc": "Pula uma conta/key ruim; outras conexões continuam atendendo",
+    "layer3Title": "Lockout de Modelos",
+    "layer3Desc": "Travas de rate-limit por modelo; a mesma conexão ainda atende outros modelos",
+    "badgeAffectedOf": "{affected} de {total} afetados",
+    "badgeCooling": "{count} em cooldown",
+    "badgeLocked": "{count} travados",
+    "emptyCircuits": "Nenhum circuit breaker ativo",
+    "emptyCooldowns": "Nenhum cooldown de conexão ativo",
+    "emptyLockouts": "Nenhum lockout de modelo",
+    "moreCooldowns": "+{count} cooldowns adicionais",
+    "moreLockouts": "+{count} lockouts adicionais",
+    "feedTitle": "Feed ao Vivo",
+    "feedSubtitle": "Últimos {count} eventos",
+    "feedFilterAll": "Todos",
+    "feedFilterCircuits": "Circuits",
+    "feedFilterCooldowns": "Cooldowns",
+    "feedFilterLockouts": "Lockouts",
+    "feedFilterSessions": "Sessões",
+    "feedFilterQuotas": "Quotas",
+    "feedClear": "Limpar",
+    "feedEmptyWaiting": "Aguardando eventos... (poll a cada 5s)",
+    "feedEmptyFiltered": "Nenhum evento corresponde ao filtro",
+    "sessionsTitle": "Sessões Ativas",
+    "sessionsSubtitle": "Fingerprints de requisições sticky-bound (live)",
+    "sessionsActive": "{count} ativas",
+    "sessionsEmptyTitle": "Nenhuma sessão ativa",
+    "sessionsEmptyHint": "Sessões aparecem conforme as requisições passam pela proxy",
+    "tblSession": "Sessão",
+    "tblAge": "Idade",
+    "tblIdle": "Ocioso",
+    "tblReqs": "Reqs",
+    "tblBoundTo": "Vinculada a",
+    "topApiKeys": "Top API keys",
+    "quotaMonitorsTitle": "Monitores de Quota",
+    "quotaMonitorsSubtitle": "Estado live de quota por janela de conta",
+    "openQuota": "Abrir Quota",
+    "allQuotasHealthy": "Todas as quotas saudáveis",
+    "statusExhausted": "ESGOTADO",
+    "statusAlerting": "ALERTANDO",
+    "statusError": "ERRO",
+    "moreSuffix": "+{count} mais"
+  },
+  "quotaShare": {
+    "title": "Compartilhamento de Cota",
+    "description": "Compartilhe cotas de provedores entre API keys com limites %",
+    "newPool": "Novo pool",
+    "betaTitle": "Beta",
+    "betaDescription": "A configuração é salva em localStorage (ainda não persistida no servidor). A aplicação dos caps por request ainda não está conectada ao pipeline da proxy. Esta tela permite desenhar e visualizar a divisão de cota; a aplicação real virá em uma próxima iteração com persistência no banco e interceptação na chamada upstream.",
+    "kpiActivePools": "Pools ativos",
+    "kpiKeysAllocated": "Keys alocadas",
+    "kpiAvgUnallocated": "Média não alocada",
+    "kpiProvidersWithQuota": "Providers c/ cota",
+    "emptyTitle": "Nenhum pool configurado",
+    "emptyDescription": "Crie um pool para atribuir API keys e compartilhar uma janela de cota do provedor com alocações %.",
+    "loading": "Carregando…",
+    "removePool": "Remover pool",
+    "removeConfirm": "Remover este pool?",
+    "pool": "Pool",
+    "used": "usado",
+    "allocationsCount": "Alocações ({count})",
+    "allocatedFree": "{allocated}% alocado · {free}% livre",
+    "noAllocations": "Nenhuma key alocada ainda",
+    "capLabel": "cap {value}",
+    "notTrackedYet": "(ainda não rastreado)",
+    "policy": "Política",
+    "policyHard": "hard",
+    "policySoft": "soft",
+    "policyBurst": "burst",
+    "policyHardHint": "Bloqueia quando key esgota alocação",
+    "policySoftHint": "Permite overflow, apenas alerta",
+    "policyBurstHint": "Permite burst para o pool livre",
+    "editAllocations": "Editar alocações",
+    "newPoolTitle": "Novo pool de cota",
+    "providerConnection": "Conexão de provider (conta)",
+    "selectConnection": "Selecione uma conexão…",
+    "noEligibleConnections": "Nenhuma conexão com dados de cota. Atualize em /dashboard/quota primeiro.",
+    "quotaWindow": "Janela de cota",
+    "selectWindow": "Selecione uma janela…",
+    "alreadyUsedSuffix": "(já utilizada)",
+    "windowReset": "Reset",
+    "duplicatePoolError": "Já existe um pool para esta conexão + janela",
+    "cancel": "Cancelar",
+    "createPool": "Criar pool",
+    "editTitle": "Editar alocações",
+    "noKeysAdded": "Nenhuma key alocada. Adicione uma abaixo.",
+    "totalLabel": "Total: {percent}%",
+    "totalExceeded": "⚠ excede 100%",
+    "addKey": "+ Adicionar key…",
+    "equalSplit": "Divisão igual",
+    "save": "Salvar alocações",
+    "betaPreviewLabel": "Beta – visualização da IU.",
+    "betaConfigSavedPrefix": "A configuração é salva em",
+    "betaConfigSavedSuffix": "(ainda não persistido no servidor). A aplicação do limite por solicitação ainda não está conectada ao pipeline do proxy. Esta tela permite desenhar e visualizar a divisão de cotas; a aplicação real chegará em uma iteração futura com persistência de banco de dados e interceptação de chamadas upstream.",
+    "policyLabel": "Política:",
+    "resetIn": "redefinir em",
+    "quotaTotal": "total",
+    "kpiAvgUtilization": "Util média",
+    "kpiBorrowingNow": "Em empréstimo agora",
+    "conceptTitle": "Como funciona o Quota Share",
+    "conceptIntro": "O Quota Share divide a cota de um provider entre múltiplas API keys usando fair-share work-conserving: cada key recebe uma fatia proporcional, mas pode tomar emprestado do saldo livre sem estourar o teto global.",
+    "conceptFairShare": "Fair-share: cada key recebe proporcionalmente ao peso configurado",
+    "conceptBorrowing": "Empréstimo: keys podem usar saldo livre de outras sem ultrapassar o teto",
+    "conceptGlobalCap": "Teto intransponível: o cap absoluto do provider nunca é excedido",
+    "conceptWindows": "Janelas: 5h, horária, diária, semanal, mensal — cada uma rastreada independentemente",
+    "conceptKeyHowTitle": "Habilitando uma key para cota",
+    "conceptKeyHowDesc": "Crie a key normalmente no Gerenciador de APIs — ela aparece automaticamente na etapa de keys do wizard. Marque Exclusiva lá para torná-la somente-cota. Não há etapa de ativação separada.",
+    "conceptExclusiveTitle": "O que \"Exclusiva\" faz",
+    "conceptExclusiveDesc": "Uma key exclusiva enxerga/usa apenas os modelos quotaShared-* do pool — todos os outros modelos ficam ocultos no seu /v1/models e bloqueados.",
+    "burnRateTitle": "Taxa de consumo",
+    "burnRateExhaustsIn": "Esgota em",
+    "dimensionResetIn": "Reset em",
+    "realConsumedColumn": "Consumido",
+    "deficitColumn": "Déficit",
+    "borrowingIndicator": "empréstimo",
+    "migratedFromLocalStorageNotice": "Pools migrados do localStorage com sucesso.",
+    "policyCapAbsoluteLabel": "Cap absoluto",
+    "policyCapAbsolutePlaceholder": "Limite numérico (opcional)",
+    "multiDimensionLabel": "Multi-dimensão",
+    "stackedBarTitle": "Fatias por API key",
+    "usedSuffix": "usou {percent}%",
+    "wizardTitle": "Novo pool de cota",
+    "editPoolTitle": "Editar pool",
+    "saveChanges": "Salvar alterações",
+    "wizardStep1Label": "Conta",
+    "wizardStep2Label": "Limite",
+    "wizardStep3Label": "Chaves",
+    "wizardStep1Title": "Escolha a conexão de provider",
+    "wizardStep1Subtitle": "Selecione a conta do provider cuja cota este pool compartilhará, defina um nome e a política padrão.",
+    "wizardStep2Title": "Configure as dimensões de cota",
+    "wizardStep2Subtitle": "Defina as dimensões do plano de cota (unidade, janela, limite) para a conexão escolhida. Deixe sem alteração para manter as configurações atuais.",
+    "wizardStep3Title": "Aloque API keys",
+    "wizardStep3Subtitle": "Atribua API keys a este pool com alocações de peso % e caps opcionais.",
+    "wizardPoolNameLabel": "Nome do pool",
+    "wizardPoolNamePlaceholder": "Meu pool de cota",
+    "wizardNext": "Avançar",
+    "wizardBack": "Voltar",
+    "wizardCreatePool": "Criar pool",
+    "wizardDimensionsEditedNotice": "Dimensões editadas — serão salvas como override manual quando o pool for criado.",
+    "wizardExclusiveLabel": "Cota exclusiva",
+    "wizardExclusiveHint": "Quando ativado, estas API keys só poderão usar os modelos virtuais deste pool (reconciliação de allowedQuotas aplicada ao salvar).",
+    "wizardPreviewLabel": "Prévia dos nomes de modelos virtuais",
+    "wizardConnectionsLabel": "Conexões de provider",
+    "wizardPrimaryBadge": "principal",
+    "wizardAdditionalConnectionsNote": "Conexões adicionais usam os limites padrão do catálogo (editáveis posteriormente).",
+    "wizardSingleProviderNote": "Um pool usa um provedor só",
+    "wizardPreviewMoreModels": "+{count} mais",
+    "accountQuotaTitle": "Cota da conta",
+    "accountQuotaNone": "—",
+    "logTitle": "Log de uso",
+    "logEmpty": "Sem uso ainda",
+    "groupLabel": "Grupo",
+    "newGroup": "Novo grupo",
+    "renameGroup": "Renomear grupo",
+    "groupSelectHint": "Filtrar pools por grupo",
+    "groupAllocationNote": "As alocações se aplicam a todos os pools deste grupo através da camada de cota compartilhada.",
+    "groupNamePrompt": "Digite o nome do grupo",
+    "wizardGroupLabel": "Grupo",
+    "allGroups": "Todos os grupos",
+    "endpointsTitle": "Endpoints disponíveis",
+    "endpointsHint": "Chame estes modelos virtuais com qualquer chave alocada — roteamento + cota são tratados por grupo.",
+    "previewForKey": "Pré-visualizar p/ chave",
+    "previewKeyNone": "(todos os endpoints)",
+    "endpointsBaseUrl": "URL base",
+    "endpointsCollapse": "Recolher",
+    "endpointsExpand": "Expandir",
+    "endpointsAnthropicNote": "nativo Anthropic",
+    "endpointsResponsesNote": "OpenAI Responses — codex/github",
+    "endpointsWsNote": "WebSocket — somente codex",
+    "betaText": "O Quota Share está funcional, mas bugs são esperados. Encontrou um? Reporte, por favor.",
+    "betaReportLink": "Abrir uma issue",
+    "deleteGroup": "Excluir grupo",
+    "deleteGroupConfirm": "Excluir este grupo? Os pools dele precisam ser reatribuídos ou removidos antes.",
+    "deleteGroupHasPools": "Este grupo ainda tem pools — reatribua ou exclua-os primeiro.",
+    "ungroupedTitle": "Sem grupo",
+    "ungroupedHint": "Estes pools não estão atribuídos a um grupo conhecido. Edite um pool para movê-lo para um grupo real."
+  },
   "plugins": {
     "title": "Plugins",
     "description": "Install and manage plugins for extending OmniRoute functionality",
@@ -8079,6 +8376,16 @@
     "status": "Status",
     "enabled": "Enabled",
     "disabled": "Disabled",
+    "installedTab": "__MISSING__:Installed",
+    "marketplaceTab": "__MISSING__:Marketplace",
+    "marketplaceUrlLabel": "__MISSING__:Custom Marketplace URL",
+    "marketplaceUrlPlaceholder": "__MISSING__:Leave empty for official Omniroute registry",
+    "saveMarketplaceUrl": "__MISSING__:Save & Reload",
+    "marketplaceUrlSaved": "__MISSING__:Marketplace URL updated",
+    "marketplaceEmpty": "__MISSING__:No plugins found in marketplace.",
+    "verified": "__MISSING__:Verified",
+    "install": "__MISSING__:Install",
+    "installedFromMarketplace": "__MISSING__:Plugin {name} installed!",
     "hooks": "Hooks"
   },
   "quotaPlans": {
@@ -8274,6 +8581,28 @@
     "quickLinks": "Atalhos",
     "quickLinkProviders": "Configurar provedores",
     "quickLinkInspector": "Ver tráfego no Traffic Inspector",
+    "maintenanceTitle": "__MISSING__:Maintenance & Diagnostics",
+    "maintenanceSubtitle": "__MISSING__:Self-test the capture pipeline, undo leftover system state, and move your setup between machines.",
+    "orphanedStateWarning": "__MISSING__:A previous session left system state behind (DNS spoof, CA, or system proxy). Run Repair to clean it up.",
+    "diagnose": "__MISSING__:Diagnose",
+    "diagnosing": "__MISSING__:Diagnosing…",
+    "diagnoseHealthy": "__MISSING__:Capture pipeline is healthy.",
+    "diagnoseUnhealthy": "__MISSING__:Capture pipeline has problems:",
+    "repair": "__MISSING__:Repair",
+    "repairing": "__MISSING__:Repairing…",
+    "repairDone": "__MISSING__:Repaired: {items}",
+    "repairNothing": "__MISSING__:Nothing to repair — system state is clean.",
+    "removeCa": "__MISSING__:Remove CA",
+    "removeCaConfirm": "__MISSING__:Remove CA?",
+    "removeCaDone": "__MISSING__:MITM root CA removed from the OS trust store.",
+    "removing": "__MISSING__:Removing…",
+    "confirm": "__MISSING__:Confirm",
+    "exportConfig": "__MISSING__:Export config",
+    "exporting": "__MISSING__:Exporting…",
+    "importConfig": "__MISSING__:Import config",
+    "importing": "__MISSING__:Importing…",
+    "importInvalidJson": "__MISSING__:The selected file is not valid JSON.",
+    "importDone": "__MISSING__:Imported {bypass} bypass · {hosts} hosts · {agents} agents",
     "save": "Salvar",
     "saving": "Salvando…",
     "cancel": "Cancelar",
@@ -8301,6 +8630,8 @@
     "httpProxyModeDesc": "Usar variável de ambiente HTTP_PROXY",
     "systemWideMode": "Sistema inteiro",
     "systemWideModeDesc": "Interceptar todo o tráfego do sistema (avançado)",
+    "tproxyMode": "__MISSING__:TPROXY Decrypt",
+    "tproxyModeUnavailable": "__MISSING__:TPROXY decrypt requires Linux + root + the native addon",
     "filterBarTitle": "Filtros",
     "profileLlmOnly": "Apenas LLM",
     "profileCustom": "Personalizado",
@@ -8357,6 +8688,7 @@
     "httpProxyTitle": "Snippet de Proxy HTTP — porta {port}",
     "notRecording": "Sem gravação",
     "anyStatus": "Qualquer status",
+    "liveOnly": "__MISSING__:Live",
     "viewingRecordedSession": "Visualizando sessão gravada",
     "backToLive": "Voltar ao live",
     "untitledSession": "Sessão sem nome",
@@ -8407,6 +8739,7 @@
     "comparison": {
       "title": "Entenda os 3 tipos de CLI no OmniRoute",
       "thisPage": "[Esta página ✓]",
+      "open": "__MISSING__:Open →",
       "code": {
         "title": "Ferramenta de código",
         "desc": "Aponta para o Omni",
@@ -8436,9 +8769,11 @@
       "manualConfig": "Manual config",
       "installGuide": "Install guide",
       "endpointLabel": "Endpoint",
+      "baseUrlFull": "__MISSING__:Full Base URL",
       "baseUrlPartial": "Base URL parcial",
       "refreshDetection": "Atualizar detecção",
-      "alsoAcp": "também ACP"
+      "alsoAcp": "também ACP",
+      "connectProviderHint": "__MISSING__:Connect a provider in Providers"
     },
     "detail": {
       "back": "Voltar",
@@ -8586,5 +8921,26 @@
     "regenerateRunning": "Regenerando skills…",
     "regenerateSuccess": "Skills regeneradas com sucesso.",
     "regenerateError": "Falha ao regenerar skills."
+  },
+  "freeProviderRankingsPage": {
+    "title": "__MISSING__:Free Provider Rankings",
+    "subtitle": "__MISSING__:Best free providers ranked by model ELO scores from Arena AI leaderboards",
+    "loading": "__MISSING__:Loading rankings...",
+    "errorLoading": "__MISSING__:Failed to load rankings",
+    "emptyState": "__MISSING__:No rankings available yet. Arena ELO data syncs on startup (daily) — check back shortly, or trigger a manual sync. Disable Arena ELO Sync in Feature Flags or set ARENA_ELO_SYNC_ENABLED=false to opt out.",
+    "bestModel": "__MISSING__:Best",
+    "allCategories": "__MISSING__:All Categories",
+    "categoryDefault": "__MISSING__:Default",
+    "categoryCoding": "__MISSING__:Coding",
+    "categoryReview": "__MISSING__:Review",
+    "categoryDocumentation": "__MISSING__:Documentation",
+    "categoryDebugging": "__MISSING__:Debugging",
+    "colRank": "__MISSING__:Rank",
+    "colProvider": "__MISSING__:Provider",
+    "colTopModel": "__MISSING__:Top Model",
+    "colScore": "__MISSING__:Score",
+    "colAvgScore": "__MISSING__:Avg Score",
+    "colModels": "__MISSING__:Models",
+    "colType": "__MISSING__:Type"
   }
 }
diff --git a/src/i18n/messages/pt.json b/src/i18n/messages/pt.json
index 5e80578616..e9511b4839 100644
--- a/src/i18n/messages/pt.json
+++ b/src/i18n/messages/pt.json
@@ -393,6 +393,7 @@
     "cloudBenefitAccess": "Cloud Benefit Access",
     "maxRetries": "Max Retries",
     "queueTimeout": "Queue Timeout",
+    "queueDepth": "__MISSING__:Queue Depth",
     "addProvider": "Add Provider",
     "realtime": "Realtime",
     "totalTranslations": "Total Translations",
@@ -709,6 +710,7 @@
     "batchFilesListFilesTable": "Arquivos",
     "batchPageLoadingMore": "Carregando mais…",
     "recommended": "__MISSING__:Recommended",
+    "understand": "__MISSING__:I understand",
     "batchConceptTitle": "Batch processing",
     "batchConceptSubtitle": "Process thousands of requests asynchronously at ~50% of the cost (24h window). Ideal for evaluations, classification, and embeddings.",
     "batchConceptHowItWorks": "How it works",
@@ -773,36 +775,13 @@
     "filesListUploadButton": "Upload",
     "filesListUsedByColumn": "Used by",
     "filesListUsedByNone": "None",
-    "filesListDelete": "Delete",
-    "filesListDownload": "Download",
-    "batchDetailActionCancel": "Cancel batch",
-    "batchDetailActionRetry": "Retry failed requests",
-    "batchDetailCancelling": "Cancelling…",
-    "batchDetailRetrying": "Preparing retry…",
-    "batchDetailCancelConfirm": "Cancel this batch? In-progress requests will stop.",
-    "batchActionCancelError": "Failed to cancel batch. Try again.",
-    "batchActionRetryError": "Failed to retry failed requests. Try again.",
-    "batchConceptRetentionNote": "Results and error files are retained for 30 days (Anthropic: 29 days)",
     "filesListUsedByRoleInput": "input",
     "filesListUsedByRoleOutput": "output",
     "filesListUsedByRoleError": "error",
-    "batchListProgressPartial": "(partial)",
     "filesListSizeColumn": "Size",
+    "batchListProgressPartial": "(partial)",
     "batchListProviderColumn": "Provider",
     "batchListProviderUnknown": "—",
-    "batchListBatchCreated": "Batch {id} created — refreshing list…",
-    "batchListBatchCreatedDismiss": "Dismiss",
-    "batchListRefreshing": "Refreshing…",
-    "batchListRefresh": "Refresh",
-    "uploadFileModalRemove": "Remove",
-    "uploadFileModalUploading": "Uploading…",
-    "wizardInputReading": "Reading file…",
-    "wizardInputReady": "Ready",
-    "wizardInputLargeFileLabel": "Large file — sampling validation",
-    "wizardInputCsvJsonlReady": "JSONL generated — ready to validate.",
-    "wizardInputLargeFileWarning": "Large file detected — validation runs by sampling (first 5 MB + last 100 KB). Full validation happens server-side.",
-    "wizardCostWindow24h": "24h completion window",
-    "wizardValidationFieldsOk": "required fields valid",
     "batchListProviderOther": "Other",
     "batchListTitle": "Batches",
     "batchListCount": "{count} batches",
@@ -839,8 +818,33 @@
     "wizardCostWindow": "Window",
     "wizardDestinationSelectProvider": "Select a provider…",
     "wizardDestinationSelectModel": "Select a model…",
-    "wizardDestinationConnectProvider": "Connect a provider"
+    "wizardDestinationConnectProvider": "Connect a provider",
+    "batchListBatchCreated": "Batch {id} created — refreshing list…",
+    "batchListBatchCreatedDismiss": "Dismiss",
+    "batchListRefreshing": "Refreshing…",
+    "batchListRefresh": "Refresh",
+    "uploadFileModalRemove": "Remove",
+    "uploadFileModalUploading": "Uploading…",
+    "wizardInputReading": "Reading file…",
+    "wizardInputReady": "Ready",
+    "wizardInputLargeFileLabel": "Large file — sampling validation",
+    "wizardInputCsvJsonlReady": "JSONL generated — ready to validate.",
+    "wizardInputLargeFileWarning": "Large file detected — validation runs by sampling (first 5 MB + last 100 KB). Full validation happens server-side.",
+    "wizardCostWindow24h": "24h completion window",
+    "wizardValidationFieldsOk": "required fields valid",
+    "filesListDelete": "Delete",
+    "filesListDownload": "Download",
+    "batchDetailActionCancel": "Cancel batch",
+    "batchDetailActionRetry": "Retry failed requests",
+    "batchDetailCancelling": "Cancelling…",
+    "batchDetailRetrying": "Preparing retry…",
+    "batchDetailCancelConfirm": "Cancel this batch? In-progress requests will stop.",
+    "batchActionCancelError": "Failed to cancel batch. Try again.",
+    "batchActionRetryError": "Failed to retry failed requests. Try again.",
+    "batchConceptRetentionNote": "Results and error files are retained for 30 days (Anthropic: 29 days)"
   },
+  "featureFlagOmnirouteEmergencyFallbackDescription": "__MISSING__:Route budget-exhausted requests to the emergency free fallback provider/model.",
+  "featureFlagArenaEloSyncEnabledDescription": "__MISSING__:Enable periodic Arena AI leaderboard ELO sync for model intelligence rankings.",
   "sidebar": {
     "home": "Página inicial",
     "dashboard": "Painel",
@@ -968,6 +972,7 @@
     "aiFeaturesSection": "AI Features",
     "mcp": "MCP",
     "a2a": "A2A",
+    "plugins": "__MISSING__:Plugins",
     "apiEndpoints": "API Endpoints",
     "batchFiles": "Files",
     "analyticsEvals": "Evals",
@@ -976,6 +981,10 @@
     "analyticsComboHealth": "Combo Health",
     "analyticsCompression": "Compression",
     "costsBudget": "Budget",
+    "costsFreeTiers": "__MISSING__:Free-Tier Budget",
+    "costsFreeTiersSubtitle": "__MISSING__:Monthly free-token allowances",
+    "freeProviderRankings": "__MISSING__:Free Provider Rankings",
+    "freeProviderRankingsSubtitle": "__MISSING__:Best free providers ranked by model ELO scores",
     "costsQuotaShare": "Quota Sharing",
     "costsPricing": "Pricing",
     "logsProxy": "Proxy Logs",
@@ -987,10 +996,12 @@
     "settingsAppearance": "Appearance",
     "settingsAi": "AI Settings",
     "settingsSecurity": "Security",
+    "settingsAccessTokens": "__MISSING__:Access Tokens",
     "settingsFeatureFlags": "Sinalizadores de recursos",
     "settingsAuthz": "__MISSING__:Authz",
     "settingsRouting": "Routing",
     "settingsResilience": "Resilience",
+    "modelLockout": "__MISSING__:Model Lockout",
     "settingsAdvanced": "Advanced",
     "omniProxySection": "OmniProxy",
     "quotaTracker": "Provider Quota",
@@ -1036,6 +1047,8 @@
     "analyticsCompressionSubtitle": "Estatísticas de economia de tokens",
     "analyticsSearchSubtitle": "Analytics das ferramentas de busca",
     "analyticsEvalsSubtitle": "Resultados das suites de avaliação",
+    "providerStats": "__MISSING__:Provider Stats",
+    "providerStatsSubtitle": "__MISSING__:Latency and performance metrics",
     "logsSubtitle": "Logs da aplicação",
     "logsProxySubtitle": "Logs de tráfego do proxy",
     "consoleLogsSubtitle": "Saída do console",
@@ -1055,6 +1068,7 @@
     "agentSkillsSubtitle": "Registro de skills A2A",
     "mcpSubtitle": "Controles do servidor MCP",
     "a2aSubtitle": "Servidor do protocolo A2A",
+    "pluginsSubtitle": "__MISSING__:Plugin marketplace & installs",
     "mediaSubtitle": "Arquivos de mídia em cache",
     "batchFilesSubtitle": "Arquivos de entrada/saída de batch",
     "settingsSubtitle": "Todas as configurações",
@@ -1065,13 +1079,41 @@
     "settingsResilienceSubtitle": "Retries e circuit breakers",
     "settingsAdvancedSubtitle": "Opções avançadas",
     "settingsSecuritySubtitle": "Auth e criptografia",
+    "settingsAccessTokensSubtitle": "__MISSING__:Scoped CLI tokens for remote mode",
     "settingsFeatureFlagsSubtitle": "Alternar recursos do sistema",
     "settingsSidebar": "Sidebar",
     "settingsSidebarSubtitle": "Customize sidebar layout",
     "settingsAuthzSubtitle": "__MISSING__:Route inventory and bypass policy",
     "docsSubtitle": "Documentação",
     "issuesSubtitle": "Reportar um bug",
-    "changelogSubtitle": "Notas de versão"
+    "changelogSubtitle": "Notas de versão",
+    "costsQuotaPlans": "__MISSING__:Plans & Quotas",
+    "costsQuotaPlansSubtitle": "__MISSING__:Configure plans by provider",
+    "activity": "__MISSING__:Activity",
+    "activitySubtitle": "__MISSING__:Friendly feed of recent events",
+    "logsGroup": "__MISSING__:Logs",
+    "systemGroup": "__MISSING__:System",
+    "costsOverview": "__MISSING__:Overview",
+    "costsOverviewSubtitle": "__MISSING__:Consolidated cost analysis",
+    "agentBridge": "__MISSING__:Agent Bridge",
+    "agentBridgeSubtitle": "__MISSING__:Intercept IDE agent traffic",
+    "trafficInspector": "__MISSING__:Traffic Inspector",
+    "trafficInspectorSubtitle": "__MISSING__:Monitor LLM calls + debug any HTTPS traffic",
+    "cliCode": "__MISSING__:CLI Code",
+    "cliCodeSubtitle": "__MISSING__:Code tools pointing to OmniRoute",
+    "cliAgents": "__MISSING__:CLI Agents",
+    "cliAgentsSubtitle": "__MISSING__:Autonomous CLI agents",
+    "acpAgents": "__MISSING__:ACP Agents",
+    "acpAgentsSubtitle": "__MISSING__:CLIs spawned by OmniRoute",
+    "skipToContent": "__MISSING__:Skip to content",
+    "unpinSection": "__MISSING__:Unpin section",
+    "pinSectionOpen": "__MISSING__:Pin section open",
+    "reloadPage": "__MISSING__:Reload Page",
+    "dragReorderSection": "__MISSING__:Drag to reorder section",
+    "dragReorderItem": "__MISSING__:Drag to reorder",
+    "cannotHide": "__MISSING__:This item cannot be hidden",
+    "alwaysVisible": "__MISSING__:Always visible",
+    "groupSeparatorLabel": "__MISSING__:Separator"
   },
   "webhooks": {
     "title": "Webhooks",
@@ -1272,7 +1314,47 @@
     "a2aEvents": "Eventos",
     "a2aArtifacts": "Artefatos",
     "a2aNoTasks": "Nenhuma tarefa A2A registrada.",
-    "a2aLoadingTasks": "Carregando tarefas A2A..."
+    "a2aLoadingTasks": "Carregando tarefas A2A...",
+    "actor": "__MISSING__:Actor",
+    "actorPlaceholder": "__MISSING__:Filter by actor",
+    "eventTypes": {
+      "apiKey.activate": "__MISSING__:API Key Activated",
+      "apiKey.ban": "__MISSING__:API Key Banned",
+      "apiKey.deactivate": "__MISSING__:API Key Deactivated",
+      "apiKey.regenerate": "__MISSING__:API Key Regenerated",
+      "apiKey.scopes.grant": "__MISSING__:API Key Scopes Granted",
+      "apiKey.scopes.revoke": "__MISSING__:API Key Scopes Revoked",
+      "apiKey.scopes.update": "__MISSING__:API Key Scopes Updated",
+      "apiKey.unban": "__MISSING__:API Key Unbanned",
+      "auth.login.error": "__MISSING__:Login Error",
+      "auth.login.failed": "__MISSING__:Login Failed",
+      "auth.login.locked": "__MISSING__:Login Locked",
+      "auth.login.misconfigured": "__MISSING__:Login Misconfigured",
+      "auth.login.setup_required": "__MISSING__:Login Setup Required",
+      "auth.login.success": "__MISSING__:Login Success",
+      "auth.logout.success": "__MISSING__:Logout Success",
+      "compliance.cleanup": "__MISSING__:Compliance Cleanup",
+      "provider.credentials.applied": "__MISSING__:Provider Credentials Applied",
+      "provider.credentials.batch_revoked": "__MISSING__:Provider Credentials Batch Revoked",
+      "provider.credentials.bulk_created": "__MISSING__:Provider Credentials Bulk Created",
+      "provider.credentials.bulk_imported": "__MISSING__:Provider Credentials Bulk Imported",
+      "provider.credentials.created": "__MISSING__:Provider Credentials Created",
+      "provider.credentials.imported": "__MISSING__:Provider Credentials Imported",
+      "provider.credentials.revoked": "__MISSING__:Provider Credentials Revoked",
+      "provider.credentials.updated": "__MISSING__:Provider Credentials Updated",
+      "provider.validation.ssrf_blocked": "__MISSING__:Provider SSRF Blocked",
+      "quota.plan.updated": "__MISSING__:Quota Plan Updated",
+      "quota.pool.created": "__MISSING__:Quota Pool Created",
+      "quota.pool.deleted": "__MISSING__:Quota Pool Deleted",
+      "quota.pool.updated": "__MISSING__:Quota Pool Updated",
+      "quota.store.driver_changed": "__MISSING__:Quota Store Driver Changed",
+      "server.start": "__MISSING__:Server Start",
+      "service.reveal_api_key": "__MISSING__:Service API Key Revealed",
+      "settings.update": "__MISSING__:Settings Updated",
+      "settings.update_failed": "__MISSING__:Settings Update Failed",
+      "sync.token.created": "__MISSING__:Sync Token Created",
+      "sync.token.revoked": "__MISSING__:Sync Token Revoked"
+    }
   },
   "themesPage": {
     "title": "Themes",
@@ -1381,7 +1463,8 @@
     "settingsResilienceDescription": "Circuit breaker, retry, and fallback configuration",
     "settingsAdvancedDescription": "Advanced payload rules, request limits, and proxy API settings",
     "mitmProxyDescription": "Configure MITM proxy settings for traffic inspection and debugging",
-    "oneProxyDescription": "Configure 1Proxy settings for advanced proxy chaining"
+    "oneProxyDescription": "Configure 1Proxy settings for advanced proxy chaining",
+    "omniSkillsDescription": "__MISSING__:Install and manage sandbox skills for automated prompt and tool execution"
   },
   "home": {
     "quickStart": "Início rápido",
@@ -1612,16 +1695,24 @@
     "ownUsageVisibilityDesc": "Permitir que esta chave chame seu endpoint de status para ver o próprio uso em USD, percentual do orçamento e totais de tokens.",
     "sharedAccountQuotaVisibility": "Cota de conta compartilhada",
     "sharedAccountQuotaVisibilityDesc": "Permitir que esta chave veja a cota da conta upstream compartilhada quando uma conexão explícita estiver configurada.",
+    "localUsageCommand": "__MISSING__:Allow local usage command",
+    "localUsageCommandDesc": "__MISSING__:Allows this API key to use @@om-usage to retrieve cached usage and quota information without calling an upstream provider.",
+    "localUsageCommandBadge": "__MISSING__:Usage cmd",
     "keyCreated": "Chave de API criada",
     "keyCreatedSuccess": "Chave criada com sucesso!",
     "keyCreatedNote": "Copie e armazene esta chave agora — ela não será mostrada novamente.",
     "done": "Concluído",
     "savePermissions": "Salvar permissões",
-    "endpointRestrictions": "__MISSING__:Allowed Endpoints",
-    "allEndpointsAllowed": "__MISSING__:This key can access all API endpoints.",
-    "endpointsRestricted": "__MISSING__:Restricted to {count} endpoint{count, plural, one {} other {s}}.",
+    "endpointRestrictions": "Allowed Endpoints",
+    "allEndpointsAllowed": "This key can access all API endpoints.",
+    "endpointsRestricted": "Restricted to {count} endpoint{count, plural, one {} other {s}}.",
     "autoResolve": "Auto-Resolve",
     "autoResolveDesc": "Auto-resolve ambiguous model names to native provider for this API key.",
+    "streamDefaultMode": "__MISSING__:Stream Default Compatibility",
+    "streamDefaultModeDesc": "__MISSING__:Controls omitted `stream` flags for this key. JSON mode returns non-streaming responses unless the client explicitly requests SSE.",
+    "streamDefaultLegacy": "__MISSING__:Legacy",
+    "streamDefaultJson": "__MISSING__:JSON Compatible",
+    "streamDefaultBadge": "__MISSING__:JSON stream default",
     "keyActive": "Key Active",
     "keyActiveDesc": "Enable or disable this API key. Disabled keys are immediately rejected with 403.",
     "accessSchedule": "Access Schedule",
@@ -1667,6 +1758,7 @@
     "keyOnlyAvailableAtCreation": "Full key available only at creation time — copy it when you first create the key",
     "modelsCount": "{count, plural, one {# model} other {# models}}",
     "lastUsedOn": "Último: {date}",
+    "viewCostsFor": "__MISSING__:View costs for {name}",
     "editPermissions": "Editar permissões",
     "deleteKey": "Excluir chave",
     "regenerateKey": "Chave regenerada",
@@ -1708,9 +1800,12 @@
     "shownOf": "__MISSING__:{shown} of {total} shown",
     "emptyFilterTitle": "__MISSING__:No keys match your filters",
     "emptyFilterClear": "__MISSING__:Clear filters",
-    "endpointRestrictions": "Allowed Endpoints",
-    "allEndpointsAllowed": "This key can access all API endpoints.",
-    "endpointsRestricted": "Restricted to {count} endpoint{count, plural, one {} other {s}}."
+    "disableNonPublicModels": "__MISSING__:Disable Non-Public Models",
+    "disableNonPublicModelsDesc": "__MISSING__:Reject requests for models that are not discovered or not marked as public in the provider catalog",
+    "normalKeysSection": "__MISSING__:Normal keys",
+    "quotaKeysSection": "__MISSING__:Quota keys",
+    "quotaPill": "__MISSING__:QUOTA",
+    "quotaModeOnly": "__MISSING__:qtSd-only"
   },
   "auditLog": {
     "title": "Registro de auditoria",
@@ -1845,6 +1940,8 @@
     "freeQuota": "Free quota/mo",
     "scrapeUrl": "URL to scrape",
     "scrapeUrlPlaceholder": "https://example.com",
+    "scrapeUrlRequired": "__MISSING__:URL is required",
+    "scrapeUrlInvalid": "__MISSING__:Invalid URL — it must start with http:// or https://",
     "scrapeExtract": "Extract",
     "scrapeExtracting": "Extracting…",
     "scrapeFullPage": "Full page",
@@ -1858,6 +1955,8 @@
     "scrapeMetadata": "Metadata",
     "scrapeProvider": "Provider",
     "scrapeSize": "Size",
+    "scrapeEmptyState": "__MISSING__:Enter a URL to extract its content",
+    "scrapeProvidersAvailable": "__MISSING__:Available providers: Firecrawl, Jina Reader, Tavily.",
     "compareRun": "Compare",
     "compareRunning": "Comparing…",
     "autoProvider": "Auto (cheapest)",
@@ -2245,6 +2344,8 @@
     "leastLatency": "Menor latência",
     "comboName": "Nome do combo",
     "comboNamePlaceholder": "meu-combo",
+    "comboDescription": "__MISSING__:Description",
+    "comboDescriptionPlaceholder": "__MISSING__:Optional note describing this combo",
     "deleteConfirm": "Excluir este combo?",
     "noCombosYet": "Ainda não há combos",
     "comboCreated": "Combo criado com sucesso",
@@ -2284,6 +2385,8 @@
     "resetAwareDesc": "Equilibra a cota restante com redefinições de 5h e semanais e, em seguida, faz um round-robin de pontuações semelhantes",
     "strictRandom": "Aleatório Estrito",
     "strictRandomDesc": "Baralho embaralhado — usa cada modelo uma vez antes de reembaralhar",
+    "fusion": "__MISSING__:Fusion",
+    "fusionDesc": "__MISSING__:Fans the prompt to every panel model in parallel, then a judge model synthesizes one final answer",
     "models": "Modelos",
     "autoBalance": "Equilíbrio automático",
     "advancedSettings": "Configurações avançadas",
@@ -2982,14 +3085,19 @@
     "ngrokStarted": "Túnel ngrok iniciado",
     "ngrokStopped": "Túnel ngrok parado",
     "ngrokRequestFailed": "Falha ao atualizar túnel ngrok",
-    "tokenSaverSubtitle": "Gaste menos tokens em cada solicitação.",
-    "tokenSaverToolOutput": "Saída da ferramenta",
-    "tokenSaverLlmOutput": "Saída LLM",
-    "tokenSaverInputCompression": "Compressão de entrada",
     "apiEndpointsCatalogUnavailable": "Catálogo de API indisponível",
     "apiEndpointsSearchPlaceholder": "Pesquisar pontos de extremidade...",
     "apiEndpointsRequiresAuth": "Requer autenticação",
     "apiEndpointsNoMatch": "Nenhum endpoint corresponde ao seu filtro",
+    "vscodeAliasTitle": "__MISSING__:VS Code Token Alias",
+    "vscodeAliasDescriptionReady": "__MISSING__:Ready-to-paste compatibility URLs using the /api/v1/vscode/TOKEN/... endpoint.",
+    "vscodeAliasDescriptionError": "__MISSING__:Showing placeholder URLs because CLI keys could not be loaded in this session.",
+    "vscodeAliasDescriptionLoading": "__MISSING__:Loading CLI keys. Placeholder URLs are shown until a key is available.",
+    "vscodeAliasDescriptionPlaceholder": "__MISSING__:Showing placeholder URLs. Create or activate an API key in CLI Tools to replace TOKEN.",
+    "vscodeAliasManage": "__MISSING__:CLI Tools",
+    "vscodeAliasBaseLabel": "__MISSING__:VS Code base",
+    "vscodeAliasModelsLabel": "__MISSING__:VS Code models",
+    "vscodeAliasChatLabel": "__MISSING__:VS Code chat",
     "localServer": "Servidor local",
     "cloudOmniroute": "Cloud OmniRoute",
     "copyUrl": "Copiar URL",
@@ -3002,7 +3110,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
@@ -3178,42 +3289,187 @@
     "a2aStep3": "__MISSING__:Track and cancel tasks with {code1} and {code2}."
   },
   "memory": {
-    "title": "Gerenciamento de Memória",
-    "description": "Visualize e gerencie entradas de memória armazenadas",
-    "memories": "Memórias",
-    "totalEntries": "Total de Entradas",
-    "tokensUsed": "Tokens Usados",
-    "hitRate": "Taxa de Acerto",
-    "loading": "Carregando memórias...",
-    "noMemories": "Nenhuma memória encontrada",
-    "search": "Buscar memórias...",
-    "allTypes": "Todos os Tipos",
-    "export": "Exportar",
-    "import": "Importar",
-    "addMemory": "Adicionar Memória",
-    "type": "Tipo",
-    "key": "Chave",
-    "content": "Conteúdo",
-    "created": "Criado",
-    "actions": "Ações",
-    "delete": "Delete",
-    "factual": "Factual",
-    "episodic": "Episódica",
-    "procedural": "Procedural",
-    "semantic": "Semântica",
     "a": "A",
-    "pipelineOk": "Pipeline OK ({latencyMs}ms)",
-    "pipelineError": "Erro de pipeline",
-    "healthUnknown": "Saúde desconhecida",
-    "checkingHealth": "Verificando…",
-    "checkHealth": "Verifique a saúde",
-    "pageInfo": "Página {page} de {totalPages} ({total} total)",
-    "previous": "Anterior",
-    "next": "Próximo",
+    "actions": "Ações",
+    "addMemory": "Adicionar Memória",
+    "allTypes": "Todos os Tipos",
     "cancel": "Cancelar",
-    "save": "Salvar",
+    "checkHealth": "Verifique a saúde",
+    "checkingHealth": "Verificando…",
+    "compactOld": "__MISSING__:Compact old",
+    "concept": {
+      "title": "__MISSING__:Conversational Memory",
+      "description": "__MISSING__:OmniRoute learns from every conversation, remembering facts, episodes, procedures, and semantic concepts that make responses more accurate and context-aware.",
+      "howWorksToggle": "__MISSING__:How it works",
+      "howWorksContent": "__MISSING__:1. Automatic extraction: at the end of each response, facts and episodes are detected and saved automatically.\n2. Retrieval: before each response, the most relevant memories are searched via FTS5 (exact), vector (semantic), or hybrid RRF.\n3. Injection: relevant memories are injected into the assistant context to improve response quality.\n4. Management: use this page to view, edit, export, and compact old memories."
+    },
+    "content": "Conteúdo",
+    "contentPlaceholder": "Valor ou conteúdo JSON para lembrar",
+    "created": "Criado",
+    "delete": "Delete",
+    "deleteConfirmDesc": "__MISSING__:This action cannot be undone. The memory will be permanently removed.",
+    "deleteConfirmTitle": "__MISSING__:Delete memory?",
+    "description": "Visualize e gerencie entradas de memória armazenadas",
+    "editMemory": "__MISSING__:Edit memory",
+    "editModal": {
+      "title": "__MISSING__:Edit Memory",
+      "metadataLabel": "__MISSING__:Metadata (JSON)",
+      "metadataInvalid": "__MISSING__:Invalid JSON",
+      "saveFailed": "__MISSING__:Failed to save memory"
+    },
+    "embedding": {
+      "autoLabel": "__MISSING__:Automatic",
+      "autoDesc": "__MISSING__:Uses best available: remote provider > static > transformers",
+      "remoteLabel": "__MISSING__:Remote provider",
+      "remoteDesc": "__MISSING__:Uses embedding via provider API (requires API key)",
+      "staticLabel": "__MISSING__:Static local (potion)",
+      "staticDesc": "__MISSING__:Local embedding without WASM or external dependencies",
+      "transformersLabel": "__MISSING__:Transformers.js (MiniLM)",
+      "transformersDesc": "__MISSING__:Local embedding via @huggingface/transformers (~400MB RAM)",
+      "providerModelLabel": "__MISSING__:Provider / Model",
+      "noRemoteProviders": "__MISSING__:No providers with configured API key",
+      "selectProviderModel": "__MISSING__:Select a model",
+      "staticEnabledLabel": "__MISSING__:Enable Static Potion",
+      "staticEnabledDesc": "__MISSING__:Download and use potion-base-8M model locally",
+      "transformersEnabledLabel": "__MISSING__:Enable Transformers.js",
+      "transformersEnabledDesc": "__MISSING__:Opt-in for local MiniLM (~400MB RAM, ~3s cold start)",
+      "transformersWarning": "__MISSING__:Requires ~400MB RAM and ~3s cold start on the first semantic query."
+    },
+    "emptyState": {
+      "title": "__MISSING__:No memories yet",
+      "description": "__MISSING__:Memories are created automatically from conversations. You can also add them manually using the button above."
+    },
+    "engine": {
+      "statusTitle": "__MISSING__:Engine Status",
+      "embeddingTitle": "__MISSING__:Embedding Source",
+      "rerankTitle": "__MISSING__:Rerank (optional)",
+      "reindexNow": "__MISSING__:Reindex now",
+      "reindexStarted": "__MISSING__:Reindexing started ({pending} pending)",
+      "reindexFailed": "__MISSING__:Failed to start reindexing",
+      "keywordLabel": "__MISSING__:Keyword (FTS5)",
+      "keywordReason": "__MISSING__:Keyword search always available",
+      "embeddingLabel": "__MISSING__:Embedding",
+      "vectorStoreLabel": "__MISSING__:Vector Store",
+      "qdrantLabel": "__MISSING__:Qdrant",
+      "rerankLabel": "__MISSING__:Rerank",
+      "qdrantDisabled": "__MISSING__:Disabled",
+      "qdrantOk": "__MISSING__:Healthy ({latencyMs}ms)",
+      "qdrantError": "__MISSING__:Connection error",
+      "needsReindex": "__MISSING__:{count} memory(ies) need reindexing",
+      "configureCta": "__MISSING__:Configure",
+      "vectorStoreInstallHint": "__MISSING__:To enable vector search: npm install sqlite-vec (needs native Node.js, not WASM), then restart."
+    },
+    "episodic": "Episódica",
+    "export": "Exportar",
+    "factual": "Factual",
+    "healthUnknown": "Saúde desconhecida",
+    "hitRate": "Taxa de Acerto",
+    "import": "Importar",
+    "importError": "__MISSING__:Failed to import file",
+    "importResult": "__MISSING__:{imported} imported, {skipped} skipped",
+    "key": "Chave",
     "keyPlaceholder": "por exemplo usuário.preferências.tema",
-    "contentPlaceholder": "Valor ou conteúdo JSON para lembrar"
+    "loading": "Carregando memórias...",
+    "memories": "Memórias",
+    "next": "Próximo",
+    "noMemories": "Nenhuma memória encontrada",
+    "pageInfo": "Página {page} de {totalPages} ({total} total)",
+    "pipelineError": "Erro de pipeline",
+    "pipelineOk": "Pipeline OK ({latencyMs}ms)",
+    "playground": {
+      "infoTitle": "__MISSING__:Memory Playground",
+      "infoDesc": "__MISSING__:Simulate what would be retrieved for a given query. No memories are modified — read-only preview.",
+      "queryLabel": "__MISSING__:Test query",
+      "queryPlaceholder": "__MISSING__:Type a question or test phrase...",
+      "strategyLabel": "__MISSING__:Strategy",
+      "strategyExact": "__MISSING__:Exact (FTS5)",
+      "strategySemantic": "__MISSING__:Semantic (vector)",
+      "strategyHybrid": "__MISSING__:Hybrid (RRF)",
+      "budgetLabel": "__MISSING__:Budget (tokens)",
+      "simulate": "__MISSING__:Simulate",
+      "resultsTitle": "__MISSING__:{count} result(s)",
+      "resolutionTitle": "__MISSING__:Search resolution",
+      "resolutionEmbedding": "__MISSING__:Embedding",
+      "resolutionStore": "__MISSING__:Vector store",
+      "resolutionStrategy": "__MISSING__:Strategy used",
+      "rerankApplied": "__MISSING__:Rerank applied",
+      "fallback": "__MISSING__:Fallback",
+      "noResults": "__MISSING__:No memories found for this query.",
+      "tokensUsed": "__MISSING__:tokens used",
+      "none": "__MISSING__:none",
+      "errorFetch": "__MISSING__:Failed to fetch preview"
+    },
+    "previous": "Anterior",
+    "procedural": "Procedural",
+    "qdrant": {
+      "title": "__MISSING__:Qdrant (Vector Store Tier 2)",
+      "description": "__MISSING__:Optional Qdrant integration for scalable semantic search",
+      "enableLabel": "__MISSING__:Enable Qdrant",
+      "enableDesc": "__MISSING__:When enabled, Qdrant is used as the primary vector store",
+      "testConnection": "__MISSING__:Test connection",
+      "testing": "__MISSING__:Testing...",
+      "statusActive": "__MISSING__:Active",
+      "statusError": "__MISSING__:Error",
+      "statusDisabled": "__MISSING__:Disabled",
+      "healthOk": "__MISSING__:Connection OK ({latencyMs}ms)",
+      "healthError": "__MISSING__:Connection error",
+      "saved": "__MISSING__:Settings saved",
+      "saveError": "__MISSING__:Failed to save",
+      "portLabel": "__MISSING__:Port",
+      "embeddingModelLabel": "__MISSING__:Embedding Model",
+      "optional": "__MISSING__:optional",
+      "apiKeyKeepPlaceholder": "__MISSING__:Leave blank to keep current key",
+      "apiKeyOptional": "__MISSING__:Leave blank if not using authentication",
+      "removeApiKey": "__MISSING__:Remove",
+      "quickSelectModel": "__MISSING__:Quick select",
+      "searchTestTitle": "__MISSING__:Semantic search test",
+      "searchPlaceholder": "__MISSING__:Type a test query...",
+      "searching": "__MISSING__:Searching...",
+      "search": "__MISSING__:Search",
+      "cleanupTitle": "__MISSING__:Clean up old points",
+      "cleanupDesc": "__MISSING__:Remove Qdrant points for expired memories (retention period).",
+      "cleaning": "__MISSING__:Cleaning...",
+      "cleanNow": "__MISSING__:Clean now",
+      "cleanupSuccess": "__MISSING__:{count} point(s) removed",
+      "cleanupFailed": "__MISSING__:Cleanup failed"
+    },
+    "rerank": {
+      "enableLabel": "__MISSING__:Enable Rerank",
+      "enableDesc": "__MISSING__:Reorders results with a reranking model after search",
+      "warning": "__MISSING__:Rerank adds +200-500ms latency and additional cost per request. Use sparingly.",
+      "providerModelLabel": "__MISSING__:Rerank Provider / Model",
+      "noProviderWithKey": "__MISSING__:No provider with configured API key. Configure a provider to use rerank.",
+      "selectProviderModel": "__MISSING__:Select a provider/model"
+    },
+    "save": "Salvar",
+    "saving": "__MISSING__:Saving...",
+    "search": "Buscar memórias...",
+    "semantic": "Semântica",
+    "summarize": {
+      "title": "__MISSING__:Compact old memories",
+      "noCandidates": "__MISSING__:No memories eligible for compaction (criteria: >30 days old).",
+      "candidatesDesc": "__MISSING__:{count} memories will be compacted into summaries. This action cannot be undone.",
+      "confirm": "__MISSING__:Compact now"
+    },
+    "tabs": {
+      "memories": "__MISSING__:Memories",
+      "playground": "__MISSING__:Playground",
+      "engine": "__MISSING__:Engine"
+    },
+    "title": "Gerenciamento de Memória",
+    "tokensUsed": "Tokens Usados",
+    "tooltip": {
+      "totalEntries": "__MISSING__:Total memories stored for this API key",
+      "tokensUsed": "__MISSING__:Estimated total tokens occupied by active memories",
+      "hitRate": "__MISSING__:Read-by-ID cache hit rate (not semantic recall accuracy)",
+      "factual": "__MISSING__:Objective, permanent facts from user context",
+      "episodic": "__MISSING__:Events and experiences from conversation history",
+      "procedural": "__MISSING__:Procedures, workflows, and instructions the assistant should follow",
+      "semantic": "__MISSING__:Concepts, preferences, and domain knowledge"
+    },
+    "totalEntries": "Total de Entradas",
+    "type": "Tipo",
+    "memoryEnabled": "__MISSING__:Memory enabled"
   },
   "skills": {
     "title": "Skills",
@@ -3544,6 +3800,14 @@
     "export": "Export",
     "exporting": "Exporting...",
     "exportFailed": "Export failed",
+    "cleanHistoryButton": "__MISSING__:Clean history",
+    "cleanHistoryTitle": "__MISSING__:Clean log history?",
+    "cleanHistoryMessage": "__MISSING__:This permanently clears all request log rows, legacy detail rows, and local artifact files under DATA_DIR/call_logs. The live page will refresh after cleanup.",
+    "cleanHistoryConfirm": "__MISSING__:Clean history",
+    "cleanHistoryCancel": "__MISSING__:Cancel",
+    "cleanHistorySuccess": "__MISSING__:Cleaned {deleted} log entries, {deletedArtifacts} artifacts, and {deletedDetailedLogs} legacy detail rows.",
+    "cleanHistoryEmpty": "__MISSING__:No request log history was found.",
+    "cleanHistoryFailed": "__MISSING__:Failed to clean log history.",
     "timeRange": "Time Range",
     "lastNHours": "Last {hours}",
     "defaultRange": "default",
@@ -3551,10 +3815,14 @@
       "fetchFailed": "Failed to fetch logs",
       "copyFailed": "Failed to copy log entry",
       "copyLogEntry": "Copy log entry"
-    }
+    },
+    "compressionLogTitle": "__MISSING__:Compression Log",
+    "compressionLogEmpty": "__MISSING__:No compressed requests yet. Compression stats will appear here when requests are processed with compression enabled.",
+    "tokens": "__MISSING__:tokens"
   },
   "onboarding": {
     "welcome": "Bem vindo",
+    "tiers": "__MISSING__:Tiers",
     "security": "Segurança",
     "test": "Teste",
     "ready": "Pronto!",
@@ -3616,6 +3884,7 @@
   },
   "providers": {
     "title": "Provedores",
+    "Account Deactivated": "__MISSING__:Account Deactivated",
     "allProviders": "Todos os provedores",
     "audioProviders": "Provedores de áudio",
     "showFreeOnly": "Somente grátis",
@@ -3623,6 +3892,33 @@
     "addFirstProvider": "Adicione seu primeiro provedor",
     "addFirstProviderDesc": "Conecte um provedor de IA para começar a rotear solicitações por meio do OmniRoute. Você pode usar provedores gratuitos, chaves de API ou contas OAuth.",
     "learnMore": "Saiba mais",
+    "adaptaTutorial": {
+      "title": "__MISSING__:How to connect Adapta Web",
+      "introPrefix": "__MISSING__:Adapta authenticates through Clerk. The token",
+      "introSuffix": "__MISSING__:is a long-lived JWT that lets OmniRoute refresh sessions automatically.",
+      "or": "__MISSING__:or",
+      "step1Title": "__MISSING__:Open Adapta chat",
+      "step1DescPrefix": "__MISSING__:Open",
+      "step1DescSuffix": "__MISSING__:and sign in with your Gold or Business account.",
+      "step2Title": "__MISSING__:Open DevTools",
+      "step2DescPrefix": "__MISSING__:Press",
+      "step2DescSuffix": "__MISSING__:to open Developer Tools.",
+      "step3Title": "__MISSING__:Go to Application → Cookies",
+      "step3DescPrefix": "__MISSING__:In the",
+      "step3DescMiddle": "__MISSING__:expand",
+      "step3DescSuffix": "__MISSING__:and click",
+      "step4Title": "__MISSING__:Copy the cookie value for",
+      "step4DescPrefix": "__MISSING__:Find the cookie named",
+      "step4DescMiddle": "__MISSING__:in the list. Click it and copy the content from the",
+      "step4DescSuffix": "__MISSING__:column. It starts with",
+      "step5Title": "__MISSING__:Paste it here and save",
+      "step5DescPrefix": "__MISSING__:Click",
+      "step5DescMiddle": "__MISSING__:paste the",
+      "step5DescSuffix": "__MISSING__:value into the API Key field, then save. OmniRoute will refresh the session automatically.",
+      "tipLabel": "__MISSING__:Tip:",
+      "tipPrefix": "__MISSING__:The",
+      "tipSuffix": "__MISSING__:cookie is long-lived, usually for months. You only need to renew it if you sign out or Adapta invalidates the session."
+    },
     "editProvider": "Editar provedor",
     "deleteProvider": "Excluir provedor",
     "noProviders": "Nenhum provedor configurado",
@@ -3648,13 +3944,38 @@
     "apiKeyProviders": "Provedores de chaves de API",
     "compatibleProviders": "Provedores compatíveis com chave de API",
     "testAll": "Teste tudo",
+    "distributeProxies": "__MISSING__:Distribute Proxies",
+    "distributing": "__MISSING__:Distributing...",
+    "selectedCount": "__MISSING__:{count, plural, one {# selected} other {# selected}}",
+    "accountsCount": "__MISSING__:{count, plural, one {# account} other {# accounts}}",
     "testAllOAuth": "Teste todas as conexões OAuth",
     "testAllFree": "Teste todas as conexões gratuitas",
     "testAllApiKey": "Teste todas as conexões de chave de API",
     "testAllCompatible": "Teste todas as conexões compatíveis",
+    "testAllModels": "__MISSING__:Test all models",
+    "testAllModelsConfirm": "__MISSING__:Test all visible models? Failed models will be hidden if auto-hide is enabled.",
+    "testingAllModels": "__MISSING__:Testing {done}/{total}...",
+    "testAllResults": "__MISSING__:{ok} of {total} models working",
+    "noModelsToTest": "__MISSING__:No models match the current filter",
+    "showAllModels": "__MISSING__:All",
+    "showVisibleOnly": "__MISSING__:Visible only",
+    "freeFilterAll": "__MISSING__:All",
+    "freeFilterFreeOnly": "__MISSING__:Free only",
+    "freeFilterPaidOnly": "__MISSING__:Paid only",
+    "sortFreeFirst": "__MISSING__:Free first",
+    "showHiddenOnly": "__MISSING__:Hidden only",
+    "filterByVisibility": "__MISSING__:Filter by visibility",
+    "autoHideFailed": "__MISSING__:Auto-hide failed models",
+    "autoHideFailedHint": "__MISSING__:When enabled, Test all hides non-transient failures from public catalogs such as /v1/models. Single-model tests never auto-hide.",
     "connected": "{count} Conectado",
     "errorCount": "{count} Erro ({code})",
     "errorCountNoCode": "{count} Erro",
+    "testAllCompleted": "__MISSING__:Tested {total} models: {ok} OK, {failed} failed",
+    "modelAutoHidden": "__MISSING__:Model {model} auto-hidden (test failed)",
+    "filterAll": "__MISSING__:All",
+    "filterVisible": "__MISSING__:Visible only",
+    "filterHidden": "__MISSING__:Hidden only",
+    "modelsHiddenCount": "__MISSING__:{count} hidden",
     "warningCount": "{count} Aviso",
     "noConnections": "Sem conexões",
     "expiredBadge": "Expired",
@@ -3764,7 +4085,16 @@
     "batchUpdateNone": "Nenhuma conexão foi atualizada (podem não existir mais)",
     "batchRetestLimit": "Reteste até {max} conexões por vez",
     "noConnectionsToTest": "Nenhuma conexão correspondente para testar",
+    "batchDeleteConfirmTitle": "__MISSING__:Delete connections",
+    "batchDeleteConfirmButton": "__MISSING__:Delete",
+    "filterActive": "__MISSING__:Active",
+    "filterError": "__MISSING__:Error",
+    "filterBanned": "__MISSING__:Banned",
+    "filterCreditsExhausted": "__MISSING__:Credits Exhausted",
+    "noFilteredConnections": "__MISSING__:No connections match the current filter.",
     "failedSetAlias": "Falha ao definir o alias",
+    "setAliasSuccess": "__MISSING__:Alias {alias} set",
+    "deleteAliasSuccess": "__MISSING__:Alias {alias} deleted",
     "failedSaveConnection": "Falha ao salvar conexão",
     "failedSaveConnectionRetry": "Falha ao salvar a conexão. Por favor, tente novamente.",
     "failedRetestConnection": "Falha ao testar novamente a conexão",
@@ -3799,6 +4129,8 @@
     "fetchingModels": "Buscando modelos disponíveis...",
     "failedFetchModels": "Falha ao buscar modelos",
     "noFreeModelsFound": "Nenhum modelo gratuito encontrado para este provedor — nada importado.",
+    "fetchModelsSuccess": "__MISSING__:Found {count} new models",
+    "fetchModelsFailed": "__MISSING__:Could not auto-fetch models (you can retry from settings)",
     "noModelsFound": "Nenhum modelo encontrado",
     "importFailed": "Falha na importação",
     "noNewModelsAdded": "Nenhum novo modelo foi adicionado.",
@@ -3807,6 +4139,10 @@
     "importingModelsTitle": "Importando Modelos",
     "copyModel": "Copiar modelo",
     "filterModels": "Filtrar modelos...",
+    "testAllRateLimited": "__MISSING__:Rate limit reached, stopped early",
+    "hideFailedAuto": "__MISSING__:Auto-hide failed models",
+    "selectAllModels": "Selecionar todos",
+    "hideAllModels": "__MISSING__:Hide all",
     "modelsActive": "ativos",
     "showModel": "Mostrar modelo",
     "hideModel": "Ocultar modelo",
@@ -3815,6 +4151,9 @@
     "rateLimitUnprotected": "Desprotegido",
     "enableRateLimitProtection": "Clique para ativar a proteção de limite de taxa",
     "disableRateLimitProtection": "Clique para desativar a proteção de limite de taxa",
+    "testAllProgress": "__MISSING__:Tested {done}/{total}",
+    "testAllFailedHidden": "__MISSING__:{count} failed models hidden",
+    "testAllDone": "__MISSING__:All models tested",
     "productionKey": "Chave de produção",
     "enterNewApiKey": "Insira a nova chave de API",
     "codexApplyModalTitle": "Inscreva-se no Codex Local",
@@ -3890,10 +4229,20 @@
     "errorTypeNetworkError": "Erro de rede",
     "errorTypeTestUnsupported": "Teste sem suporte",
     "errorTypeUpstreamError": "Erro de envio",
+    "errorTypeCreditsExhausted": "__MISSING__:No credits",
+    "errorTypeBanned": "__MISSING__:403 Banned",
     "proxySourceGlobal": "Globais",
     "proxySourceProvider": "Provedor",
     "proxySourceKey": "Chave",
     "proxyConfiguredBySource": "Proxy ({source}): {host}",
+    "proxyOn": "__MISSING__:Proxy On",
+    "proxyOff": "__MISSING__:Direct (bypass proxy)",
+    "proxyEnabledTitle": "__MISSING__:Proxy is enabled for this connection",
+    "proxyDisabledTitle": "__MISSING__:Direct connection — bypasses every proxy (including the global proxy) for this connection",
+    "perKeyProxyOn": "__MISSING__:Per-key",
+    "perKeyProxyOff": "__MISSING__:Connection",
+    "perKeyProxyEnabledTitle": "__MISSING__:Per-key proxy assignment enabled for this provider",
+    "perKeyProxyDisabledTitle": "__MISSING__:Per-key proxy assignment disabled for this provider",
     "autoPriority": "Automático: {priority}",
     "proxy": "Procurador",
     "retestAuthentication": "Testar novamente a autenticação",
@@ -3921,6 +4270,12 @@
     "compatProtocolOpenAI": "OpenAI Chat Completions",
     "compatProtocolOpenAIResponses": "OpenAI Responses API",
     "compatProtocolClaude": "Anthropic Messages",
+    "targetFormatLabel": "__MISSING__:Target Format",
+    "targetFormatHint": "__MISSING__:Override the upstream wire format. Use 'Anthropic Messages' to route OpenAI-compatible providers (e.g. opencode-go) through the /v1/messages endpoint.",
+    "targetFormatAuto": "__MISSING__:Default (auto)",
+    "targetFormatGemini": "__MISSING__:Gemini",
+    "targetFormatGeminiCli": "__MISSING__:Gemini CLI",
+    "targetFormatAntigravity": "__MISSING__:Antigravity",
     "compatUpstreamHeadersLabel": "Extra upstream headers",
     "compatUpstreamHeadersHint": "High-privilege setting — same trust level as editing provider API credentials; only trusted admins should use it. Merged after OmniRoute adds auth from the provider API key. If a custom header uses the same name as an existing one (e.g. Authorization), your value fully replaces the auto-generated header (including the Bearer token) — the upstream only sees what you typed, not the key from settings. Misconfiguration can cause 401 or broken upstream auth. One row per header (e.g. extra Authentication for some gateways). Hover or focus the value to preview. Saves on blur, outside click, or closing this panel.",
     "compatUpstreamHeaderName": "Header name",
@@ -3967,7 +4322,6 @@
     "email": "E-mail",
     "healthCheckMinutes": "Verificação de integridade (min)",
     "healthCheckHint": "Intervalo de atualização de token proativo. 0 = desabilitado.",
-    "selectAllModels": "Selecionar todos",
     "deselectAllModels": "Desmarcar todos",
     "modelsActiveCount": "{active}/{total} ativos",
     "noModelsMatch": "Nenhum modelo corresponde a \"{filter}\"",
@@ -3979,6 +4333,9 @@
     "editCompatibleTitle": "Editar {type} Compatível",
     "compatibleBaseUrlHint": "Root URL of your {type}-compatible API. Use Advanced Settings for custom endpoint paths.",
     "apiKeyForCheck": "Chave API (para verificação)",
+    "testModelIdLabel": "__MISSING__:Model ID (optional)",
+    "testModelIdPlaceholder": "__MISSING__:e.g. my-model-id",
+    "testModelIdHint": "__MISSING__:If the provider lacks a /models endpoint, enter a model ID to validate via /chat/completions instead.",
     "compatibleProdPlaceholder": "{type} Compatível (Produção)",
     "tokenRefreshed": "Token refreshed successfully",
     "tokenRefreshFailed": "Token refresh failed",
@@ -4072,6 +4429,19 @@
     "codexAuthApplyFailed": "Failed to apply Codex auth.json locally",
     "codexAuthExported": "Codex auth.json exported",
     "codexAuthExportFailed": "Failed to export Codex auth.json",
+    "codexCliGuideButton": "__MISSING__:Codex CLI Guide",
+    "codexCliGuideTitle": "__MISSING__:Codex CLI Guide",
+    "codexCliGuideLoading": "__MISSING__:Loading guide...",
+    "codexCliGuideLoadFailed": "__MISSING__:Could not load the guide.",
+    "codexExternalLinkButton": "__MISSING__:External Codex link",
+    "codexExternalLinkModalTitle": "__MISSING__:External Codex link",
+    "codexExternalLinkModalDescription": "__MISSING__:Share this single-use link with the person who will authenticate the Codex account. They open it in their own browser, complete the OpenAI login, and the connection is registered here. The link expires in 15 minutes.",
+    "codexExternalLinkGenerating": "__MISSING__:Generating link...",
+    "codexExternalLinkWaiting": "__MISSING__:Waiting for browser authentication. This window refreshes automatically.",
+    "codexExternalLinkCreateFailed": "__MISSING__:Failed to generate the link.",
+    "codexExternalLinkNetworkError": "__MISSING__:Could not contact the server.",
+    "codexExternalLinkConnected": "__MISSING__:Codex account connected through the external link.",
+    "codexExternalLinkExpired": "__MISSING__:The link expired before completion.",
     "importCodexAuth": "Importar autenticação",
     "codexImportModalTitle": "Importar autenticação do Codex",
     "codexImportTabSingle": "Solteiro",
@@ -4149,6 +4519,8 @@
     "t3ChatWebCookiePlaceholder": "id-de-sessão-convexa=abc123...",
     "blockClaudeExtraUsageDescription": "Block Claude Extra Usage Description",
     "blockClaudeExtraUsageLabel": "Block Claude Extra Usage Label",
+    "disableCoolingDescription": "__MISSING__:Skip the transient cooldown so this connection stays eligible even after recoverable errors (terminal states like banned/expired still apply).",
+    "disableCoolingLabel": "__MISSING__:Disable cooldown for this connection",
     "bulkPasteAdded": "{count, plural, one {1 key added} other {# keys added}}",
     "bulkPasteDuplicatesIgnored": "{count, plural, one {1 duplicate skipped} other {# duplicates skipped}}",
     "bulkPasteHint": "Paste one API key per line. Empty lines are ignored and duplicate keys are skipped.",
@@ -4246,6 +4618,17 @@
     "personalAccessTokenLabel": "Personal Access Token Label",
     "qoderPatHint": "Qoder Pat Hint",
     "qoderPatPlaceholder": "Qoder Pat Placeholder",
+    "rateLimitOverridesSection": "__MISSING__:Rate Limit Overrides",
+    "rateLimitOverridesMaxConcurrentHint": "__MISSING__:Max concurrent requests override for this connection. Overrides the account-level cap.",
+    "rateLimitOverridesMaxConcurrentLabel": "__MISSING__:Max Concurrent (Rate Limit)",
+    "rateLimitOverridesMinTimeHint": "__MISSING__:Minimum time (ms) between requests. Overrides the default rate limiter delay.",
+    "rateLimitOverridesMinTimeLabel": "__MISSING__:Min Interval (ms)",
+    "rateLimitOverridesRpmHint": "__MISSING__:Max requests per minute for this connection. Overrides the provider default.",
+    "rateLimitOverridesRpmLabel": "__MISSING__:RPM (Requests/min)",
+    "rateLimitOverridesTpdHint": "__MISSING__:Max tokens per day for this connection. Overrides the provider default.",
+    "rateLimitOverridesTpdLabel": "__MISSING__:TPD (Tokens/day)",
+    "rateLimitOverridesTpmHint": "__MISSING__:Max tokens per minute for this connection. Overrides the provider default.",
+    "rateLimitOverridesTpmLabel": "__MISSING__:TPM (Tokens/min)",
     "refreshOauthTokenTitle": "Refresh Oauth Token Title",
     "regionHint": "Region Hint",
     "regionLabel": "Region Label",
@@ -4260,6 +4643,7 @@
     "searchProvider": "Search Provider",
     "searchProviderDesc": "Search Provider Desc",
     "searchProviders": "Pesquisar fornecedores...",
+    "searchByModel": "__MISSING__:Search by model…",
     "searchProvidersHeading": "Search Providers Heading",
     "searxngBaseUrlHint": "Searxng Base Url Hint",
     "searxngInfo": "Searxng Info",
@@ -4425,7 +4809,21 @@
     "webNoAuthGuideBody": "{provider} não precisa de chave de API ou cookie. Salve a conexão para usar seu endpoint web gratuito.",
     "webSessionCredentialValidationFailed": "Falha na validação da credencial da sessão. Faça login novamente, copie uma nova credencial e tente novamente.",
     "checkCookie": "Verifique o cookie",
-    "checkWebToken": "Verifique o token"
+    "checkWebToken": "Verifique o token",
+    "huggingchatLabel": "__MISSING__:HuggingChat (Free)",
+    "huggingchatDesc": "__MISSING__:Free LLM chat via huggingface.co/chat",
+    "phindLabel": "__MISSING__:Phind (Free)",
+    "phindDesc": "__MISSING__:Free dev-focused AI chat",
+    "poeWebLabel": "__MISSING__:Poe Web",
+    "poeWebDesc": "__MISSING__:Multi-model chat via poe.com",
+    "veniceWebLabel": "__MISSING__:Venice Web",
+    "veniceWebDesc": "__MISSING__:Privacy-focused AI chat",
+    "v0VercelWebLabel": "__MISSING__:v0 Vercel Web",
+    "v0VercelWebDesc": "__MISSING__:AI code generation via v0.dev",
+    "kimiWebLabel": "__MISSING__:Kimi Web",
+    "kimiWebDesc": "__MISSING__:Chinese market AI chat via kimi.moonshot.cn",
+    "doubaoWebLabel": "__MISSING__:Doubao Web",
+    "doubaoWebDesc": "__MISSING__:ByteDance AI chat via doubao.com"
   },
   "settings": {
     "title": "Configurações",
@@ -4531,6 +4929,7 @@
     "memoryDesc": "Memória conversacional persistente entre sessões",
     "memoryEnabled": "Ativar Memória",
     "memoryEnabledDesc": "Quando ativado, injetará o contexto passado relevante de forma dinâmica.",
+    "memoryTokenCostWarning": "__MISSING__:Heads up: with memory enabled, OmniRoute injects up to {tokens} tokens of retrieved context into every chat request — this increases token usage and cost. To skip injection for a specific request, send the \"x-omniroute-no-memory: true\" header.",
     "maxTokens": "Tokens Máximos",
     "retentionDays": "Retenção",
     "recent": "Recente",
@@ -4569,6 +4968,15 @@
     "modelsDevInfoOrder": "User Override → models.dev → LiteLLM → Hardcoded Default",
     "systemTheme": "Tema do sistema",
     "debugToggle": "Enable Debug Mode",
+    "homePinProviderQuotaToHome": "Pin Information to Home Page",
+    "homeProviderQuotaLimits": "Provider Quota Limits",
+    "homeProviderQuotaLimitsDesc": "Pin the Provider Quota status container (with Refresh All button) to the top of the Home page.",
+    "homeQuickStart": "Quick Start",
+    "homeQuickStartDesc": "Show the Quick Start panel on the Home page.",
+    "homeProviderTopology": "Provider Topology",
+    "homeProviderTopologyDesc": "Show the Provider Topology on the Home page.",
+    "accountEmailVisibility": "__MISSING__:Account email visibility",
+    "accountEmailVisibilityDesc": "__MISSING__:Show full account emails across providers, combos, logs, quota, and playground screens. Turn this off to mask them by default.",
     "sidebarVisibilityToggle": "Show Sidebar Items",
     "enableCache": "Habilitar cache",
     "cacheTTL": "Cache TTL",
@@ -4602,11 +5010,17 @@
     "autoDisableDescription": "Marca permanentemente conexões de provedor como desativadas quando retornam sinais terminais de banimento (ex.: HTTP 403 'verify your account'). Isso remove a conexão da rotação de combos.",
     "autoDisableThreshold": "Limite de banimento",
     "autoDisableThresholdDesc": "Quantidade de sinais consecutivos de banimento antes da desativação permanente.",
+    "customBannedSignals": "__MISSING__:Banned Keywords",
+    "customBannedSignalsDesc": "__MISSING__:Additional keywords that trigger permanent account ban detection. Built-in keywords always apply.",
+    "customBannedSignalsPlaceholder": "__MISSING__:e.g. api key revoked",
+    "noCustomBannedSignals": "__MISSING__:No custom keywords. Only built-in keywords are active.",
     "resilienceStructureTitle": "Estrutura de resiliência",
     "resilienceStructureDesc": "Esta página configura apenas o comportamento. O estado ao vivo de circuit breaker aparece na página Saúde. Controle de retry específico por combo e slot de round-robin continuam nas configurações de combos.",
     "enableThinking": "Habilite o pensamento",
     "maxThinkingTokens": "Tokens de pensamento máximo",
     "enableProxy": "Habilitar proxy",
+    "perKeyProxyEnabled": "__MISSING__:Enable per-key proxy assignment",
+    "perKeyProxyEnabledDesc": "__MISSING__:When enabled, each provider connection can use its own proxy assignment",
     "proxyUrl": "URL proxy",
     "pricingRates": "Formato de taxas de preços",
     "currentPricing": "Visão geral de preços atuais",
@@ -4686,6 +5100,13 @@
     "globalProxy": "Procurador global",
     "globalProxyDesc": "Configure um proxy de saída global para todas as chamadas de API. Provedores individuais, combos e chaves podem substituir isso.",
     "noGlobalProxy": "Nenhum proxy global configurado",
+    "proxyPool": "__MISSING__:Proxy Pool",
+    "freePool": "__MISSING__:Free Pool",
+    "proxyDocumentation": "__MISSING__:Proxy Documentation",
+    "proxyGlobalConfigTab": "__MISSING__:Global Config",
+    "proxyPoolTab": "__MISSING__:Proxy Pool",
+    "freePoolTab": "__MISSING__:Free Pool",
+    "proxyDocumentationTab": "__MISSING__:Documentation",
     "bulkHealthcheck": "Bulk Healthcheck",
     "bulkHealthcheckDesc": "Test all configured proxies against a target URL to find which ones work.",
     "healthcheckTesting": "Testing...",
@@ -4698,6 +5119,51 @@
     "healthcheckStatus": "Status",
     "healthcheckProxyUrl": "Proxy URL",
     "healthcheckLatency": "Latency",
+    "proxyDocumentationScopeTitle": "__MISSING__:Proxy scope resolution",
+    "proxyDocumentationScopeDescBefore": "__MISSING__:OmniRoute resolves the outbound proxy in priority order: ",
+    "proxyDocumentationScopeOrder": "__MISSING__:combo → account → provider → global",
+    "proxyDocumentationScopeDescAfter": "__MISSING__:. The most specific scope wins.",
+    "proxyDocumentationAddTitle": "__MISSING__:Adding a custom proxy",
+    "proxyDocumentationAddDescBefore": "__MISSING__:Go to the ",
+    "proxyDocumentationAddDescMiddle": "__MISSING__: tab → click ",
+    "proxyDocumentationAddCta": "__MISSING__:+ Add proxy",
+    "proxyDocumentationAddDescAfter": "__MISSING__:. Fill in type (http/https/socks5), host, and port. Optionally assign it to a scope.",
+    "proxyDocumentationBulkTitle": "__MISSING__:Bulk import format",
+    "proxyDocumentationBulkDesc": "__MISSING__:Pipe-delimited fields:",
+    "proxyDocumentationSocks5DescBefore": "__MISSING__:SOCKS5 proxies are disabled by default. Set",
+    "proxyDocumentationFreePoolDesc": "__MISSING__:The Free Pool tab aggregates proxies from 1proxy, Proxifly, and IPLocate. Use ⊕ to test and promote a proxy to your registry. Only proxies that pass the connectivity test are added.",
+    "proxyDocumentationVercelRelayDescBefore": "__MISSING__:The Vercel Relay is an outbound edge relay — not an inbound tunnel. Deploying one sends LLM API calls through Vercel's dynamic IPs, bypassing datacenter geo-blocks and rate limits. The relay is protected by a generated secret header",
+    "proxyDocumentationVercelRelayDescAfter": "__MISSING__:Your Vercel token is used only during deploy and is never stored.",
+    "vercelRelayTokenRequired": "__MISSING__:Token is required",
+    "vercelRelayDeployFailed": "__MISSING__:Deploy failed",
+    "vercelRelayTokenHint": "__MISSING__:Token is used only during deploy — never stored.",
+    "denoRelayTokenRequired": "__MISSING__:Deno Deploy token is required",
+    "denoRelayOrgDomainRequired": "__MISSING__:Organization domain is required",
+    "denoRelayDeployFailed": "__MISSING__:Deno Deploy failed",
+    "denoRelayTokenHint": "__MISSING__:Organization token (prefix ddo_) from console.deno.com → Organization → Settings → Organization Tokens. Used once for deploy and never stored.",
+    "denoRelayOrgDomainHint": "__MISSING__:Your Deno Deploy organization's default domain (e.g. acme.deno.net). The relay will be reachable at https://<app-name>.<org-slug>.deno.net.",
+    "proxyFreePoolFilterProtocol": "__MISSING__:Filter by protocol",
+    "proxyFreePoolProtocol": "__MISSING__:Protocol",
+    "proxyFreePoolCountryPlaceholder": "__MISSING__:Country (e.g. US)",
+    "proxyFreePoolFilterCountry": "__MISSING__:Filter by country",
+    "proxyFreePoolMinQualityPlaceholder": "__MISSING__:Min quality",
+    "proxyFreePoolMinQualityLabel": "__MISSING__:Minimum quality score",
+    "proxyFreePoolSyncAll": "__MISSING__:Sync All",
+    "proxyFreePoolTotal": "__MISSING__:Total",
+    "proxyFreePoolInPool": "__MISSING__:In pool",
+    "proxyFreePoolAvgQuality": "__MISSING__:Avg quality",
+    "proxyFreePoolSelected": "__MISSING__:{count} selected",
+    "proxyFreePoolAddSelected": "__MISSING__:Add selected to pool",
+    "proxyFreePoolAddVisible": "__MISSING__:Add all visible to pool",
+    "proxyFreePoolSource": "__MISSING__:Source",
+    "proxyFreePoolHostPort": "__MISSING__:Host:Port",
+    "proxyFreePoolType": "__MISSING__:Type",
+    "proxyFreePoolCountry": "__MISSING__:Country",
+    "proxyFreePoolQuality": "__MISSING__:Quality",
+    "proxyFreePoolLatency": "__MISSING__:Latency",
+    "proxyFreePoolEmpty": "__MISSING__:No proxies found. Click Sync All to fetch from sources.",
+    "close": "__MISSING__:Close",
+    "cancel": "__MISSING__:Cancel",
     "globalLabel": "Globais",
     "configure": "Configurar",
     "globalSystemPrompt": "Alerta do sistema global",
@@ -4954,6 +5420,7 @@
     "systemStorage": "Sistema e armazenamento",
     "allDataLocal": "Todos os dados armazenados localmente em sua máquina",
     "databasePath": "Caminho do banco de dados",
+    "export": "__MISSING__:Export",
     "exportDatabase": "Exportar banco de dados",
     "exportAll": "Exportar tudo (.tar.gz)",
     "importDatabase": "Importar banco de dados",
@@ -5041,6 +5508,11 @@
     "adaptiveVolumeRoutingDesc": "Escala conexões dinamicamente com base no volume e pressão na taxa de transferência.",
     "lkgpToggleTitle": "Last Known Good Provider (LKGP)",
     "lkgpToggleDesc": "When enabled, the router remembers which provider last served a successful response and tries it first on subsequent requests.",
+    "echoRequestedModelTitle": "__MISSING__:Echo requested model name in responses",
+    "echoRequestedModelDesc": "__MISSING__:When enabled, the response `model` field echoes the alias or combo name the client requested instead of the upstream model name. Fixes strict clients (e.g. Claude Desktop) that reject a response whose model does not match the request.",
+    "webSearchRouteTitle": "__MISSING__:Web search routing",
+    "webSearchRouteDesc": "__MISSING__:When a request includes a native web_search tool, route the whole request to this model instead of the default — useful for providers that don't implement Anthropic's web_search server tool. Leave blank to disable.",
+    "webSearchRoutePlaceholder": "__MISSING__:e.g. openrouter,anthropic/claude-3.5-sonnet",
     "clearLkgpCache": "Clear LKGP Cache",
     "lkgpCacheCleared": "LKGP cache cleared successfully",
     "lkgpCacheClearFailed": "Failed to clear LKGP cache",
@@ -5105,6 +5577,16 @@
     "clearSyncedPricing": "Clear Synced Pricing",
     "compressionTitle": "Prompt Compression",
     "compressionDesc": "Reduce token usage by compressing prompts before sending to providers",
+    "tokenSaverTitle": "__MISSING__:Token Saver",
+    "tokenSaverSubtitle": "__MISSING__:Spend fewer tokens on every request.",
+    "tokenSaverToolOutput": "__MISSING__:Tool output",
+    "tokenSaverToolOutputDesc": "__MISSING__:Clean git, grep, ls, tree, and log output before it reaches the provider.",
+    "tokenSaverLlmOutput": "__MISSING__:LLM output",
+    "tokenSaverLlmOutputDesc": "__MISSING__:Inject terse response instructions without rewriting provider output.",
+    "tokenSaverInputCompression": "__MISSING__:Input compression",
+    "tokenSaverInputCompressionDesc": "__MISSING__:Rewrite eligible chat history while preserving code, URLs, and intent.",
+    "tokenSaverFineTunePrefix": "__MISSING__:Fine-tune each engine on",
+    "tokenSaverFineTuneSuffix": "__MISSING__:or combine engines per request on",
     "compressionMode": "Compression Mode",
     "compressionModeOff": "Off",
     "compressionModeOffDesc": "No compression applied",
@@ -5124,6 +5606,11 @@
     "compressionUltraMinScore": "Minimum Score Threshold",
     "compressionUltraSlmFallback": "Fallback to Aggressive",
     "compressionUltraModelPath": "SLM Model Path",
+    "compressionUltraEngine": "__MISSING__:Ultra tier",
+    "compressionUltraEngineHeuristic": "__MISSING__:Heuristic (Tier-A, default)",
+    "compressionUltraEngineSlm": "__MISSING__:SLM (LLMLingua-2, opt-in)",
+    "compressionUltraSlmHint": "__MISSING__:SLM downloads a small ONNX model on first use (cold-start) and transparently falls back to the heuristic on timeout or if unavailable.",
+    "compressionUltraSlmPrewarm": "__MISSING__:Pre-warm SLM model on enable",
     "compressionSummarizerEnabled": "Enable Summarizer",
     "compressionMaxTokensPerMessage": "Max Tokens Per Message",
     "compressionMinSavings": "Min Savings Threshold",
@@ -5311,13 +5798,22 @@
     "resilienceNo": "Não",
     "resilienceDefault": "Default",
     "storageDatabaseBackupRetention": "Retenção de backup de banco de dados",
+    "storageDatabaseBackups": "__MISSING__:Database backups",
     "storagePurgeData": "Limpar dados",
+    "storagePurgeDataDesc": "__MISSING__:Immediately delete all records without applying retention checks. Use with caution.",
+    "storageRetentionCleanup": "__MISSING__:Retention Settings",
+    "storageRetentionCleanupDesc": "__MISSING__:Configure operational record retention and database backup cleanup.",
+    "retentionCallDays": "__MISSING__:Call {count}d",
+    "retentionAppDays": "__MISSING__:App {count}d",
+    "retentionRows": "__MISSING__:{count} rows",
     "retentionQuotaSnapshots": "Instantâneos de cota (dias)",
+    "retentionCompressionAnalytics": "__MISSING__:Compression Analytics (days)",
     "retentionMcpAudit": "Auditoria MCP (dias)",
     "retentionA2aEvents": "Eventos A2A (dias)",
     "retentionCallLogs": "Registros de chamadas (dias)",
     "retentionUsageHistory": "Histórico de uso (dias)",
     "retentionMemoryEntries": "Entradas de memória (dias)",
+    "saveRetentionSettings": "__MISSING__:Save retention settings",
     "storageAutoVacuumMode": "Modo de vácuo automático",
     "storageScheduledVacuum": "Vácuo programado",
     "storageVacuumHour": "Hora de Vácuo (0-23)",
@@ -5331,10 +5827,16 @@
     "storageIntegrityOk": "✓ OK",
     "storageIntegrityError": "✗ Erro",
     "storageUsageTokenBuffer": "Buffer de token de uso",
+    "storageUsageTokenBufferDesc": "__MISSING__:Extra tokens added to reported usage to account for system prompt overhead.",
+    "storageUsageTokenBufferHint": "__MISSING__:Set to 0 to report raw provider token counts. Default: 2000.",
+    "storageUsageTokenBufferCurrent": "__MISSING__:Current: {value}",
     "compressionSettingsAutoTriggerMode": "Modo de disparo automático",
     "compressionSettingsMcpDescriptionCompression": "Compressão de descrição MCP",
+    "mcpAccessibilityTitle": "__MISSING__:MCP accessibility output",
     "compressionSettingsCavemanIntensity": "Intensidade do homem das cavernas",
     "compressionSettingsCavemanOutputMode": "Modo de saída do homem das cavernas",
+    "compressionSettingsOutputStyles": "__MISSING__:Output styles",
+    "compressionStylesTileTitle": "__MISSING__:Output styles",
     "compressionSettingsOutputIntensity": "Intensidade de saída",
     "compressionSettingsAutoClarityBypass": "Desvio de clareza automática",
     "resilienceWaitForCooldown": "Aguarde o resfriamento",
@@ -5350,6 +5852,9 @@
     "cliproxyapiUrl": "URL CLIProxyAPI",
     "cliproxyapiStatus": "Status CLIProxyAPI",
     "cliproxyapiNotDetected": "Não detectado",
+    "cliproxyapiImportAuthTitle": "__MISSING__:Import accounts from CLIProxyAPI",
+    "cliproxyapiImportAuthDesc": "__MISSING__:Import the OAuth accounts CLIProxyAPI already saved in ~/.cli-proxy-api/ as OmniRoute connections, so you don't have to log in to each account again. Supported account types (Gemini, Codex, Claude, Antigravity, Qwen, Kimi) are imported; others are skipped.",
+    "cliproxyapiImportAuthButton": "__MISSING__:Import accounts",
     "payloadRulesTitle": "Regras de carga útil",
     "payloadRulesDesc": "__MISSING__:Configure request payload mutations by model and protocol. Changes are persisted in settings and hot reloaded into the runtime immediately after save.",
     "payloadRuleDefaultTitle": "__MISSING__:default",
@@ -5382,6 +5887,14 @@
     "maxResponseTokensDesc": "__MISSING__:Maximum total tokens allowed in a single response.",
     "modelCooldownsTitle": "Modelos em espera",
     "modelCooldownsEmpty": "Nenhum modelo em espera no momento.",
+    "responsesStateTitle": "__MISSING__:Responses State",
+    "responsesStateDesc": "__MISSING__:Control how OmniRoute forwards previous_response_id.",
+    "responsesStateModeLabel": "__MISSING__:previous_response_id handling",
+    "responsesStateModeAuto": "__MISSING__:Auto",
+    "responsesStateModeStrip": "__MISSING__:Strip",
+    "responsesStateModePreserve": "__MISSING__:Preserve",
+    "responsesStateHint": "__MISSING__:Auto strips previous_response_id unless a connection explicitly enables OpenAI Responses storage. Strip is safest for stateless clients such as VS Code Custom Endpoint; context then depends on the client sending full history.",
+    "responsesStateSaveError": "__MISSING__:Failed to update Responses state setting",
     "codexFastTierTitle": "Camada rápida do Codex",
     "codexFastTierDesc": "Injete globalmente service_tier=priority para solicitações do OpenAI Codex.",
     "codexFastTierHint": "Quando habilitado, o OmniRoute adiciona service_tier=priority às solicitações de saída do Codex para conexões que ainda não especificam uma camada. O nível de prioridade requer uma chave de API OpenAI Enterprise ou o caminho ChatGPT-auth Codex; outros tipos de chave receberão um erro relacionado ao nível do OpenAI. As configurações por conexão na página do provedor Codex têm precedência.",
@@ -5488,6 +6001,15 @@
     "resilienceEnableServerWaitDesc": "Quando ativado, o OmniRoute aguarda o primeiro resfriamento expirar e tenta novamente automaticamente.",
     "resilienceMaxAttempts": "Máximo de tentativas",
     "resilienceMaxWaitPerAttempt": "Espera máxima por tentativa",
+    "resilienceProviderCooldownTitle": "__MISSING__:Provider Cooldown",
+    "resilienceProviderCooldownScope": "__MISSING__:All combo requests",
+    "resilienceProviderCooldownTrigger": "__MISSING__:When a provider/connection fails",
+    "resilienceProviderCooldownEffect": "__MISSING__:Skips the failed provider for a cooldown period before retrying",
+    "resilienceProviderCooldownDesc": "__MISSING__:Prevents subsequent requests from re-walking the same failing providers. Cooldown scales exponentially with consecutive failures.",
+    "resilienceProviderCooldownEnabled": "__MISSING__:Enable global provider cooldown",
+    "resilienceProviderCooldownEnabledDesc": "__MISSING__:When enabled, failed providers are tracked globally and skipped for a cooldown period.",
+    "resilienceProviderCooldownMin": "__MISSING__:Minimum cooldown",
+    "resilienceProviderCooldownMax": "__MISSING__:Maximum cooldown",
     "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
     "forcedFingerprintBadge": "Required",
     "codexSessionAffinityTitle": "Afinidade de sessão do Codex",
@@ -5509,13 +6031,45 @@
     "vercelRelayFreeTierNote": "__MISSING__:Relays are lightweight proxy endpoints deployed on Vercel's free tier to bypass local network/region limitations.",
     "vercelRelayDeploying": "__MISSING__:Deploying...",
     "vercelRelayDeploy": "__MISSING__:Deploy",
-    "homePinProviderQuotaToHome": "Pin Information to Home Page",
-    "homeProviderQuotaLimits": "Provider Quota Limits",
-    "homeProviderQuotaLimitsDesc": "Pin the Provider Quota status container (with Refresh All button) to the top of the Home page.",
-    "homeQuickStart": "Quick Start",
-    "homeQuickStartDesc": "Show the Quick Start panel on the Home page.",
-    "homeProviderTopology": "Provider Topology",
-    "homeProviderTopologyDesc": "Show the Provider Topology on the Home page."
+    "deployRelayButton": "__MISSING__:Deploy Relay",
+    "denoRelayButton": "__MISSING__:Deploy Deno Relay",
+    "denoRelayModalTitle": "__MISSING__:Deploy Deno Relay",
+    "denoRelayWarning": "__MISSING__:Warning: A Deno Deploy organization token is required. This token will only be used to create the relay app and will never be stored by OmniRoute.",
+    "denoRelayTokenLabel": "__MISSING__:Deno Deploy Organization Token",
+    "denoRelayOrgDomainLabel": "__MISSING__:Organization Domain",
+    "denoRelayProjectNameLabel": "__MISSING__:Deno App Name",
+    "denoRelayFreeTierNote": "__MISSING__:Deno Deploy v2 runs on a global edge network. Free tier: 1M requests & 100GiB outbound traffic per month, no per-request CPU limits, up to 20 active apps & 50 custom domains.",
+    "denoRelayDeploying": "__MISSING__:Deploying...",
+    "denoRelayDeploy": "__MISSING__:Deploy",
+    "cloudflareRelaySuccess": "__MISSING__:Cloudflare Relay deployed successfully",
+    "cloudflareRelayButton": "__MISSING__:Deploy Cloudflare Relay",
+    "cloudflareRelayModalTitle": "__MISSING__:Deploy Cloudflare Worker Relay",
+    "cloudflareRelayWarning": "__MISSING__:Deploys a Cloudflare Worker that proxies LLM requests through Cloudflare's edge network — masking the host IP behind dynamic Cloudflare addresses. The Worker enforces a one-time auth secret so the public workers.dev URL cannot be reused as an open relay.",
+    "cloudflareRelayTokenHowto": "__MISSING__:Create the API token under My Profile -> API Tokens -> Create Token -> Custom Token -> Account / Workers Scripts / Edit.",
+    "cloudflareRelayAccountIdLabel": "__MISSING__:Cloudflare Account ID",
+    "cloudflareRelayAccountIdHint": "__MISSING__:Found on the right side of the Cloudflare dashboard overview page.",
+    "cloudflareRelayApiTokenLabel": "__MISSING__:Cloudflare API Token",
+    "cloudflareRelayApiTokenHint": "__MISSING__:Requires 'Workers Scripts: Edit' permission. The token is used only at deploy time and is never stored.",
+    "cloudflareRelayProjectNameLabel": "__MISSING__:Worker Name",
+    "cloudflareRelayFreeTierNote": "__MISSING__:Free tier: 100,000 requests/day per Cloudflare account.",
+    "cloudflareRelayDeploying": "__MISSING__:Deploying...",
+    "cloudflareRelayDeploy": "__MISSING__:Deploy",
+    "cloudflareRelayCredsRequired": "__MISSING__:Account ID and API Token are required",
+    "cloudflareRelayDeployFailed": "__MISSING__:Deploy failed",
+    "modelLockout": "__MISSING__:Model Lockout",
+    "modelLockoutPageDescription": "__MISSING__:Configure which HTTP error codes trigger per-model lockout and control the cooldown behavior.",
+    "modelLockoutEnabled": "__MISSING__:Enable Model Lockout",
+    "modelLockoutEnabledDescription": "__MISSING__:When enabled, models that fail with configured error codes are temporarily locked to prevent retry loops.",
+    "modelLockoutErrorCodes": "__MISSING__:Error Codes",
+    "modelLockoutErrorCodesDescription": "__MISSING__:HTTP status codes that trigger model lockout. Type a code and click Add, or select from suggestions.",
+    "modelLockoutBaseCooldown": "__MISSING__:Base Cooldown (ms)",
+    "modelLockoutBaseCooldownDescription": "__MISSING__:Initial cooldown duration in milliseconds before a model can be retried.",
+    "modelLockoutMaxCooldown": "__MISSING__:Max Cooldown (ms)",
+    "modelLockoutMaxCooldownDescription": "__MISSING__:Maximum cooldown duration in milliseconds. Prevents excessively long lockouts.",
+    "modelLockoutExponentialBackoff": "__MISSING__:Exponential Backoff",
+    "modelLockoutExponentialBackoffDescription": "__MISSING__:When enabled, each consecutive failure increases the cooldown duration exponentially.",
+    "modelLockoutMaxBackoffSteps": "__MISSING__:Max Backoff Steps",
+    "modelLockoutMaxBackoffStepsDescription": "__MISSING__:Maximum number of backoff steps before the cooldown stops growing. The Max Cooldown cap is reached first in most configurations, making this a safety ceiling for when Max Cooldown is raised."
   },
   "contextRtk": {
     "title": "RTK Engine",
@@ -5566,7 +6120,21 @@
     "searchFilters": "Filtros de pesquisa...",
     "tooltipDedup": "Quão agressivamente remover linhas repetidas.",
     "tooltipMaxChars": "Máximo de caracteres por bloco de saída.",
-    "tooltipMaxLines": "Máximo de linhas a serem mantidas na saída do comando. O excesso é truncado."
+    "tooltipMaxLines": "Máximo de linhas a serem mantidas na saída do comando. O excesso é truncado.",
+    "learnDiscoverTitle": "__MISSING__:Learn & Discover filters",
+    "learnDiscoverDesc": "__MISSING__:Mine your captured command output (Raw Output retention must be on) to suggest new RTK filters. Suggestions only — you review and save them.",
+    "discoverHeading": "__MISSING__:Discover repeated noise",
+    "discoverButton": "__MISSING__:Scan samples",
+    "discoverScanning": "__MISSING__:Scanning…",
+    "discoverEmpty": "__MISSING__:No repeated noise found. Enable Raw Output retention and run a few commands first.",
+    "discoverSamples": "__MISSING__:{count} sample(s) scanned",
+    "discoverHits": "__MISSING__:{hits}× across samples",
+    "learnHeading": "__MISSING__:Learn a filter for a command",
+    "learnCommandPlaceholder": "__MISSING__:e.g. npm install",
+    "learnButton": "__MISSING__:Suggest filter",
+    "learnEmpty": "__MISSING__:No suggestion yet. Type a command you have run and scan.",
+    "learnSamplesUsed": "__MISSING__:Learned from {count} matching sample(s)",
+    "suggestionError": "__MISSING__:Could not load suggestions. Check management auth and try again."
   },
   "contextCombos": {
     "title": "Compression Combos",
@@ -5856,7 +6424,80 @@
     "routeConnectionLabel": "Conexão",
     "scenarioVision": "Visão (compreensão da imagem)",
     "scenarioSchemaCoercion": "Coerção de esquema (saída estruturada)",
-    "techniques": "Técnicas:"
+    "techniques": "Técnicas:",
+    "friendlyTitle": "__MISSING__:Translator",
+    "friendlySubtitle": "__MISSING__:Use your existing app with any provider — without rewriting code.",
+    "conceptHeadline": "__MISSING__:Your app speaks one API's \"language\". The Translator converts it to use another provider.",
+    "conceptDiagramAppLabel": "__MISSING__:Your app",
+    "conceptDiagramSourceLabel": "__MISSING__:Source format",
+    "conceptDiagramHubLabel": "__MISSING__:OpenAI (hub)",
+    "conceptDiagramTargetLabel": "__MISSING__:Target provider",
+    "conceptDiagramExampleApp": "__MISSING__:e.g. Anthropic SDK",
+    "conceptDiagramExampleSource": "__MISSING__:claude",
+    "conceptDiagramExampleTarget": "__MISSING__:Gemini",
+    "conceptHowItWorksToggle": "__MISSING__:How it works",
+    "conceptHowItWorksBody": "__MISSING__:Your app sends a request in its own format. The Translator detects the format, converts it through OpenAI as an intermediate hub (or directly when a direct translator is available), sends it to the chosen provider, and returns the response converted back to your app's format.",
+    "tabTranslate": "__MISSING__:Translate",
+    "tabMonitor": "__MISSING__:Monitor",
+    "tabTranslateAriaLabel": "__MISSING__:Go to the Translate tab",
+    "tabMonitorAriaLabel": "__MISSING__:Go to the Monitor tab",
+    "simpleAppUsesLabel": "__MISSING__:My app uses",
+    "simpleAppUsesHint": "__MISSING__:The API format your app speaks (e.g. Anthropic SDK = claude).",
+    "simpleSendToLabel": "__MISSING__:Send to",
+    "simpleSendToHint": "__MISSING__:Where to actually send the request (a provider connected in OmniRoute).",
+    "simpleStartWithLabel": "__MISSING__:Start with",
+    "simpleStartWithExamplePlaceholder": "__MISSING__:Select a ready-made example",
+    "simpleStartWithCustomOption": "__MISSING__:Paste your request (advanced)",
+    "simpleModeLabel": "__MISSING__:Mode",
+    "simpleModePreview": "__MISSING__:Preview translation only",
+    "simpleModeSend": "__MISSING__:Send and see response",
+    "simpleAdvancedToggle": "__MISSING__:Advanced",
+    "simpleInputPanelTitle": "__MISSING__:Input",
+    "simpleInputPanelHint": "__MISSING__:Free-text message or ready-made example",
+    "simpleResultPanelTitle": "__MISSING__:Translation + Response",
+    "narratedDetected": "__MISSING__:✓ Detected: {format}",
+    "narratedTranslating": "__MISSING__:Translating to {target}...",
+    "narratedSending": "__MISSING__:Sending to {target}...",
+    "narratedSuccess": "__MISSING__:→ translated to {target} · response in {latency}ms",
+    "narratedError": "__MISSING__:Failed: {reason}",
+    "narratedSeeTranslatedJson": "__MISSING__:see translated JSON",
+    "narratedSeePipeline": "__MISSING__:see pipeline",
+    "advancedSectionTitle": "__MISSING__:Advanced",
+    "advancedSectionSubtitle": "__MISSING__:Raw JSON, pipeline and technical tools. Everything here is the same as the old tabs — just reorganized.",
+    "advancedRawJsonTitle": "__MISSING__:Raw JSON (auto-detect + Monaco)",
+    "advancedRawJsonSubtitle": "__MISSING__:Paste a JSON request; the format is detected automatically.",
+    "advancedPipelineTitle": "__MISSING__:OpenAI intermediate pipeline",
+    "advancedPipelineSubtitle": "__MISSING__:Visualize each translation step (hub-and-spoke).",
+    "advancedStreamTransformTitle": "__MISSING__:Stream Transformer (Chat → Responses SSE)",
+    "advancedStreamTransformSubtitle": "__MISSING__:Converts Chat Completions SSE into Responses API.",
+    "advancedTestBenchTitle": "__MISSING__:Test Bench (8 scenarios)",
+    "advancedTestBenchSubtitle": "__MISSING__:Runs all scenarios and reports pass/fail + compatibility %.",
+    "advancedCompressionTitle": "__MISSING__:Compression Preview",
+    "advancedCompressionSubtitle": "__MISSING__:Estimate token savings across different compression modes.",
+    "monitorOriginHint": "__MISSING__:Events generated by Translate or the main pipeline appear here in real time.",
+    "monitorEmptyCta": "__MISSING__:Go to the Translate tab and send a request — it will appear here.",
+    "monitorOpenTranslateButton": "__MISSING__:Go to Translate",
+    "pipelineStepClientRequest": "__MISSING__:Client Request",
+    "pipelineStepClientRequestDesc": "__MISSING__:Request received in client format",
+    "pipelineStepFormatDetected": "__MISSING__:Format Detected",
+    "pipelineStepFormatDetectedDesc": "__MISSING__:Auto-detected source format",
+    "pipelineStepOpenAIIntermediate": "__MISSING__:OpenAI Intermediate",
+    "pipelineStepOpenAIIntermediateDesc": "__MISSING__:Translated to OpenAI hub format",
+    "pipelineStepProviderFormat": "__MISSING__:Provider Format",
+    "pipelineStepProviderFormatDesc": "__MISSING__:Translated to provider target format",
+    "pipelineStepProviderResponse": "__MISSING__:Provider Response",
+    "pipelineStepProviderResponseDesc": "__MISSING__:Streaming response from provider",
+    "conceptDiagramArrow1": "__MISSING__:speaks",
+    "conceptDiagramArrow2": "__MISSING__:translates",
+    "conceptDiagramArrow3": "__MISSING__:converts",
+    "conceptDiagramExampleHub": "__MISSING__:OpenAI",
+    "conceptDiagramHubTooltip": "__MISSING__:Intermediate hub used by the translator to convert between formats that don't have a direct mapping.",
+    "conceptDiagramSourceTooltip": "__MISSING__:The API format your app speaks (e.g., Anthropic SDK = claude).",
+    "conceptDiagramTargetTooltip": "__MISSING__:The provider where the request will actually be sent.",
+    "compressionEmptyHint": "__MISSING__:Fill in the input field on the Translate tab (Simple Controls or Raw JSON) to enable the preview.",
+    "compressionModeLabel": "__MISSING__:Compression mode",
+    "compressionPreviewButton": "__MISSING__:Preview Compression",
+    "compressionPreviewing": "__MISSING__:Previewing…"
   },
   "usage": {
     "title": "Uso",
@@ -6013,6 +6654,8 @@
     "notApplicable": "N/A",
     "rawPlanWithValue": "Plano bruto: {plan}",
     "noPlanFromProvider": "Nenhum plano do provedor",
+    "tokenExpiresIn": "__MISSING__:Token expires in {time}",
+    "tokenExpired": "__MISSING__:Token expired",
     "noQuotaData": "Sem dados de cota",
     "cardExpand": "__MISSING__:Expand",
     "cardCollapse": "__MISSING__:Collapse",
@@ -6162,6 +6805,11 @@
     "quotaCutoffsButtonDefault": "Padrão",
     "quotaCutoffsButtonHelp": "Edite os limites mínimos de cota restantes para esta conta.",
     "quotaCutoffsButtonDisabled": "Ainda não há janelas de cota disponíveis para esta conta.",
+    "deactivateAccount": "__MISSING__:Deactivate account (stop routing)",
+    "activateAccount": "__MISSING__:Activate account (resume routing)",
+    "accountActivated": "__MISSING__:Account activated",
+    "accountDeactivated": "__MISSING__:Account deactivated",
+    "toggleActiveFailed": "__MISSING__:Failed to update account status",
     "quotaCutoffsTitle": "Limites de cota para {name} ({provider})",
     "quotaCutoffsExplainer": "Substitua a porcentagem mínima de cota restante onde esta conta deixa de ser selecionada para cada janela de cota. Deixe em branco para herdar o padrão do provedor.",
     "quotaCutoffsDefaultHint": "Minuto restante padrão: {default}%",
@@ -6182,6 +6830,7 @@
     "budgetColDailyLim": "Limite diário",
     "budgetColMonthlyLim": "Limite mensal",
     "budgetColUsedPct": "% usado",
+    "percentUsed": "__MISSING__:{pct}% used",
     "budgetLoading": "Carregando…",
     "budgetNoKeysMatch": "Nenhuma chave corresponde aos filtros",
     "budgetLinearExtrapolation": "extrapolação linear",
@@ -7127,6 +7776,11 @@
     "modalEditTitle": "Modal Edit Title",
     "labelName": "Label Name",
     "labelType": "Tipo",
+    "labelFamily": "__MISSING__:IP family",
+    "familyAuto": "__MISSING__:Auto (dual-stack)",
+    "familyIpv4": "__MISSING__:IPv4 only",
+    "familyIpv6": "__MISSING__:IPv6 only",
+    "familyHint": "__MISSING__:Egress address family. Auto keeps dual-stack; IPv4/IPv6 pin this proxy to that family (prevents a v4 leak under an IPv6-only proxy).",
     "labelHost": "Anfitrião",
     "labelPort": "Porto",
     "labelUsername": "Nome de usuário",
@@ -7269,7 +7923,16 @@
     "improveConfirm": "Improve",
     "exportCode": "Export code",
     "exportCodeTitle": "Export Code",
+    "exportShort": "__MISSING__:Export",
     "noStateToExport": "No playground state available to export.",
+    "closeExportModal": "__MISSING__:Close export modal",
+    "close": "__MISSING__:Close",
+    "exportRealKeyWarning": "__MISSING__:Security warning: export blocked — a real API key was detected in the output. Please reset your API key and try again.",
+    "placeholderHintPrefix": "__MISSING__:Replace",
+    "placeholderHintSuffix": "__MISSING__:with your actual API key, or set it as an environment variable.",
+    "copyLangCode": "__MISSING__:Copy {language} code",
+    "loadingPresets": "__MISSING__:Loading…",
+    "loadPresetPlaceholder": "__MISSING__:Load preset…",
     "copyCode": "Copy",
     "copiedCode": "Copied!",
     "addModel": "+ Add model",
@@ -7294,7 +7957,27 @@
     "invalidJson": "Invalid JSON",
     "running": "Running…",
     "runLabel": "Run",
-    "enterToolResult": "Enter tool result…"
+    "enterToolResult": "Enter tool result…",
+    "build": {
+      "step1Label": "__MISSING__:What to test?",
+      "step2Label": "__MISSING__:Configure",
+      "step3Label": "__MISSING__:Run",
+      "step1Title": "__MISSING__:What do you want to test?",
+      "step1Subtitle": "__MISSING__:Choose the capability you want to explore in this session.",
+      "step2Title": "__MISSING__:Configure",
+      "step2Subtitle": "__MISSING__:Set up the tools or JSON schema that will be used in the request.",
+      "step3Title": "__MISSING__:Run",
+      "modeToolsTitle": "__MISSING__:Tools",
+      "modeToolsDesc": "__MISSING__:Test function calling — define tools and see how the model invokes them.",
+      "modeJsonTitle": "__MISSING__:JSON",
+      "modeJsonDesc": "__MISSING__:Test structured output — constrain the response to a JSON schema.",
+      "modeBothTitle": "__MISSING__:Tools + JSON",
+      "modeBothDesc": "__MISSING__:Combine function calling and structured output in a single request.",
+      "backButton": "__MISSING__:Back",
+      "nextButton": "__MISSING__:Next",
+      "runButton": "__MISSING__:Run",
+      "promptPlaceholder": "__MISSING__:Enter your message… (Enter to send, Shift+Enter for newline)"
+    }
   },
   "miniPlayground": {
     "endpoint": "__MISSING__:Endpoint",
@@ -7398,7 +8081,9 @@
     "loadingLogs": "Loading logs...",
     "noLogs": "No logs yet. Make some API calls to see them here.",
     "noMatchingLogs": "No logs matching current filters.",
-    "callLogsInfo": "Call logs are also saved as JSON files to {dataDir} and rotated based on {retentionDays} and {maxEntries}."
+    "callLogsInfo": "Call logs are also saved as JSON files to {dataDir} and rotated based on {retentionDays} and {maxEntries}.",
+    "loadMore": "__MISSING__:Load More",
+    "loadingMore": "__MISSING__:Loading more..."
   },
   "proxyLogger": {
     "filterAll": "All",
@@ -7435,7 +8120,8 @@
     "loadingProxyLogs": "Loading proxy logs...",
     "noProxyLogs": "No proxy logs yet. Configure proxies and make API calls to see them here.",
     "noMatchingLogs": "No logs match the current filters.",
-    "tlsFingerprint": "Chrome 124 TLS Fingerprint"
+    "tlsFingerprint": "Chrome 124 TLS Fingerprint",
+    "colPublicIp": "__MISSING__:Public IP"
   },
   "endpointOptions": {
     "speech": "Speech",
@@ -7575,7 +8261,86 @@
     "betaConfigSavedSuffix": "(ainda não persistido no servidor). A aplicação do limite por solicitação ainda não está conectada ao pipeline do proxy. Esta tela permite desenhar e visualizar a divisão de cotas; a aplicação real chegará em uma iteração futura com persistência de banco de dados e interceptação de chamadas upstream.",
     "policyLabel": "Política:",
     "resetIn": "redefinir em",
-    "quotaTotal": "total"
+    "quotaTotal": "total",
+    "kpiAvgUtilization": "__MISSING__:Avg utilization",
+    "kpiBorrowingNow": "__MISSING__:Borrowing now",
+    "conceptTitle": "__MISSING__:How Quota Share works",
+    "conceptIntro": "__MISSING__:Quota Share divides a provider's quota among multiple API keys using work-conserving fair-share: each key receives a proportional slice but can borrow from the free balance without exceeding the global cap.",
+    "conceptFairShare": "__MISSING__:Fair-share: each key receives quota proportional to its configured weight",
+    "conceptBorrowing": "__MISSING__:Borrowing: keys can consume free balance from others without breaching the cap",
+    "conceptGlobalCap": "__MISSING__:Hard global cap: the provider's absolute limit is never exceeded",
+    "conceptWindows": "__MISSING__:Windows: 5h, hourly, daily, weekly, monthly — each tracked independently",
+    "conceptKeyHowTitle": "__MISSING__:Enabling a key for quota",
+    "conceptKeyHowDesc": "__MISSING__:Create the key normally in API Keys — it appears in the wizard's key step automatically. Tick Exclusive there to make it quota-only. No separate enable step.",
+    "conceptExclusiveTitle": "__MISSING__:What \"Exclusive\" does",
+    "conceptExclusiveDesc": "__MISSING__:An exclusive key only sees/uses the pool's quotaShared-* models — every other model is hidden from its /v1/models and blocked.",
+    "burnRateTitle": "__MISSING__:Burn rate",
+    "burnRateExhaustsIn": "__MISSING__:Exhausts in",
+    "dimensionResetIn": "__MISSING__:Resets in",
+    "realConsumedColumn": "__MISSING__:Consumed",
+    "deficitColumn": "__MISSING__:Deficit",
+    "borrowingIndicator": "__MISSING__:borrowing",
+    "migratedFromLocalStorageNotice": "__MISSING__:Pools successfully migrated from localStorage.",
+    "policyCapAbsoluteLabel": "__MISSING__:Absolute cap",
+    "policyCapAbsolutePlaceholder": "__MISSING__:Numeric limit (optional)",
+    "multiDimensionLabel": "__MISSING__:Multi-dimension",
+    "stackedBarTitle": "__MISSING__:Slices by API key",
+    "usedSuffix": "__MISSING__:used {percent}%",
+    "wizardTitle": "__MISSING__:New quota pool",
+    "editPoolTitle": "__MISSING__:Edit pool",
+    "saveChanges": "__MISSING__:Save changes",
+    "wizardStep1Label": "__MISSING__:Account",
+    "wizardStep2Label": "__MISSING__:Limit",
+    "wizardStep3Label": "__MISSING__:Keys",
+    "wizardStep1Title": "__MISSING__:Choose provider connection",
+    "wizardStep1Subtitle": "__MISSING__:Select the provider account this pool will share quota for, set a name and default policy.",
+    "wizardStep2Title": "__MISSING__:Configure quota dimensions",
+    "wizardStep2Subtitle": "__MISSING__:Define the quota plan dimensions (unit, window, limit) for the chosen connection. Leave unchanged to keep current settings.",
+    "wizardStep3Title": "__MISSING__:Allocate API keys",
+    "wizardStep3Subtitle": "__MISSING__:Assign API keys to this pool with weight % allocations and optional caps.",
+    "wizardPoolNameLabel": "__MISSING__:Pool name",
+    "wizardPoolNamePlaceholder": "__MISSING__:My quota pool",
+    "wizardNext": "__MISSING__:Next",
+    "wizardBack": "__MISSING__:Back",
+    "wizardCreatePool": "__MISSING__:Create pool",
+    "wizardDimensionsEditedNotice": "__MISSING__:Dimensions edited — will be saved as a manual override when the pool is created.",
+    "wizardExclusiveLabel": "__MISSING__:Exclusive quota",
+    "wizardExclusiveHint": "__MISSING__:When enabled, these API keys will only be allowed to use this pool's virtual models (allowedQuotas reconciliation is applied on save).",
+    "wizardPreviewLabel": "__MISSING__:Virtual model names preview",
+    "wizardConnectionsLabel": "__MISSING__:Provider connections",
+    "wizardPrimaryBadge": "__MISSING__:primary",
+    "wizardAdditionalConnectionsNote": "__MISSING__:Additional connections use their catalog default limits (editable later).",
+    "wizardSingleProviderNote": "__MISSING__:A pool uses a single provider",
+    "wizardPreviewMoreModels": "__MISSING__:+{count} more",
+    "accountQuotaTitle": "__MISSING__:Account quota",
+    "accountQuotaNone": "__MISSING__:—",
+    "logTitle": "__MISSING__:Usage log",
+    "logEmpty": "__MISSING__:No usage yet",
+    "groupLabel": "__MISSING__:Group",
+    "newGroup": "__MISSING__:New group",
+    "renameGroup": "__MISSING__:Rename group",
+    "groupSelectHint": "__MISSING__:Filter pools by group",
+    "groupAllocationNote": "__MISSING__:Allocations apply to all pools in this group via the shared quota layer.",
+    "groupNamePrompt": "__MISSING__:Enter group name",
+    "wizardGroupLabel": "__MISSING__:Group",
+    "allGroups": "__MISSING__:All groups",
+    "endpointsTitle": "__MISSING__:Available endpoints",
+    "endpointsHint": "__MISSING__:Call these virtual models with any allocated key — routing + quota are handled per group.",
+    "previewForKey": "__MISSING__:Preview for key",
+    "previewKeyNone": "__MISSING__:(all endpoints)",
+    "endpointsBaseUrl": "__MISSING__:Base URL",
+    "endpointsCollapse": "__MISSING__:Collapse",
+    "endpointsExpand": "__MISSING__:Expand",
+    "endpointsAnthropicNote": "__MISSING__:Anthropic-native",
+    "endpointsResponsesNote": "__MISSING__:OpenAI Responses — codex/github",
+    "endpointsWsNote": "__MISSING__:WebSocket — codex only",
+    "betaText": "__MISSING__:Quota Share is functional but bugs are expected. Found one? Please report it.",
+    "betaReportLink": "__MISSING__:Report an issue",
+    "deleteGroup": "__MISSING__:Delete group",
+    "deleteGroupConfirm": "__MISSING__:Delete this group? Its pools must be reassigned or removed first.",
+    "deleteGroupHasPools": "__MISSING__:This group still has pools — reassign or delete them first.",
+    "ungroupedTitle": "__MISSING__:Ungrouped",
+    "ungroupedHint": "__MISSING__:These pools are not assigned to a known group. Edit a pool to move it into a real group."
   },
   "plugins": {
     "title": "Plugins",
@@ -7611,6 +8376,571 @@
     "status": "Status",
     "enabled": "Enabled",
     "disabled": "Disabled",
+    "installedTab": "__MISSING__:Installed",
+    "marketplaceTab": "__MISSING__:Marketplace",
+    "marketplaceUrlLabel": "__MISSING__:Custom Marketplace URL",
+    "marketplaceUrlPlaceholder": "__MISSING__:Leave empty for official Omniroute registry",
+    "saveMarketplaceUrl": "__MISSING__:Save & Reload",
+    "marketplaceUrlSaved": "__MISSING__:Marketplace URL updated",
+    "marketplaceEmpty": "__MISSING__:No plugins found in marketplace.",
+    "verified": "__MISSING__:Verified",
+    "install": "__MISSING__:Install",
+    "installedFromMarketplace": "__MISSING__:Plugin {name} installed!",
     "hooks": "Hooks"
+  },
+  "quotaPlans": {
+    "title": "__MISSING__:Plans & Quotas",
+    "description": "__MISSING__:Configure quota plans per provider — dimensions (%, requests, tokens, $) and time windows",
+    "providerLabel": "__MISSING__:Provider / Connection",
+    "detectedPlanLabel": "__MISSING__:Detected plan",
+    "manualPlanLabel": "__MISSING__:Manual override",
+    "unconfiguredLabel": "__MISSING__:Not configured — manual required",
+    "dimensionLabel": "__MISSING__:Dimensions",
+    "addDimension": "__MISSING__:Add dimension",
+    "removeDimension": "__MISSING__:Remove",
+    "limitLabel": "__MISSING__:Limit",
+    "unitOptions": {
+      "percent": "__MISSING__:%",
+      "requests": "__MISSING__:requests",
+      "tokens": "__MISSING__:tokens",
+      "usd": "__MISSING__:USD ($)"
+    },
+    "windowOptions": {
+      "5h": "__MISSING__:5 hours",
+      "hourly": "__MISSING__:Hourly",
+      "daily": "__MISSING__:Daily",
+      "weekly": "__MISSING__:Weekly",
+      "monthly": "__MISSING__:Monthly"
+    },
+    "useCatalogButton": "__MISSING__:Use catalog",
+    "saveOverrideButton": "__MISSING__:Save override",
+    "revertToCatalogButton": "__MISSING__:Revert to catalog",
+    "unknownProviderNotice": "__MISSING__:Select a provider on the left to configure its quota plan.",
+    "catalogTitle": "__MISSING__:Known catalog",
+    "catalogDescription": "__MISSING__:Automatically detected plans for the following providers:"
+  },
+  "activity": {
+    "title": "__MISSING__:Activity",
+    "description": "__MISSING__:Recent events feed",
+    "emptyTitle": "__MISSING__:No activity yet",
+    "emptyDescription": "__MISSING__:When you add providers, create combos, or rotate keys, events will appear here.",
+    "todayHeader": "__MISSING__:Today",
+    "yesterdayHeader": "__MISSING__:Yesterday",
+    "filterAll": "__MISSING__:All",
+    "filterProviders": "__MISSING__:Providers",
+    "filterCombos": "__MISSING__:Combos",
+    "filterApiKeys": "__MISSING__:API Keys",
+    "filterSettings": "__MISSING__:Settings",
+    "filterQuota": "__MISSING__:Quota",
+    "filterAuth": "__MISSING__:Auth",
+    "filterSystem": "__MISSING__:System",
+    "relative": {
+      "justNow": "__MISSING__:just now",
+      "minutesAgo": "__MISSING__:{n} min ago",
+      "hoursAgo": "__MISSING__:{n} h ago",
+      "yesterday": "__MISSING__:yesterday",
+      "daysAgo": "__MISSING__:{n} days ago"
+    },
+    "eventVerb": {
+      "providerAdded": "__MISSING__:{actor} added provider {target}",
+      "providerRemoved": "__MISSING__:{actor} removed provider {target}",
+      "providerTested": "__MISSING__:{actor} tested provider {target}",
+      "comboCreated": "__MISSING__:{actor} created combo {target}",
+      "comboUpdated": "__MISSING__:{actor} updated combo {target}",
+      "comboDeleted": "__MISSING__:{actor} removed combo {target}",
+      "apiKeyCreated": "__MISSING__:{actor} created API key {target}",
+      "apiKeyRevoked": "__MISSING__:{actor} revoked API key {target}",
+      "apiKeyRotated": "__MISSING__:{actor} rotated API key {target}",
+      "budgetThreshold": "__MISSING__:Budget threshold reached for {target}",
+      "settingUpdated": "__MISSING__:{actor} updated setting {target}",
+      "authLogin": "__MISSING__:{actor} signed in",
+      "authLogout": "__MISSING__:{actor} signed out",
+      "cloudAgentSession": "__MISSING__:Cloud agent session started for {target}",
+      "mcpToolRegistered": "__MISSING__:MCP tool {target} registered",
+      "webhookCreated": "__MISSING__:{actor} created webhook {target}",
+      "webhookDeleted": "__MISSING__:{actor} removed webhook {target}",
+      "quotaPoolCreated": "__MISSING__:{actor} created quota pool {target}",
+      "quotaPoolUpdated": "__MISSING__:{actor} updated quota pool {target}",
+      "quotaPoolDeleted": "__MISSING__:{actor} removed quota pool {target}",
+      "quotaPlanUpdated": "__MISSING__:{actor} updated quota plan {target}",
+      "quotaStoreDriverChanged": "__MISSING__:QuotaStore driver changed",
+      "updateApplied": "__MISSING__:Update {target} applied",
+      "deployCompleted": "__MISSING__:Deploy completed",
+      "skillInstalled": "__MISSING__:{actor} installed skill {target}",
+      "skillRemoved": "__MISSING__:{actor} removed skill {target}",
+      "providerCredentialsCreated": "__MISSING__:{actor} created credentials for {target}",
+      "providerCredentialsApplied": "__MISSING__:Credentials for {target} applied",
+      "providerCredentialsUpdated": "__MISSING__:{actor} updated credentials for {target}",
+      "providerCredentialsRevoked": "__MISSING__:{actor} revoked credentials for {target}",
+      "providerCredentialsBatchRevoked": "__MISSING__:{actor} batch-revoked credentials",
+      "providerCredentialsBatchUpdated": "__MISSING__:{actor} batch-updated credentials",
+      "providerCredentialsBulkCreated": "__MISSING__:{actor} bulk-created credentials",
+      "providerCredentialsBulkImported": "__MISSING__:{actor} bulk-imported credentials",
+      "providerCredentialsImported": "__MISSING__:{actor} imported credentials",
+      "providerSsrfBlocked": "__MISSING__:SSRF attempt blocked for {target}",
+      "authLoginSuccess": "__MISSING__:{actor} signed in",
+      "authLoginError": "__MISSING__:Login error for {actor}",
+      "authLoginFailed": "__MISSING__:Login failed for {actor}",
+      "authLoginLocked": "__MISSING__:{actor} locked out after too many attempts",
+      "authLoginMisconfigured": "__MISSING__:Auth configuration invalid",
+      "authLoginSetupRequired": "__MISSING__:Auth setup required",
+      "authLogoutSuccess": "__MISSING__:{actor} signed out",
+      "syncTokenCreated": "__MISSING__:{actor} created sync token",
+      "syncTokenRevoked": "__MISSING__:{actor} revoked sync token",
+      "settingsUpdate": "__MISSING__:{actor} updated settings",
+      "settingsUpdateFailed": "__MISSING__:Settings update failed",
+      "serviceRevealApiKey": "__MISSING__:{actor} revealed API key for {target}",
+      "genericEvent": "__MISSING__:{actor} {target}"
+    }
+  },
+  "agentBridge": {
+    "title": "__MISSING__:AgentBridge",
+    "subtitle": "__MISSING__:Use IDE agents with OmniRoute models — no config required",
+    "riskBannerTitle": "__MISSING__:Use at your own risk",
+    "riskBannerBody": "__MISSING__:AgentBridge intercepts HTTPS traffic from IDE agents. By activating it you accept responsibility for compliance with the terms of service of each agent. Never use on devices or networks where TLS inspection is prohibited.",
+    "riskBannerDismiss": "__MISSING__:Dismiss",
+    "serverCardTitle": "__MISSING__:AgentBridge Server",
+    "statusRunning": "__MISSING__:Running",
+    "statusStopped": "__MISSING__:Stopped",
+    "statusActive": "__MISSING__:Active",
+    "statusDnsOff": "__MISSING__:DNS off",
+    "statusSetupRequired": "__MISSING__:Setup required",
+    "statusInvestigating": "__MISSING__:Investigating",
+    "serverPort": "__MISSING__:Port",
+    "serverConns": "__MISSING__:Connections",
+    "serverIntercepted": "__MISSING__:Intercepted",
+    "serverLastStarted": "__MISSING__:Last started",
+    "startServer": "__MISSING__:Start",
+    "stopServer": "__MISSING__:Stop",
+    "restartServer": "__MISSING__:Restart",
+    "trustCert": "__MISSING__:Trust Cert",
+    "downloadCert": "__MISSING__:Download Cert",
+    "regenerateCert": "__MISSING__:Regenerate Cert",
+    "starting": "__MISSING__:Starting…",
+    "stopping": "__MISSING__:Stopping…",
+    "restarting": "__MISSING__:Restarting…",
+    "trusting": "__MISSING__:Trusting…",
+    "regenerating": "__MISSING__:Regenerating…",
+    "upstreamCaLabel": "__MISSING__:Upstream CA Certificate (corporate)",
+    "upstreamCaPlaceholder": "__MISSING__:/etc/ssl/certs/corp-ca.pem",
+    "upstreamCaTest": "__MISSING__:Test TLS",
+    "upstreamCaTestOk": "__MISSING__:TLS test passed",
+    "upstreamCaTestError": "__MISSING__:TLS test failed — check the path and CA file",
+    "bypassSectionTitle": "__MISSING__:Bypass List",
+    "bypassSectionDesc": "__MISSING__:Hosts matching these patterns are tunneled directly (no TLS decryption). Defaults include banks, .gov, and corporate SSO.",
+    "bypassDefaultsLabel": "__MISSING__:Default bypass patterns (read-only)",
+    "bypassUserLabel": "__MISSING__:Custom bypass patterns (one per line, glob or regex)",
+    "saveBypassList": "__MISSING__:Save bypass list",
+    "agentListTitle": "__MISSING__:IDE Agents",
+    "filterAll": "__MISSING__:All",
+    "filterActive": "__MISSING__:Active",
+    "filterSetupRequired": "__MISSING__:Setup required",
+    "filterInvestigating": "__MISSING__:Investigating",
+    "searchAgents": "__MISSING__:Search agents…",
+    "noAgentsMatch": "__MISSING__:No agents match the current filter",
+    "agentHosts": "__MISSING__:Intercepted hosts",
+    "certTrusted": "__MISSING__:Certificate trusted",
+    "certNotTrusted": "__MISSING__:Certificate not trusted",
+    "investigatingNotice": "__MISSING__:This agent is under investigation. Hosts and API surface are still being confirmed. Setup will be available once the upstream API is documented.",
+    "modelMappingsLabel": "__MISSING__:Model mappings",
+    "sourceModel": "__MISSING__:Source model (agent native)",
+    "targetModel": "__MISSING__:Target model (OmniRoute)",
+    "noMappings": "__MISSING__:No model mappings configured. Run setup wizard to auto-detect models.",
+    "selectModel": "__MISSING__:Select…",
+    "saveMappings": "__MISSING__:Save mappings",
+    "setupWizard": "__MISSING__:Setup wizard",
+    "startDns": "__MISSING__:Start DNS",
+    "stopDns": "__MISSING__:Stop DNS",
+    "toggling": "__MISSING__:Toggling…",
+    "viewTraffic": "__MISSING__:View traffic",
+    "emptyNoProvidersTitle": "__MISSING__:No providers configured yet",
+    "emptyNoProvidersBody": "__MISSING__:To use AgentBridge, first connect at least one provider. It will be the destination where IDE requests are routed.",
+    "emptyGoToProviders": "__MISSING__:Go to Providers",
+    "wizardTitle": "__MISSING__:Setup wizard",
+    "wizardSubtitle": "__MISSING__:3-step setup",
+    "wizardStep1Label": "__MISSING__:Verify",
+    "wizardStep2Label": "__MISSING__:DNS",
+    "wizardStep3Label": "__MISSING__:Mappings",
+    "wizardStep1Desc": "__MISSING__:Confirm the server is running and the certificate is installed.",
+    "wizardStep2Desc": "__MISSING__:The following entries will be added to /etc/hosts to redirect traffic through AgentBridge:",
+    "wizardStep3Desc": "__MISSING__:You can now configure model mappings in the agent card. Restart the IDE to apply changes.",
+    "wizardStep3Success": "__MISSING__:Agent is configured!",
+    "wizardServerCheck": "__MISSING__:AgentBridge server",
+    "wizardRunning": "__MISSING__:running",
+    "wizardNotRunning": "__MISSING__:not running",
+    "wizardCertCheck": "__MISSING__:Certificate",
+    "wizardTrusted": "__MISSING__:trusted",
+    "wizardNotTrusted": "__MISSING__:not yet trusted — use Trust Cert button",
+    "wizardTutorialTitle": "__MISSING__:Setup instructions:",
+    "wizardEnableDns": "__MISSING__:Add /etc/hosts entries",
+    "wizardDnsAlreadyEnabled": "__MISSING__:DNS already enabled for this agent",
+    "enablingDns": "__MISSING__:Enabling…",
+    "modelSelectorTitle": "__MISSING__:Select target model",
+    "modelSelectorSearch": "__MISSING__:Search models…",
+    "noModelsFound": "__MISSING__:No models found",
+    "quickLinks": "__MISSING__:Quick links",
+    "quickLinkProviders": "__MISSING__:Configure providers",
+    "quickLinkInspector": "__MISSING__:View traffic in Traffic Inspector",
+    "maintenanceTitle": "__MISSING__:Maintenance & Diagnostics",
+    "maintenanceSubtitle": "__MISSING__:Self-test the capture pipeline, undo leftover system state, and move your setup between machines.",
+    "orphanedStateWarning": "__MISSING__:A previous session left system state behind (DNS spoof, CA, or system proxy). Run Repair to clean it up.",
+    "diagnose": "__MISSING__:Diagnose",
+    "diagnosing": "__MISSING__:Diagnosing…",
+    "diagnoseHealthy": "__MISSING__:Capture pipeline is healthy.",
+    "diagnoseUnhealthy": "__MISSING__:Capture pipeline has problems:",
+    "repair": "__MISSING__:Repair",
+    "repairing": "__MISSING__:Repairing…",
+    "repairDone": "__MISSING__:Repaired: {items}",
+    "repairNothing": "__MISSING__:Nothing to repair — system state is clean.",
+    "removeCa": "__MISSING__:Remove CA",
+    "removeCaConfirm": "__MISSING__:Remove CA?",
+    "removeCaDone": "__MISSING__:MITM root CA removed from the OS trust store.",
+    "removing": "__MISSING__:Removing…",
+    "confirm": "__MISSING__:Confirm",
+    "exportConfig": "__MISSING__:Export config",
+    "exporting": "__MISSING__:Exporting…",
+    "importConfig": "__MISSING__:Import config",
+    "importing": "__MISSING__:Importing…",
+    "importInvalidJson": "__MISSING__:The selected file is not valid JSON.",
+    "importDone": "__MISSING__:Imported {bypass} bypass · {hosts} hosts · {agents} agents",
+    "save": "__MISSING__:Save",
+    "saving": "__MISSING__:Saving…",
+    "cancel": "__MISSING__:Cancel",
+    "back": "__MISSING__:Back",
+    "next": "__MISSING__:Next",
+    "done": "__MISSING__:Done",
+    "loading": "__MISSING__:Loading…",
+    "riskNoticeTitle": "__MISSING__:Risk acknowledgment",
+    "riskNoticeBody": "__MISSING__:AgentBridge will intercept HTTPS traffic from this agent by redirecting its API hosts via DNS. Only enable if you accept responsibility for compliance with the agent's terms of service and any applicable network policies.",
+    "pageMoved": {
+      "goNow": "__MISSING__:Go now",
+      "message": "__MISSING__:The MITM Proxy now lives under AgentBridge.",
+      "title": "__MISSING__:This page has moved"
+    }
+  },
+  "trafficInspector": {
+    "title": "__MISSING__:Traffic Inspector",
+    "subtitle": "__MISSING__:Monitor LLM calls and debug any application's HTTPS traffic",
+    "captureModesTitle": "__MISSING__:Capture Modes",
+    "agentBridgeMode": "__MISSING__:AgentBridge",
+    "agentBridgeModeDesc": "__MISSING__:Capture traffic from all connected IDE agents",
+    "customHostsMode": "__MISSING__:Custom Hosts",
+    "customHostsModeDesc": "__MISSING__:Add specific hosts to intercept",
+    "httpProxyMode": "__MISSING__:HTTP Proxy",
+    "httpProxyModeDesc": "__MISSING__:Use HTTP_PROXY environment variable",
+    "systemWideMode": "__MISSING__:System-wide",
+    "systemWideModeDesc": "__MISSING__:Intercept all system traffic (advanced)",
+    "tproxyMode": "__MISSING__:TPROXY Decrypt",
+    "tproxyModeUnavailable": "__MISSING__:TPROXY decrypt requires Linux + root + the native addon",
+    "filterBarTitle": "__MISSING__:Filters",
+    "profileLlmOnly": "__MISSING__:LLM only",
+    "profileCustom": "__MISSING__:Custom",
+    "profileAll": "__MISSING__:All",
+    "filterHost": "__MISSING__:Filter host…",
+    "filterAgent": "__MISSING__:Agent",
+    "filterStatus": "__MISSING__:Status",
+    "pauseBtn": "__MISSING__:Pause",
+    "resumeBtn": "__MISSING__:Resume",
+    "clearBtn": "__MISSING__:Clear",
+    "exportHar": "__MISSING__:Export .har",
+    "recordSession": "__MISSING__:REC",
+    "stopSession": "__MISSING__:Stop",
+    "liveBadge": "__MISSING__:live",
+    "offlineBadge": "__MISSING__:offline",
+    "noRequests": "__MISSING__:No requests captured yet.",
+    "noRequestsDesc": "__MISSING__:Make sure AgentBridge is running or enable another capture mode.",
+    "selectRequest": "__MISSING__:Select a request to inspect it.",
+    "tabConversation": "__MISSING__:Conversation",
+    "tabHeaders": "__MISSING__:Headers",
+    "tabRequest": "__MISSING__:Request",
+    "tabResponse": "__MISSING__:Response",
+    "tabTiming": "__MISSING__:Timing",
+    "tabLlm": "__MISSING__:LLM",
+    "tabStats": "__MISSING__:Stats",
+    "requestHeaders": "__MISSING__:Request Headers",
+    "responseHeaders": "__MISSING__:Response Headers",
+    "rawEvents": "__MISSING__:Raw events",
+    "mergedView": "__MISSING__:Merged view",
+    "noBody": "__MISSING__:No body.",
+    "streaming": "__MISSING__:streaming…",
+    "manageHosts": "__MISSING__:Manage hosts",
+    "copySnippet": "__MISSING__:Copy proxy snippet",
+    "addHost": "__MISSING__:Add",
+    "hostPlaceholder": "__MISSING__:api.openai.com",
+    "noHostsYet": "__MISSING__:No custom hosts added yet.",
+    "noSessionsYet": "__MISSING__:No sessions yet",
+    "allTraffic": "__MISSING__:All traffic (no session)",
+    "sessionsDropdown": "__MISSING__:Sessions",
+    "annotationPlaceholder": "__MISSING__:Add a note…",
+    "contextFingerprint": "__MISSING__:Context fingerprint",
+    "llmProvider": "__MISSING__:Detected provider",
+    "llmApiKind": "__MISSING__:API kind",
+    "llmModel": "__MISSING__:Model",
+    "llmMessages": "__MISSING__:Messages",
+    "llmStream": "__MISSING__:Stream",
+    "llmMappedTo": "__MISSING__:Mapped to",
+    "llmCostEstimate": "__MISSING__:Cost estimate",
+    "systemProxyExitWarning": "__MISSING__:System-wide proxy still active — leave page anyway?",
+    "customHostsTitle": "__MISSING__:Custom Hosts",
+    "loading": "__MISSING__:Loading…",
+    "copied": "__MISSING__:Copied!",
+    "copy": "__MISSING__:Copy",
+    "httpProxyTitle": "__MISSING__:HTTP Proxy Snippet — port {port}",
+    "notRecording": "__MISSING__:Not recording",
+    "anyStatus": "__MISSING__:Any status",
+    "liveOnly": "__MISSING__:Live",
+    "viewingRecordedSession": "__MISSING__:Viewing recorded session",
+    "backToLive": "__MISSING__:Back to live",
+    "untitledSession": "__MISSING__:Untitled session",
+    "contextHistory": "__MISSING__:Context History",
+    "modelResponse": "__MISSING__:Model Response",
+    "conversationNoMessages": "__MISSING__:No messages found in this request.",
+    "conversationNotAvailable": "__MISSING__:Conversation data not available. This may not be an LLM request or the body could not be parsed.",
+    "loadingCharts": "__MISSING__:Loading charts…",
+    "statsErrors": "__MISSING__:Errors",
+    "statsLatency": "__MISSING__:Latency (last 50 requests)",
+    "statsNoData": "__MISSING__:No requests yet. Start a session recording to capture data for stats.",
+    "statsStatusDistribution": "__MISSING__:Status distribution",
+    "statsSuccessful": "__MISSING__:Successful",
+    "statsTotalRequests": "__MISSING__:Total requests",
+    "timingProxyOverhead": "__MISSING__:Proxy overhead",
+    "timingUpstreamResponse": "__MISSING__:Upstream response",
+    "timingNoData": "__MISSING__:No timing data available.",
+    "timingTotalLatency": "__MISSING__:Total latency",
+    "timingTimestamp": "__MISSING__:Timestamp",
+    "timingMethod": "__MISSING__:Method",
+    "timingStatus": "__MISSING__:Status",
+    "timingRequestSize": "__MISSING__:Request size",
+    "timingResponseSize": "__MISSING__:Response size",
+    "pausedNewBadge": "__MISSING__:{count} new",
+    "clearContextFilter": "__MISSING__:clear"
+  },
+  "cliCommon": {
+    "concept": {
+      "code": {
+        "title": "__MISSING__:CLI Code",
+        "phrase": "__MISSING__:Code tools you point at OmniRoute",
+        "flow": "__MISSING__:You → CLI Code → OmniRoute → Provider",
+        "seeOther": "__MISSING__:See →"
+      },
+      "agent": {
+        "title": "__MISSING__:CLI Agents",
+        "phrase": "__MISSING__:Broad-purpose autonomous CLI agents you point at OmniRoute",
+        "flow": "__MISSING__:You → CLI Agent → OmniRoute → Provider",
+        "seeOther": "__MISSING__:See →"
+      },
+      "acp": {
+        "title": "__MISSING__:ACP Agents",
+        "phrase": "__MISSING__:CLIs that OmniRoute spawns as execution backend (reverse flow)",
+        "flow": "__MISSING__:Client → OmniRoute → spawn CLI (stdio/ACP) → response",
+        "seeOther": "__MISSING__:See →"
+      }
+    },
+    "comparison": {
+      "title": "__MISSING__:Understand the 3 CLI types in OmniRoute",
+      "thisPage": "__MISSING__:This page",
+      "open": "__MISSING__:Open →",
+      "code": {
+        "title": "__MISSING__:Code tool",
+        "desc": "__MISSING__:Points to Omni",
+        "flow": "__MISSING__:you → CLI → Omni → provider",
+        "examples": "__MISSING__:e.g.: claude, codex"
+      },
+      "agent": {
+        "title": "__MISSING__:Broad autonomous agent",
+        "desc": "__MISSING__:Points to Omni",
+        "flow": "__MISSING__:you → agent → Omni",
+        "examples": "__MISSING__:e.g.: hermes, goose"
+      },
+      "acp": {
+        "title": "__MISSING__:CLI used as backend by Omni",
+        "desc": "__MISSING__:Reverse execution",
+        "flow": "__MISSING__:Omni → spawn CLI → resp",
+        "examples": "__MISSING__:e.g.: claude, codex (ACP)"
+      }
+    },
+    "card": {
+      "detected": "__MISSING__:Detected",
+      "notDetected": "__MISSING__:Not detected",
+      "configured": "__MISSING__:Configured",
+      "notConfigured": "__MISSING__:Not configured",
+      "configure": "__MISSING__:Configure →",
+      "howToInstall": "__MISSING__:How to install →",
+      "manualConfig": "__MISSING__:Manual config",
+      "installGuide": "__MISSING__:Install guide",
+      "endpointLabel": "__MISSING__:Endpoint",
+      "baseUrlFull": "__MISSING__:Full Base URL",
+      "baseUrlPartial": "__MISSING__:Partial Base URL",
+      "refreshDetection": "__MISSING__:Refresh detection",
+      "alsoAcp": "__MISSING__:also ACP",
+      "connectProviderHint": "__MISSING__:Connect a provider in Providers"
+    },
+    "detail": {
+      "back": "__MISSING__:Back",
+      "apply": "__MISSING__:Save",
+      "reset": "__MISSING__:Clear",
+      "manualConfig": "__MISSING__:Manual configuration",
+      "vendor": "__MISSING__:Vendor",
+      "category": "__MISSING__:Type",
+      "detectionStatus": "__MISSING__:Detection",
+      "configStatus": "__MISSING__:Configuration",
+      "baseUrlLabel": "__MISSING__:Base URL",
+      "apiKeyLabel": "__MISSING__:API Key",
+      "modelMappingLabel": "__MISSING__:Model mapping",
+      "noActiveProviders": "__MISSING__:No active providers.",
+      "noActiveProvidersDesc": "__MISSING__:Go to Providers to connect at least 1 provider before configuring the CLI.",
+      "openProviders": "__MISSING__:Open Providers →"
+    }
+  },
+  "cliCode": {
+    "pageTitle": "__MISSING__:CLI Code's",
+    "pageSubtitle": "__MISSING__:Code tools pointing to OmniRoute",
+    "searchPlaceholder": "__MISSING__:Search CLI…",
+    "filterDetectionLabel": "__MISSING__:Detection",
+    "filterBaseUrlLabel": "__MISSING__:Base URL",
+    "detectionAll": "__MISSING__:All",
+    "detectionInstalled": "__MISSING__:Installed",
+    "detectionNotFound": "__MISSING__:Not found",
+    "baseUrlAll": "__MISSING__:All",
+    "baseUrlFull": "__MISSING__:Full",
+    "baseUrlPartial": "__MISSING__:Partial"
+  },
+  "cliAgents": {
+    "pageTitle": "__MISSING__:CLI Agents",
+    "pageSubtitle": "__MISSING__:Broad-purpose autonomous CLI agents",
+    "refreshDetection": "__MISSING__:Refresh detection",
+    "searchPlaceholder": "__MISSING__:Search agent…",
+    "detectionFilterLabel": "__MISSING__:Detection",
+    "detectionAll": "__MISSING__:All",
+    "detectionInstalled": "__MISSING__:Installed",
+    "detectionNotInstalled": "__MISSING__:Not installed",
+    "visibleCount": "__MISSING__:{count} visible",
+    "emptyState": "__MISSING__:No CLI agents found with the current filters."
+  },
+  "acpAgents": {
+    "pageTitle": "__MISSING__:ACP Agents",
+    "pageSubtitle": "__MISSING__:CLIs that OmniRoute spawns as execution backend",
+    "scanning": "__MISSING__:Detecting agents…",
+    "refresh": "__MISSING__:Refresh",
+    "setupGuideTitle": "__MISSING__:Setup guide",
+    "setupGuideDetectCliTitle": "__MISSING__:Detect CLI",
+    "setupGuideDetectCliDesc": "__MISSING__:Agents are identified by running the --version command in PATH.",
+    "setupGuideCustomAgentTitle": "__MISSING__:Add custom agent",
+    "setupGuideCustomAgentDesc": "__MISSING__:Fill in the form below to register a custom CLI agent.",
+    "setupGuideCommandMissingTitle": "__MISSING__:Command not found",
+    "setupGuideCommandMissingDesc": "__MISSING__:Check that the binary is in PATH.",
+    "fingerprintSettingsHint": "__MISSING__:Configure routing and fingerprints in",
+    "settingsRoutingLink": "__MISSING__:Settings → Routing",
+    "installed": "__MISSING__:Installed",
+    "notFound": "__MISSING__:Not found",
+    "builtIn": "__MISSING__:Built-in",
+    "custom": "__MISSING__:Custom",
+    "agentUseCaseHint": "__MISSING__:Available for spawn via ACP.",
+    "remove": "__MISSING__:Remove",
+    "addCustomAgent": "__MISSING__:Add custom agent",
+    "addCustomAgentDesc": "__MISSING__:Register a custom CLI agent to be spawned via ACP.",
+    "addAgent": "__MISSING__:Add agent",
+    "agentName": "__MISSING__:Name",
+    "agentNamePlaceholder": "__MISSING__:e.g.: My Agent",
+    "binaryName": "__MISSING__:Binary",
+    "binaryNamePlaceholder": "__MISSING__:e.g.: myagent",
+    "versionCommand": "__MISSING__:Version command",
+    "versionCommandPlaceholder": "__MISSING__:e.g.: myagent --version",
+    "spawnArgs": "__MISSING__:Spawn arguments",
+    "spawnArgsPlaceholder": "__MISSING__:e.g.: --quiet, --json",
+    "cliCodeRedirectCta": "__MISSING__:Open CLI Code"
+  },
+  "agentSkills": {
+    "pageTitle": "__MISSING__:Agent Skills",
+    "pageSubtitle": "__MISSING__:Teach your agent to operate OmniRoute — 22 API areas + 20 CLI families",
+    "conceptCard": {
+      "agent": {
+        "title": "__MISSING__:Agent Skills — Outbound",
+        "description": "__MISSING__:Agent Skills are machine-readable SKILL.md documents that external AI agents (Claude Code, Cursor, Copilot…) fetch from GitHub to learn how to operate OmniRoute via REST or CLI. They are read by the agent, not executed by OmniRoute.",
+        "crossLinkLabel": "__MISSING__:Understand the difference →"
+      },
+      "omni": {
+        "title": "__MISSING__:Omni Skills — Inbound",
+        "description": "__MISSING__:Omni Skills are sandbox tools that OmniRoute injects into the model's context on every request. They are executed by OmniRoute, not read by the agent.",
+        "crossLinkLabel": "__MISSING__:Understand the difference →"
+      },
+      "comparison": {
+        "colAgent": "__MISSING__:Agent Skills",
+        "colOmni": "__MISSING__:Omni Skills",
+        "whatIs": {
+          "label": "__MISSING__:What it is",
+          "agent": "__MISSING__:Machine-readable SKILL.md that teaches an external agent to operate OmniRoute",
+          "omni": "__MISSING__:Executable tools that OmniRoute injects as tools into LLM requests"
+        },
+        "direction": {
+          "label": "__MISSING__:Direction",
+          "agent": "__MISSING__:Outbound — external agent learns to control OmniRoute",
+          "omni": "__MISSING__:Inbound — OmniRoute gives tools to models passing through it"
+        },
+        "executor": {
+          "label": "__MISSING__:Executor",
+          "agent": "__MISSING__:External agent (reads markdown → acts via API/CLI)",
+          "omni": "__MISSING__:OmniRoute itself (intercepts tool_calls, Docker sandbox)"
+        },
+        "storage": {
+          "label": "__MISSING__:Storage",
+          "agent": "__MISSING__:Dynamic catalog (/api/agent-skills) → SKILL.md on GitHub",
+          "omni": "__MISSING__:SQLite (SkillsMP / skills.sh / local)"
+        },
+        "tagline": {
+          "label": "__MISSING__:Tagline",
+          "agent": "__MISSING__:Teach your agent to use OmniRoute",
+          "omni": "__MISSING__:Give executable tools to OmniRoute models"
+        }
+      }
+    },
+    "filters": {
+      "category": "__MISSING__:Category",
+      "area": "__MISSING__:Area",
+      "searchPlaceholder": "__MISSING__:Search skills…"
+    },
+    "categoryApi": "__MISSING__:API",
+    "categoryCli": "__MISSING__:CLI",
+    "categoryConfig": "__MISSING__:Config",
+    "filterAll": "__MISSING__:All",
+    "coverageLabel": "__MISSING__:Coverage",
+    "mcpUrl": "__MISSING__:MCP URL",
+    "a2aLink": "__MISSING__:A2A",
+    "copyUrl": "__MISSING__:Copy URL",
+    "viewOnGithub": "__MISSING__:View on GitHub",
+    "previewLoading": "__MISSING__:Loading skill documentation…",
+    "previewError": "__MISSING__:Failed to load skill documentation.",
+    "previewEmpty": "__MISSING__:Select a skill to preview its documentation.",
+    "generateButton": "__MISSING__:Generate missing skills",
+    "coverageBar": {
+      "complete": "__MISSING__:Complete",
+      "partial": "__MISSING__:Partial"
+    },
+    "noSkillsFound": "__MISSING__:No skills found matching your filters.",
+    "regenerateConfirm": "__MISSING__:This will regenerate all missing SKILL.md files. Continue?",
+    "regenerateRunning": "__MISSING__:Regenerating skills…",
+    "regenerateSuccess": "__MISSING__:Skills regenerated successfully.",
+    "regenerateError": "__MISSING__:Failed to regenerate skills."
+  },
+  "freeProviderRankingsPage": {
+    "title": "__MISSING__:Free Provider Rankings",
+    "subtitle": "__MISSING__:Best free providers ranked by model ELO scores from Arena AI leaderboards",
+    "loading": "__MISSING__:Loading rankings...",
+    "errorLoading": "__MISSING__:Failed to load rankings",
+    "emptyState": "__MISSING__:No rankings available yet. Arena ELO data syncs on startup (daily) — check back shortly, or trigger a manual sync. Disable Arena ELO Sync in Feature Flags or set ARENA_ELO_SYNC_ENABLED=false to opt out.",
+    "bestModel": "__MISSING__:Best",
+    "allCategories": "__MISSING__:All Categories",
+    "categoryDefault": "__MISSING__:Default",
+    "categoryCoding": "__MISSING__:Coding",
+    "categoryReview": "__MISSING__:Review",
+    "categoryDocumentation": "__MISSING__:Documentation",
+    "categoryDebugging": "__MISSING__:Debugging",
+    "colRank": "__MISSING__:Rank",
+    "colProvider": "__MISSING__:Provider",
+    "colTopModel": "__MISSING__:Top Model",
+    "colScore": "__MISSING__:Score",
+    "colAvgScore": "__MISSING__:Avg Score",
+    "colModels": "__MISSING__:Models",
+    "colType": "__MISSING__:Type"
   }
 }
diff --git a/src/i18n/messages/ro.json b/src/i18n/messages/ro.json
index 53f5b1b94c..2cfed792db 100644
--- a/src/i18n/messages/ro.json
+++ b/src/i18n/messages/ro.json
@@ -393,6 +393,7 @@
     "cloudBenefitAccess": "Cloud Benefit Access",
     "maxRetries": "Max Retries",
     "queueTimeout": "Queue Timeout",
+    "queueDepth": "__MISSING__:Queue Depth",
     "addProvider": "Add Provider",
     "realtime": "Realtime",
     "totalTranslations": "Total Translations",
@@ -709,6 +710,7 @@
     "batchFilesListFilesTable": "Fișiere",
     "batchPageLoadingMore": "Se încarcă mai multe…",
     "recommended": "__MISSING__:Recommended",
+    "understand": "__MISSING__:I understand",
     "batchConceptTitle": "Batch processing",
     "batchConceptSubtitle": "Process thousands of requests asynchronously at ~50% of the cost (24h window). Ideal for evaluations, classification, and embeddings.",
     "batchConceptHowItWorks": "How it works",
@@ -773,36 +775,13 @@
     "filesListUploadButton": "Upload",
     "filesListUsedByColumn": "Used by",
     "filesListUsedByNone": "None",
-    "filesListDelete": "Delete",
-    "filesListDownload": "Download",
-    "batchDetailActionCancel": "Cancel batch",
-    "batchDetailActionRetry": "Retry failed requests",
-    "batchDetailCancelling": "Cancelling…",
-    "batchDetailRetrying": "Preparing retry…",
-    "batchDetailCancelConfirm": "Cancel this batch? In-progress requests will stop.",
-    "batchActionCancelError": "Failed to cancel batch. Try again.",
-    "batchActionRetryError": "Failed to retry failed requests. Try again.",
-    "batchConceptRetentionNote": "Results and error files are retained for 30 days (Anthropic: 29 days)",
     "filesListUsedByRoleInput": "input",
     "filesListUsedByRoleOutput": "output",
     "filesListUsedByRoleError": "error",
-    "batchListProgressPartial": "(partial)",
     "filesListSizeColumn": "Size",
+    "batchListProgressPartial": "(partial)",
     "batchListProviderColumn": "Provider",
     "batchListProviderUnknown": "—",
-    "batchListBatchCreated": "Batch {id} created — refreshing list…",
-    "batchListBatchCreatedDismiss": "Dismiss",
-    "batchListRefreshing": "Refreshing…",
-    "batchListRefresh": "Refresh",
-    "uploadFileModalRemove": "Remove",
-    "uploadFileModalUploading": "Uploading…",
-    "wizardInputReading": "Reading file…",
-    "wizardInputReady": "Ready",
-    "wizardInputLargeFileLabel": "Large file — sampling validation",
-    "wizardInputCsvJsonlReady": "JSONL generated — ready to validate.",
-    "wizardInputLargeFileWarning": "Large file detected — validation runs by sampling (first 5 MB + last 100 KB). Full validation happens server-side.",
-    "wizardCostWindow24h": "24h completion window",
-    "wizardValidationFieldsOk": "required fields valid",
     "batchListProviderOther": "Other",
     "batchListTitle": "Batches",
     "batchListCount": "{count} batches",
@@ -839,8 +818,33 @@
     "wizardCostWindow": "Window",
     "wizardDestinationSelectProvider": "Select a provider…",
     "wizardDestinationSelectModel": "Select a model…",
-    "wizardDestinationConnectProvider": "Connect a provider"
+    "wizardDestinationConnectProvider": "Connect a provider",
+    "batchListBatchCreated": "Batch {id} created — refreshing list…",
+    "batchListBatchCreatedDismiss": "Dismiss",
+    "batchListRefreshing": "Refreshing…",
+    "batchListRefresh": "Refresh",
+    "uploadFileModalRemove": "Remove",
+    "uploadFileModalUploading": "Uploading…",
+    "wizardInputReading": "Reading file…",
+    "wizardInputReady": "Ready",
+    "wizardInputLargeFileLabel": "Large file — sampling validation",
+    "wizardInputCsvJsonlReady": "JSONL generated — ready to validate.",
+    "wizardInputLargeFileWarning": "Large file detected — validation runs by sampling (first 5 MB + last 100 KB). Full validation happens server-side.",
+    "wizardCostWindow24h": "24h completion window",
+    "wizardValidationFieldsOk": "required fields valid",
+    "filesListDelete": "Delete",
+    "filesListDownload": "Download",
+    "batchDetailActionCancel": "Cancel batch",
+    "batchDetailActionRetry": "Retry failed requests",
+    "batchDetailCancelling": "Cancelling…",
+    "batchDetailRetrying": "Preparing retry…",
+    "batchDetailCancelConfirm": "Cancel this batch? In-progress requests will stop.",
+    "batchActionCancelError": "Failed to cancel batch. Try again.",
+    "batchActionRetryError": "Failed to retry failed requests. Try again.",
+    "batchConceptRetentionNote": "Results and error files are retained for 30 days (Anthropic: 29 days)"
   },
+  "featureFlagOmnirouteEmergencyFallbackDescription": "__MISSING__:Route budget-exhausted requests to the emergency free fallback provider/model.",
+  "featureFlagArenaEloSyncEnabledDescription": "__MISSING__:Enable periodic Arena AI leaderboard ELO sync for model intelligence rankings.",
   "sidebar": {
     "home": "Acasă",
     "dashboard": "Tabloul de bord",
@@ -968,6 +972,7 @@
     "aiFeaturesSection": "AI Features",
     "mcp": "MCP",
     "a2a": "A2A",
+    "plugins": "__MISSING__:Plugins",
     "apiEndpoints": "API Endpoints",
     "batchFiles": "Files",
     "analyticsEvals": "Evals",
@@ -976,6 +981,10 @@
     "analyticsComboHealth": "Combo Health",
     "analyticsCompression": "Compression",
     "costsBudget": "Budget",
+    "costsFreeTiers": "__MISSING__:Free-Tier Budget",
+    "costsFreeTiersSubtitle": "__MISSING__:Monthly free-token allowances",
+    "freeProviderRankings": "__MISSING__:Free Provider Rankings",
+    "freeProviderRankingsSubtitle": "__MISSING__:Best free providers ranked by model ELO scores",
     "costsQuotaShare": "Quota Sharing",
     "costsPricing": "Pricing",
     "logsProxy": "Proxy Logs",
@@ -987,10 +996,12 @@
     "settingsAppearance": "Appearance",
     "settingsAi": "AI Settings",
     "settingsSecurity": "Security",
+    "settingsAccessTokens": "__MISSING__:Access Tokens",
     "settingsFeatureFlags": "Caracteristici Steaguri",
     "settingsAuthz": "__MISSING__:Authz",
     "settingsRouting": "Routing",
     "settingsResilience": "Resilience",
+    "modelLockout": "__MISSING__:Model Lockout",
     "settingsAdvanced": "Advanced",
     "omniProxySection": "OmniProxy",
     "quotaTracker": "Provider Quota",
@@ -1036,6 +1047,8 @@
     "analyticsCompressionSubtitle": "Token savings stats",
     "analyticsSearchSubtitle": "Search tool analytics",
     "analyticsEvalsSubtitle": "Eval suite results",
+    "providerStats": "__MISSING__:Provider Stats",
+    "providerStatsSubtitle": "__MISSING__:Latency and performance metrics",
     "logsSubtitle": "Application logs",
     "logsProxySubtitle": "Proxy traffic logs",
     "consoleLogsSubtitle": "Console output",
@@ -1055,6 +1068,7 @@
     "agentSkillsSubtitle": "A2A skill registry",
     "mcpSubtitle": "MCP server controls",
     "a2aSubtitle": "A2A protocol server",
+    "pluginsSubtitle": "__MISSING__:Plugin marketplace & installs",
     "mediaSubtitle": "Cached media files",
     "batchFilesSubtitle": "Batch input/output files",
     "settingsSubtitle": "All settings",
@@ -1065,13 +1079,41 @@
     "settingsResilienceSubtitle": "Retries and breakers",
     "settingsAdvancedSubtitle": "Power user options",
     "settingsSecuritySubtitle": "Auth and encryption",
+    "settingsAccessTokensSubtitle": "__MISSING__:Scoped CLI tokens for remote mode",
     "settingsFeatureFlagsSubtitle": "Comutați capacitățile sistemului",
     "settingsSidebar": "Sidebar",
     "settingsSidebarSubtitle": "Customize sidebar layout",
     "settingsAuthzSubtitle": "__MISSING__:Route inventory and bypass policy",
     "docsSubtitle": "Documentation",
     "issuesSubtitle": "Report a bug",
-    "changelogSubtitle": "Release notes"
+    "changelogSubtitle": "Release notes",
+    "costsQuotaPlans": "__MISSING__:Plans & Quotas",
+    "costsQuotaPlansSubtitle": "__MISSING__:Configure plans by provider",
+    "activity": "__MISSING__:Activity",
+    "activitySubtitle": "__MISSING__:Friendly feed of recent events",
+    "logsGroup": "__MISSING__:Logs",
+    "systemGroup": "__MISSING__:System",
+    "costsOverview": "__MISSING__:Overview",
+    "costsOverviewSubtitle": "__MISSING__:Consolidated cost analysis",
+    "agentBridge": "__MISSING__:Agent Bridge",
+    "agentBridgeSubtitle": "__MISSING__:Intercept IDE agent traffic",
+    "trafficInspector": "__MISSING__:Traffic Inspector",
+    "trafficInspectorSubtitle": "__MISSING__:Monitor LLM calls + debug any HTTPS traffic",
+    "cliCode": "__MISSING__:CLI Code",
+    "cliCodeSubtitle": "__MISSING__:Code tools pointing to OmniRoute",
+    "cliAgents": "__MISSING__:CLI Agents",
+    "cliAgentsSubtitle": "__MISSING__:Autonomous CLI agents",
+    "acpAgents": "__MISSING__:ACP Agents",
+    "acpAgentsSubtitle": "__MISSING__:CLIs spawned by OmniRoute",
+    "skipToContent": "__MISSING__:Skip to content",
+    "unpinSection": "__MISSING__:Unpin section",
+    "pinSectionOpen": "__MISSING__:Pin section open",
+    "reloadPage": "__MISSING__:Reload Page",
+    "dragReorderSection": "__MISSING__:Drag to reorder section",
+    "dragReorderItem": "__MISSING__:Drag to reorder",
+    "cannotHide": "__MISSING__:This item cannot be hidden",
+    "alwaysVisible": "__MISSING__:Always visible",
+    "groupSeparatorLabel": "__MISSING__:Separator"
   },
   "webhooks": {
     "title": "Webhook-uri",
@@ -1272,7 +1314,47 @@
     "a2aEvents": "Evenimente",
     "a2aArtifacts": "Artefacte",
     "a2aNoTasks": "Nu au fost înregistrate sarcini A2A.",
-    "a2aLoadingTasks": "Se încarcă sarcini A2A..."
+    "a2aLoadingTasks": "Se încarcă sarcini A2A...",
+    "actor": "__MISSING__:Actor",
+    "actorPlaceholder": "__MISSING__:Filter by actor",
+    "eventTypes": {
+      "apiKey.activate": "__MISSING__:API Key Activated",
+      "apiKey.ban": "__MISSING__:API Key Banned",
+      "apiKey.deactivate": "__MISSING__:API Key Deactivated",
+      "apiKey.regenerate": "__MISSING__:API Key Regenerated",
+      "apiKey.scopes.grant": "__MISSING__:API Key Scopes Granted",
+      "apiKey.scopes.revoke": "__MISSING__:API Key Scopes Revoked",
+      "apiKey.scopes.update": "__MISSING__:API Key Scopes Updated",
+      "apiKey.unban": "__MISSING__:API Key Unbanned",
+      "auth.login.error": "__MISSING__:Login Error",
+      "auth.login.failed": "__MISSING__:Login Failed",
+      "auth.login.locked": "__MISSING__:Login Locked",
+      "auth.login.misconfigured": "__MISSING__:Login Misconfigured",
+      "auth.login.setup_required": "__MISSING__:Login Setup Required",
+      "auth.login.success": "__MISSING__:Login Success",
+      "auth.logout.success": "__MISSING__:Logout Success",
+      "compliance.cleanup": "__MISSING__:Compliance Cleanup",
+      "provider.credentials.applied": "__MISSING__:Provider Credentials Applied",
+      "provider.credentials.batch_revoked": "__MISSING__:Provider Credentials Batch Revoked",
+      "provider.credentials.bulk_created": "__MISSING__:Provider Credentials Bulk Created",
+      "provider.credentials.bulk_imported": "__MISSING__:Provider Credentials Bulk Imported",
+      "provider.credentials.created": "__MISSING__:Provider Credentials Created",
+      "provider.credentials.imported": "__MISSING__:Provider Credentials Imported",
+      "provider.credentials.revoked": "__MISSING__:Provider Credentials Revoked",
+      "provider.credentials.updated": "__MISSING__:Provider Credentials Updated",
+      "provider.validation.ssrf_blocked": "__MISSING__:Provider SSRF Blocked",
+      "quota.plan.updated": "__MISSING__:Quota Plan Updated",
+      "quota.pool.created": "__MISSING__:Quota Pool Created",
+      "quota.pool.deleted": "__MISSING__:Quota Pool Deleted",
+      "quota.pool.updated": "__MISSING__:Quota Pool Updated",
+      "quota.store.driver_changed": "__MISSING__:Quota Store Driver Changed",
+      "server.start": "__MISSING__:Server Start",
+      "service.reveal_api_key": "__MISSING__:Service API Key Revealed",
+      "settings.update": "__MISSING__:Settings Updated",
+      "settings.update_failed": "__MISSING__:Settings Update Failed",
+      "sync.token.created": "__MISSING__:Sync Token Created",
+      "sync.token.revoked": "__MISSING__:Sync Token Revoked"
+    }
   },
   "themesPage": {
     "title": "Themes",
@@ -1381,7 +1463,8 @@
     "settingsResilienceDescription": "Circuit breaker, retry, and fallback configuration",
     "settingsAdvancedDescription": "Advanced payload rules, request limits, and proxy API settings",
     "mitmProxyDescription": "Configure MITM proxy settings for traffic inspection and debugging",
-    "oneProxyDescription": "Configure 1Proxy settings for advanced proxy chaining"
+    "oneProxyDescription": "Configure 1Proxy settings for advanced proxy chaining",
+    "omniSkillsDescription": "__MISSING__:Install and manage sandbox skills for automated prompt and tool execution"
   },
   "home": {
     "quickStart": "Pornire rapidă",
@@ -1612,16 +1695,24 @@
     "ownUsageVisibilityDesc": "Permite acestei chei să apeleze endpointul propriu de stare pentru utilizarea în USD, procentul de buget și totalurile de tokenuri.",
     "sharedAccountQuotaVisibility": "Cotă de cont partajată",
     "sharedAccountQuotaVisibilityDesc": "Permite acestei chei să vadă cota contului upstream partajat când este configurată o conexiune explicită.",
+    "localUsageCommand": "__MISSING__:Allow local usage command",
+    "localUsageCommandDesc": "__MISSING__:Allows this API key to use @@om-usage to retrieve cached usage and quota information without calling an upstream provider.",
+    "localUsageCommandBadge": "__MISSING__:Usage cmd",
     "keyCreated": "Cheia API creată",
     "keyCreatedSuccess": "Cheie creată cu succes!",
     "keyCreatedNote": "Copiați și stocați această cheie acum - nu va fi afișată din nou.",
     "done": "Gata",
     "savePermissions": "Salvare permisiuni",
-    "endpointRestrictions": "__MISSING__:Allowed Endpoints",
-    "allEndpointsAllowed": "__MISSING__:This key can access all API endpoints.",
-    "endpointsRestricted": "__MISSING__:Restricted to {count} endpoint{count, plural, one {} other {s}}.",
+    "endpointRestrictions": "Allowed Endpoints",
+    "allEndpointsAllowed": "This key can access all API endpoints.",
+    "endpointsRestricted": "Restricted to {count} endpoint{count, plural, one {} other {s}}.",
     "autoResolve": "Auto-Resolve",
     "autoResolveDesc": "Auto-resolve ambiguous model names to native provider for this API key.",
+    "streamDefaultMode": "__MISSING__:Stream Default Compatibility",
+    "streamDefaultModeDesc": "__MISSING__:Controls omitted `stream` flags for this key. JSON mode returns non-streaming responses unless the client explicitly requests SSE.",
+    "streamDefaultLegacy": "__MISSING__:Legacy",
+    "streamDefaultJson": "__MISSING__:JSON Compatible",
+    "streamDefaultBadge": "__MISSING__:JSON stream default",
     "keyActive": "Key Active",
     "keyActiveDesc": "Enable or disable this API key. Disabled keys are immediately rejected with 403.",
     "accessSchedule": "Access Schedule",
@@ -1667,6 +1758,7 @@
     "keyOnlyAvailableAtCreation": "Full key available only at creation time — copy it when you first create the key",
     "modelsCount": "{count, plural, one {# model} other {# models}}",
     "lastUsedOn": "Ultima: {date}",
+    "viewCostsFor": "__MISSING__:View costs for {name}",
     "editPermissions": "Editați permisiunile",
     "deleteKey": "Șterge cheia",
     "regenerateKey": "Regenerați cheia",
@@ -1708,9 +1800,12 @@
     "shownOf": "__MISSING__:{shown} of {total} shown",
     "emptyFilterTitle": "__MISSING__:No keys match your filters",
     "emptyFilterClear": "__MISSING__:Clear filters",
-    "endpointRestrictions": "Allowed Endpoints",
-    "allEndpointsAllowed": "This key can access all API endpoints.",
-    "endpointsRestricted": "Restricted to {count} endpoint{count, plural, one {} other {s}}."
+    "disableNonPublicModels": "__MISSING__:Disable Non-Public Models",
+    "disableNonPublicModelsDesc": "__MISSING__:Reject requests for models that are not discovered or not marked as public in the provider catalog",
+    "normalKeysSection": "__MISSING__:Normal keys",
+    "quotaKeysSection": "__MISSING__:Quota keys",
+    "quotaPill": "__MISSING__:QUOTA",
+    "quotaModeOnly": "__MISSING__:qtSd-only"
   },
   "auditLog": {
     "title": "Jurnal de audit",
@@ -1845,6 +1940,8 @@
     "freeQuota": "Free quota/mo",
     "scrapeUrl": "URL to scrape",
     "scrapeUrlPlaceholder": "https://example.com",
+    "scrapeUrlRequired": "__MISSING__:URL is required",
+    "scrapeUrlInvalid": "__MISSING__:Invalid URL — it must start with http:// or https://",
     "scrapeExtract": "Extract",
     "scrapeExtracting": "Extracting…",
     "scrapeFullPage": "Full page",
@@ -1858,6 +1955,8 @@
     "scrapeMetadata": "Metadata",
     "scrapeProvider": "Provider",
     "scrapeSize": "Size",
+    "scrapeEmptyState": "__MISSING__:Enter a URL to extract its content",
+    "scrapeProvidersAvailable": "__MISSING__:Available providers: Firecrawl, Jina Reader, Tavily.",
     "compareRun": "Compare",
     "compareRunning": "Comparing…",
     "autoProvider": "Auto (cheapest)",
@@ -2245,6 +2344,8 @@
     "leastLatency": "Latență minimă",
     "comboName": "Nume combinat",
     "comboNamePlaceholder": "combo-ul meu",
+    "comboDescription": "__MISSING__:Description",
+    "comboDescriptionPlaceholder": "__MISSING__:Optional note describing this combo",
     "deleteConfirm": "Ștergeți această combinație?",
     "noCombosYet": "Nicio combinație încă",
     "comboCreated": "Combo creat cu succes",
@@ -2284,6 +2385,8 @@
     "resetAwareDesc": "Echilibrează cota rămasă față de 5 ore și resetări săptămânale, apoi scoruri similare la round-robin",
     "strictRandom": "Strict Random",
     "strictRandomDesc": "Shuffle deck — uses each model once before reshuffling",
+    "fusion": "__MISSING__:Fusion",
+    "fusionDesc": "__MISSING__:Fans the prompt to every panel model in parallel, then a judge model synthesizes one final answer",
     "models": "Modele",
     "autoBalance": "Auto-echilibrare",
     "advancedSettings": "Setări avansate",
@@ -2982,14 +3085,19 @@
     "ngrokStarted": "a început tunelul ngrok",
     "ngrokStopped": "tunelul ngrok sa oprit",
     "ngrokRequestFailed": "Nu s-a putut actualiza tunelul ngrok",
-    "tokenSaverSubtitle": "Cheltuiți mai puține jetoane pentru fiecare cerere.",
-    "tokenSaverToolOutput": "Ieșire instrument",
-    "tokenSaverLlmOutput": "Ieșire LLM",
-    "tokenSaverInputCompression": "Compresie de intrare",
     "apiEndpointsCatalogUnavailable": "Catalogul API nu este disponibil",
     "apiEndpointsSearchPlaceholder": "Căutați puncte finale...",
     "apiEndpointsRequiresAuth": "Necesită autentificare",
     "apiEndpointsNoMatch": "Niciun punct final nu se potrivește cu filtrul dvs",
+    "vscodeAliasTitle": "__MISSING__:VS Code Token Alias",
+    "vscodeAliasDescriptionReady": "__MISSING__:Ready-to-paste compatibility URLs using the /api/v1/vscode/TOKEN/... endpoint.",
+    "vscodeAliasDescriptionError": "__MISSING__:Showing placeholder URLs because CLI keys could not be loaded in this session.",
+    "vscodeAliasDescriptionLoading": "__MISSING__:Loading CLI keys. Placeholder URLs are shown until a key is available.",
+    "vscodeAliasDescriptionPlaceholder": "__MISSING__:Showing placeholder URLs. Create or activate an API key in CLI Tools to replace TOKEN.",
+    "vscodeAliasManage": "__MISSING__:CLI Tools",
+    "vscodeAliasBaseLabel": "__MISSING__:VS Code base",
+    "vscodeAliasModelsLabel": "__MISSING__:VS Code models",
+    "vscodeAliasChatLabel": "__MISSING__:VS Code chat",
     "localServer": "Server local",
     "cloudOmniroute": "Cloud OmniRoute",
     "copyUrl": "Copiați adresa URL",
@@ -3002,7 +3110,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
@@ -3178,42 +3289,187 @@
     "a2aStep3": "__MISSING__:Track and cancel tasks with {code1} and {code2}."
   },
   "memory": {
-    "title": "Memory Management",
-    "description": "View and manage stored memory entries",
-    "memories": "Memories",
-    "totalEntries": "Total Entries",
-    "tokensUsed": "Tokens Used",
-    "hitRate": "Hit Rate",
-    "loading": "Loading memories...",
-    "noMemories": "No memories found",
-    "search": "Search memories...",
-    "allTypes": "All Types",
-    "export": "Export",
-    "import": "Import",
-    "addMemory": "Add Memory",
-    "type": "Type",
-    "key": "Key",
-    "content": "Content",
-    "created": "Created",
-    "actions": "Actions",
-    "delete": "Delete",
-    "factual": "Factual",
-    "episodic": "Episodic",
-    "procedural": "Procedural",
-    "semantic": "Semantic",
     "a": "A",
-    "pipelineOk": "Conductă OK ({latencyMs}ms)",
-    "pipelineError": "Eroare de conductă",
-    "healthUnknown": "Sănătate necunoscută",
-    "checkingHealth": "Se verifică…",
-    "checkHealth": "Verificați starea de sănătate",
-    "pageInfo": "Pagina {page} din {totalPages} ({total} total)",
-    "previous": "Anterior",
-    "next": "În continuare",
+    "actions": "Actions",
+    "addMemory": "Add Memory",
+    "allTypes": "All Types",
     "cancel": "Anulează",
-    "save": "Salvați",
+    "checkHealth": "Verificați starea de sănătate",
+    "checkingHealth": "Se verifică…",
+    "compactOld": "__MISSING__:Compact old",
+    "concept": {
+      "title": "__MISSING__:Conversational Memory",
+      "description": "__MISSING__:OmniRoute learns from every conversation, remembering facts, episodes, procedures, and semantic concepts that make responses more accurate and context-aware.",
+      "howWorksToggle": "__MISSING__:How it works",
+      "howWorksContent": "__MISSING__:1. Automatic extraction: at the end of each response, facts and episodes are detected and saved automatically.\n2. Retrieval: before each response, the most relevant memories are searched via FTS5 (exact), vector (semantic), or hybrid RRF.\n3. Injection: relevant memories are injected into the assistant context to improve response quality.\n4. Management: use this page to view, edit, export, and compact old memories."
+    },
+    "content": "Content",
+    "contentPlaceholder": "Valoare sau conținut JSON de reținut",
+    "created": "Created",
+    "delete": "Delete",
+    "deleteConfirmDesc": "__MISSING__:This action cannot be undone. The memory will be permanently removed.",
+    "deleteConfirmTitle": "__MISSING__:Delete memory?",
+    "description": "View and manage stored memory entries",
+    "editMemory": "__MISSING__:Edit memory",
+    "editModal": {
+      "title": "__MISSING__:Edit Memory",
+      "metadataLabel": "__MISSING__:Metadata (JSON)",
+      "metadataInvalid": "__MISSING__:Invalid JSON",
+      "saveFailed": "__MISSING__:Failed to save memory"
+    },
+    "embedding": {
+      "autoLabel": "__MISSING__:Automatic",
+      "autoDesc": "__MISSING__:Uses best available: remote provider > static > transformers",
+      "remoteLabel": "__MISSING__:Remote provider",
+      "remoteDesc": "__MISSING__:Uses embedding via provider API (requires API key)",
+      "staticLabel": "__MISSING__:Static local (potion)",
+      "staticDesc": "__MISSING__:Local embedding without WASM or external dependencies",
+      "transformersLabel": "__MISSING__:Transformers.js (MiniLM)",
+      "transformersDesc": "__MISSING__:Local embedding via @huggingface/transformers (~400MB RAM)",
+      "providerModelLabel": "__MISSING__:Provider / Model",
+      "noRemoteProviders": "__MISSING__:No providers with configured API key",
+      "selectProviderModel": "__MISSING__:Select a model",
+      "staticEnabledLabel": "__MISSING__:Enable Static Potion",
+      "staticEnabledDesc": "__MISSING__:Download and use potion-base-8M model locally",
+      "transformersEnabledLabel": "__MISSING__:Enable Transformers.js",
+      "transformersEnabledDesc": "__MISSING__:Opt-in for local MiniLM (~400MB RAM, ~3s cold start)",
+      "transformersWarning": "__MISSING__:Requires ~400MB RAM and ~3s cold start on the first semantic query."
+    },
+    "emptyState": {
+      "title": "__MISSING__:No memories yet",
+      "description": "__MISSING__:Memories are created automatically from conversations. You can also add them manually using the button above."
+    },
+    "engine": {
+      "statusTitle": "__MISSING__:Engine Status",
+      "embeddingTitle": "__MISSING__:Embedding Source",
+      "rerankTitle": "__MISSING__:Rerank (optional)",
+      "reindexNow": "__MISSING__:Reindex now",
+      "reindexStarted": "__MISSING__:Reindexing started ({pending} pending)",
+      "reindexFailed": "__MISSING__:Failed to start reindexing",
+      "keywordLabel": "__MISSING__:Keyword (FTS5)",
+      "keywordReason": "__MISSING__:Keyword search always available",
+      "embeddingLabel": "__MISSING__:Embedding",
+      "vectorStoreLabel": "__MISSING__:Vector Store",
+      "qdrantLabel": "__MISSING__:Qdrant",
+      "rerankLabel": "__MISSING__:Rerank",
+      "qdrantDisabled": "__MISSING__:Disabled",
+      "qdrantOk": "__MISSING__:Healthy ({latencyMs}ms)",
+      "qdrantError": "__MISSING__:Connection error",
+      "needsReindex": "__MISSING__:{count} memory(ies) need reindexing",
+      "configureCta": "__MISSING__:Configure",
+      "vectorStoreInstallHint": "__MISSING__:To enable vector search: npm install sqlite-vec (needs native Node.js, not WASM), then restart."
+    },
+    "episodic": "Episodic",
+    "export": "Export",
+    "factual": "Factual",
+    "healthUnknown": "Sănătate necunoscută",
+    "hitRate": "Hit Rate",
+    "import": "Import",
+    "importError": "__MISSING__:Failed to import file",
+    "importResult": "__MISSING__:{imported} imported, {skipped} skipped",
+    "key": "Key",
     "keyPlaceholder": "de ex. temă.preferințe.utilizator",
-    "contentPlaceholder": "Valoare sau conținut JSON de reținut"
+    "loading": "Loading memories...",
+    "memories": "Memories",
+    "next": "În continuare",
+    "noMemories": "No memories found",
+    "pageInfo": "Pagina {page} din {totalPages} ({total} total)",
+    "pipelineError": "Eroare de conductă",
+    "pipelineOk": "Conductă OK ({latencyMs}ms)",
+    "playground": {
+      "infoTitle": "__MISSING__:Memory Playground",
+      "infoDesc": "__MISSING__:Simulate what would be retrieved for a given query. No memories are modified — read-only preview.",
+      "queryLabel": "__MISSING__:Test query",
+      "queryPlaceholder": "__MISSING__:Type a question or test phrase...",
+      "strategyLabel": "__MISSING__:Strategy",
+      "strategyExact": "__MISSING__:Exact (FTS5)",
+      "strategySemantic": "__MISSING__:Semantic (vector)",
+      "strategyHybrid": "__MISSING__:Hybrid (RRF)",
+      "budgetLabel": "__MISSING__:Budget (tokens)",
+      "simulate": "__MISSING__:Simulate",
+      "resultsTitle": "__MISSING__:{count} result(s)",
+      "resolutionTitle": "__MISSING__:Search resolution",
+      "resolutionEmbedding": "__MISSING__:Embedding",
+      "resolutionStore": "__MISSING__:Vector store",
+      "resolutionStrategy": "__MISSING__:Strategy used",
+      "rerankApplied": "__MISSING__:Rerank applied",
+      "fallback": "__MISSING__:Fallback",
+      "noResults": "__MISSING__:No memories found for this query.",
+      "tokensUsed": "__MISSING__:tokens used",
+      "none": "__MISSING__:none",
+      "errorFetch": "__MISSING__:Failed to fetch preview"
+    },
+    "previous": "Anterior",
+    "procedural": "Procedural",
+    "qdrant": {
+      "title": "__MISSING__:Qdrant (Vector Store Tier 2)",
+      "description": "__MISSING__:Optional Qdrant integration for scalable semantic search",
+      "enableLabel": "__MISSING__:Enable Qdrant",
+      "enableDesc": "__MISSING__:When enabled, Qdrant is used as the primary vector store",
+      "testConnection": "__MISSING__:Test connection",
+      "testing": "__MISSING__:Testing...",
+      "statusActive": "__MISSING__:Active",
+      "statusError": "__MISSING__:Error",
+      "statusDisabled": "__MISSING__:Disabled",
+      "healthOk": "__MISSING__:Connection OK ({latencyMs}ms)",
+      "healthError": "__MISSING__:Connection error",
+      "saved": "__MISSING__:Settings saved",
+      "saveError": "__MISSING__:Failed to save",
+      "portLabel": "__MISSING__:Port",
+      "embeddingModelLabel": "__MISSING__:Embedding Model",
+      "optional": "__MISSING__:optional",
+      "apiKeyKeepPlaceholder": "__MISSING__:Leave blank to keep current key",
+      "apiKeyOptional": "__MISSING__:Leave blank if not using authentication",
+      "removeApiKey": "__MISSING__:Remove",
+      "quickSelectModel": "__MISSING__:Quick select",
+      "searchTestTitle": "__MISSING__:Semantic search test",
+      "searchPlaceholder": "__MISSING__:Type a test query...",
+      "searching": "__MISSING__:Searching...",
+      "search": "__MISSING__:Search",
+      "cleanupTitle": "__MISSING__:Clean up old points",
+      "cleanupDesc": "__MISSING__:Remove Qdrant points for expired memories (retention period).",
+      "cleaning": "__MISSING__:Cleaning...",
+      "cleanNow": "__MISSING__:Clean now",
+      "cleanupSuccess": "__MISSING__:{count} point(s) removed",
+      "cleanupFailed": "__MISSING__:Cleanup failed"
+    },
+    "rerank": {
+      "enableLabel": "__MISSING__:Enable Rerank",
+      "enableDesc": "__MISSING__:Reorders results with a reranking model after search",
+      "warning": "__MISSING__:Rerank adds +200-500ms latency and additional cost per request. Use sparingly.",
+      "providerModelLabel": "__MISSING__:Rerank Provider / Model",
+      "noProviderWithKey": "__MISSING__:No provider with configured API key. Configure a provider to use rerank.",
+      "selectProviderModel": "__MISSING__:Select a provider/model"
+    },
+    "save": "Salvați",
+    "saving": "__MISSING__:Saving...",
+    "search": "Search memories...",
+    "semantic": "Semantic",
+    "summarize": {
+      "title": "__MISSING__:Compact old memories",
+      "noCandidates": "__MISSING__:No memories eligible for compaction (criteria: >30 days old).",
+      "candidatesDesc": "__MISSING__:{count} memories will be compacted into summaries. This action cannot be undone.",
+      "confirm": "__MISSING__:Compact now"
+    },
+    "tabs": {
+      "memories": "__MISSING__:Memories",
+      "playground": "__MISSING__:Playground",
+      "engine": "__MISSING__:Engine"
+    },
+    "title": "Memory Management",
+    "tokensUsed": "Tokens Used",
+    "tooltip": {
+      "totalEntries": "__MISSING__:Total memories stored for this API key",
+      "tokensUsed": "__MISSING__:Estimated total tokens occupied by active memories",
+      "hitRate": "__MISSING__:Read-by-ID cache hit rate (not semantic recall accuracy)",
+      "factual": "__MISSING__:Objective, permanent facts from user context",
+      "episodic": "__MISSING__:Events and experiences from conversation history",
+      "procedural": "__MISSING__:Procedures, workflows, and instructions the assistant should follow",
+      "semantic": "__MISSING__:Concepts, preferences, and domain knowledge"
+    },
+    "totalEntries": "Total Entries",
+    "type": "Type",
+    "memoryEnabled": "__MISSING__:Memory enabled"
   },
   "skills": {
     "title": "Skills",
@@ -3544,6 +3800,14 @@
     "export": "Export",
     "exporting": "Exporting...",
     "exportFailed": "Export failed",
+    "cleanHistoryButton": "__MISSING__:Clean history",
+    "cleanHistoryTitle": "__MISSING__:Clean log history?",
+    "cleanHistoryMessage": "__MISSING__:This permanently clears all request log rows, legacy detail rows, and local artifact files under DATA_DIR/call_logs. The live page will refresh after cleanup.",
+    "cleanHistoryConfirm": "__MISSING__:Clean history",
+    "cleanHistoryCancel": "__MISSING__:Cancel",
+    "cleanHistorySuccess": "__MISSING__:Cleaned {deleted} log entries, {deletedArtifacts} artifacts, and {deletedDetailedLogs} legacy detail rows.",
+    "cleanHistoryEmpty": "__MISSING__:No request log history was found.",
+    "cleanHistoryFailed": "__MISSING__:Failed to clean log history.",
     "timeRange": "Time Range",
     "lastNHours": "Last {hours}",
     "defaultRange": "default",
@@ -3551,10 +3815,14 @@
       "fetchFailed": "Failed to fetch logs",
       "copyFailed": "Failed to copy log entry",
       "copyLogEntry": "Copy log entry"
-    }
+    },
+    "compressionLogTitle": "__MISSING__:Compression Log",
+    "compressionLogEmpty": "__MISSING__:No compressed requests yet. Compression stats will appear here when requests are processed with compression enabled.",
+    "tokens": "__MISSING__:tokens"
   },
   "onboarding": {
     "welcome": "Bun venit",
+    "tiers": "__MISSING__:Tiers",
     "security": "Securitate",
     "test": "Testează",
     "ready": "Gata!",
@@ -3616,6 +3884,7 @@
   },
   "providers": {
     "title": "Furnizorii",
+    "Account Deactivated": "__MISSING__:Account Deactivated",
     "allProviders": "Toți Furnizorii",
     "audioProviders": "Furnizori audio",
     "showFreeOnly": "Numai gratuit",
@@ -3623,6 +3892,33 @@
     "addFirstProvider": "Adăugați primul dvs. furnizor",
     "addFirstProviderDesc": "Conectați un furnizor AI pentru a începe să direcționați cererile prin OmniRoute. Puteți folosi furnizori gratuiti, chei API sau conturi OAuth.",
     "learnMore": "Aflați mai multe",
+    "adaptaTutorial": {
+      "title": "__MISSING__:How to connect Adapta Web",
+      "introPrefix": "__MISSING__:Adapta authenticates through Clerk. The token",
+      "introSuffix": "__MISSING__:is a long-lived JWT that lets OmniRoute refresh sessions automatically.",
+      "or": "__MISSING__:or",
+      "step1Title": "__MISSING__:Open Adapta chat",
+      "step1DescPrefix": "__MISSING__:Open",
+      "step1DescSuffix": "__MISSING__:and sign in with your Gold or Business account.",
+      "step2Title": "__MISSING__:Open DevTools",
+      "step2DescPrefix": "__MISSING__:Press",
+      "step2DescSuffix": "__MISSING__:to open Developer Tools.",
+      "step3Title": "__MISSING__:Go to Application → Cookies",
+      "step3DescPrefix": "__MISSING__:In the",
+      "step3DescMiddle": "__MISSING__:expand",
+      "step3DescSuffix": "__MISSING__:and click",
+      "step4Title": "__MISSING__:Copy the cookie value for",
+      "step4DescPrefix": "__MISSING__:Find the cookie named",
+      "step4DescMiddle": "__MISSING__:in the list. Click it and copy the content from the",
+      "step4DescSuffix": "__MISSING__:column. It starts with",
+      "step5Title": "__MISSING__:Paste it here and save",
+      "step5DescPrefix": "__MISSING__:Click",
+      "step5DescMiddle": "__MISSING__:paste the",
+      "step5DescSuffix": "__MISSING__:value into the API Key field, then save. OmniRoute will refresh the session automatically.",
+      "tipLabel": "__MISSING__:Tip:",
+      "tipPrefix": "__MISSING__:The",
+      "tipSuffix": "__MISSING__:cookie is long-lived, usually for months. You only need to renew it if you sign out or Adapta invalidates the session."
+    },
     "editProvider": "Editați furnizorul",
     "deleteProvider": "Ștergeți furnizorul",
     "noProviders": "Nu au fost configurați furnizori",
@@ -3648,13 +3944,38 @@
     "apiKeyProviders": "Furnizori de chei API",
     "compatibleProviders": "Furnizori compatibili cu cheile API",
     "testAll": "Testează toate",
+    "distributeProxies": "__MISSING__:Distribute Proxies",
+    "distributing": "__MISSING__:Distributing...",
+    "selectedCount": "__MISSING__:{count, plural, one {# selected} other {# selected}}",
+    "accountsCount": "__MISSING__:{count, plural, one {# account} other {# accounts}}",
     "testAllOAuth": "Testați toate conexiunile OAuth",
     "testAllFree": "Testați toate conexiunile gratuite",
     "testAllApiKey": "Testați toate conexiunile API Key",
     "testAllCompatible": "Testați toate conexiunile compatibile",
+    "testAllModels": "__MISSING__:Test all models",
+    "testAllModelsConfirm": "__MISSING__:Test all visible models? Failed models will be hidden if auto-hide is enabled.",
+    "testingAllModels": "__MISSING__:Testing {done}/{total}...",
+    "testAllResults": "__MISSING__:{ok} of {total} models working",
+    "noModelsToTest": "__MISSING__:No models match the current filter",
+    "showAllModels": "__MISSING__:All",
+    "showVisibleOnly": "__MISSING__:Visible only",
+    "freeFilterAll": "__MISSING__:All",
+    "freeFilterFreeOnly": "__MISSING__:Free only",
+    "freeFilterPaidOnly": "__MISSING__:Paid only",
+    "sortFreeFirst": "__MISSING__:Free first",
+    "showHiddenOnly": "__MISSING__:Hidden only",
+    "filterByVisibility": "__MISSING__:Filter by visibility",
+    "autoHideFailed": "__MISSING__:Auto-hide failed models",
+    "autoHideFailedHint": "__MISSING__:When enabled, Test all hides non-transient failures from public catalogs such as /v1/models. Single-model tests never auto-hide.",
     "connected": "{count} Conectat",
     "errorCount": "{count} Eroare ({code})",
     "errorCountNoCode": "{count} Eroare",
+    "testAllCompleted": "__MISSING__:Tested {total} models: {ok} OK, {failed} failed",
+    "modelAutoHidden": "__MISSING__:Model {model} auto-hidden (test failed)",
+    "filterAll": "__MISSING__:All",
+    "filterVisible": "__MISSING__:Visible only",
+    "filterHidden": "__MISSING__:Hidden only",
+    "modelsHiddenCount": "__MISSING__:{count} hidden",
     "warningCount": "{count} Avertisment",
     "noConnections": "Fără conexiuni",
     "expiredBadge": "Expired",
@@ -3764,7 +4085,16 @@
     "batchUpdateNone": "__MISSING__:No connections were updated (they may no longer exist)",
     "batchRetestLimit": "__MISSING__:Retest up to {max} connections at a time",
     "noConnectionsToTest": "__MISSING__:No matching connections to test",
+    "batchDeleteConfirmTitle": "__MISSING__:Delete connections",
+    "batchDeleteConfirmButton": "__MISSING__:Delete",
+    "filterActive": "__MISSING__:Active",
+    "filterError": "__MISSING__:Error",
+    "filterBanned": "__MISSING__:Banned",
+    "filterCreditsExhausted": "__MISSING__:Credits Exhausted",
+    "noFilteredConnections": "__MISSING__:No connections match the current filter.",
     "failedSetAlias": "Nu s-a putut seta aliasul",
+    "setAliasSuccess": "__MISSING__:Alias {alias} set",
+    "deleteAliasSuccess": "__MISSING__:Alias {alias} deleted",
     "failedSaveConnection": "Nu s-a putut salva conexiunea",
     "failedSaveConnectionRetry": "Nu s-a putut salva conexiunea. Vă rugăm să încercați din nou.",
     "failedRetestConnection": "Nu s-a retestat conexiunea",
@@ -3798,6 +4128,9 @@
     "connectionCount": "{count} conexiuni",
     "fetchingModels": "Se preiau modelele disponibile...",
     "failedFetchModels": "Nu s-au putut prelua modelele",
+    "noFreeModelsFound": "__MISSING__:No free models found for this provider — nothing imported.",
+    "fetchModelsSuccess": "__MISSING__:Found {count} new models",
+    "fetchModelsFailed": "__MISSING__:Could not auto-fetch models (you can retry from settings)",
     "noModelsFound": "Nu s-au găsit modele",
     "importFailed": "Importul nu a reușit",
     "noNewModelsAdded": "Nu au fost adăugate modele noi.",
@@ -3806,6 +4139,10 @@
     "importingModelsTitle": "Importul modelelor",
     "copyModel": "Copiați modelul",
     "filterModels": "Filtrează modelele…",
+    "testAllRateLimited": "__MISSING__:Rate limit reached, stopped early",
+    "hideFailedAuto": "__MISSING__:Auto-hide failed models",
+    "selectAllModels": "Select all",
+    "hideAllModels": "__MISSING__:Hide all",
     "modelsActive": "active",
     "showModel": "Afișează modelul",
     "hideModel": "Ascunde modelul",
@@ -3814,6 +4151,9 @@
     "rateLimitUnprotected": "Neprotejat",
     "enableRateLimitProtection": "Faceți clic pentru a activa protecția limitei ratei",
     "disableRateLimitProtection": "Faceți clic pentru a dezactiva protecția limitei ratei",
+    "testAllProgress": "__MISSING__:Tested {done}/{total}",
+    "testAllFailedHidden": "__MISSING__:{count} failed models hidden",
+    "testAllDone": "__MISSING__:All models tested",
     "productionKey": "Cheia de producție",
     "enterNewApiKey": "Introduceți o nouă cheie API",
     "codexApplyModalTitle": "Aplicați la Codex local",
@@ -3889,10 +4229,20 @@
     "errorTypeNetworkError": "Eroare de rețea",
     "errorTypeTestUnsupported": "Testul nu este acceptat",
     "errorTypeUpstreamError": "Eroare în amonte",
+    "errorTypeCreditsExhausted": "__MISSING__:No credits",
+    "errorTypeBanned": "__MISSING__:403 Banned",
     "proxySourceGlobal": "Global",
     "proxySourceProvider": "Furnizor",
     "proxySourceKey": "cheie",
     "proxyConfiguredBySource": "Proxy ({source}): {host}",
+    "proxyOn": "__MISSING__:Proxy On",
+    "proxyOff": "__MISSING__:Direct (bypass proxy)",
+    "proxyEnabledTitle": "__MISSING__:Proxy is enabled for this connection",
+    "proxyDisabledTitle": "__MISSING__:Direct connection — bypasses every proxy (including the global proxy) for this connection",
+    "perKeyProxyOn": "__MISSING__:Per-key",
+    "perKeyProxyOff": "__MISSING__:Connection",
+    "perKeyProxyEnabledTitle": "__MISSING__:Per-key proxy assignment enabled for this provider",
+    "perKeyProxyDisabledTitle": "__MISSING__:Per-key proxy assignment disabled for this provider",
     "autoPriority": "Auto: {priority}",
     "proxy": "Proxy",
     "retestAuthentication": "Retestați autentificarea",
@@ -3920,6 +4270,12 @@
     "compatProtocolOpenAI": "OpenAI Chat Completions",
     "compatProtocolOpenAIResponses": "OpenAI Responses API",
     "compatProtocolClaude": "Anthropic Messages",
+    "targetFormatLabel": "__MISSING__:Target Format",
+    "targetFormatHint": "__MISSING__:Override the upstream wire format. Use 'Anthropic Messages' to route OpenAI-compatible providers (e.g. opencode-go) through the /v1/messages endpoint.",
+    "targetFormatAuto": "__MISSING__:Default (auto)",
+    "targetFormatGemini": "__MISSING__:Gemini",
+    "targetFormatGeminiCli": "__MISSING__:Gemini CLI",
+    "targetFormatAntigravity": "__MISSING__:Antigravity",
     "compatUpstreamHeadersLabel": "Extra upstream headers",
     "compatUpstreamHeadersHint": "High-privilege setting — same trust level as editing provider API credentials; only trusted admins should use it. Merged after OmniRoute adds auth from the provider API key. If a custom header uses the same name as an existing one (e.g. Authorization), your value fully replaces the auto-generated header (including the Bearer token) — the upstream only sees what you typed, not the key from settings. Misconfiguration can cause 401 or broken upstream auth. One row per header (e.g. extra Authentication for some gateways). Hover or focus the value to preview. Saves on blur, outside click, or closing this panel.",
     "compatUpstreamHeaderName": "Header name",
@@ -3929,6 +4285,8 @@
     "compatBadgeUpstreamHeaders": "Headers",
     "perModelQuotaLabel": "Per Model Quota Label",
     "perModelQuotaDescription": "Per Model Quota Description",
+    "importFreeModelsOnlyLabel": "__MISSING__:Import only free models",
+    "importFreeModelsOnlyHint": "__MISSING__:When enabled, only this provider's free models are imported. Paid models are skipped.",
     "perModelQuotaToggle": "Comutare cotă per model",
     "modelId": "ID model",
     "customModelPlaceholder": "de ex. gpt-4.5-turbo",
@@ -3964,7 +4322,6 @@
     "email": "E-mail",
     "healthCheckMinutes": "Verificare de sănătate (min)",
     "healthCheckHint": "Interval proactiv de reîmprospătare a simbolului. 0 = dezactivat.",
-    "selectAllModels": "Select all",
     "deselectAllModels": "Deselect all",
     "modelsActiveCount": "{active}/{total} active",
     "noModelsMatch": "No models match \"{filter}\"",
@@ -3976,6 +4333,9 @@
     "editCompatibleTitle": "Editați {type} Compatibil",
     "compatibleBaseUrlHint": "Root URL of your {type}-compatible API. Use Advanced Settings for custom endpoint paths.",
     "apiKeyForCheck": "Cheie API (pentru verificare)",
+    "testModelIdLabel": "__MISSING__:Model ID (optional)",
+    "testModelIdPlaceholder": "__MISSING__:e.g. my-model-id",
+    "testModelIdHint": "__MISSING__:If the provider lacks a /models endpoint, enter a model ID to validate via /chat/completions instead.",
     "compatibleProdPlaceholder": "{type} Compatibil (Prod)",
     "tokenRefreshed": "Token refreshed successfully",
     "tokenRefreshFailed": "Token refresh failed",
@@ -4069,6 +4429,19 @@
     "codexAuthApplyFailed": "Failed to apply Codex auth.json locally",
     "codexAuthExported": "Codex auth.json exported",
     "codexAuthExportFailed": "Failed to export Codex auth.json",
+    "codexCliGuideButton": "__MISSING__:Codex CLI Guide",
+    "codexCliGuideTitle": "__MISSING__:Codex CLI Guide",
+    "codexCliGuideLoading": "__MISSING__:Loading guide...",
+    "codexCliGuideLoadFailed": "__MISSING__:Could not load the guide.",
+    "codexExternalLinkButton": "__MISSING__:External Codex link",
+    "codexExternalLinkModalTitle": "__MISSING__:External Codex link",
+    "codexExternalLinkModalDescription": "__MISSING__:Share this single-use link with the person who will authenticate the Codex account. They open it in their own browser, complete the OpenAI login, and the connection is registered here. The link expires in 15 minutes.",
+    "codexExternalLinkGenerating": "__MISSING__:Generating link...",
+    "codexExternalLinkWaiting": "__MISSING__:Waiting for browser authentication. This window refreshes automatically.",
+    "codexExternalLinkCreateFailed": "__MISSING__:Failed to generate the link.",
+    "codexExternalLinkNetworkError": "__MISSING__:Could not contact the server.",
+    "codexExternalLinkConnected": "__MISSING__:Codex account connected through the external link.",
+    "codexExternalLinkExpired": "__MISSING__:The link expired before completion.",
     "importCodexAuth": "Autentificare import",
     "codexImportModalTitle": "Import Codex Auth",
     "codexImportTabSingle": "singur",
@@ -4146,6 +4519,8 @@
     "t3ChatWebCookiePlaceholder": "convex-session-id=abc123...",
     "blockClaudeExtraUsageDescription": "Block Claude Extra Usage Description",
     "blockClaudeExtraUsageLabel": "Block Claude Extra Usage Label",
+    "disableCoolingDescription": "__MISSING__:Skip the transient cooldown so this connection stays eligible even after recoverable errors (terminal states like banned/expired still apply).",
+    "disableCoolingLabel": "__MISSING__:Disable cooldown for this connection",
     "bulkPasteAdded": "{count, plural, one {1 key added} other {# keys added}}",
     "bulkPasteDuplicatesIgnored": "{count, plural, one {1 duplicate skipped} other {# duplicates skipped}}",
     "bulkPasteHint": "Paste one API key per line. Empty lines are ignored and duplicate keys are skipped.",
@@ -4243,6 +4618,17 @@
     "personalAccessTokenLabel": "Personal Access Token Label",
     "qoderPatHint": "Qoder Pat Hint",
     "qoderPatPlaceholder": "Qoder Pat Placeholder",
+    "rateLimitOverridesSection": "__MISSING__:Rate Limit Overrides",
+    "rateLimitOverridesMaxConcurrentHint": "__MISSING__:Max concurrent requests override for this connection. Overrides the account-level cap.",
+    "rateLimitOverridesMaxConcurrentLabel": "__MISSING__:Max Concurrent (Rate Limit)",
+    "rateLimitOverridesMinTimeHint": "__MISSING__:Minimum time (ms) between requests. Overrides the default rate limiter delay.",
+    "rateLimitOverridesMinTimeLabel": "__MISSING__:Min Interval (ms)",
+    "rateLimitOverridesRpmHint": "__MISSING__:Max requests per minute for this connection. Overrides the provider default.",
+    "rateLimitOverridesRpmLabel": "__MISSING__:RPM (Requests/min)",
+    "rateLimitOverridesTpdHint": "__MISSING__:Max tokens per day for this connection. Overrides the provider default.",
+    "rateLimitOverridesTpdLabel": "__MISSING__:TPD (Tokens/day)",
+    "rateLimitOverridesTpmHint": "__MISSING__:Max tokens per minute for this connection. Overrides the provider default.",
+    "rateLimitOverridesTpmLabel": "__MISSING__:TPM (Tokens/min)",
     "refreshOauthTokenTitle": "Refresh Oauth Token Title",
     "regionHint": "Region Hint",
     "regionLabel": "Region Label",
@@ -4257,6 +4643,7 @@
     "searchProvider": "Search Provider",
     "searchProviderDesc": "Search Provider Desc",
     "searchProviders": "Căutați furnizori...",
+    "searchByModel": "__MISSING__:Search by model…",
     "searchProvidersHeading": "Search Providers Heading",
     "searxngBaseUrlHint": "Searxng Base Url Hint",
     "searxngInfo": "Searxng Info",
@@ -4422,7 +4809,21 @@
     "webNoAuthGuideBody": "{provider} nu are nevoie de o cheie API sau cookie. Salvați conexiunea pentru a utiliza punctul final web gratuit.",
     "webSessionCredentialValidationFailed": "Validarea acreditărilor de sesiune a eșuat. Conectați-vă din nou, copiați o nouă acreditare și încercați din nou.",
     "checkCookie": "Verificați cookie-ul",
-    "checkWebToken": "Verificați jetonul"
+    "checkWebToken": "Verificați jetonul",
+    "huggingchatLabel": "__MISSING__:HuggingChat (Free)",
+    "huggingchatDesc": "__MISSING__:Free LLM chat via huggingface.co/chat",
+    "phindLabel": "__MISSING__:Phind (Free)",
+    "phindDesc": "__MISSING__:Free dev-focused AI chat",
+    "poeWebLabel": "__MISSING__:Poe Web",
+    "poeWebDesc": "__MISSING__:Multi-model chat via poe.com",
+    "veniceWebLabel": "__MISSING__:Venice Web",
+    "veniceWebDesc": "__MISSING__:Privacy-focused AI chat",
+    "v0VercelWebLabel": "__MISSING__:v0 Vercel Web",
+    "v0VercelWebDesc": "__MISSING__:AI code generation via v0.dev",
+    "kimiWebLabel": "__MISSING__:Kimi Web",
+    "kimiWebDesc": "__MISSING__:Chinese market AI chat via kimi.moonshot.cn",
+    "doubaoWebLabel": "__MISSING__:Doubao Web",
+    "doubaoWebDesc": "__MISSING__:ByteDance AI chat via doubao.com"
   },
   "settings": {
     "title": "Setări",
@@ -4528,6 +4929,7 @@
     "memoryDesc": "Persistent cross-session conversational memory",
     "memoryEnabled": "Enable Memory",
     "memoryEnabledDesc": "When enabled, OmniRoute will inject relevant past context.",
+    "memoryTokenCostWarning": "__MISSING__:Heads up: with memory enabled, OmniRoute injects up to {tokens} tokens of retrieved context into every chat request — this increases token usage and cost. To skip injection for a specific request, send the \"x-omniroute-no-memory: true\" header.",
     "maxTokens": "Max Tokens",
     "retentionDays": "Retention",
     "recent": "Recent",
@@ -4566,6 +4968,15 @@
     "modelsDevInfoOrder": "User Override → models.dev → LiteLLM → Hardcoded Default",
     "systemTheme": "Tema sistemului",
     "debugToggle": "Enable Debug Mode",
+    "homePinProviderQuotaToHome": "Pin Information to Home Page",
+    "homeProviderQuotaLimits": "Provider Quota Limits",
+    "homeProviderQuotaLimitsDesc": "Pin the Provider Quota status container (with Refresh All button) to the top of the Home page.",
+    "homeQuickStart": "Quick Start",
+    "homeQuickStartDesc": "Show the Quick Start panel on the Home page.",
+    "homeProviderTopology": "Provider Topology",
+    "homeProviderTopologyDesc": "Show the Provider Topology on the Home page.",
+    "accountEmailVisibility": "__MISSING__:Account email visibility",
+    "accountEmailVisibilityDesc": "__MISSING__:Show full account emails across providers, combos, logs, quota, and playground screens. Turn this off to mask them by default.",
     "sidebarVisibilityToggle": "Show Sidebar Items",
     "enableCache": "Activați memoria cache",
     "cacheTTL": "Cache TTL",
@@ -4599,11 +5010,17 @@
     "autoDisableDescription": "Permanently mark provider connections as deactivated if they return specific terminal ban signals (e.g. HTTP 403 'verify your account'). This removes them from the combo rotation.",
     "autoDisableThreshold": "Ban Threshold",
     "autoDisableThresholdDesc": "Consecutive ban signals required before permanent deactivation.",
+    "customBannedSignals": "__MISSING__:Banned Keywords",
+    "customBannedSignalsDesc": "__MISSING__:Additional keywords that trigger permanent account ban detection. Built-in keywords always apply.",
+    "customBannedSignalsPlaceholder": "__MISSING__:e.g. api key revoked",
+    "noCustomBannedSignals": "__MISSING__:No custom keywords. Only built-in keywords are active.",
     "resilienceStructureTitle": "Resilience Structure",
     "resilienceStructureDesc": "Această pagină configurează doar comportamentul. Starea de întrerupere live este afișată pe pagina Sănătate. Reîncercarea specifică combo-ului și controlul slotului round-robin rămân în setările combo.",
     "enableThinking": "Activați gândirea",
     "maxThinkingTokens": "Max Thinking Tokens",
     "enableProxy": "Activați proxy",
+    "perKeyProxyEnabled": "__MISSING__:Enable per-key proxy assignment",
+    "perKeyProxyEnabledDesc": "__MISSING__:When enabled, each provider connection can use its own proxy assignment",
     "proxyUrl": "Adresa URL proxy",
     "pricingRates": "Formatul tarifelor de preț",
     "currentPricing": "Prezentare generală a prețurilor actuale",
@@ -4683,6 +5100,13 @@
     "globalProxy": "Proxy global",
     "globalProxyDesc": "Configurați un proxy global de ieșire pentru toate apelurile API. Furnizorii individuali, combo-urile și cheile pot suprascrie acest lucru.",
     "noGlobalProxy": "Nu a fost configurat niciun proxy global",
+    "proxyPool": "__MISSING__:Proxy Pool",
+    "freePool": "__MISSING__:Free Pool",
+    "proxyDocumentation": "__MISSING__:Proxy Documentation",
+    "proxyGlobalConfigTab": "__MISSING__:Global Config",
+    "proxyPoolTab": "__MISSING__:Proxy Pool",
+    "freePoolTab": "__MISSING__:Free Pool",
+    "proxyDocumentationTab": "__MISSING__:Documentation",
     "bulkHealthcheck": "Bulk Healthcheck",
     "bulkHealthcheckDesc": "Test all configured proxies against a target URL to find which ones work.",
     "healthcheckTesting": "Testing...",
@@ -4695,6 +5119,51 @@
     "healthcheckStatus": "Status",
     "healthcheckProxyUrl": "Proxy URL",
     "healthcheckLatency": "Latency",
+    "proxyDocumentationScopeTitle": "__MISSING__:Proxy scope resolution",
+    "proxyDocumentationScopeDescBefore": "__MISSING__:OmniRoute resolves the outbound proxy in priority order: ",
+    "proxyDocumentationScopeOrder": "__MISSING__:combo → account → provider → global",
+    "proxyDocumentationScopeDescAfter": "__MISSING__:. The most specific scope wins.",
+    "proxyDocumentationAddTitle": "__MISSING__:Adding a custom proxy",
+    "proxyDocumentationAddDescBefore": "__MISSING__:Go to the ",
+    "proxyDocumentationAddDescMiddle": "__MISSING__: tab → click ",
+    "proxyDocumentationAddCta": "__MISSING__:+ Add proxy",
+    "proxyDocumentationAddDescAfter": "__MISSING__:. Fill in type (http/https/socks5), host, and port. Optionally assign it to a scope.",
+    "proxyDocumentationBulkTitle": "__MISSING__:Bulk import format",
+    "proxyDocumentationBulkDesc": "__MISSING__:Pipe-delimited fields:",
+    "proxyDocumentationSocks5DescBefore": "__MISSING__:SOCKS5 proxies are disabled by default. Set",
+    "proxyDocumentationFreePoolDesc": "__MISSING__:The Free Pool tab aggregates proxies from 1proxy, Proxifly, and IPLocate. Use ⊕ to test and promote a proxy to your registry. Only proxies that pass the connectivity test are added.",
+    "proxyDocumentationVercelRelayDescBefore": "__MISSING__:The Vercel Relay is an outbound edge relay — not an inbound tunnel. Deploying one sends LLM API calls through Vercel's dynamic IPs, bypassing datacenter geo-blocks and rate limits. The relay is protected by a generated secret header",
+    "proxyDocumentationVercelRelayDescAfter": "__MISSING__:Your Vercel token is used only during deploy and is never stored.",
+    "vercelRelayTokenRequired": "__MISSING__:Token is required",
+    "vercelRelayDeployFailed": "__MISSING__:Deploy failed",
+    "vercelRelayTokenHint": "__MISSING__:Token is used only during deploy — never stored.",
+    "denoRelayTokenRequired": "__MISSING__:Deno Deploy token is required",
+    "denoRelayOrgDomainRequired": "__MISSING__:Organization domain is required",
+    "denoRelayDeployFailed": "__MISSING__:Deno Deploy failed",
+    "denoRelayTokenHint": "__MISSING__:Organization token (prefix ddo_) from console.deno.com → Organization → Settings → Organization Tokens. Used once for deploy and never stored.",
+    "denoRelayOrgDomainHint": "__MISSING__:Your Deno Deploy organization's default domain (e.g. acme.deno.net). The relay will be reachable at https://<app-name>.<org-slug>.deno.net.",
+    "proxyFreePoolFilterProtocol": "__MISSING__:Filter by protocol",
+    "proxyFreePoolProtocol": "__MISSING__:Protocol",
+    "proxyFreePoolCountryPlaceholder": "__MISSING__:Country (e.g. US)",
+    "proxyFreePoolFilterCountry": "__MISSING__:Filter by country",
+    "proxyFreePoolMinQualityPlaceholder": "__MISSING__:Min quality",
+    "proxyFreePoolMinQualityLabel": "__MISSING__:Minimum quality score",
+    "proxyFreePoolSyncAll": "__MISSING__:Sync All",
+    "proxyFreePoolTotal": "__MISSING__:Total",
+    "proxyFreePoolInPool": "__MISSING__:In pool",
+    "proxyFreePoolAvgQuality": "__MISSING__:Avg quality",
+    "proxyFreePoolSelected": "__MISSING__:{count} selected",
+    "proxyFreePoolAddSelected": "__MISSING__:Add selected to pool",
+    "proxyFreePoolAddVisible": "__MISSING__:Add all visible to pool",
+    "proxyFreePoolSource": "__MISSING__:Source",
+    "proxyFreePoolHostPort": "__MISSING__:Host:Port",
+    "proxyFreePoolType": "__MISSING__:Type",
+    "proxyFreePoolCountry": "__MISSING__:Country",
+    "proxyFreePoolQuality": "__MISSING__:Quality",
+    "proxyFreePoolLatency": "__MISSING__:Latency",
+    "proxyFreePoolEmpty": "__MISSING__:No proxies found. Click Sync All to fetch from sources.",
+    "close": "__MISSING__:Close",
+    "cancel": "__MISSING__:Cancel",
     "globalLabel": "Global",
     "configure": "Configurați",
     "globalSystemPrompt": "Global System Prompt",
@@ -4951,6 +5420,7 @@
     "systemStorage": "Sistem și stocare",
     "allDataLocal": "Toate datele stocate local pe aparatul dvs",
     "databasePath": "Calea bazei de date",
+    "export": "__MISSING__:Export",
     "exportDatabase": "Exportați baza de date",
     "exportAll": "Exportați toate (.tar.gz)",
     "importDatabase": "Importă baza de date",
@@ -5038,6 +5508,11 @@
     "adaptiveVolumeRoutingDesc": "Scale connections dynamically based on payload volume and throughput pressure.",
     "lkgpToggleTitle": "Last Known Good Provider (LKGP)",
     "lkgpToggleDesc": "When enabled, the router remembers which provider last served a successful response and tries it first on subsequent requests.",
+    "echoRequestedModelTitle": "__MISSING__:Echo requested model name in responses",
+    "echoRequestedModelDesc": "__MISSING__:When enabled, the response `model` field echoes the alias or combo name the client requested instead of the upstream model name. Fixes strict clients (e.g. Claude Desktop) that reject a response whose model does not match the request.",
+    "webSearchRouteTitle": "__MISSING__:Web search routing",
+    "webSearchRouteDesc": "__MISSING__:When a request includes a native web_search tool, route the whole request to this model instead of the default — useful for providers that don't implement Anthropic's web_search server tool. Leave blank to disable.",
+    "webSearchRoutePlaceholder": "__MISSING__:e.g. openrouter,anthropic/claude-3.5-sonnet",
     "clearLkgpCache": "Clear LKGP Cache",
     "lkgpCacheCleared": "LKGP cache cleared successfully",
     "lkgpCacheClearFailed": "Failed to clear LKGP cache",
@@ -5102,6 +5577,16 @@
     "clearSyncedPricing": "Clear Synced Pricing",
     "compressionTitle": "Prompt Compression",
     "compressionDesc": "Reduce token usage by compressing prompts before sending to providers",
+    "tokenSaverTitle": "__MISSING__:Token Saver",
+    "tokenSaverSubtitle": "__MISSING__:Spend fewer tokens on every request.",
+    "tokenSaverToolOutput": "__MISSING__:Tool output",
+    "tokenSaverToolOutputDesc": "__MISSING__:Clean git, grep, ls, tree, and log output before it reaches the provider.",
+    "tokenSaverLlmOutput": "__MISSING__:LLM output",
+    "tokenSaverLlmOutputDesc": "__MISSING__:Inject terse response instructions without rewriting provider output.",
+    "tokenSaverInputCompression": "__MISSING__:Input compression",
+    "tokenSaverInputCompressionDesc": "__MISSING__:Rewrite eligible chat history while preserving code, URLs, and intent.",
+    "tokenSaverFineTunePrefix": "__MISSING__:Fine-tune each engine on",
+    "tokenSaverFineTuneSuffix": "__MISSING__:or combine engines per request on",
     "compressionMode": "Compression Mode",
     "compressionModeOff": "Off",
     "compressionModeOffDesc": "No compression applied",
@@ -5121,6 +5606,11 @@
     "compressionUltraMinScore": "Pragul minim de scor",
     "compressionUltraSlmFallback": "Revenire la Agresiv",
     "compressionUltraModelPath": "Calea modelului SLM",
+    "compressionUltraEngine": "__MISSING__:Ultra tier",
+    "compressionUltraEngineHeuristic": "__MISSING__:Heuristic (Tier-A, default)",
+    "compressionUltraEngineSlm": "__MISSING__:SLM (LLMLingua-2, opt-in)",
+    "compressionUltraSlmHint": "__MISSING__:SLM downloads a small ONNX model on first use (cold-start) and transparently falls back to the heuristic on timeout or if unavailable.",
+    "compressionUltraSlmPrewarm": "__MISSING__:Pre-warm SLM model on enable",
     "compressionSummarizerEnabled": "Activați Summarizer",
     "compressionMaxTokensPerMessage": "Numărul maxim de jetoane per mesaj",
     "compressionMinSavings": "Pragul minim de economii",
@@ -5308,13 +5798,22 @@
     "resilienceNo": "Nu",
     "resilienceDefault": "Default",
     "storageDatabaseBackupRetention": "Reținerea backupului bazei de date",
+    "storageDatabaseBackups": "__MISSING__:Database backups",
     "storagePurgeData": "Curățați datele",
+    "storagePurgeDataDesc": "__MISSING__:Immediately delete all records without applying retention checks. Use with caution.",
+    "storageRetentionCleanup": "__MISSING__:Retention Settings",
+    "storageRetentionCleanupDesc": "__MISSING__:Configure operational record retention and database backup cleanup.",
+    "retentionCallDays": "__MISSING__:Call {count}d",
+    "retentionAppDays": "__MISSING__:App {count}d",
+    "retentionRows": "__MISSING__:{count} rows",
     "retentionQuotaSnapshots": "Instantanee de cotă (zile)",
+    "retentionCompressionAnalytics": "__MISSING__:Compression Analytics (days)",
     "retentionMcpAudit": "Audit MCP (zile)",
     "retentionA2aEvents": "Evenimente A2A (zile)",
     "retentionCallLogs": "Jurnalele de apeluri (zile)",
     "retentionUsageHistory": "Istoricul utilizării (zile)",
     "retentionMemoryEntries": "Intrări de memorie (zile)",
+    "saveRetentionSettings": "__MISSING__:Save retention settings",
     "storageAutoVacuumMode": "Modul de aspirare automată",
     "storageScheduledVacuum": "Vacuum programat",
     "storageVacuumHour": "Ora de vid (0-23)",
@@ -5328,10 +5827,16 @@
     "storageIntegrityOk": "✓ OK",
     "storageIntegrityError": "✗ Eroare",
     "storageUsageTokenBuffer": "Utilizare Token Buffer",
+    "storageUsageTokenBufferDesc": "__MISSING__:Extra tokens added to reported usage to account for system prompt overhead.",
+    "storageUsageTokenBufferHint": "__MISSING__:Set to 0 to report raw provider token counts. Default: 2000.",
+    "storageUsageTokenBufferCurrent": "__MISSING__:Current: {value}",
     "compressionSettingsAutoTriggerMode": "Modul de declanșare automată",
     "compressionSettingsMcpDescriptionCompression": "Comprimarea descrierii MCP",
+    "mcpAccessibilityTitle": "__MISSING__:MCP accessibility output",
     "compressionSettingsCavemanIntensity": "Intensitatea cavernelor",
     "compressionSettingsCavemanOutputMode": "Modul de ieșire Caveman",
+    "compressionSettingsOutputStyles": "__MISSING__:Output styles",
+    "compressionStylesTileTitle": "__MISSING__:Output styles",
     "compressionSettingsOutputIntensity": "Intensitatea ieșirii",
     "compressionSettingsAutoClarityBypass": "Ocolire automată a clarității",
     "resilienceWaitForCooldown": "Așteptați răcirea",
@@ -5347,6 +5852,9 @@
     "cliproxyapiUrl": "URL CLIProxyAPI",
     "cliproxyapiStatus": "Stare CLIProxyAPI",
     "cliproxyapiNotDetected": "Nedetectat",
+    "cliproxyapiImportAuthTitle": "__MISSING__:Import accounts from CLIProxyAPI",
+    "cliproxyapiImportAuthDesc": "__MISSING__:Import the OAuth accounts CLIProxyAPI already saved in ~/.cli-proxy-api/ as OmniRoute connections, so you don't have to log in to each account again. Supported account types (Gemini, Codex, Claude, Antigravity, Qwen, Kimi) are imported; others are skipped.",
+    "cliproxyapiImportAuthButton": "__MISSING__:Import accounts",
     "payloadRulesTitle": "Reguli de sarcină utilă",
     "payloadRulesDesc": "__MISSING__:Configure request payload mutations by model and protocol. Changes are persisted in settings and hot reloaded into the runtime immediately after save.",
     "payloadRuleDefaultTitle": "__MISSING__:default",
@@ -5379,6 +5887,14 @@
     "maxResponseTokensDesc": "__MISSING__:Maximum total tokens allowed in a single response.",
     "modelCooldownsTitle": "Modele în răcire",
     "modelCooldownsEmpty": "Nu există modele în perioada de răcire în acest moment.",
+    "responsesStateTitle": "__MISSING__:Responses State",
+    "responsesStateDesc": "__MISSING__:Control how OmniRoute forwards previous_response_id.",
+    "responsesStateModeLabel": "__MISSING__:previous_response_id handling",
+    "responsesStateModeAuto": "__MISSING__:Auto",
+    "responsesStateModeStrip": "__MISSING__:Strip",
+    "responsesStateModePreserve": "__MISSING__:Preserve",
+    "responsesStateHint": "__MISSING__:Auto strips previous_response_id unless a connection explicitly enables OpenAI Responses storage. Strip is safest for stateless clients such as VS Code Custom Endpoint; context then depends on the client sending full history.",
+    "responsesStateSaveError": "__MISSING__:Failed to update Responses state setting",
     "codexFastTierTitle": "Codex Fast Tier",
     "codexFastTierDesc": "Injectați global service_tier=priority pentru cererile OpenAI Codex.",
     "codexFastTierHint": "Când este activat, OmniRoute adaugă service_tier=priority la solicitările Codex de ieșire pentru conexiuni care nu specifică deja un nivel. Nivelul prioritar necesită o cheie API OpenAI Enterprise sau calea ChatGPT-auth Codex; alte tipuri de chei vor primi o eroare legată de nivel de la OpenAI. Setările per conexiune de pe pagina furnizorului Codex au prioritate.",
@@ -5485,6 +6001,15 @@
     "resilienceEnableServerWaitDesc": "Când este activat, OmniRoute așteaptă expirarea primei perioade de răcire și reîncearcă automat.",
     "resilienceMaxAttempts": "Încercări maxime",
     "resilienceMaxWaitPerAttempt": "Așteptare maximă pe încercare",
+    "resilienceProviderCooldownTitle": "__MISSING__:Provider Cooldown",
+    "resilienceProviderCooldownScope": "__MISSING__:All combo requests",
+    "resilienceProviderCooldownTrigger": "__MISSING__:When a provider/connection fails",
+    "resilienceProviderCooldownEffect": "__MISSING__:Skips the failed provider for a cooldown period before retrying",
+    "resilienceProviderCooldownDesc": "__MISSING__:Prevents subsequent requests from re-walking the same failing providers. Cooldown scales exponentially with consecutive failures.",
+    "resilienceProviderCooldownEnabled": "__MISSING__:Enable global provider cooldown",
+    "resilienceProviderCooldownEnabledDesc": "__MISSING__:When enabled, failed providers are tracked globally and skipped for a cooldown period.",
+    "resilienceProviderCooldownMin": "__MISSING__:Minimum cooldown",
+    "resilienceProviderCooldownMax": "__MISSING__:Maximum cooldown",
     "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
     "forcedFingerprintBadge": "Required",
     "codexSessionAffinityTitle": "Afinitatea sesiunii Codex",
@@ -5506,13 +6031,45 @@
     "vercelRelayFreeTierNote": "__MISSING__:Relays are lightweight proxy endpoints deployed on Vercel's free tier to bypass local network/region limitations.",
     "vercelRelayDeploying": "__MISSING__:Deploying...",
     "vercelRelayDeploy": "__MISSING__:Deploy",
-    "homePinProviderQuotaToHome": "Pin Information to Home Page",
-    "homeProviderQuotaLimits": "Provider Quota Limits",
-    "homeProviderQuotaLimitsDesc": "Pin the Provider Quota status container (with Refresh All button) to the top of the Home page.",
-    "homeQuickStart": "Quick Start",
-    "homeQuickStartDesc": "Show the Quick Start panel on the Home page.",
-    "homeProviderTopology": "Provider Topology",
-    "homeProviderTopologyDesc": "Show the Provider Topology on the Home page."
+    "deployRelayButton": "__MISSING__:Deploy Relay",
+    "denoRelayButton": "__MISSING__:Deploy Deno Relay",
+    "denoRelayModalTitle": "__MISSING__:Deploy Deno Relay",
+    "denoRelayWarning": "__MISSING__:Warning: A Deno Deploy organization token is required. This token will only be used to create the relay app and will never be stored by OmniRoute.",
+    "denoRelayTokenLabel": "__MISSING__:Deno Deploy Organization Token",
+    "denoRelayOrgDomainLabel": "__MISSING__:Organization Domain",
+    "denoRelayProjectNameLabel": "__MISSING__:Deno App Name",
+    "denoRelayFreeTierNote": "__MISSING__:Deno Deploy v2 runs on a global edge network. Free tier: 1M requests & 100GiB outbound traffic per month, no per-request CPU limits, up to 20 active apps & 50 custom domains.",
+    "denoRelayDeploying": "__MISSING__:Deploying...",
+    "denoRelayDeploy": "__MISSING__:Deploy",
+    "cloudflareRelaySuccess": "__MISSING__:Cloudflare Relay deployed successfully",
+    "cloudflareRelayButton": "__MISSING__:Deploy Cloudflare Relay",
+    "cloudflareRelayModalTitle": "__MISSING__:Deploy Cloudflare Worker Relay",
+    "cloudflareRelayWarning": "__MISSING__:Deploys a Cloudflare Worker that proxies LLM requests through Cloudflare's edge network — masking the host IP behind dynamic Cloudflare addresses. The Worker enforces a one-time auth secret so the public workers.dev URL cannot be reused as an open relay.",
+    "cloudflareRelayTokenHowto": "__MISSING__:Create the API token under My Profile -> API Tokens -> Create Token -> Custom Token -> Account / Workers Scripts / Edit.",
+    "cloudflareRelayAccountIdLabel": "__MISSING__:Cloudflare Account ID",
+    "cloudflareRelayAccountIdHint": "__MISSING__:Found on the right side of the Cloudflare dashboard overview page.",
+    "cloudflareRelayApiTokenLabel": "__MISSING__:Cloudflare API Token",
+    "cloudflareRelayApiTokenHint": "__MISSING__:Requires 'Workers Scripts: Edit' permission. The token is used only at deploy time and is never stored.",
+    "cloudflareRelayProjectNameLabel": "__MISSING__:Worker Name",
+    "cloudflareRelayFreeTierNote": "__MISSING__:Free tier: 100,000 requests/day per Cloudflare account.",
+    "cloudflareRelayDeploying": "__MISSING__:Deploying...",
+    "cloudflareRelayDeploy": "__MISSING__:Deploy",
+    "cloudflareRelayCredsRequired": "__MISSING__:Account ID and API Token are required",
+    "cloudflareRelayDeployFailed": "__MISSING__:Deploy failed",
+    "modelLockout": "__MISSING__:Model Lockout",
+    "modelLockoutPageDescription": "__MISSING__:Configure which HTTP error codes trigger per-model lockout and control the cooldown behavior.",
+    "modelLockoutEnabled": "__MISSING__:Enable Model Lockout",
+    "modelLockoutEnabledDescription": "__MISSING__:When enabled, models that fail with configured error codes are temporarily locked to prevent retry loops.",
+    "modelLockoutErrorCodes": "__MISSING__:Error Codes",
+    "modelLockoutErrorCodesDescription": "__MISSING__:HTTP status codes that trigger model lockout. Type a code and click Add, or select from suggestions.",
+    "modelLockoutBaseCooldown": "__MISSING__:Base Cooldown (ms)",
+    "modelLockoutBaseCooldownDescription": "__MISSING__:Initial cooldown duration in milliseconds before a model can be retried.",
+    "modelLockoutMaxCooldown": "__MISSING__:Max Cooldown (ms)",
+    "modelLockoutMaxCooldownDescription": "__MISSING__:Maximum cooldown duration in milliseconds. Prevents excessively long lockouts.",
+    "modelLockoutExponentialBackoff": "__MISSING__:Exponential Backoff",
+    "modelLockoutExponentialBackoffDescription": "__MISSING__:When enabled, each consecutive failure increases the cooldown duration exponentially.",
+    "modelLockoutMaxBackoffSteps": "__MISSING__:Max Backoff Steps",
+    "modelLockoutMaxBackoffStepsDescription": "__MISSING__:Maximum number of backoff steps before the cooldown stops growing. The Max Cooldown cap is reached first in most configurations, making this a safety ceiling for when Max Cooldown is raised."
   },
   "contextRtk": {
     "title": "RTK Engine",
@@ -5563,7 +6120,21 @@
     "searchFilters": "Filtre de căutare...",
     "tooltipDedup": "Cât de agresiv să elimini liniile repetate.",
     "tooltipMaxChars": "Maxim de caractere pe bloc de ieșire.",
-    "tooltipMaxLines": "Numărul maxim de linii de păstrat de la ieșirea comenzii. Excesul este trunchiat."
+    "tooltipMaxLines": "Numărul maxim de linii de păstrat de la ieșirea comenzii. Excesul este trunchiat.",
+    "learnDiscoverTitle": "__MISSING__:Learn & Discover filters",
+    "learnDiscoverDesc": "__MISSING__:Mine your captured command output (Raw Output retention must be on) to suggest new RTK filters. Suggestions only — you review and save them.",
+    "discoverHeading": "__MISSING__:Discover repeated noise",
+    "discoverButton": "__MISSING__:Scan samples",
+    "discoverScanning": "__MISSING__:Scanning…",
+    "discoverEmpty": "__MISSING__:No repeated noise found. Enable Raw Output retention and run a few commands first.",
+    "discoverSamples": "__MISSING__:{count} sample(s) scanned",
+    "discoverHits": "__MISSING__:{hits}× across samples",
+    "learnHeading": "__MISSING__:Learn a filter for a command",
+    "learnCommandPlaceholder": "__MISSING__:e.g. npm install",
+    "learnButton": "__MISSING__:Suggest filter",
+    "learnEmpty": "__MISSING__:No suggestion yet. Type a command you have run and scan.",
+    "learnSamplesUsed": "__MISSING__:Learned from {count} matching sample(s)",
+    "suggestionError": "__MISSING__:Could not load suggestions. Check management auth and try again."
   },
   "contextCombos": {
     "title": "Compression Combos",
@@ -5853,7 +6424,80 @@
     "routeConnectionLabel": "Conexiune",
     "scenarioVision": "Vedere (înțelegerea imaginii)",
     "scenarioSchemaCoercion": "Coerciție în schemă (ieșire structurată)",
-    "techniques": "Tehnici:"
+    "techniques": "Tehnici:",
+    "friendlyTitle": "__MISSING__:Translator",
+    "friendlySubtitle": "__MISSING__:Use your existing app with any provider — without rewriting code.",
+    "conceptHeadline": "__MISSING__:Your app speaks one API's \"language\". The Translator converts it to use another provider.",
+    "conceptDiagramAppLabel": "__MISSING__:Your app",
+    "conceptDiagramSourceLabel": "__MISSING__:Source format",
+    "conceptDiagramHubLabel": "__MISSING__:OpenAI (hub)",
+    "conceptDiagramTargetLabel": "__MISSING__:Target provider",
+    "conceptDiagramExampleApp": "__MISSING__:e.g. Anthropic SDK",
+    "conceptDiagramExampleSource": "__MISSING__:claude",
+    "conceptDiagramExampleTarget": "__MISSING__:Gemini",
+    "conceptHowItWorksToggle": "__MISSING__:How it works",
+    "conceptHowItWorksBody": "__MISSING__:Your app sends a request in its own format. The Translator detects the format, converts it through OpenAI as an intermediate hub (or directly when a direct translator is available), sends it to the chosen provider, and returns the response converted back to your app's format.",
+    "tabTranslate": "__MISSING__:Translate",
+    "tabMonitor": "__MISSING__:Monitor",
+    "tabTranslateAriaLabel": "__MISSING__:Go to the Translate tab",
+    "tabMonitorAriaLabel": "__MISSING__:Go to the Monitor tab",
+    "simpleAppUsesLabel": "__MISSING__:My app uses",
+    "simpleAppUsesHint": "__MISSING__:The API format your app speaks (e.g. Anthropic SDK = claude).",
+    "simpleSendToLabel": "__MISSING__:Send to",
+    "simpleSendToHint": "__MISSING__:Where to actually send the request (a provider connected in OmniRoute).",
+    "simpleStartWithLabel": "__MISSING__:Start with",
+    "simpleStartWithExamplePlaceholder": "__MISSING__:Select a ready-made example",
+    "simpleStartWithCustomOption": "__MISSING__:Paste your request (advanced)",
+    "simpleModeLabel": "__MISSING__:Mode",
+    "simpleModePreview": "__MISSING__:Preview translation only",
+    "simpleModeSend": "__MISSING__:Send and see response",
+    "simpleAdvancedToggle": "__MISSING__:Advanced",
+    "simpleInputPanelTitle": "__MISSING__:Input",
+    "simpleInputPanelHint": "__MISSING__:Free-text message or ready-made example",
+    "simpleResultPanelTitle": "__MISSING__:Translation + Response",
+    "narratedDetected": "__MISSING__:✓ Detected: {format}",
+    "narratedTranslating": "__MISSING__:Translating to {target}...",
+    "narratedSending": "__MISSING__:Sending to {target}...",
+    "narratedSuccess": "__MISSING__:→ translated to {target} · response in {latency}ms",
+    "narratedError": "__MISSING__:Failed: {reason}",
+    "narratedSeeTranslatedJson": "__MISSING__:see translated JSON",
+    "narratedSeePipeline": "__MISSING__:see pipeline",
+    "advancedSectionTitle": "__MISSING__:Advanced",
+    "advancedSectionSubtitle": "__MISSING__:Raw JSON, pipeline and technical tools. Everything here is the same as the old tabs — just reorganized.",
+    "advancedRawJsonTitle": "__MISSING__:Raw JSON (auto-detect + Monaco)",
+    "advancedRawJsonSubtitle": "__MISSING__:Paste a JSON request; the format is detected automatically.",
+    "advancedPipelineTitle": "__MISSING__:OpenAI intermediate pipeline",
+    "advancedPipelineSubtitle": "__MISSING__:Visualize each translation step (hub-and-spoke).",
+    "advancedStreamTransformTitle": "__MISSING__:Stream Transformer (Chat → Responses SSE)",
+    "advancedStreamTransformSubtitle": "__MISSING__:Converts Chat Completions SSE into Responses API.",
+    "advancedTestBenchTitle": "__MISSING__:Test Bench (8 scenarios)",
+    "advancedTestBenchSubtitle": "__MISSING__:Runs all scenarios and reports pass/fail + compatibility %.",
+    "advancedCompressionTitle": "__MISSING__:Compression Preview",
+    "advancedCompressionSubtitle": "__MISSING__:Estimate token savings across different compression modes.",
+    "monitorOriginHint": "__MISSING__:Events generated by Translate or the main pipeline appear here in real time.",
+    "monitorEmptyCta": "__MISSING__:Go to the Translate tab and send a request — it will appear here.",
+    "monitorOpenTranslateButton": "__MISSING__:Go to Translate",
+    "pipelineStepClientRequest": "__MISSING__:Client Request",
+    "pipelineStepClientRequestDesc": "__MISSING__:Request received in client format",
+    "pipelineStepFormatDetected": "__MISSING__:Format Detected",
+    "pipelineStepFormatDetectedDesc": "__MISSING__:Auto-detected source format",
+    "pipelineStepOpenAIIntermediate": "__MISSING__:OpenAI Intermediate",
+    "pipelineStepOpenAIIntermediateDesc": "__MISSING__:Translated to OpenAI hub format",
+    "pipelineStepProviderFormat": "__MISSING__:Provider Format",
+    "pipelineStepProviderFormatDesc": "__MISSING__:Translated to provider target format",
+    "pipelineStepProviderResponse": "__MISSING__:Provider Response",
+    "pipelineStepProviderResponseDesc": "__MISSING__:Streaming response from provider",
+    "conceptDiagramArrow1": "__MISSING__:speaks",
+    "conceptDiagramArrow2": "__MISSING__:translates",
+    "conceptDiagramArrow3": "__MISSING__:converts",
+    "conceptDiagramExampleHub": "__MISSING__:OpenAI",
+    "conceptDiagramHubTooltip": "__MISSING__:Intermediate hub used by the translator to convert between formats that don't have a direct mapping.",
+    "conceptDiagramSourceTooltip": "__MISSING__:The API format your app speaks (e.g., Anthropic SDK = claude).",
+    "conceptDiagramTargetTooltip": "__MISSING__:The provider where the request will actually be sent.",
+    "compressionEmptyHint": "__MISSING__:Fill in the input field on the Translate tab (Simple Controls or Raw JSON) to enable the preview.",
+    "compressionModeLabel": "__MISSING__:Compression mode",
+    "compressionPreviewButton": "__MISSING__:Preview Compression",
+    "compressionPreviewing": "__MISSING__:Previewing…"
   },
   "usage": {
     "title": "Utilizare",
@@ -6010,6 +6654,8 @@
     "notApplicable": "N/A",
     "rawPlanWithValue": "Plan brut: {plan}",
     "noPlanFromProvider": "Niciun plan de la furnizor",
+    "tokenExpiresIn": "__MISSING__:Token expires in {time}",
+    "tokenExpired": "__MISSING__:Token expired",
     "noQuotaData": "Fără date de cotă",
     "cardExpand": "__MISSING__:Expand",
     "cardCollapse": "__MISSING__:Collapse",
@@ -6159,6 +6805,11 @@
     "quotaCutoffsButtonDefault": "Implicit",
     "quotaCutoffsButtonHelp": "Editați limitele minime de cotă rămase pentru acest cont.",
     "quotaCutoffsButtonDisabled": "Încă nu sunt disponibile ferestre de cotă pentru acest cont.",
+    "deactivateAccount": "__MISSING__:Deactivate account (stop routing)",
+    "activateAccount": "__MISSING__:Activate account (resume routing)",
+    "accountActivated": "__MISSING__:Account activated",
+    "accountDeactivated": "__MISSING__:Account deactivated",
+    "toggleActiveFailed": "__MISSING__:Failed to update account status",
     "quotaCutoffsTitle": "Limite de cotă pentru {name} ({provider})",
     "quotaCutoffsExplainer": "Înlocuiți procentul minim de cotă rămas în cazul în care acest cont nu mai este selectat pentru fiecare fereastră de cotă. Lăsați necompletat pentru a moșteni valoarea prestabilită a furnizorului.",
     "quotaCutoffsDefaultHint": "Minim prestabilit rămas: {default}%",
@@ -6179,6 +6830,7 @@
     "budgetColDailyLim": "Lim zilnic",
     "budgetColMonthlyLim": "Lim. lunar",
     "budgetColUsedPct": "% folosit",
+    "percentUsed": "__MISSING__:{pct}% used",
     "budgetLoading": "Se încarcă…",
     "budgetNoKeysMatch": "Nicio cheie nu se potrivește cu filtrele",
     "budgetLinearExtrapolation": "extrapolare liniară",
@@ -7124,6 +7776,11 @@
     "modalEditTitle": "Modal Edit Title",
     "labelName": "Label Name",
     "labelType": "Tip",
+    "labelFamily": "__MISSING__:IP family",
+    "familyAuto": "__MISSING__:Auto (dual-stack)",
+    "familyIpv4": "__MISSING__:IPv4 only",
+    "familyIpv6": "__MISSING__:IPv6 only",
+    "familyHint": "__MISSING__:Egress address family. Auto keeps dual-stack; IPv4/IPv6 pin this proxy to that family (prevents a v4 leak under an IPv6-only proxy).",
     "labelHost": "Gazdă",
     "labelPort": "Port",
     "labelUsername": "Nume de utilizator",
@@ -7266,7 +7923,16 @@
     "improveConfirm": "Improve",
     "exportCode": "Export code",
     "exportCodeTitle": "Export Code",
+    "exportShort": "__MISSING__:Export",
     "noStateToExport": "No playground state available to export.",
+    "closeExportModal": "__MISSING__:Close export modal",
+    "close": "__MISSING__:Close",
+    "exportRealKeyWarning": "__MISSING__:Security warning: export blocked — a real API key was detected in the output. Please reset your API key and try again.",
+    "placeholderHintPrefix": "__MISSING__:Replace",
+    "placeholderHintSuffix": "__MISSING__:with your actual API key, or set it as an environment variable.",
+    "copyLangCode": "__MISSING__:Copy {language} code",
+    "loadingPresets": "__MISSING__:Loading…",
+    "loadPresetPlaceholder": "__MISSING__:Load preset…",
     "copyCode": "Copy",
     "copiedCode": "Copied!",
     "addModel": "+ Add model",
@@ -7291,7 +7957,27 @@
     "invalidJson": "Invalid JSON",
     "running": "Running…",
     "runLabel": "Run",
-    "enterToolResult": "Enter tool result…"
+    "enterToolResult": "Enter tool result…",
+    "build": {
+      "step1Label": "__MISSING__:What to test?",
+      "step2Label": "__MISSING__:Configure",
+      "step3Label": "__MISSING__:Run",
+      "step1Title": "__MISSING__:What do you want to test?",
+      "step1Subtitle": "__MISSING__:Choose the capability you want to explore in this session.",
+      "step2Title": "__MISSING__:Configure",
+      "step2Subtitle": "__MISSING__:Set up the tools or JSON schema that will be used in the request.",
+      "step3Title": "__MISSING__:Run",
+      "modeToolsTitle": "__MISSING__:Tools",
+      "modeToolsDesc": "__MISSING__:Test function calling — define tools and see how the model invokes them.",
+      "modeJsonTitle": "__MISSING__:JSON",
+      "modeJsonDesc": "__MISSING__:Test structured output — constrain the response to a JSON schema.",
+      "modeBothTitle": "__MISSING__:Tools + JSON",
+      "modeBothDesc": "__MISSING__:Combine function calling and structured output in a single request.",
+      "backButton": "__MISSING__:Back",
+      "nextButton": "__MISSING__:Next",
+      "runButton": "__MISSING__:Run",
+      "promptPlaceholder": "__MISSING__:Enter your message… (Enter to send, Shift+Enter for newline)"
+    }
   },
   "miniPlayground": {
     "endpoint": "__MISSING__:Endpoint",
@@ -7395,7 +8081,9 @@
     "loadingLogs": "Loading logs...",
     "noLogs": "No logs yet. Make some API calls to see them here.",
     "noMatchingLogs": "No logs matching current filters.",
-    "callLogsInfo": "Call logs are also saved as JSON files to {dataDir} and rotated based on {retentionDays} and {maxEntries}."
+    "callLogsInfo": "Call logs are also saved as JSON files to {dataDir} and rotated based on {retentionDays} and {maxEntries}.",
+    "loadMore": "__MISSING__:Load More",
+    "loadingMore": "__MISSING__:Loading more..."
   },
   "proxyLogger": {
     "filterAll": "All",
@@ -7432,7 +8120,8 @@
     "loadingProxyLogs": "Loading proxy logs...",
     "noProxyLogs": "No proxy logs yet. Configure proxies and make API calls to see them here.",
     "noMatchingLogs": "No logs match the current filters.",
-    "tlsFingerprint": "Chrome 124 TLS Fingerprint"
+    "tlsFingerprint": "Chrome 124 TLS Fingerprint",
+    "colPublicIp": "__MISSING__:Public IP"
   },
   "endpointOptions": {
     "speech": "Speech",
@@ -7572,7 +8261,86 @@
     "betaConfigSavedSuffix": "(nu a persistat încă pe server). Aplicarea plafonului la cerere nu este încă conectată în conducta proxy. Acest ecran vă permite să proiectați și să vizualizați împărțirea cotei; aplicarea reală va ateriza într-o iterație viitoare cu persistență DB și interceptarea apelului în amonte.",
     "policyLabel": "Politica:",
     "resetIn": "resetează",
-    "quotaTotal": "total"
+    "quotaTotal": "total",
+    "kpiAvgUtilization": "__MISSING__:Avg utilization",
+    "kpiBorrowingNow": "__MISSING__:Borrowing now",
+    "conceptTitle": "__MISSING__:How Quota Share works",
+    "conceptIntro": "__MISSING__:Quota Share divides a provider's quota among multiple API keys using work-conserving fair-share: each key receives a proportional slice but can borrow from the free balance without exceeding the global cap.",
+    "conceptFairShare": "__MISSING__:Fair-share: each key receives quota proportional to its configured weight",
+    "conceptBorrowing": "__MISSING__:Borrowing: keys can consume free balance from others without breaching the cap",
+    "conceptGlobalCap": "__MISSING__:Hard global cap: the provider's absolute limit is never exceeded",
+    "conceptWindows": "__MISSING__:Windows: 5h, hourly, daily, weekly, monthly — each tracked independently",
+    "conceptKeyHowTitle": "__MISSING__:Enabling a key for quota",
+    "conceptKeyHowDesc": "__MISSING__:Create the key normally in API Keys — it appears in the wizard's key step automatically. Tick Exclusive there to make it quota-only. No separate enable step.",
+    "conceptExclusiveTitle": "__MISSING__:What \"Exclusive\" does",
+    "conceptExclusiveDesc": "__MISSING__:An exclusive key only sees/uses the pool's quotaShared-* models — every other model is hidden from its /v1/models and blocked.",
+    "burnRateTitle": "__MISSING__:Burn rate",
+    "burnRateExhaustsIn": "__MISSING__:Exhausts in",
+    "dimensionResetIn": "__MISSING__:Resets in",
+    "realConsumedColumn": "__MISSING__:Consumed",
+    "deficitColumn": "__MISSING__:Deficit",
+    "borrowingIndicator": "__MISSING__:borrowing",
+    "migratedFromLocalStorageNotice": "__MISSING__:Pools successfully migrated from localStorage.",
+    "policyCapAbsoluteLabel": "__MISSING__:Absolute cap",
+    "policyCapAbsolutePlaceholder": "__MISSING__:Numeric limit (optional)",
+    "multiDimensionLabel": "__MISSING__:Multi-dimension",
+    "stackedBarTitle": "__MISSING__:Slices by API key",
+    "usedSuffix": "__MISSING__:used {percent}%",
+    "wizardTitle": "__MISSING__:New quota pool",
+    "editPoolTitle": "__MISSING__:Edit pool",
+    "saveChanges": "__MISSING__:Save changes",
+    "wizardStep1Label": "__MISSING__:Account",
+    "wizardStep2Label": "__MISSING__:Limit",
+    "wizardStep3Label": "__MISSING__:Keys",
+    "wizardStep1Title": "__MISSING__:Choose provider connection",
+    "wizardStep1Subtitle": "__MISSING__:Select the provider account this pool will share quota for, set a name and default policy.",
+    "wizardStep2Title": "__MISSING__:Configure quota dimensions",
+    "wizardStep2Subtitle": "__MISSING__:Define the quota plan dimensions (unit, window, limit) for the chosen connection. Leave unchanged to keep current settings.",
+    "wizardStep3Title": "__MISSING__:Allocate API keys",
+    "wizardStep3Subtitle": "__MISSING__:Assign API keys to this pool with weight % allocations and optional caps.",
+    "wizardPoolNameLabel": "__MISSING__:Pool name",
+    "wizardPoolNamePlaceholder": "__MISSING__:My quota pool",
+    "wizardNext": "__MISSING__:Next",
+    "wizardBack": "__MISSING__:Back",
+    "wizardCreatePool": "__MISSING__:Create pool",
+    "wizardDimensionsEditedNotice": "__MISSING__:Dimensions edited — will be saved as a manual override when the pool is created.",
+    "wizardExclusiveLabel": "__MISSING__:Exclusive quota",
+    "wizardExclusiveHint": "__MISSING__:When enabled, these API keys will only be allowed to use this pool's virtual models (allowedQuotas reconciliation is applied on save).",
+    "wizardPreviewLabel": "__MISSING__:Virtual model names preview",
+    "wizardConnectionsLabel": "__MISSING__:Provider connections",
+    "wizardPrimaryBadge": "__MISSING__:primary",
+    "wizardAdditionalConnectionsNote": "__MISSING__:Additional connections use their catalog default limits (editable later).",
+    "wizardSingleProviderNote": "__MISSING__:A pool uses a single provider",
+    "wizardPreviewMoreModels": "__MISSING__:+{count} more",
+    "accountQuotaTitle": "__MISSING__:Account quota",
+    "accountQuotaNone": "__MISSING__:—",
+    "logTitle": "__MISSING__:Usage log",
+    "logEmpty": "__MISSING__:No usage yet",
+    "groupLabel": "__MISSING__:Group",
+    "newGroup": "__MISSING__:New group",
+    "renameGroup": "__MISSING__:Rename group",
+    "groupSelectHint": "__MISSING__:Filter pools by group",
+    "groupAllocationNote": "__MISSING__:Allocations apply to all pools in this group via the shared quota layer.",
+    "groupNamePrompt": "__MISSING__:Enter group name",
+    "wizardGroupLabel": "__MISSING__:Group",
+    "allGroups": "__MISSING__:All groups",
+    "endpointsTitle": "__MISSING__:Available endpoints",
+    "endpointsHint": "__MISSING__:Call these virtual models with any allocated key — routing + quota are handled per group.",
+    "previewForKey": "__MISSING__:Preview for key",
+    "previewKeyNone": "__MISSING__:(all endpoints)",
+    "endpointsBaseUrl": "__MISSING__:Base URL",
+    "endpointsCollapse": "__MISSING__:Collapse",
+    "endpointsExpand": "__MISSING__:Expand",
+    "endpointsAnthropicNote": "__MISSING__:Anthropic-native",
+    "endpointsResponsesNote": "__MISSING__:OpenAI Responses — codex/github",
+    "endpointsWsNote": "__MISSING__:WebSocket — codex only",
+    "betaText": "__MISSING__:Quota Share is functional but bugs are expected. Found one? Please report it.",
+    "betaReportLink": "__MISSING__:Report an issue",
+    "deleteGroup": "__MISSING__:Delete group",
+    "deleteGroupConfirm": "__MISSING__:Delete this group? Its pools must be reassigned or removed first.",
+    "deleteGroupHasPools": "__MISSING__:This group still has pools — reassign or delete them first.",
+    "ungroupedTitle": "__MISSING__:Ungrouped",
+    "ungroupedHint": "__MISSING__:These pools are not assigned to a known group. Edit a pool to move it into a real group."
   },
   "plugins": {
     "title": "Plugins",
@@ -7608,6 +8376,571 @@
     "status": "Status",
     "enabled": "Enabled",
     "disabled": "Disabled",
+    "installedTab": "__MISSING__:Installed",
+    "marketplaceTab": "__MISSING__:Marketplace",
+    "marketplaceUrlLabel": "__MISSING__:Custom Marketplace URL",
+    "marketplaceUrlPlaceholder": "__MISSING__:Leave empty for official Omniroute registry",
+    "saveMarketplaceUrl": "__MISSING__:Save & Reload",
+    "marketplaceUrlSaved": "__MISSING__:Marketplace URL updated",
+    "marketplaceEmpty": "__MISSING__:No plugins found in marketplace.",
+    "verified": "__MISSING__:Verified",
+    "install": "__MISSING__:Install",
+    "installedFromMarketplace": "__MISSING__:Plugin {name} installed!",
     "hooks": "Hooks"
+  },
+  "quotaPlans": {
+    "title": "__MISSING__:Plans & Quotas",
+    "description": "__MISSING__:Configure quota plans per provider — dimensions (%, requests, tokens, $) and time windows",
+    "providerLabel": "__MISSING__:Provider / Connection",
+    "detectedPlanLabel": "__MISSING__:Detected plan",
+    "manualPlanLabel": "__MISSING__:Manual override",
+    "unconfiguredLabel": "__MISSING__:Not configured — manual required",
+    "dimensionLabel": "__MISSING__:Dimensions",
+    "addDimension": "__MISSING__:Add dimension",
+    "removeDimension": "__MISSING__:Remove",
+    "limitLabel": "__MISSING__:Limit",
+    "unitOptions": {
+      "percent": "__MISSING__:%",
+      "requests": "__MISSING__:requests",
+      "tokens": "__MISSING__:tokens",
+      "usd": "__MISSING__:USD ($)"
+    },
+    "windowOptions": {
+      "5h": "__MISSING__:5 hours",
+      "hourly": "__MISSING__:Hourly",
+      "daily": "__MISSING__:Daily",
+      "weekly": "__MISSING__:Weekly",
+      "monthly": "__MISSING__:Monthly"
+    },
+    "useCatalogButton": "__MISSING__:Use catalog",
+    "saveOverrideButton": "__MISSING__:Save override",
+    "revertToCatalogButton": "__MISSING__:Revert to catalog",
+    "unknownProviderNotice": "__MISSING__:Select a provider on the left to configure its quota plan.",
+    "catalogTitle": "__MISSING__:Known catalog",
+    "catalogDescription": "__MISSING__:Automatically detected plans for the following providers:"
+  },
+  "activity": {
+    "title": "__MISSING__:Activity",
+    "description": "__MISSING__:Recent events feed",
+    "emptyTitle": "__MISSING__:No activity yet",
+    "emptyDescription": "__MISSING__:When you add providers, create combos, or rotate keys, events will appear here.",
+    "todayHeader": "__MISSING__:Today",
+    "yesterdayHeader": "__MISSING__:Yesterday",
+    "filterAll": "__MISSING__:All",
+    "filterProviders": "__MISSING__:Providers",
+    "filterCombos": "__MISSING__:Combos",
+    "filterApiKeys": "__MISSING__:API Keys",
+    "filterSettings": "__MISSING__:Settings",
+    "filterQuota": "__MISSING__:Quota",
+    "filterAuth": "__MISSING__:Auth",
+    "filterSystem": "__MISSING__:System",
+    "relative": {
+      "justNow": "__MISSING__:just now",
+      "minutesAgo": "__MISSING__:{n} min ago",
+      "hoursAgo": "__MISSING__:{n} h ago",
+      "yesterday": "__MISSING__:yesterday",
+      "daysAgo": "__MISSING__:{n} days ago"
+    },
+    "eventVerb": {
+      "providerAdded": "__MISSING__:{actor} added provider {target}",
+      "providerRemoved": "__MISSING__:{actor} removed provider {target}",
+      "providerTested": "__MISSING__:{actor} tested provider {target}",
+      "comboCreated": "__MISSING__:{actor} created combo {target}",
+      "comboUpdated": "__MISSING__:{actor} updated combo {target}",
+      "comboDeleted": "__MISSING__:{actor} removed combo {target}",
+      "apiKeyCreated": "__MISSING__:{actor} created API key {target}",
+      "apiKeyRevoked": "__MISSING__:{actor} revoked API key {target}",
+      "apiKeyRotated": "__MISSING__:{actor} rotated API key {target}",
+      "budgetThreshold": "__MISSING__:Budget threshold reached for {target}",
+      "settingUpdated": "__MISSING__:{actor} updated setting {target}",
+      "authLogin": "__MISSING__:{actor} signed in",
+      "authLogout": "__MISSING__:{actor} signed out",
+      "cloudAgentSession": "__MISSING__:Cloud agent session started for {target}",
+      "mcpToolRegistered": "__MISSING__:MCP tool {target} registered",
+      "webhookCreated": "__MISSING__:{actor} created webhook {target}",
+      "webhookDeleted": "__MISSING__:{actor} removed webhook {target}",
+      "quotaPoolCreated": "__MISSING__:{actor} created quota pool {target}",
+      "quotaPoolUpdated": "__MISSING__:{actor} updated quota pool {target}",
+      "quotaPoolDeleted": "__MISSING__:{actor} removed quota pool {target}",
+      "quotaPlanUpdated": "__MISSING__:{actor} updated quota plan {target}",
+      "quotaStoreDriverChanged": "__MISSING__:QuotaStore driver changed",
+      "updateApplied": "__MISSING__:Update {target} applied",
+      "deployCompleted": "__MISSING__:Deploy completed",
+      "skillInstalled": "__MISSING__:{actor} installed skill {target}",
+      "skillRemoved": "__MISSING__:{actor} removed skill {target}",
+      "providerCredentialsCreated": "__MISSING__:{actor} created credentials for {target}",
+      "providerCredentialsApplied": "__MISSING__:Credentials for {target} applied",
+      "providerCredentialsUpdated": "__MISSING__:{actor} updated credentials for {target}",
+      "providerCredentialsRevoked": "__MISSING__:{actor} revoked credentials for {target}",
+      "providerCredentialsBatchRevoked": "__MISSING__:{actor} batch-revoked credentials",
+      "providerCredentialsBatchUpdated": "__MISSING__:{actor} batch-updated credentials",
+      "providerCredentialsBulkCreated": "__MISSING__:{actor} bulk-created credentials",
+      "providerCredentialsBulkImported": "__MISSING__:{actor} bulk-imported credentials",
+      "providerCredentialsImported": "__MISSING__:{actor} imported credentials",
+      "providerSsrfBlocked": "__MISSING__:SSRF attempt blocked for {target}",
+      "authLoginSuccess": "__MISSING__:{actor} signed in",
+      "authLoginError": "__MISSING__:Login error for {actor}",
+      "authLoginFailed": "__MISSING__:Login failed for {actor}",
+      "authLoginLocked": "__MISSING__:{actor} locked out after too many attempts",
+      "authLoginMisconfigured": "__MISSING__:Auth configuration invalid",
+      "authLoginSetupRequired": "__MISSING__:Auth setup required",
+      "authLogoutSuccess": "__MISSING__:{actor} signed out",
+      "syncTokenCreated": "__MISSING__:{actor} created sync token",
+      "syncTokenRevoked": "__MISSING__:{actor} revoked sync token",
+      "settingsUpdate": "__MISSING__:{actor} updated settings",
+      "settingsUpdateFailed": "__MISSING__:Settings update failed",
+      "serviceRevealApiKey": "__MISSING__:{actor} revealed API key for {target}",
+      "genericEvent": "__MISSING__:{actor} {target}"
+    }
+  },
+  "agentBridge": {
+    "title": "__MISSING__:AgentBridge",
+    "subtitle": "__MISSING__:Use IDE agents with OmniRoute models — no config required",
+    "riskBannerTitle": "__MISSING__:Use at your own risk",
+    "riskBannerBody": "__MISSING__:AgentBridge intercepts HTTPS traffic from IDE agents. By activating it you accept responsibility for compliance with the terms of service of each agent. Never use on devices or networks where TLS inspection is prohibited.",
+    "riskBannerDismiss": "__MISSING__:Dismiss",
+    "serverCardTitle": "__MISSING__:AgentBridge Server",
+    "statusRunning": "__MISSING__:Running",
+    "statusStopped": "__MISSING__:Stopped",
+    "statusActive": "__MISSING__:Active",
+    "statusDnsOff": "__MISSING__:DNS off",
+    "statusSetupRequired": "__MISSING__:Setup required",
+    "statusInvestigating": "__MISSING__:Investigating",
+    "serverPort": "__MISSING__:Port",
+    "serverConns": "__MISSING__:Connections",
+    "serverIntercepted": "__MISSING__:Intercepted",
+    "serverLastStarted": "__MISSING__:Last started",
+    "startServer": "__MISSING__:Start",
+    "stopServer": "__MISSING__:Stop",
+    "restartServer": "__MISSING__:Restart",
+    "trustCert": "__MISSING__:Trust Cert",
+    "downloadCert": "__MISSING__:Download Cert",
+    "regenerateCert": "__MISSING__:Regenerate Cert",
+    "starting": "__MISSING__:Starting…",
+    "stopping": "__MISSING__:Stopping…",
+    "restarting": "__MISSING__:Restarting…",
+    "trusting": "__MISSING__:Trusting…",
+    "regenerating": "__MISSING__:Regenerating…",
+    "upstreamCaLabel": "__MISSING__:Upstream CA Certificate (corporate)",
+    "upstreamCaPlaceholder": "__MISSING__:/etc/ssl/certs/corp-ca.pem",
+    "upstreamCaTest": "__MISSING__:Test TLS",
+    "upstreamCaTestOk": "__MISSING__:TLS test passed",
+    "upstreamCaTestError": "__MISSING__:TLS test failed — check the path and CA file",
+    "bypassSectionTitle": "__MISSING__:Bypass List",
+    "bypassSectionDesc": "__MISSING__:Hosts matching these patterns are tunneled directly (no TLS decryption). Defaults include banks, .gov, and corporate SSO.",
+    "bypassDefaultsLabel": "__MISSING__:Default bypass patterns (read-only)",
+    "bypassUserLabel": "__MISSING__:Custom bypass patterns (one per line, glob or regex)",
+    "saveBypassList": "__MISSING__:Save bypass list",
+    "agentListTitle": "__MISSING__:IDE Agents",
+    "filterAll": "__MISSING__:All",
+    "filterActive": "__MISSING__:Active",
+    "filterSetupRequired": "__MISSING__:Setup required",
+    "filterInvestigating": "__MISSING__:Investigating",
+    "searchAgents": "__MISSING__:Search agents…",
+    "noAgentsMatch": "__MISSING__:No agents match the current filter",
+    "agentHosts": "__MISSING__:Intercepted hosts",
+    "certTrusted": "__MISSING__:Certificate trusted",
+    "certNotTrusted": "__MISSING__:Certificate not trusted",
+    "investigatingNotice": "__MISSING__:This agent is under investigation. Hosts and API surface are still being confirmed. Setup will be available once the upstream API is documented.",
+    "modelMappingsLabel": "__MISSING__:Model mappings",
+    "sourceModel": "__MISSING__:Source model (agent native)",
+    "targetModel": "__MISSING__:Target model (OmniRoute)",
+    "noMappings": "__MISSING__:No model mappings configured. Run setup wizard to auto-detect models.",
+    "selectModel": "__MISSING__:Select…",
+    "saveMappings": "__MISSING__:Save mappings",
+    "setupWizard": "__MISSING__:Setup wizard",
+    "startDns": "__MISSING__:Start DNS",
+    "stopDns": "__MISSING__:Stop DNS",
+    "toggling": "__MISSING__:Toggling…",
+    "viewTraffic": "__MISSING__:View traffic",
+    "emptyNoProvidersTitle": "__MISSING__:No providers configured yet",
+    "emptyNoProvidersBody": "__MISSING__:To use AgentBridge, first connect at least one provider. It will be the destination where IDE requests are routed.",
+    "emptyGoToProviders": "__MISSING__:Go to Providers",
+    "wizardTitle": "__MISSING__:Setup wizard",
+    "wizardSubtitle": "__MISSING__:3-step setup",
+    "wizardStep1Label": "__MISSING__:Verify",
+    "wizardStep2Label": "__MISSING__:DNS",
+    "wizardStep3Label": "__MISSING__:Mappings",
+    "wizardStep1Desc": "__MISSING__:Confirm the server is running and the certificate is installed.",
+    "wizardStep2Desc": "__MISSING__:The following entries will be added to /etc/hosts to redirect traffic through AgentBridge:",
+    "wizardStep3Desc": "__MISSING__:You can now configure model mappings in the agent card. Restart the IDE to apply changes.",
+    "wizardStep3Success": "__MISSING__:Agent is configured!",
+    "wizardServerCheck": "__MISSING__:AgentBridge server",
+    "wizardRunning": "__MISSING__:running",
+    "wizardNotRunning": "__MISSING__:not running",
+    "wizardCertCheck": "__MISSING__:Certificate",
+    "wizardTrusted": "__MISSING__:trusted",
+    "wizardNotTrusted": "__MISSING__:not yet trusted — use Trust Cert button",
+    "wizardTutorialTitle": "__MISSING__:Setup instructions:",
+    "wizardEnableDns": "__MISSING__:Add /etc/hosts entries",
+    "wizardDnsAlreadyEnabled": "__MISSING__:DNS already enabled for this agent",
+    "enablingDns": "__MISSING__:Enabling…",
+    "modelSelectorTitle": "__MISSING__:Select target model",
+    "modelSelectorSearch": "__MISSING__:Search models…",
+    "noModelsFound": "__MISSING__:No models found",
+    "quickLinks": "__MISSING__:Quick links",
+    "quickLinkProviders": "__MISSING__:Configure providers",
+    "quickLinkInspector": "__MISSING__:View traffic in Traffic Inspector",
+    "maintenanceTitle": "__MISSING__:Maintenance & Diagnostics",
+    "maintenanceSubtitle": "__MISSING__:Self-test the capture pipeline, undo leftover system state, and move your setup between machines.",
+    "orphanedStateWarning": "__MISSING__:A previous session left system state behind (DNS spoof, CA, or system proxy). Run Repair to clean it up.",
+    "diagnose": "__MISSING__:Diagnose",
+    "diagnosing": "__MISSING__:Diagnosing…",
+    "diagnoseHealthy": "__MISSING__:Capture pipeline is healthy.",
+    "diagnoseUnhealthy": "__MISSING__:Capture pipeline has problems:",
+    "repair": "__MISSING__:Repair",
+    "repairing": "__MISSING__:Repairing…",
+    "repairDone": "__MISSING__:Repaired: {items}",
+    "repairNothing": "__MISSING__:Nothing to repair — system state is clean.",
+    "removeCa": "__MISSING__:Remove CA",
+    "removeCaConfirm": "__MISSING__:Remove CA?",
+    "removeCaDone": "__MISSING__:MITM root CA removed from the OS trust store.",
+    "removing": "__MISSING__:Removing…",
+    "confirm": "__MISSING__:Confirm",
+    "exportConfig": "__MISSING__:Export config",
+    "exporting": "__MISSING__:Exporting…",
+    "importConfig": "__MISSING__:Import config",
+    "importing": "__MISSING__:Importing…",
+    "importInvalidJson": "__MISSING__:The selected file is not valid JSON.",
+    "importDone": "__MISSING__:Imported {bypass} bypass · {hosts} hosts · {agents} agents",
+    "save": "__MISSING__:Save",
+    "saving": "__MISSING__:Saving…",
+    "cancel": "__MISSING__:Cancel",
+    "back": "__MISSING__:Back",
+    "next": "__MISSING__:Next",
+    "done": "__MISSING__:Done",
+    "loading": "__MISSING__:Loading…",
+    "riskNoticeTitle": "__MISSING__:Risk acknowledgment",
+    "riskNoticeBody": "__MISSING__:AgentBridge will intercept HTTPS traffic from this agent by redirecting its API hosts via DNS. Only enable if you accept responsibility for compliance with the agent's terms of service and any applicable network policies.",
+    "pageMoved": {
+      "goNow": "__MISSING__:Go now",
+      "message": "__MISSING__:The MITM Proxy now lives under AgentBridge.",
+      "title": "__MISSING__:This page has moved"
+    }
+  },
+  "trafficInspector": {
+    "title": "__MISSING__:Traffic Inspector",
+    "subtitle": "__MISSING__:Monitor LLM calls and debug any application's HTTPS traffic",
+    "captureModesTitle": "__MISSING__:Capture Modes",
+    "agentBridgeMode": "__MISSING__:AgentBridge",
+    "agentBridgeModeDesc": "__MISSING__:Capture traffic from all connected IDE agents",
+    "customHostsMode": "__MISSING__:Custom Hosts",
+    "customHostsModeDesc": "__MISSING__:Add specific hosts to intercept",
+    "httpProxyMode": "__MISSING__:HTTP Proxy",
+    "httpProxyModeDesc": "__MISSING__:Use HTTP_PROXY environment variable",
+    "systemWideMode": "__MISSING__:System-wide",
+    "systemWideModeDesc": "__MISSING__:Intercept all system traffic (advanced)",
+    "tproxyMode": "__MISSING__:TPROXY Decrypt",
+    "tproxyModeUnavailable": "__MISSING__:TPROXY decrypt requires Linux + root + the native addon",
+    "filterBarTitle": "__MISSING__:Filters",
+    "profileLlmOnly": "__MISSING__:LLM only",
+    "profileCustom": "__MISSING__:Custom",
+    "profileAll": "__MISSING__:All",
+    "filterHost": "__MISSING__:Filter host…",
+    "filterAgent": "__MISSING__:Agent",
+    "filterStatus": "__MISSING__:Status",
+    "pauseBtn": "__MISSING__:Pause",
+    "resumeBtn": "__MISSING__:Resume",
+    "clearBtn": "__MISSING__:Clear",
+    "exportHar": "__MISSING__:Export .har",
+    "recordSession": "__MISSING__:REC",
+    "stopSession": "__MISSING__:Stop",
+    "liveBadge": "__MISSING__:live",
+    "offlineBadge": "__MISSING__:offline",
+    "noRequests": "__MISSING__:No requests captured yet.",
+    "noRequestsDesc": "__MISSING__:Make sure AgentBridge is running or enable another capture mode.",
+    "selectRequest": "__MISSING__:Select a request to inspect it.",
+    "tabConversation": "__MISSING__:Conversation",
+    "tabHeaders": "__MISSING__:Headers",
+    "tabRequest": "__MISSING__:Request",
+    "tabResponse": "__MISSING__:Response",
+    "tabTiming": "__MISSING__:Timing",
+    "tabLlm": "__MISSING__:LLM",
+    "tabStats": "__MISSING__:Stats",
+    "requestHeaders": "__MISSING__:Request Headers",
+    "responseHeaders": "__MISSING__:Response Headers",
+    "rawEvents": "__MISSING__:Raw events",
+    "mergedView": "__MISSING__:Merged view",
+    "noBody": "__MISSING__:No body.",
+    "streaming": "__MISSING__:streaming…",
+    "manageHosts": "__MISSING__:Manage hosts",
+    "copySnippet": "__MISSING__:Copy proxy snippet",
+    "addHost": "__MISSING__:Add",
+    "hostPlaceholder": "__MISSING__:api.openai.com",
+    "noHostsYet": "__MISSING__:No custom hosts added yet.",
+    "noSessionsYet": "__MISSING__:No sessions yet",
+    "allTraffic": "__MISSING__:All traffic (no session)",
+    "sessionsDropdown": "__MISSING__:Sessions",
+    "annotationPlaceholder": "__MISSING__:Add a note…",
+    "contextFingerprint": "__MISSING__:Context fingerprint",
+    "llmProvider": "__MISSING__:Detected provider",
+    "llmApiKind": "__MISSING__:API kind",
+    "llmModel": "__MISSING__:Model",
+    "llmMessages": "__MISSING__:Messages",
+    "llmStream": "__MISSING__:Stream",
+    "llmMappedTo": "__MISSING__:Mapped to",
+    "llmCostEstimate": "__MISSING__:Cost estimate",
+    "systemProxyExitWarning": "__MISSING__:System-wide proxy still active — leave page anyway?",
+    "customHostsTitle": "__MISSING__:Custom Hosts",
+    "loading": "__MISSING__:Loading…",
+    "copied": "__MISSING__:Copied!",
+    "copy": "__MISSING__:Copy",
+    "httpProxyTitle": "__MISSING__:HTTP Proxy Snippet — port {port}",
+    "notRecording": "__MISSING__:Not recording",
+    "anyStatus": "__MISSING__:Any status",
+    "liveOnly": "__MISSING__:Live",
+    "viewingRecordedSession": "__MISSING__:Viewing recorded session",
+    "backToLive": "__MISSING__:Back to live",
+    "untitledSession": "__MISSING__:Untitled session",
+    "contextHistory": "__MISSING__:Context History",
+    "modelResponse": "__MISSING__:Model Response",
+    "conversationNoMessages": "__MISSING__:No messages found in this request.",
+    "conversationNotAvailable": "__MISSING__:Conversation data not available. This may not be an LLM request or the body could not be parsed.",
+    "loadingCharts": "__MISSING__:Loading charts…",
+    "statsErrors": "__MISSING__:Errors",
+    "statsLatency": "__MISSING__:Latency (last 50 requests)",
+    "statsNoData": "__MISSING__:No requests yet. Start a session recording to capture data for stats.",
+    "statsStatusDistribution": "__MISSING__:Status distribution",
+    "statsSuccessful": "__MISSING__:Successful",
+    "statsTotalRequests": "__MISSING__:Total requests",
+    "timingProxyOverhead": "__MISSING__:Proxy overhead",
+    "timingUpstreamResponse": "__MISSING__:Upstream response",
+    "timingNoData": "__MISSING__:No timing data available.",
+    "timingTotalLatency": "__MISSING__:Total latency",
+    "timingTimestamp": "__MISSING__:Timestamp",
+    "timingMethod": "__MISSING__:Method",
+    "timingStatus": "__MISSING__:Status",
+    "timingRequestSize": "__MISSING__:Request size",
+    "timingResponseSize": "__MISSING__:Response size",
+    "pausedNewBadge": "__MISSING__:{count} new",
+    "clearContextFilter": "__MISSING__:clear"
+  },
+  "cliCommon": {
+    "concept": {
+      "code": {
+        "title": "__MISSING__:CLI Code",
+        "phrase": "__MISSING__:Code tools you point at OmniRoute",
+        "flow": "__MISSING__:You → CLI Code → OmniRoute → Provider",
+        "seeOther": "__MISSING__:See →"
+      },
+      "agent": {
+        "title": "__MISSING__:CLI Agents",
+        "phrase": "__MISSING__:Broad-purpose autonomous CLI agents you point at OmniRoute",
+        "flow": "__MISSING__:You → CLI Agent → OmniRoute → Provider",
+        "seeOther": "__MISSING__:See →"
+      },
+      "acp": {
+        "title": "__MISSING__:ACP Agents",
+        "phrase": "__MISSING__:CLIs that OmniRoute spawns as execution backend (reverse flow)",
+        "flow": "__MISSING__:Client → OmniRoute → spawn CLI (stdio/ACP) → response",
+        "seeOther": "__MISSING__:See →"
+      }
+    },
+    "comparison": {
+      "title": "__MISSING__:Understand the 3 CLI types in OmniRoute",
+      "thisPage": "__MISSING__:This page",
+      "open": "__MISSING__:Open →",
+      "code": {
+        "title": "__MISSING__:Code tool",
+        "desc": "__MISSING__:Points to Omni",
+        "flow": "__MISSING__:you → CLI → Omni → provider",
+        "examples": "__MISSING__:e.g.: claude, codex"
+      },
+      "agent": {
+        "title": "__MISSING__:Broad autonomous agent",
+        "desc": "__MISSING__:Points to Omni",
+        "flow": "__MISSING__:you → agent → Omni",
+        "examples": "__MISSING__:e.g.: hermes, goose"
+      },
+      "acp": {
+        "title": "__MISSING__:CLI used as backend by Omni",
+        "desc": "__MISSING__:Reverse execution",
+        "flow": "__MISSING__:Omni → spawn CLI → resp",
+        "examples": "__MISSING__:e.g.: claude, codex (ACP)"
+      }
+    },
+    "card": {
+      "detected": "__MISSING__:Detected",
+      "notDetected": "__MISSING__:Not detected",
+      "configured": "__MISSING__:Configured",
+      "notConfigured": "__MISSING__:Not configured",
+      "configure": "__MISSING__:Configure →",
+      "howToInstall": "__MISSING__:How to install →",
+      "manualConfig": "__MISSING__:Manual config",
+      "installGuide": "__MISSING__:Install guide",
+      "endpointLabel": "__MISSING__:Endpoint",
+      "baseUrlFull": "__MISSING__:Full Base URL",
+      "baseUrlPartial": "__MISSING__:Partial Base URL",
+      "refreshDetection": "__MISSING__:Refresh detection",
+      "alsoAcp": "__MISSING__:also ACP",
+      "connectProviderHint": "__MISSING__:Connect a provider in Providers"
+    },
+    "detail": {
+      "back": "__MISSING__:Back",
+      "apply": "__MISSING__:Save",
+      "reset": "__MISSING__:Clear",
+      "manualConfig": "__MISSING__:Manual configuration",
+      "vendor": "__MISSING__:Vendor",
+      "category": "__MISSING__:Type",
+      "detectionStatus": "__MISSING__:Detection",
+      "configStatus": "__MISSING__:Configuration",
+      "baseUrlLabel": "__MISSING__:Base URL",
+      "apiKeyLabel": "__MISSING__:API Key",
+      "modelMappingLabel": "__MISSING__:Model mapping",
+      "noActiveProviders": "__MISSING__:No active providers.",
+      "noActiveProvidersDesc": "__MISSING__:Go to Providers to connect at least 1 provider before configuring the CLI.",
+      "openProviders": "__MISSING__:Open Providers →"
+    }
+  },
+  "cliCode": {
+    "pageTitle": "__MISSING__:CLI Code's",
+    "pageSubtitle": "__MISSING__:Code tools pointing to OmniRoute",
+    "searchPlaceholder": "__MISSING__:Search CLI…",
+    "filterDetectionLabel": "__MISSING__:Detection",
+    "filterBaseUrlLabel": "__MISSING__:Base URL",
+    "detectionAll": "__MISSING__:All",
+    "detectionInstalled": "__MISSING__:Installed",
+    "detectionNotFound": "__MISSING__:Not found",
+    "baseUrlAll": "__MISSING__:All",
+    "baseUrlFull": "__MISSING__:Full",
+    "baseUrlPartial": "__MISSING__:Partial"
+  },
+  "cliAgents": {
+    "pageTitle": "__MISSING__:CLI Agents",
+    "pageSubtitle": "__MISSING__:Broad-purpose autonomous CLI agents",
+    "refreshDetection": "__MISSING__:Refresh detection",
+    "searchPlaceholder": "__MISSING__:Search agent…",
+    "detectionFilterLabel": "__MISSING__:Detection",
+    "detectionAll": "__MISSING__:All",
+    "detectionInstalled": "__MISSING__:Installed",
+    "detectionNotInstalled": "__MISSING__:Not installed",
+    "visibleCount": "__MISSING__:{count} visible",
+    "emptyState": "__MISSING__:No CLI agents found with the current filters."
+  },
+  "acpAgents": {
+    "pageTitle": "__MISSING__:ACP Agents",
+    "pageSubtitle": "__MISSING__:CLIs that OmniRoute spawns as execution backend",
+    "scanning": "__MISSING__:Detecting agents…",
+    "refresh": "__MISSING__:Refresh",
+    "setupGuideTitle": "__MISSING__:Setup guide",
+    "setupGuideDetectCliTitle": "__MISSING__:Detect CLI",
+    "setupGuideDetectCliDesc": "__MISSING__:Agents are identified by running the --version command in PATH.",
+    "setupGuideCustomAgentTitle": "__MISSING__:Add custom agent",
+    "setupGuideCustomAgentDesc": "__MISSING__:Fill in the form below to register a custom CLI agent.",
+    "setupGuideCommandMissingTitle": "__MISSING__:Command not found",
+    "setupGuideCommandMissingDesc": "__MISSING__:Check that the binary is in PATH.",
+    "fingerprintSettingsHint": "__MISSING__:Configure routing and fingerprints in",
+    "settingsRoutingLink": "__MISSING__:Settings → Routing",
+    "installed": "__MISSING__:Installed",
+    "notFound": "__MISSING__:Not found",
+    "builtIn": "__MISSING__:Built-in",
+    "custom": "__MISSING__:Custom",
+    "agentUseCaseHint": "__MISSING__:Available for spawn via ACP.",
+    "remove": "__MISSING__:Remove",
+    "addCustomAgent": "__MISSING__:Add custom agent",
+    "addCustomAgentDesc": "__MISSING__:Register a custom CLI agent to be spawned via ACP.",
+    "addAgent": "__MISSING__:Add agent",
+    "agentName": "__MISSING__:Name",
+    "agentNamePlaceholder": "__MISSING__:e.g.: My Agent",
+    "binaryName": "__MISSING__:Binary",
+    "binaryNamePlaceholder": "__MISSING__:e.g.: myagent",
+    "versionCommand": "__MISSING__:Version command",
+    "versionCommandPlaceholder": "__MISSING__:e.g.: myagent --version",
+    "spawnArgs": "__MISSING__:Spawn arguments",
+    "spawnArgsPlaceholder": "__MISSING__:e.g.: --quiet, --json",
+    "cliCodeRedirectCta": "__MISSING__:Open CLI Code"
+  },
+  "agentSkills": {
+    "pageTitle": "__MISSING__:Agent Skills",
+    "pageSubtitle": "__MISSING__:Teach your agent to operate OmniRoute — 22 API areas + 20 CLI families",
+    "conceptCard": {
+      "agent": {
+        "title": "__MISSING__:Agent Skills — Outbound",
+        "description": "__MISSING__:Agent Skills are machine-readable SKILL.md documents that external AI agents (Claude Code, Cursor, Copilot…) fetch from GitHub to learn how to operate OmniRoute via REST or CLI. They are read by the agent, not executed by OmniRoute.",
+        "crossLinkLabel": "__MISSING__:Understand the difference →"
+      },
+      "omni": {
+        "title": "__MISSING__:Omni Skills — Inbound",
+        "description": "__MISSING__:Omni Skills are sandbox tools that OmniRoute injects into the model's context on every request. They are executed by OmniRoute, not read by the agent.",
+        "crossLinkLabel": "__MISSING__:Understand the difference →"
+      },
+      "comparison": {
+        "colAgent": "__MISSING__:Agent Skills",
+        "colOmni": "__MISSING__:Omni Skills",
+        "whatIs": {
+          "label": "__MISSING__:What it is",
+          "agent": "__MISSING__:Machine-readable SKILL.md that teaches an external agent to operate OmniRoute",
+          "omni": "__MISSING__:Executable tools that OmniRoute injects as tools into LLM requests"
+        },
+        "direction": {
+          "label": "__MISSING__:Direction",
+          "agent": "__MISSING__:Outbound — external agent learns to control OmniRoute",
+          "omni": "__MISSING__:Inbound — OmniRoute gives tools to models passing through it"
+        },
+        "executor": {
+          "label": "__MISSING__:Executor",
+          "agent": "__MISSING__:External agent (reads markdown → acts via API/CLI)",
+          "omni": "__MISSING__:OmniRoute itself (intercepts tool_calls, Docker sandbox)"
+        },
+        "storage": {
+          "label": "__MISSING__:Storage",
+          "agent": "__MISSING__:Dynamic catalog (/api/agent-skills) → SKILL.md on GitHub",
+          "omni": "__MISSING__:SQLite (SkillsMP / skills.sh / local)"
+        },
+        "tagline": {
+          "label": "__MISSING__:Tagline",
+          "agent": "__MISSING__:Teach your agent to use OmniRoute",
+          "omni": "__MISSING__:Give executable tools to OmniRoute models"
+        }
+      }
+    },
+    "filters": {
+      "category": "__MISSING__:Category",
+      "area": "__MISSING__:Area",
+      "searchPlaceholder": "__MISSING__:Search skills…"
+    },
+    "categoryApi": "__MISSING__:API",
+    "categoryCli": "__MISSING__:CLI",
+    "categoryConfig": "__MISSING__:Config",
+    "filterAll": "__MISSING__:All",
+    "coverageLabel": "__MISSING__:Coverage",
+    "mcpUrl": "__MISSING__:MCP URL",
+    "a2aLink": "__MISSING__:A2A",
+    "copyUrl": "__MISSING__:Copy URL",
+    "viewOnGithub": "__MISSING__:View on GitHub",
+    "previewLoading": "__MISSING__:Loading skill documentation…",
+    "previewError": "__MISSING__:Failed to load skill documentation.",
+    "previewEmpty": "__MISSING__:Select a skill to preview its documentation.",
+    "generateButton": "__MISSING__:Generate missing skills",
+    "coverageBar": {
+      "complete": "__MISSING__:Complete",
+      "partial": "__MISSING__:Partial"
+    },
+    "noSkillsFound": "__MISSING__:No skills found matching your filters.",
+    "regenerateConfirm": "__MISSING__:This will regenerate all missing SKILL.md files. Continue?",
+    "regenerateRunning": "__MISSING__:Regenerating skills…",
+    "regenerateSuccess": "__MISSING__:Skills regenerated successfully.",
+    "regenerateError": "__MISSING__:Failed to regenerate skills."
+  },
+  "freeProviderRankingsPage": {
+    "title": "__MISSING__:Free Provider Rankings",
+    "subtitle": "__MISSING__:Best free providers ranked by model ELO scores from Arena AI leaderboards",
+    "loading": "__MISSING__:Loading rankings...",
+    "errorLoading": "__MISSING__:Failed to load rankings",
+    "emptyState": "__MISSING__:No rankings available yet. Arena ELO data syncs on startup (daily) — check back shortly, or trigger a manual sync. Disable Arena ELO Sync in Feature Flags or set ARENA_ELO_SYNC_ENABLED=false to opt out.",
+    "bestModel": "__MISSING__:Best",
+    "allCategories": "__MISSING__:All Categories",
+    "categoryDefault": "__MISSING__:Default",
+    "categoryCoding": "__MISSING__:Coding",
+    "categoryReview": "__MISSING__:Review",
+    "categoryDocumentation": "__MISSING__:Documentation",
+    "categoryDebugging": "__MISSING__:Debugging",
+    "colRank": "__MISSING__:Rank",
+    "colProvider": "__MISSING__:Provider",
+    "colTopModel": "__MISSING__:Top Model",
+    "colScore": "__MISSING__:Score",
+    "colAvgScore": "__MISSING__:Avg Score",
+    "colModels": "__MISSING__:Models",
+    "colType": "__MISSING__:Type"
   }
 }
diff --git a/src/i18n/messages/ru.json b/src/i18n/messages/ru.json
index 4a8ccb2bee..3e9cc392c9 100644
--- a/src/i18n/messages/ru.json
+++ b/src/i18n/messages/ru.json
@@ -393,6 +393,7 @@
     "cloudBenefitAccess": "Cloud Benefit Access",
     "maxRetries": "Max Retries",
     "queueTimeout": "Queue Timeout",
+    "queueDepth": "__MISSING__:Queue Depth",
     "addProvider": "Add Provider",
     "realtime": "Realtime",
     "totalTranslations": "Total Translations",
@@ -842,6 +843,8 @@
     "batchActionRetryError": "Failed to retry failed requests. Try again.",
     "batchConceptRetentionNote": "Results and error files are retained for 30 days (Anthropic: 29 days)"
   },
+  "featureFlagOmnirouteEmergencyFallbackDescription": "__MISSING__:Route budget-exhausted requests to the emergency free fallback provider/model.",
+  "featureFlagArenaEloSyncEnabledDescription": "__MISSING__:Enable periodic Arena AI leaderboard ELO sync for model intelligence rankings.",
   "sidebar": {
     "home": "Главная",
     "dashboard": "Панель управления",
@@ -969,6 +972,7 @@
     "aiFeaturesSection": "AI Features",
     "mcp": "MCP",
     "a2a": "A2A",
+    "plugins": "__MISSING__:Plugins",
     "apiEndpoints": "API Endpoints",
     "batchFiles": "Files",
     "analyticsEvals": "Evals",
@@ -977,6 +981,10 @@
     "analyticsComboHealth": "Combo Health",
     "analyticsCompression": "Compression",
     "costsBudget": "Budget",
+    "costsFreeTiers": "__MISSING__:Free-Tier Budget",
+    "costsFreeTiersSubtitle": "__MISSING__:Monthly free-token allowances",
+    "freeProviderRankings": "__MISSING__:Free Provider Rankings",
+    "freeProviderRankingsSubtitle": "__MISSING__:Best free providers ranked by model ELO scores",
     "costsQuotaShare": "Quota Sharing",
     "costsPricing": "Pricing",
     "logsProxy": "Proxy Logs",
@@ -988,10 +996,12 @@
     "settingsAppearance": "Appearance",
     "settingsAi": "AI Settings",
     "settingsSecurity": "Security",
+    "settingsAccessTokens": "__MISSING__:Access Tokens",
     "settingsFeatureFlags": "Флаги функций",
     "settingsAuthz": "Authz",
     "settingsRouting": "Routing",
     "settingsResilience": "Resilience",
+    "modelLockout": "__MISSING__:Model Lockout",
     "settingsAdvanced": "Advanced",
     "omniProxySection": "OmniProxy",
     "quotaTracker": "Provider Quota",
@@ -1037,6 +1047,8 @@
     "analyticsCompressionSubtitle": "Token savings stats",
     "analyticsSearchSubtitle": "Search tool analytics",
     "analyticsEvalsSubtitle": "Eval suite results",
+    "providerStats": "__MISSING__:Provider Stats",
+    "providerStatsSubtitle": "__MISSING__:Latency and performance metrics",
     "logsSubtitle": "Application logs",
     "logsProxySubtitle": "Proxy traffic logs",
     "consoleLogsSubtitle": "Console output",
@@ -1056,6 +1068,7 @@
     "agentSkillsSubtitle": "A2A skill registry",
     "mcpSubtitle": "MCP server controls",
     "a2aSubtitle": "A2A protocol server",
+    "pluginsSubtitle": "__MISSING__:Plugin marketplace & installs",
     "mediaSubtitle": "Cached media files",
     "batchFilesSubtitle": "Batch input/output files",
     "settingsSubtitle": "All settings",
@@ -1066,6 +1079,7 @@
     "settingsResilienceSubtitle": "Retries and breakers",
     "settingsAdvancedSubtitle": "Power user options",
     "settingsSecuritySubtitle": "Auth and encryption",
+    "settingsAccessTokensSubtitle": "__MISSING__:Scoped CLI tokens for remote mode",
     "settingsFeatureFlagsSubtitle": "Переключить возможности системы",
     "settingsSidebar": "Sidebar",
     "settingsSidebarSubtitle": "Customize sidebar layout",
@@ -1090,7 +1104,16 @@
     "cliAgents": "CLI Агенты",
     "cliAgentsSubtitle": "Автономные CLI-агенты",
     "acpAgents": "Агенты ACP",
-    "acpAgentsSubtitle": "CLIs, запущенные OmniRoute"
+    "acpAgentsSubtitle": "CLIs, запущенные OmniRoute",
+    "skipToContent": "__MISSING__:Skip to content",
+    "unpinSection": "__MISSING__:Unpin section",
+    "pinSectionOpen": "__MISSING__:Pin section open",
+    "reloadPage": "__MISSING__:Reload Page",
+    "dragReorderSection": "__MISSING__:Drag to reorder section",
+    "dragReorderItem": "__MISSING__:Drag to reorder",
+    "cannotHide": "__MISSING__:This item cannot be hidden",
+    "alwaysVisible": "__MISSING__:Always visible",
+    "groupSeparatorLabel": "__MISSING__:Separator"
   },
   "webhooks": {
     "title": "Вебхуки",
@@ -1672,6 +1695,9 @@
     "ownUsageVisibilityDesc": "Разрешить этому ключу вызывать свой endpoint статуса для просмотра собственного использования в USD, процента бюджета и сумм токенов.",
     "sharedAccountQuotaVisibility": "Общая квота аккаунта",
     "sharedAccountQuotaVisibilityDesc": "Разрешить этому ключу видеть общую квоту upstream-аккаунта, когда настроено одно явное подключение.",
+    "localUsageCommand": "__MISSING__:Allow local usage command",
+    "localUsageCommandDesc": "__MISSING__:Allows this API key to use @@om-usage to retrieve cached usage and quota information without calling an upstream provider.",
+    "localUsageCommandBadge": "__MISSING__:Usage cmd",
     "keyCreated": "Ключ API создан",
     "keyCreatedSuccess": "Ключ успешно создан!",
     "keyCreatedNote": "Скопируйте и сохраните этот ключ сейчас — он больше не будет отображаться.",
@@ -1732,6 +1758,7 @@
     "keyOnlyAvailableAtCreation": "Полный ключ доступен только при создании — скопируйте его сразу после генерации",
     "modelsCount": "{count, plural, one {# модель} few {# модели} many {# моделей} other {# модели}}",
     "lastUsedOn": "Последний: {date}",
+    "viewCostsFor": "__MISSING__:View costs for {name}",
     "editPermissions": "Редактировать разрешения",
     "deleteKey": "Удалить ключ",
     "regenerateKey": "Восстановить ключ",
@@ -1913,6 +1940,8 @@
     "freeQuota": "Free quota/mo",
     "scrapeUrl": "URL to scrape",
     "scrapeUrlPlaceholder": "https://example.com",
+    "scrapeUrlRequired": "__MISSING__:URL is required",
+    "scrapeUrlInvalid": "__MISSING__:Invalid URL — it must start with http:// or https://",
     "scrapeExtract": "Extract",
     "scrapeExtracting": "Extracting…",
     "scrapeFullPage": "Full page",
@@ -1926,6 +1955,8 @@
     "scrapeMetadata": "Metadata",
     "scrapeProvider": "Provider",
     "scrapeSize": "Size",
+    "scrapeEmptyState": "__MISSING__:Enter a URL to extract its content",
+    "scrapeProvidersAvailable": "__MISSING__:Available providers: Firecrawl, Jina Reader, Tavily.",
     "compareRun": "Compare",
     "compareRunning": "Comparing…",
     "autoProvider": "Auto (cheapest)",
@@ -2313,6 +2344,8 @@
     "leastLatency": "Наименьшая задержка",
     "comboName": "Имя комбинации",
     "comboNamePlaceholder": "мое комбо",
+    "comboDescription": "__MISSING__:Description",
+    "comboDescriptionPlaceholder": "__MISSING__:Optional note describing this combo",
     "deleteConfirm": "Удалить это комбо?",
     "noCombosYet": "Комбинаций пока нет",
     "comboCreated": "Комбо успешно создано",
@@ -2352,6 +2385,8 @@
     "resetAwareDesc": "Балансирует оставшуюся квоту с 5-часовым и еженедельным сбросом, затем выполняет циклический анализ одинаковых результатов.",
     "strictRandom": "Строгий случайный",
     "strictRandomDesc": "Перемешивание колоды - каждая модель используется по одному разу перед новым перемешиванием",
+    "fusion": "__MISSING__:Fusion",
+    "fusionDesc": "__MISSING__:Fans the prompt to every panel model in parallel, then a judge model synthesizes one final answer",
     "models": "Модели",
     "autoBalance": "Автобаланс",
     "advancedSettings": "Расширенные настройки",
@@ -3050,14 +3085,19 @@
     "ngrokStarted": "туннель нгрока запущен",
     "ngrokStopped": "Туннель Нгрока остановлен",
     "ngrokRequestFailed": "Не удалось обновить туннель ngrok.",
-    "tokenSaverSubtitle": "Тратьте меньше жетонов на каждый запрос.",
-    "tokenSaverToolOutput": "Выход инструмента",
-    "tokenSaverLlmOutput": "Выход LLM",
-    "tokenSaverInputCompression": "Входное сжатие",
     "apiEndpointsCatalogUnavailable": "Каталог API недоступен",
     "apiEndpointsSearchPlaceholder": "Поиск конечных точек...",
     "apiEndpointsRequiresAuth": "Требуется авторизация",
     "apiEndpointsNoMatch": "Ни одна конечная точка не соответствует вашему фильтру.",
+    "vscodeAliasTitle": "__MISSING__:VS Code Token Alias",
+    "vscodeAliasDescriptionReady": "__MISSING__:Ready-to-paste compatibility URLs using the /api/v1/vscode/TOKEN/... endpoint.",
+    "vscodeAliasDescriptionError": "__MISSING__:Showing placeholder URLs because CLI keys could not be loaded in this session.",
+    "vscodeAliasDescriptionLoading": "__MISSING__:Loading CLI keys. Placeholder URLs are shown until a key is available.",
+    "vscodeAliasDescriptionPlaceholder": "__MISSING__:Showing placeholder URLs. Create or activate an API key in CLI Tools to replace TOKEN.",
+    "vscodeAliasManage": "__MISSING__:CLI Tools",
+    "vscodeAliasBaseLabel": "__MISSING__:VS Code base",
+    "vscodeAliasModelsLabel": "__MISSING__:VS Code models",
+    "vscodeAliasChatLabel": "__MISSING__:VS Code chat",
     "localServer": "Локальный сервер",
     "cloudOmniroute": "Облачный OmniRoute",
     "copyUrl": "Копировать URL",
@@ -3070,7 +3110,10 @@
     "tierAlwaysProtected": "Всегда Защищено",
     "tierPublic": "Публичный",
     "hideInternal": "Скрыть внутренние",
-    "showInternal": "Показать Внутренний"
+    "showInternal": "Показать Внутренний",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Прокси конечных точек",
@@ -3757,6 +3800,14 @@
     "export": "Export",
     "exporting": "Exporting...",
     "exportFailed": "Export failed",
+    "cleanHistoryButton": "__MISSING__:Clean history",
+    "cleanHistoryTitle": "__MISSING__:Clean log history?",
+    "cleanHistoryMessage": "__MISSING__:This permanently clears all request log rows, legacy detail rows, and local artifact files under DATA_DIR/call_logs. The live page will refresh after cleanup.",
+    "cleanHistoryConfirm": "__MISSING__:Clean history",
+    "cleanHistoryCancel": "__MISSING__:Cancel",
+    "cleanHistorySuccess": "__MISSING__:Cleaned {deleted} log entries, {deletedArtifacts} artifacts, and {deletedDetailedLogs} legacy detail rows.",
+    "cleanHistoryEmpty": "__MISSING__:No request log history was found.",
+    "cleanHistoryFailed": "__MISSING__:Failed to clean log history.",
     "timeRange": "Time Range",
     "lastNHours": "Last {hours}",
     "defaultRange": "default",
@@ -3771,6 +3822,7 @@
   },
   "onboarding": {
     "welcome": "Добро пожаловать",
+    "tiers": "__MISSING__:Tiers",
     "security": "Безопасность",
     "test": "Тест",
     "ready": "Готово!",
@@ -3832,6 +3884,7 @@
   },
   "providers": {
     "title": "Провайдеры",
+    "Account Deactivated": "__MISSING__:Account Deactivated",
     "allProviders": "Все провайдеры",
     "audioProviders": "Поставщики аудио",
     "showFreeOnly": "Только бесплатно",
@@ -3839,6 +3892,33 @@
     "addFirstProvider": "Добавьте своего первого провайдера",
     "addFirstProviderDesc": "Подключите поставщика искусственного интеллекта, чтобы начать маршрутизацию запросов через OmniRoute. Вы можете использовать бесплатных провайдеров, ключи API или учетные записи OAuth.",
     "learnMore": "Узнать больше",
+    "adaptaTutorial": {
+      "title": "__MISSING__:How to connect Adapta Web",
+      "introPrefix": "__MISSING__:Adapta authenticates through Clerk. The token",
+      "introSuffix": "__MISSING__:is a long-lived JWT that lets OmniRoute refresh sessions automatically.",
+      "or": "__MISSING__:or",
+      "step1Title": "__MISSING__:Open Adapta chat",
+      "step1DescPrefix": "__MISSING__:Open",
+      "step1DescSuffix": "__MISSING__:and sign in with your Gold or Business account.",
+      "step2Title": "__MISSING__:Open DevTools",
+      "step2DescPrefix": "__MISSING__:Press",
+      "step2DescSuffix": "__MISSING__:to open Developer Tools.",
+      "step3Title": "__MISSING__:Go to Application → Cookies",
+      "step3DescPrefix": "__MISSING__:In the",
+      "step3DescMiddle": "__MISSING__:expand",
+      "step3DescSuffix": "__MISSING__:and click",
+      "step4Title": "__MISSING__:Copy the cookie value for",
+      "step4DescPrefix": "__MISSING__:Find the cookie named",
+      "step4DescMiddle": "__MISSING__:in the list. Click it and copy the content from the",
+      "step4DescSuffix": "__MISSING__:column. It starts with",
+      "step5Title": "__MISSING__:Paste it here and save",
+      "step5DescPrefix": "__MISSING__:Click",
+      "step5DescMiddle": "__MISSING__:paste the",
+      "step5DescSuffix": "__MISSING__:value into the API Key field, then save. OmniRoute will refresh the session automatically.",
+      "tipLabel": "__MISSING__:Tip:",
+      "tipPrefix": "__MISSING__:The",
+      "tipSuffix": "__MISSING__:cookie is long-lived, usually for months. You only need to renew it if you sign out or Adapta invalidates the session."
+    },
     "editProvider": "Изменить поставщика",
     "deleteProvider": "Удалить поставщика",
     "noProviders": "Поставщики не настроены",
@@ -3864,13 +3944,38 @@
     "apiKeyProviders": "Поставщики ключей API",
     "compatibleProviders": "Поставщики, совместимые с ключами API",
     "testAll": "Проверить все",
+    "distributeProxies": "__MISSING__:Distribute Proxies",
+    "distributing": "__MISSING__:Distributing...",
+    "selectedCount": "__MISSING__:{count, plural, one {# selected} other {# selected}}",
+    "accountsCount": "__MISSING__:{count, plural, one {# account} other {# accounts}}",
     "testAllOAuth": "Проверьте все соединения OAuth",
     "testAllFree": "Проверьте все бесплатные соединения",
     "testAllApiKey": "Проверьте все соединения API-ключей",
     "testAllCompatible": "Проверьте все совместимые соединения",
+    "testAllModels": "__MISSING__:Test all models",
+    "testAllModelsConfirm": "__MISSING__:Test all visible models? Failed models will be hidden if auto-hide is enabled.",
+    "testingAllModels": "__MISSING__:Testing {done}/{total}...",
+    "testAllResults": "__MISSING__:{ok} of {total} models working",
+    "noModelsToTest": "__MISSING__:No models match the current filter",
+    "showAllModels": "__MISSING__:All",
+    "showVisibleOnly": "__MISSING__:Visible only",
+    "freeFilterAll": "__MISSING__:All",
+    "freeFilterFreeOnly": "__MISSING__:Free only",
+    "freeFilterPaidOnly": "__MISSING__:Paid only",
+    "sortFreeFirst": "__MISSING__:Free first",
+    "showHiddenOnly": "__MISSING__:Hidden only",
+    "filterByVisibility": "__MISSING__:Filter by visibility",
+    "autoHideFailed": "__MISSING__:Auto-hide failed models",
+    "autoHideFailedHint": "__MISSING__:When enabled, Test all hides non-transient failures from public catalogs such as /v1/models. Single-model tests never auto-hide.",
     "connected": "{count} подключено",
     "errorCount": "{count} Ошибка ({code})",
     "errorCountNoCode": "{count} Ошибка",
+    "testAllCompleted": "__MISSING__:Tested {total} models: {ok} OK, {failed} failed",
+    "modelAutoHidden": "__MISSING__:Model {model} auto-hidden (test failed)",
+    "filterAll": "__MISSING__:All",
+    "filterVisible": "__MISSING__:Visible only",
+    "filterHidden": "__MISSING__:Hidden only",
+    "modelsHiddenCount": "__MISSING__:{count} hidden",
     "warningCount": "{count} Предупреждение",
     "noConnections": "Нет соединений",
     "expiredBadge": "Expired",
@@ -3980,7 +4085,16 @@
     "batchUpdateNone": "__MISSING__:No connections were updated (they may no longer exist)",
     "batchRetestLimit": "__MISSING__:Retest up to {max} connections at a time",
     "noConnectionsToTest": "__MISSING__:No matching connections to test",
+    "batchDeleteConfirmTitle": "__MISSING__:Delete connections",
+    "batchDeleteConfirmButton": "__MISSING__:Delete",
+    "filterActive": "__MISSING__:Active",
+    "filterError": "__MISSING__:Error",
+    "filterBanned": "__MISSING__:Banned",
+    "filterCreditsExhausted": "__MISSING__:Credits Exhausted",
+    "noFilteredConnections": "__MISSING__:No connections match the current filter.",
     "failedSetAlias": "Не удалось установить псевдоним",
+    "setAliasSuccess": "__MISSING__:Alias {alias} set",
+    "deleteAliasSuccess": "__MISSING__:Alias {alias} deleted",
     "failedSaveConnection": "Не удалось сохранить соединение.",
     "failedSaveConnectionRetry": "Не удалось сохранить соединение. Пожалуйста, попробуйте еще раз.",
     "failedRetestConnection": "Не удалось повторно проверить соединение",
@@ -4014,6 +4128,9 @@
     "connectionCount": "{count} соединение(я)",
     "fetchingModels": "Загрузка доступных моделей...",
     "failedFetchModels": "Не удалось получить модели.",
+    "noFreeModelsFound": "__MISSING__:No free models found for this provider — nothing imported.",
+    "fetchModelsSuccess": "__MISSING__:Found {count} new models",
+    "fetchModelsFailed": "__MISSING__:Could not auto-fetch models (you can retry from settings)",
     "noModelsFound": "Модели не найдены",
     "importFailed": "Импорт не удался",
     "noNewModelsAdded": "Новых моделей не добавлялось.",
@@ -4022,6 +4139,10 @@
     "importingModelsTitle": "Импорт моделей",
     "copyModel": "Копировать модель",
     "filterModels": "Фильтровать модели…",
+    "testAllRateLimited": "__MISSING__:Rate limit reached, stopped early",
+    "hideFailedAuto": "__MISSING__:Auto-hide failed models",
+    "selectAllModels": "Select all",
+    "hideAllModels": "__MISSING__:Hide all",
     "modelsActive": "активные",
     "showModel": "Показать модель",
     "hideModel": "Скрыть модель",
@@ -4030,6 +4151,9 @@
     "rateLimitUnprotected": "незащищенный",
     "enableRateLimitProtection": "Нажмите, чтобы включить защиту от ограничения скорости",
     "disableRateLimitProtection": "Нажмите, чтобы отключить защиту ограничения скорости",
+    "testAllProgress": "__MISSING__:Tested {done}/{total}",
+    "testAllFailedHidden": "__MISSING__:{count} failed models hidden",
+    "testAllDone": "__MISSING__:All models tested",
     "productionKey": "Производственный ключ",
     "enterNewApiKey": "Введите новый ключ API",
     "codexApplyModalTitle": "Подать заявку в местный Кодекс",
@@ -4105,10 +4229,20 @@
     "errorTypeNetworkError": "Ошибка сети",
     "errorTypeTestUnsupported": "Тест не поддерживается",
     "errorTypeUpstreamError": "Ошибка восходящего потока",
+    "errorTypeCreditsExhausted": "__MISSING__:No credits",
+    "errorTypeBanned": "__MISSING__:403 Banned",
     "proxySourceGlobal": "Глобальный",
     "proxySourceProvider": "Поставщик",
     "proxySourceKey": "Ключ",
     "proxyConfiguredBySource": "Прокси ({source}): {host}",
+    "proxyOn": "__MISSING__:Proxy On",
+    "proxyOff": "__MISSING__:Direct (bypass proxy)",
+    "proxyEnabledTitle": "__MISSING__:Proxy is enabled for this connection",
+    "proxyDisabledTitle": "__MISSING__:Direct connection — bypasses every proxy (including the global proxy) for this connection",
+    "perKeyProxyOn": "__MISSING__:Per-key",
+    "perKeyProxyOff": "__MISSING__:Connection",
+    "perKeyProxyEnabledTitle": "__MISSING__:Per-key proxy assignment enabled for this provider",
+    "perKeyProxyDisabledTitle": "__MISSING__:Per-key proxy assignment disabled for this provider",
     "autoPriority": "Авто: {priority}",
     "proxy": "Прокси",
     "retestAuthentication": "Повторная проверка подлинности",
@@ -4136,6 +4270,12 @@
     "compatProtocolOpenAI": "OpenAI Chat Completions",
     "compatProtocolOpenAIResponses": "OpenAI Responses API",
     "compatProtocolClaude": "Anthropic Messages",
+    "targetFormatLabel": "__MISSING__:Target Format",
+    "targetFormatHint": "__MISSING__:Override the upstream wire format. Use 'Anthropic Messages' to route OpenAI-compatible providers (e.g. opencode-go) through the /v1/messages endpoint.",
+    "targetFormatAuto": "__MISSING__:Default (auto)",
+    "targetFormatGemini": "__MISSING__:Gemini",
+    "targetFormatGeminiCli": "__MISSING__:Gemini CLI",
+    "targetFormatAntigravity": "__MISSING__:Antigravity",
     "compatUpstreamHeadersLabel": "Дополнительные заголовки upstream",
     "compatUpstreamHeadersHint": "Настройка с высоким уровнем доверия - тот же уровень, что и редактирование API-учётных данных провайдера; использовать только доверенным администраторам. Применяется после того, как OmniRoute добавит авторизацию из API-ключа провайдера. Если пользовательский заголовок совпадает по имени с уже существующим (например, Authorization), ваше значение полностью заменяет автоматически созданный заголовок (включая Bearer token) - upstream увидит только введённое вами значение, а не ключ из настроек. Ошибка настройки может привести к 401 или поломке upstream-аутентификации. По одной строке на заголовок (например, дополнительный Authentication для некоторых шлюзов). Наведите курсор или сфокусируйте поле, чтобы увидеть предпросмотр. Сохраняется при потере фокуса, клике вне поля или закрытии панели.",
     "compatUpstreamHeaderName": "Имя заголовка",
@@ -4145,6 +4285,8 @@
     "compatBadgeUpstreamHeaders": "Заголовки",
     "perModelQuotaLabel": "Per Model Quota Label",
     "perModelQuotaDescription": "Per Model Quota Description",
+    "importFreeModelsOnlyLabel": "__MISSING__:Import only free models",
+    "importFreeModelsOnlyHint": "__MISSING__:When enabled, only this provider's free models are imported. Paid models are skipped.",
     "perModelQuotaToggle": "Переключение квот для каждой модели",
     "modelId": "Идентификатор модели",
     "customModelPlaceholder": "например gpt-4.5-турбо",
@@ -4180,7 +4322,6 @@
     "email": "электронная почта",
     "healthCheckMinutes": "Проверка здоровья (мин)",
     "healthCheckHint": "Интервал обновления упреждающего токена. 0 = отключено.",
-    "selectAllModels": "Select all",
     "deselectAllModels": "Deselect all",
     "modelsActiveCount": "{active}/{total} active",
     "noModelsMatch": "No models match \"{filter}\"",
@@ -4192,6 +4333,9 @@
     "editCompatibleTitle": "Изменить совместимость {type}",
     "compatibleBaseUrlHint": "Базовый URL вашего API, совместимого с {type}. Используйте расширенные настройки для собственных путей конечных точек.",
     "apiKeyForCheck": "API-ключ (для проверки)",
+    "testModelIdLabel": "__MISSING__:Model ID (optional)",
+    "testModelIdPlaceholder": "__MISSING__:e.g. my-model-id",
+    "testModelIdHint": "__MISSING__:If the provider lacks a /models endpoint, enter a model ID to validate via /chat/completions instead.",
     "compatibleProdPlaceholder": "{type} Совместимость (Прод.)",
     "tokenRefreshed": "Токен успешно обновлён",
     "tokenRefreshFailed": "Не удалось обновить токен",
@@ -4285,6 +4429,19 @@
     "codexAuthApplyFailed": "Не удалось применить Codex auth.json локально",
     "codexAuthExported": "Codex auth.json экспортирован",
     "codexAuthExportFailed": "Не удалось экспортировать Codex auth.json",
+    "codexCliGuideButton": "__MISSING__:Codex CLI Guide",
+    "codexCliGuideTitle": "__MISSING__:Codex CLI Guide",
+    "codexCliGuideLoading": "__MISSING__:Loading guide...",
+    "codexCliGuideLoadFailed": "__MISSING__:Could not load the guide.",
+    "codexExternalLinkButton": "__MISSING__:External Codex link",
+    "codexExternalLinkModalTitle": "__MISSING__:External Codex link",
+    "codexExternalLinkModalDescription": "__MISSING__:Share this single-use link with the person who will authenticate the Codex account. They open it in their own browser, complete the OpenAI login, and the connection is registered here. The link expires in 15 minutes.",
+    "codexExternalLinkGenerating": "__MISSING__:Generating link...",
+    "codexExternalLinkWaiting": "__MISSING__:Waiting for browser authentication. This window refreshes automatically.",
+    "codexExternalLinkCreateFailed": "__MISSING__:Failed to generate the link.",
+    "codexExternalLinkNetworkError": "__MISSING__:Could not contact the server.",
+    "codexExternalLinkConnected": "__MISSING__:Codex account connected through the external link.",
+    "codexExternalLinkExpired": "__MISSING__:The link expired before completion.",
     "importCodexAuth": "Импорт авторизации",
     "codexImportModalTitle": "Импортировать аутентификацию Кодекса",
     "codexImportTabSingle": "Одинокий",
@@ -4362,6 +4519,8 @@
     "t3ChatWebCookiePlaceholder": "выпуклый-session-id=abc123...",
     "blockClaudeExtraUsageDescription": "Block Claude Extra Usage Description",
     "blockClaudeExtraUsageLabel": "Block Claude Extra Usage Label",
+    "disableCoolingDescription": "__MISSING__:Skip the transient cooldown so this connection stays eligible even after recoverable errors (terminal states like banned/expired still apply).",
+    "disableCoolingLabel": "__MISSING__:Disable cooldown for this connection",
     "bulkPasteAdded": "{count, plural, one {1 key added} other {# keys added}}",
     "bulkPasteDuplicatesIgnored": "{count, plural, one {1 duplicate skipped} other {# duplicates skipped}}",
     "bulkPasteHint": "Paste one API key per line. Empty lines are ignored and duplicate keys are skipped.",
@@ -4459,6 +4618,17 @@
     "personalAccessTokenLabel": "Personal Access Token Label",
     "qoderPatHint": "Qoder Pat Hint",
     "qoderPatPlaceholder": "Qoder Pat Placeholder",
+    "rateLimitOverridesSection": "__MISSING__:Rate Limit Overrides",
+    "rateLimitOverridesMaxConcurrentHint": "__MISSING__:Max concurrent requests override for this connection. Overrides the account-level cap.",
+    "rateLimitOverridesMaxConcurrentLabel": "__MISSING__:Max Concurrent (Rate Limit)",
+    "rateLimitOverridesMinTimeHint": "__MISSING__:Minimum time (ms) between requests. Overrides the default rate limiter delay.",
+    "rateLimitOverridesMinTimeLabel": "__MISSING__:Min Interval (ms)",
+    "rateLimitOverridesRpmHint": "__MISSING__:Max requests per minute for this connection. Overrides the provider default.",
+    "rateLimitOverridesRpmLabel": "__MISSING__:RPM (Requests/min)",
+    "rateLimitOverridesTpdHint": "__MISSING__:Max tokens per day for this connection. Overrides the provider default.",
+    "rateLimitOverridesTpdLabel": "__MISSING__:TPD (Tokens/day)",
+    "rateLimitOverridesTpmHint": "__MISSING__:Max tokens per minute for this connection. Overrides the provider default.",
+    "rateLimitOverridesTpmLabel": "__MISSING__:TPM (Tokens/min)",
     "refreshOauthTokenTitle": "Refresh Oauth Token Title",
     "regionHint": "Region Hint",
     "regionLabel": "Region Label",
@@ -4473,6 +4643,7 @@
     "searchProvider": "Search Provider",
     "searchProviderDesc": "Search Provider Desc",
     "searchProviders": "Поиск поставщиков...",
+    "searchByModel": "__MISSING__:Search by model…",
     "searchProvidersHeading": "Search Providers Heading",
     "searxngBaseUrlHint": "Searxng Base Url Hint",
     "searxngInfo": "Searxng Info",
@@ -4758,6 +4929,7 @@
     "memoryDesc": "Постоянная кросс-сессионная память для диалогов",
     "memoryEnabled": "Включить память",
     "memoryEnabledDesc": "Когда включено, OmniRoute будет внедрять релевантный прошлый контекст.",
+    "memoryTokenCostWarning": "__MISSING__:Heads up: with memory enabled, OmniRoute injects up to {tokens} tokens of retrieved context into every chat request — this increases token usage and cost. To skip injection for a specific request, send the \"x-omniroute-no-memory: true\" header.",
     "maxTokens": "Макс. токенов",
     "retentionDays": "Срок хранения",
     "recent": "Недавнее",
@@ -4803,6 +4975,8 @@
     "homeQuickStartDesc": "Показывать панель быстрого старта на главной странице.",
     "homeProviderTopology": "Топология провайдеров",
     "homeProviderTopologyDesc": "Показывать топологию провайдеров на главной странице.",
+    "accountEmailVisibility": "__MISSING__:Account email visibility",
+    "accountEmailVisibilityDesc": "__MISSING__:Show full account emails across providers, combos, logs, quota, and playground screens. Turn this off to mask them by default.",
     "sidebarVisibilityToggle": "Показывать элементы боковой панели",
     "enableCache": "Включить кеш",
     "cacheTTL": "Срок жизни кэша",
@@ -4836,11 +5010,17 @@
     "autoDisableDescription": "Навсегда помечать соединения провайдера как отключённые, если они возвращают сигнал окончательной блокировки (например, HTTP 403 'verify your account'). Это убирает их из ротации комбо.",
     "autoDisableThreshold": "Порог блокировки",
     "autoDisableThresholdDesc": "Количество подряд идущих сигналов блокировки, необходимых перед постоянным отключением.",
+    "customBannedSignals": "__MISSING__:Banned Keywords",
+    "customBannedSignalsDesc": "__MISSING__:Additional keywords that trigger permanent account ban detection. Built-in keywords always apply.",
+    "customBannedSignalsPlaceholder": "__MISSING__:e.g. api key revoked",
+    "noCustomBannedSignals": "__MISSING__:No custom keywords. Only built-in keywords are active.",
     "resilienceStructureTitle": "Resilience Structure",
     "resilienceStructureDesc": "Эта страница только настраивает поведение. Состояние автоматического выключателя отображается на странице «Состояние». Повторные попытки для конкретной комбинации и управление слотами циклического перебора остаются в настройках комбинации.",
     "enableThinking": "Включить мышление",
     "maxThinkingTokens": "Максимальное количество жетонов мышления",
     "enableProxy": "Включить прокси",
+    "perKeyProxyEnabled": "__MISSING__:Enable per-key proxy assignment",
+    "perKeyProxyEnabledDesc": "__MISSING__:When enabled, each provider connection can use its own proxy assignment",
     "proxyUrl": "URL-адрес прокси-сервера",
     "pricingRates": "Формат ценообразования",
     "currentPricing": "Текущий обзор цен",
@@ -4920,6 +5100,13 @@
     "globalProxy": "Глобальный прокси",
     "globalProxyDesc": "Настройте глобальный исходящий прокси-сервер для всех вызовов API. Отдельные поставщики, комбинации и ключи могут переопределить это.",
     "noGlobalProxy": "Глобальный прокси не настроен",
+    "proxyPool": "__MISSING__:Proxy Pool",
+    "freePool": "__MISSING__:Free Pool",
+    "proxyDocumentation": "__MISSING__:Proxy Documentation",
+    "proxyGlobalConfigTab": "Глобальная Конфигурация",
+    "proxyPoolTab": "Пул Прокси",
+    "freePoolTab": "Бесплатный Пул",
+    "proxyDocumentationTab": "Документация",
     "bulkHealthcheck": "Массовая проверка здоровья",
     "bulkHealthcheckDesc": "Проверьте все настроенные прокси по целевому URL, чтобы определить рабочие.",
     "healthcheckTesting": "Проверка...",
@@ -4932,6 +5119,51 @@
     "healthcheckStatus": "Статус",
     "healthcheckProxyUrl": "URL прокси",
     "healthcheckLatency": "Задержка",
+    "proxyDocumentationScopeTitle": "__MISSING__:Proxy scope resolution",
+    "proxyDocumentationScopeDescBefore": "__MISSING__:OmniRoute resolves the outbound proxy in priority order: ",
+    "proxyDocumentationScopeOrder": "__MISSING__:combo → account → provider → global",
+    "proxyDocumentationScopeDescAfter": "__MISSING__:. The most specific scope wins.",
+    "proxyDocumentationAddTitle": "__MISSING__:Adding a custom proxy",
+    "proxyDocumentationAddDescBefore": "__MISSING__:Go to the ",
+    "proxyDocumentationAddDescMiddle": "__MISSING__: tab → click ",
+    "proxyDocumentationAddCta": "__MISSING__:+ Add proxy",
+    "proxyDocumentationAddDescAfter": "__MISSING__:. Fill in type (http/https/socks5), host, and port. Optionally assign it to a scope.",
+    "proxyDocumentationBulkTitle": "__MISSING__:Bulk import format",
+    "proxyDocumentationBulkDesc": "__MISSING__:Pipe-delimited fields:",
+    "proxyDocumentationSocks5DescBefore": "__MISSING__:SOCKS5 proxies are disabled by default. Set",
+    "proxyDocumentationFreePoolDesc": "__MISSING__:The Free Pool tab aggregates proxies from 1proxy, Proxifly, and IPLocate. Use ⊕ to test and promote a proxy to your registry. Only proxies that pass the connectivity test are added.",
+    "proxyDocumentationVercelRelayDescBefore": "__MISSING__:The Vercel Relay is an outbound edge relay — not an inbound tunnel. Deploying one sends LLM API calls through Vercel's dynamic IPs, bypassing datacenter geo-blocks and rate limits. The relay is protected by a generated secret header",
+    "proxyDocumentationVercelRelayDescAfter": "__MISSING__:Your Vercel token is used only during deploy and is never stored.",
+    "vercelRelayTokenRequired": "__MISSING__:Token is required",
+    "vercelRelayDeployFailed": "__MISSING__:Deploy failed",
+    "vercelRelayTokenHint": "__MISSING__:Token is used only during deploy — never stored.",
+    "denoRelayTokenRequired": "__MISSING__:Deno Deploy token is required",
+    "denoRelayOrgDomainRequired": "__MISSING__:Organization domain is required",
+    "denoRelayDeployFailed": "__MISSING__:Deno Deploy failed",
+    "denoRelayTokenHint": "__MISSING__:Organization token (prefix ddo_) from console.deno.com → Organization → Settings → Organization Tokens. Used once for deploy and never stored.",
+    "denoRelayOrgDomainHint": "__MISSING__:Your Deno Deploy organization's default domain (e.g. acme.deno.net). The relay will be reachable at https://<app-name>.<org-slug>.deno.net.",
+    "proxyFreePoolFilterProtocol": "__MISSING__:Filter by protocol",
+    "proxyFreePoolProtocol": "__MISSING__:Protocol",
+    "proxyFreePoolCountryPlaceholder": "__MISSING__:Country (e.g. US)",
+    "proxyFreePoolFilterCountry": "__MISSING__:Filter by country",
+    "proxyFreePoolMinQualityPlaceholder": "__MISSING__:Min quality",
+    "proxyFreePoolMinQualityLabel": "__MISSING__:Minimum quality score",
+    "proxyFreePoolSyncAll": "__MISSING__:Sync All",
+    "proxyFreePoolTotal": "__MISSING__:Total",
+    "proxyFreePoolInPool": "__MISSING__:In pool",
+    "proxyFreePoolAvgQuality": "__MISSING__:Avg quality",
+    "proxyFreePoolSelected": "__MISSING__:{count} selected",
+    "proxyFreePoolAddSelected": "__MISSING__:Add selected to pool",
+    "proxyFreePoolAddVisible": "__MISSING__:Add all visible to pool",
+    "proxyFreePoolSource": "__MISSING__:Source",
+    "proxyFreePoolHostPort": "__MISSING__:Host:Port",
+    "proxyFreePoolType": "__MISSING__:Type",
+    "proxyFreePoolCountry": "__MISSING__:Country",
+    "proxyFreePoolQuality": "__MISSING__:Quality",
+    "proxyFreePoolLatency": "__MISSING__:Latency",
+    "proxyFreePoolEmpty": "__MISSING__:No proxies found. Click Sync All to fetch from sources.",
+    "close": "__MISSING__:Close",
+    "cancel": "__MISSING__:Cancel",
     "globalLabel": "Глобальный",
     "configure": "Настроить",
     "globalSystemPrompt": "Глобальная системная подсказка",
@@ -5188,6 +5420,7 @@
     "systemStorage": "Система и хранилище",
     "allDataLocal": "Все данные хранятся локально на вашем компьютере.",
     "databasePath": "Путь к базе данных",
+    "export": "__MISSING__:Export",
     "exportDatabase": "Экспорт базы данных",
     "exportAll": "Экспортировать все (.tar.gz)",
     "importDatabase": "Импортировать базу данных",
@@ -5275,6 +5508,11 @@
     "adaptiveVolumeRoutingDesc": "Динамически масштабируйте соединения на основе объёма нагрузки и давления пропускной способности.",
     "lkgpToggleTitle": "Последний известный хороший провайдер (LKGP)",
     "lkgpToggleDesc": "Когда включено, маршрутизатор запоминает, какой провайдер последним отдал успешный ответ, и сначала пытается использовать его в следующих запросах.",
+    "echoRequestedModelTitle": "__MISSING__:Echo requested model name in responses",
+    "echoRequestedModelDesc": "__MISSING__:When enabled, the response `model` field echoes the alias or combo name the client requested instead of the upstream model name. Fixes strict clients (e.g. Claude Desktop) that reject a response whose model does not match the request.",
+    "webSearchRouteTitle": "__MISSING__:Web search routing",
+    "webSearchRouteDesc": "__MISSING__:When a request includes a native web_search tool, route the whole request to this model instead of the default — useful for providers that don't implement Anthropic's web_search server tool. Leave blank to disable.",
+    "webSearchRoutePlaceholder": "__MISSING__:e.g. openrouter,anthropic/claude-3.5-sonnet",
     "clearLkgpCache": "Очистить кэш LKGP",
     "lkgpCacheCleared": "Кэш LKGP успешно очищен",
     "lkgpCacheClearFailed": "Не удалось очистить кэш LKGP",
@@ -5339,6 +5577,16 @@
     "clearSyncedPricing": "Clear Synced Pricing",
     "compressionTitle": "Prompt Compression",
     "compressionDesc": "Reduce token usage by compressing prompts before sending to providers",
+    "tokenSaverTitle": "__MISSING__:Token Saver",
+    "tokenSaverSubtitle": "__MISSING__:Spend fewer tokens on every request.",
+    "tokenSaverToolOutput": "__MISSING__:Tool output",
+    "tokenSaverToolOutputDesc": "__MISSING__:Clean git, grep, ls, tree, and log output before it reaches the provider.",
+    "tokenSaverLlmOutput": "__MISSING__:LLM output",
+    "tokenSaverLlmOutputDesc": "__MISSING__:Inject terse response instructions without rewriting provider output.",
+    "tokenSaverInputCompression": "__MISSING__:Input compression",
+    "tokenSaverInputCompressionDesc": "__MISSING__:Rewrite eligible chat history while preserving code, URLs, and intent.",
+    "tokenSaverFineTunePrefix": "__MISSING__:Fine-tune each engine on",
+    "tokenSaverFineTuneSuffix": "__MISSING__:or combine engines per request on",
     "compressionMode": "Compression Mode",
     "compressionModeOff": "Off",
     "compressionModeOffDesc": "No compression applied",
@@ -5358,6 +5606,11 @@
     "compressionUltraMinScore": "Минимальный порог оценки",
     "compressionUltraSlmFallback": "Откат к агрессивному режиму",
     "compressionUltraModelPath": "Путь модели УУЗР",
+    "compressionUltraEngine": "__MISSING__:Ultra tier",
+    "compressionUltraEngineHeuristic": "__MISSING__:Heuristic (Tier-A, default)",
+    "compressionUltraEngineSlm": "__MISSING__:SLM (LLMLingua-2, opt-in)",
+    "compressionUltraSlmHint": "__MISSING__:SLM downloads a small ONNX model on first use (cold-start) and transparently falls back to the heuristic on timeout or if unavailable.",
+    "compressionUltraSlmPrewarm": "__MISSING__:Pre-warm SLM model on enable",
     "compressionSummarizerEnabled": "Включить сумматор",
     "compressionMaxTokensPerMessage": "Максимальное количество токенов на сообщение",
     "compressionMinSavings": "Минимальный порог сбережений",
@@ -5545,13 +5798,22 @@
     "resilienceNo": "Нет",
     "resilienceDefault": "Default",
     "storageDatabaseBackupRetention": "Хранение резервной копии базы данных",
+    "storageDatabaseBackups": "__MISSING__:Database backups",
     "storagePurgeData": "Очистить данные",
+    "storagePurgeDataDesc": "__MISSING__:Immediately delete all records without applying retention checks. Use with caution.",
+    "storageRetentionCleanup": "__MISSING__:Retention Settings",
+    "storageRetentionCleanupDesc": "__MISSING__:Configure operational record retention and database backup cleanup.",
+    "retentionCallDays": "__MISSING__:Call {count}d",
+    "retentionAppDays": "__MISSING__:App {count}d",
+    "retentionRows": "__MISSING__:{count} rows",
     "retentionQuotaSnapshots": "Снимки квот (дни)",
+    "retentionCompressionAnalytics": "__MISSING__:Compression Analytics (days)",
     "retentionMcpAudit": "Аудит MCP (дни)",
     "retentionA2aEvents": "События A2A (дни)",
     "retentionCallLogs": "Журналы вызовов (дни)",
     "retentionUsageHistory": "История использования (дни)",
     "retentionMemoryEntries": "Записи в памяти (дни)",
+    "saveRetentionSettings": "__MISSING__:Save retention settings",
     "storageAutoVacuumMode": "Автоматический режим вакуума",
     "storageScheduledVacuum": "Запланированный вакуум",
     "storageVacuumHour": "Час вакуума (0-23)",
@@ -5565,10 +5827,16 @@
     "storageIntegrityOk": "✓ ОК",
     "storageIntegrityError": "✗ Ошибка",
     "storageUsageTokenBuffer": "Буфер токена использования",
+    "storageUsageTokenBufferDesc": "__MISSING__:Extra tokens added to reported usage to account for system prompt overhead.",
+    "storageUsageTokenBufferHint": "__MISSING__:Set to 0 to report raw provider token counts. Default: 2000.",
+    "storageUsageTokenBufferCurrent": "__MISSING__:Current: {value}",
     "compressionSettingsAutoTriggerMode": "Режим автоматического запуска",
     "compressionSettingsMcpDescriptionCompression": "Сжатие описания MCP",
+    "mcpAccessibilityTitle": "__MISSING__:MCP accessibility output",
     "compressionSettingsCavemanIntensity": "Интенсивность пещерного человека",
     "compressionSettingsCavemanOutputMode": "Режим вывода «Пещерный человек»",
+    "compressionSettingsOutputStyles": "__MISSING__:Output styles",
+    "compressionStylesTileTitle": "__MISSING__:Output styles",
     "compressionSettingsOutputIntensity": "Выходная интенсивность",
     "compressionSettingsAutoClarityBypass": "Автоматический обход четкости",
     "resilienceWaitForCooldown": "Подождите перезарядки",
@@ -5584,6 +5852,9 @@
     "cliproxyapiUrl": "URL-адрес CLIProxyAPI",
     "cliproxyapiStatus": "Статус CLIProxyAPI",
     "cliproxyapiNotDetected": "Не обнаружено",
+    "cliproxyapiImportAuthTitle": "__MISSING__:Import accounts from CLIProxyAPI",
+    "cliproxyapiImportAuthDesc": "__MISSING__:Import the OAuth accounts CLIProxyAPI already saved in ~/.cli-proxy-api/ as OmniRoute connections, so you don't have to log in to each account again. Supported account types (Gemini, Codex, Claude, Antigravity, Qwen, Kimi) are imported; others are skipped.",
+    "cliproxyapiImportAuthButton": "__MISSING__:Import accounts",
     "payloadRulesTitle": "Правила полезной нагрузки",
     "payloadRulesDesc": "Настройте мутации полезной нагрузки запроса по модели и протоколу. Изменения сохраняются в настройках и немедленно загружаются в среду выполнения после сохранения.",
     "payloadRuleDefaultTitle": "по умолчанию",
@@ -5616,6 +5887,14 @@
     "maxResponseTokensDesc": "Максимальное количество токенов, разрешенное в одном ответе.",
     "modelCooldownsTitle": "Модели в кулдауне",
     "modelCooldownsEmpty": "Сейчас нет моделей в режиме восстановления.",
+    "responsesStateTitle": "__MISSING__:Responses State",
+    "responsesStateDesc": "__MISSING__:Control how OmniRoute forwards previous_response_id.",
+    "responsesStateModeLabel": "__MISSING__:previous_response_id handling",
+    "responsesStateModeAuto": "__MISSING__:Auto",
+    "responsesStateModeStrip": "__MISSING__:Strip",
+    "responsesStateModePreserve": "__MISSING__:Preserve",
+    "responsesStateHint": "__MISSING__:Auto strips previous_response_id unless a connection explicitly enables OpenAI Responses storage. Strip is safest for stateless clients such as VS Code Custom Endpoint; context then depends on the client sending full history.",
+    "responsesStateSaveError": "__MISSING__:Failed to update Responses state setting",
     "codexFastTierTitle": "Быстрый уровень Кодекса",
     "codexFastTierDesc": "Глобально внедрите service_tier=priority для запросов OpenAI Codex.",
     "codexFastTierHint": "Если эта функция включена, OmniRoute добавляет атрибут service_tier=priority к исходящим запросам Кодекса для соединений, для которых еще не указан уровень. Для уровня приоритета требуется ключ OpenAI Enterprise API или путь Codex для аутентификации ChatGPT; другие типы ключей получат от OpenAI ошибку, связанную с уровнем. Настройки для каждого соединения на странице поставщика Кодекса имеют приоритет.",
@@ -5722,6 +6001,15 @@
     "resilienceEnableServerWaitDesc": "Если эта функция включена, OmniRoute ожидает истечения первого времени восстановления и автоматически повторяет попытку.",
     "resilienceMaxAttempts": "Максимальное количество попыток",
     "resilienceMaxWaitPerAttempt": "Максимальное ожидание за попытку",
+    "resilienceProviderCooldownTitle": "__MISSING__:Provider Cooldown",
+    "resilienceProviderCooldownScope": "__MISSING__:All combo requests",
+    "resilienceProviderCooldownTrigger": "__MISSING__:When a provider/connection fails",
+    "resilienceProviderCooldownEffect": "__MISSING__:Skips the failed provider for a cooldown period before retrying",
+    "resilienceProviderCooldownDesc": "__MISSING__:Prevents subsequent requests from re-walking the same failing providers. Cooldown scales exponentially with consecutive failures.",
+    "resilienceProviderCooldownEnabled": "__MISSING__:Enable global provider cooldown",
+    "resilienceProviderCooldownEnabledDesc": "__MISSING__:When enabled, failed providers are tracked globally and skipped for a cooldown period.",
+    "resilienceProviderCooldownMin": "__MISSING__:Minimum cooldown",
+    "resilienceProviderCooldownMax": "__MISSING__:Maximum cooldown",
     "forcedFingerprintTitle": "Всегда включено для {provider} — требуется для безопасности OAuth-аккаунта; отключить нельзя.",
     "forcedFingerprintBadge": "Обязательно",
     "codexSessionAffinityTitle": "Привязка сеансов Кодекса",
@@ -5743,10 +6031,45 @@
     "vercelRelayFreeTierNote": "Реле — это легковесные прокси-эндпоинты, развернутые на бесплатном тарифе Vercel, чтобы обойти ограничения локальной сети/региона.",
     "vercelRelayDeploying": "Развёртывание...",
     "vercelRelayDeploy": "Развернуть",
-    "proxyGlobalConfigTab": "Глобальная Конфигурация",
-    "proxyPoolTab": "Пул Прокси",
-    "freePoolTab": "Бесплатный Пул",
-    "proxyDocumentationTab": "Документация"
+    "deployRelayButton": "__MISSING__:Deploy Relay",
+    "denoRelayButton": "__MISSING__:Deploy Deno Relay",
+    "denoRelayModalTitle": "__MISSING__:Deploy Deno Relay",
+    "denoRelayWarning": "__MISSING__:Warning: A Deno Deploy organization token is required. This token will only be used to create the relay app and will never be stored by OmniRoute.",
+    "denoRelayTokenLabel": "__MISSING__:Deno Deploy Organization Token",
+    "denoRelayOrgDomainLabel": "__MISSING__:Organization Domain",
+    "denoRelayProjectNameLabel": "__MISSING__:Deno App Name",
+    "denoRelayFreeTierNote": "__MISSING__:Deno Deploy v2 runs on a global edge network. Free tier: 1M requests & 100GiB outbound traffic per month, no per-request CPU limits, up to 20 active apps & 50 custom domains.",
+    "denoRelayDeploying": "__MISSING__:Deploying...",
+    "denoRelayDeploy": "__MISSING__:Deploy",
+    "cloudflareRelaySuccess": "__MISSING__:Cloudflare Relay deployed successfully",
+    "cloudflareRelayButton": "__MISSING__:Deploy Cloudflare Relay",
+    "cloudflareRelayModalTitle": "__MISSING__:Deploy Cloudflare Worker Relay",
+    "cloudflareRelayWarning": "__MISSING__:Deploys a Cloudflare Worker that proxies LLM requests through Cloudflare's edge network — masking the host IP behind dynamic Cloudflare addresses. The Worker enforces a one-time auth secret so the public workers.dev URL cannot be reused as an open relay.",
+    "cloudflareRelayTokenHowto": "__MISSING__:Create the API token under My Profile -> API Tokens -> Create Token -> Custom Token -> Account / Workers Scripts / Edit.",
+    "cloudflareRelayAccountIdLabel": "__MISSING__:Cloudflare Account ID",
+    "cloudflareRelayAccountIdHint": "__MISSING__:Found on the right side of the Cloudflare dashboard overview page.",
+    "cloudflareRelayApiTokenLabel": "__MISSING__:Cloudflare API Token",
+    "cloudflareRelayApiTokenHint": "__MISSING__:Requires 'Workers Scripts: Edit' permission. The token is used only at deploy time and is never stored.",
+    "cloudflareRelayProjectNameLabel": "__MISSING__:Worker Name",
+    "cloudflareRelayFreeTierNote": "__MISSING__:Free tier: 100,000 requests/day per Cloudflare account.",
+    "cloudflareRelayDeploying": "__MISSING__:Deploying...",
+    "cloudflareRelayDeploy": "__MISSING__:Deploy",
+    "cloudflareRelayCredsRequired": "__MISSING__:Account ID and API Token are required",
+    "cloudflareRelayDeployFailed": "__MISSING__:Deploy failed",
+    "modelLockout": "__MISSING__:Model Lockout",
+    "modelLockoutPageDescription": "__MISSING__:Configure which HTTP error codes trigger per-model lockout and control the cooldown behavior.",
+    "modelLockoutEnabled": "__MISSING__:Enable Model Lockout",
+    "modelLockoutEnabledDescription": "__MISSING__:When enabled, models that fail with configured error codes are temporarily locked to prevent retry loops.",
+    "modelLockoutErrorCodes": "__MISSING__:Error Codes",
+    "modelLockoutErrorCodesDescription": "__MISSING__:HTTP status codes that trigger model lockout. Type a code and click Add, or select from suggestions.",
+    "modelLockoutBaseCooldown": "__MISSING__:Base Cooldown (ms)",
+    "modelLockoutBaseCooldownDescription": "__MISSING__:Initial cooldown duration in milliseconds before a model can be retried.",
+    "modelLockoutMaxCooldown": "__MISSING__:Max Cooldown (ms)",
+    "modelLockoutMaxCooldownDescription": "__MISSING__:Maximum cooldown duration in milliseconds. Prevents excessively long lockouts.",
+    "modelLockoutExponentialBackoff": "__MISSING__:Exponential Backoff",
+    "modelLockoutExponentialBackoffDescription": "__MISSING__:When enabled, each consecutive failure increases the cooldown duration exponentially.",
+    "modelLockoutMaxBackoffSteps": "__MISSING__:Max Backoff Steps",
+    "modelLockoutMaxBackoffStepsDescription": "__MISSING__:Maximum number of backoff steps before the cooldown stops growing. The Max Cooldown cap is reached first in most configurations, making this a safety ceiling for when Max Cooldown is raised."
   },
   "contextRtk": {
     "title": "RTK Engine",
@@ -5797,7 +6120,21 @@
     "searchFilters": "Фильтры поиска...",
     "tooltipDedup": "Как агрессивно удалять повторяющиеся строки.",
     "tooltipMaxChars": "Максимальное количество символов на выходной блок.",
-    "tooltipMaxLines": "Максимальное количество строк, которые следует исключить из вывода команды. Лишнее отсекается."
+    "tooltipMaxLines": "Максимальное количество строк, которые следует исключить из вывода команды. Лишнее отсекается.",
+    "learnDiscoverTitle": "__MISSING__:Learn & Discover filters",
+    "learnDiscoverDesc": "__MISSING__:Mine your captured command output (Raw Output retention must be on) to suggest new RTK filters. Suggestions only — you review and save them.",
+    "discoverHeading": "__MISSING__:Discover repeated noise",
+    "discoverButton": "__MISSING__:Scan samples",
+    "discoverScanning": "__MISSING__:Scanning…",
+    "discoverEmpty": "__MISSING__:No repeated noise found. Enable Raw Output retention and run a few commands first.",
+    "discoverSamples": "__MISSING__:{count} sample(s) scanned",
+    "discoverHits": "__MISSING__:{hits}× across samples",
+    "learnHeading": "__MISSING__:Learn a filter for a command",
+    "learnCommandPlaceholder": "__MISSING__:e.g. npm install",
+    "learnButton": "__MISSING__:Suggest filter",
+    "learnEmpty": "__MISSING__:No suggestion yet. Type a command you have run and scan.",
+    "learnSamplesUsed": "__MISSING__:Learned from {count} matching sample(s)",
+    "suggestionError": "__MISSING__:Could not load suggestions. Check management auth and try again."
   },
   "contextCombos": {
     "title": "Compression Combos",
@@ -6156,7 +6493,11 @@
     "conceptDiagramExampleHub": "OpenAI",
     "conceptDiagramHubTooltip": "Промежуточный хаб, используемый переводчиком для преобразования между форматами, которые не имеют прямого соответствия.",
     "conceptDiagramSourceTooltip": "Формат API, с которым работает ваше приложение (например, Anthropic SDK = claude).",
-    "conceptDiagramTargetTooltip": "Провайдер, куда фактически будет отправлен запрос."
+    "conceptDiagramTargetTooltip": "Провайдер, куда фактически будет отправлен запрос.",
+    "compressionEmptyHint": "__MISSING__:Fill in the input field on the Translate tab (Simple Controls or Raw JSON) to enable the preview.",
+    "compressionModeLabel": "__MISSING__:Compression mode",
+    "compressionPreviewButton": "__MISSING__:Preview Compression",
+    "compressionPreviewing": "__MISSING__:Previewing…"
   },
   "usage": {
     "title": "Использование",
@@ -6313,6 +6654,8 @@
     "notApplicable": "Н/Д",
     "rawPlanWithValue": "Необработанный план: {plan}",
     "noPlanFromProvider": "Нет плана от провайдера",
+    "tokenExpiresIn": "__MISSING__:Token expires in {time}",
+    "tokenExpired": "__MISSING__:Token expired",
     "noQuotaData": "Нет данных о квотах",
     "cardExpand": "Развернуть",
     "cardCollapse": "Свернуть",
@@ -6462,6 +6805,11 @@
     "quotaCutoffsButtonDefault": "По умолчанию",
     "quotaCutoffsButtonHelp": "Измените минимальные оставшиеся ограничения квоты для этого аккаунта.",
     "quotaCutoffsButtonDisabled": "Для этого аккаунта пока нет доступных окон квот.",
+    "deactivateAccount": "__MISSING__:Deactivate account (stop routing)",
+    "activateAccount": "__MISSING__:Activate account (resume routing)",
+    "accountActivated": "__MISSING__:Account activated",
+    "accountDeactivated": "__MISSING__:Account deactivated",
+    "toggleActiveFailed": "__MISSING__:Failed to update account status",
     "quotaCutoffsTitle": "Предельные квоты для {name} ({provider})",
     "quotaCutoffsExplainer": "Переопределить минимальный оставшийся процент квоты, при котором эта учетная запись перестанет выбираться для каждого окна квоты. Оставьте пустым, чтобы наследовать значение поставщика по умолчанию.",
     "quotaCutoffsDefaultHint": "Минимальный остаток по умолчанию: {default}%",
@@ -6482,6 +6830,7 @@
     "budgetColDailyLim": "Ежедневный лимит",
     "budgetColMonthlyLim": "Ежемесячный лимит",
     "budgetColUsedPct": "Использовано %",
+    "percentUsed": "__MISSING__:{pct}% used",
     "budgetLoading": "Загрузка…",
     "budgetNoKeysMatch": "Нет ключей, соответствующих фильтрам",
     "budgetLinearExtrapolation": "линейная экстраполяция",
@@ -7427,6 +7776,11 @@
     "modalEditTitle": "Modal Edit Title",
     "labelName": "Label Name",
     "labelType": "Тип",
+    "labelFamily": "__MISSING__:IP family",
+    "familyAuto": "__MISSING__:Auto (dual-stack)",
+    "familyIpv4": "__MISSING__:IPv4 only",
+    "familyIpv6": "__MISSING__:IPv6 only",
+    "familyHint": "__MISSING__:Egress address family. Auto keeps dual-stack; IPv4/IPv6 pin this proxy to that family (prevents a v4 leak under an IPv6-only proxy).",
     "labelHost": "Хост",
     "labelPort": "Порт",
     "labelUsername": "Имя пользователя",
@@ -7727,7 +8081,9 @@
     "loadingLogs": "Loading logs...",
     "noLogs": "No logs yet. Make some API calls to see them here.",
     "noMatchingLogs": "No logs matching current filters.",
-    "callLogsInfo": "Call logs are also saved as JSON files to {dataDir} and rotated based on {retentionDays} and {maxEntries}."
+    "callLogsInfo": "Call logs are also saved as JSON files to {dataDir} and rotated based on {retentionDays} and {maxEntries}.",
+    "loadMore": "__MISSING__:Load More",
+    "loadingMore": "__MISSING__:Loading more..."
   },
   "proxyLogger": {
     "filterAll": "All",
@@ -8020,6 +8376,16 @@
     "status": "Status",
     "enabled": "Enabled",
     "disabled": "Disabled",
+    "installedTab": "__MISSING__:Installed",
+    "marketplaceTab": "__MISSING__:Marketplace",
+    "marketplaceUrlLabel": "__MISSING__:Custom Marketplace URL",
+    "marketplaceUrlPlaceholder": "__MISSING__:Leave empty for official Omniroute registry",
+    "saveMarketplaceUrl": "__MISSING__:Save & Reload",
+    "marketplaceUrlSaved": "__MISSING__:Marketplace URL updated",
+    "marketplaceEmpty": "__MISSING__:No plugins found in marketplace.",
+    "verified": "__MISSING__:Verified",
+    "install": "__MISSING__:Install",
+    "installedFromMarketplace": "__MISSING__:Plugin {name} installed!",
     "hooks": "Hooks"
   },
   "quotaPlans": {
@@ -8215,6 +8581,28 @@
     "quickLinks": "Быстрые ссылки",
     "quickLinkProviders": "Настроить провайдеров",
     "quickLinkInspector": "Просмотр трафика в Traffic Inspector",
+    "maintenanceTitle": "__MISSING__:Maintenance & Diagnostics",
+    "maintenanceSubtitle": "__MISSING__:Self-test the capture pipeline, undo leftover system state, and move your setup between machines.",
+    "orphanedStateWarning": "__MISSING__:A previous session left system state behind (DNS spoof, CA, or system proxy). Run Repair to clean it up.",
+    "diagnose": "__MISSING__:Diagnose",
+    "diagnosing": "__MISSING__:Diagnosing…",
+    "diagnoseHealthy": "__MISSING__:Capture pipeline is healthy.",
+    "diagnoseUnhealthy": "__MISSING__:Capture pipeline has problems:",
+    "repair": "__MISSING__:Repair",
+    "repairing": "__MISSING__:Repairing…",
+    "repairDone": "__MISSING__:Repaired: {items}",
+    "repairNothing": "__MISSING__:Nothing to repair — system state is clean.",
+    "removeCa": "__MISSING__:Remove CA",
+    "removeCaConfirm": "__MISSING__:Remove CA?",
+    "removeCaDone": "__MISSING__:MITM root CA removed from the OS trust store.",
+    "removing": "__MISSING__:Removing…",
+    "confirm": "__MISSING__:Confirm",
+    "exportConfig": "__MISSING__:Export config",
+    "exporting": "__MISSING__:Exporting…",
+    "importConfig": "__MISSING__:Import config",
+    "importing": "__MISSING__:Importing…",
+    "importInvalidJson": "__MISSING__:The selected file is not valid JSON.",
+    "importDone": "__MISSING__:Imported {bypass} bypass · {hosts} hosts · {agents} agents",
     "save": "Сохранить",
     "saving": "Сохранение…",
     "cancel": "Отмена",
@@ -8242,6 +8630,8 @@
     "httpProxyModeDesc": "Используйте переменную окружения HTTP_PROXY",
     "systemWideMode": "Системный уровень",
     "systemWideModeDesc": "Перехватить весь системный трафик (расширенный)",
+    "tproxyMode": "__MISSING__:TPROXY Decrypt",
+    "tproxyModeUnavailable": "__MISSING__:TPROXY decrypt requires Linux + root + the native addon",
     "filterBarTitle": "Фильтры",
     "profileLlmOnly": "Только LLM",
     "profileCustom": "Пользовательский",
@@ -8298,6 +8688,7 @@
     "httpProxyTitle": "HTTP Proxy Snippet — порт {port}",
     "notRecording": "Не записывается",
     "anyStatus": "Любой статус",
+    "liveOnly": "__MISSING__:Live",
     "viewingRecordedSession": "Просмотр записанной сессии",
     "backToLive": "Назад к прямому эфиру",
     "untitledSession": "Безымянная сессия",
@@ -8348,6 +8739,7 @@
     "comparison": {
       "title": "Поймите 3 типа CLI в OmniRoute",
       "thisPage": "[Эта страница ✓]",
+      "open": "__MISSING__:Open →",
       "code": {
         "title": "Инструмент кода",
         "desc": "Точки к Omni",
@@ -8377,9 +8769,11 @@
       "manualConfig": "Ручная настройка",
       "installGuide": "Руководство по установке",
       "endpointLabel": "Конечная точка",
+      "baseUrlFull": "__MISSING__:Full Base URL",
       "baseUrlPartial": "Частичный базовый URL",
       "refreshDetection": "Обнаружение обновления",
-      "alsoAcp": "также ACP"
+      "alsoAcp": "также ACP",
+      "connectProviderHint": "__MISSING__:Connect a provider in Providers"
     },
     "detail": {
       "back": "Назад",
@@ -8527,5 +8921,26 @@
     "regenerateRunning": "Регенерация навыков…",
     "regenerateSuccess": "Навыки успешно восстановлены.",
     "regenerateError": "Не удалось восстановить навыки."
+  },
+  "freeProviderRankingsPage": {
+    "title": "__MISSING__:Free Provider Rankings",
+    "subtitle": "__MISSING__:Best free providers ranked by model ELO scores from Arena AI leaderboards",
+    "loading": "__MISSING__:Loading rankings...",
+    "errorLoading": "__MISSING__:Failed to load rankings",
+    "emptyState": "__MISSING__:No rankings available yet. Arena ELO data syncs on startup (daily) — check back shortly, or trigger a manual sync. Disable Arena ELO Sync in Feature Flags or set ARENA_ELO_SYNC_ENABLED=false to opt out.",
+    "bestModel": "__MISSING__:Best",
+    "allCategories": "__MISSING__:All Categories",
+    "categoryDefault": "__MISSING__:Default",
+    "categoryCoding": "__MISSING__:Coding",
+    "categoryReview": "__MISSING__:Review",
+    "categoryDocumentation": "__MISSING__:Documentation",
+    "categoryDebugging": "__MISSING__:Debugging",
+    "colRank": "__MISSING__:Rank",
+    "colProvider": "__MISSING__:Provider",
+    "colTopModel": "__MISSING__:Top Model",
+    "colScore": "__MISSING__:Score",
+    "colAvgScore": "__MISSING__:Avg Score",
+    "colModels": "__MISSING__:Models",
+    "colType": "__MISSING__:Type"
   }
 }
diff --git a/src/i18n/messages/sk.json b/src/i18n/messages/sk.json
index 7e9f61e0fb..3db55a380b 100644
--- a/src/i18n/messages/sk.json
+++ b/src/i18n/messages/sk.json
@@ -393,6 +393,7 @@
     "cloudBenefitAccess": "Cloud Benefit Access",
     "maxRetries": "Max Retries",
     "queueTimeout": "Queue Timeout",
+    "queueDepth": "__MISSING__:Queue Depth",
     "addProvider": "Add Provider",
     "realtime": "Realtime",
     "totalTranslations": "Total Translations",
@@ -709,6 +710,7 @@
     "batchFilesListFilesTable": "Súbory",
     "batchPageLoadingMore": "Načítava sa viac…",
     "recommended": "__MISSING__:Recommended",
+    "understand": "__MISSING__:I understand",
     "batchConceptTitle": "Batch processing",
     "batchConceptSubtitle": "Process thousands of requests asynchronously at ~50% of the cost (24h window). Ideal for evaluations, classification, and embeddings.",
     "batchConceptHowItWorks": "How it works",
@@ -773,36 +775,13 @@
     "filesListUploadButton": "Upload",
     "filesListUsedByColumn": "Used by",
     "filesListUsedByNone": "None",
-    "filesListDelete": "Delete",
-    "filesListDownload": "Download",
-    "batchDetailActionCancel": "Cancel batch",
-    "batchDetailActionRetry": "Retry failed requests",
-    "batchDetailCancelling": "Cancelling…",
-    "batchDetailRetrying": "Preparing retry…",
-    "batchDetailCancelConfirm": "Cancel this batch? In-progress requests will stop.",
-    "batchActionCancelError": "Failed to cancel batch. Try again.",
-    "batchActionRetryError": "Failed to retry failed requests. Try again.",
-    "batchConceptRetentionNote": "Results and error files are retained for 30 days (Anthropic: 29 days)",
     "filesListUsedByRoleInput": "input",
     "filesListUsedByRoleOutput": "output",
     "filesListUsedByRoleError": "error",
-    "batchListProgressPartial": "(partial)",
     "filesListSizeColumn": "Size",
+    "batchListProgressPartial": "(partial)",
     "batchListProviderColumn": "Provider",
     "batchListProviderUnknown": "—",
-    "batchListBatchCreated": "Batch {id} created — refreshing list…",
-    "batchListBatchCreatedDismiss": "Dismiss",
-    "batchListRefreshing": "Refreshing…",
-    "batchListRefresh": "Refresh",
-    "uploadFileModalRemove": "Remove",
-    "uploadFileModalUploading": "Uploading…",
-    "wizardInputReading": "Reading file…",
-    "wizardInputReady": "Ready",
-    "wizardInputLargeFileLabel": "Large file — sampling validation",
-    "wizardInputCsvJsonlReady": "JSONL generated — ready to validate.",
-    "wizardInputLargeFileWarning": "Large file detected — validation runs by sampling (first 5 MB + last 100 KB). Full validation happens server-side.",
-    "wizardCostWindow24h": "24h completion window",
-    "wizardValidationFieldsOk": "required fields valid",
     "batchListProviderOther": "Other",
     "batchListTitle": "Batches",
     "batchListCount": "{count} batches",
@@ -839,8 +818,33 @@
     "wizardCostWindow": "Window",
     "wizardDestinationSelectProvider": "Select a provider…",
     "wizardDestinationSelectModel": "Select a model…",
-    "wizardDestinationConnectProvider": "Connect a provider"
+    "wizardDestinationConnectProvider": "Connect a provider",
+    "batchListBatchCreated": "Batch {id} created — refreshing list…",
+    "batchListBatchCreatedDismiss": "Dismiss",
+    "batchListRefreshing": "Refreshing…",
+    "batchListRefresh": "Refresh",
+    "uploadFileModalRemove": "Remove",
+    "uploadFileModalUploading": "Uploading…",
+    "wizardInputReading": "Reading file…",
+    "wizardInputReady": "Ready",
+    "wizardInputLargeFileLabel": "Large file — sampling validation",
+    "wizardInputCsvJsonlReady": "JSONL generated — ready to validate.",
+    "wizardInputLargeFileWarning": "Large file detected — validation runs by sampling (first 5 MB + last 100 KB). Full validation happens server-side.",
+    "wizardCostWindow24h": "24h completion window",
+    "wizardValidationFieldsOk": "required fields valid",
+    "filesListDelete": "Delete",
+    "filesListDownload": "Download",
+    "batchDetailActionCancel": "Cancel batch",
+    "batchDetailActionRetry": "Retry failed requests",
+    "batchDetailCancelling": "Cancelling…",
+    "batchDetailRetrying": "Preparing retry…",
+    "batchDetailCancelConfirm": "Cancel this batch? In-progress requests will stop.",
+    "batchActionCancelError": "Failed to cancel batch. Try again.",
+    "batchActionRetryError": "Failed to retry failed requests. Try again.",
+    "batchConceptRetentionNote": "Results and error files are retained for 30 days (Anthropic: 29 days)"
   },
+  "featureFlagOmnirouteEmergencyFallbackDescription": "__MISSING__:Route budget-exhausted requests to the emergency free fallback provider/model.",
+  "featureFlagArenaEloSyncEnabledDescription": "__MISSING__:Enable periodic Arena AI leaderboard ELO sync for model intelligence rankings.",
   "sidebar": {
     "home": "Domov",
     "dashboard": "Dashboard",
@@ -968,6 +972,7 @@
     "aiFeaturesSection": "AI Features",
     "mcp": "MCP",
     "a2a": "A2A",
+    "plugins": "__MISSING__:Plugins",
     "apiEndpoints": "API Endpoints",
     "batchFiles": "Files",
     "analyticsEvals": "Evals",
@@ -976,6 +981,10 @@
     "analyticsComboHealth": "Combo Health",
     "analyticsCompression": "Compression",
     "costsBudget": "Budget",
+    "costsFreeTiers": "__MISSING__:Free-Tier Budget",
+    "costsFreeTiersSubtitle": "__MISSING__:Monthly free-token allowances",
+    "freeProviderRankings": "__MISSING__:Free Provider Rankings",
+    "freeProviderRankingsSubtitle": "__MISSING__:Best free providers ranked by model ELO scores",
     "costsQuotaShare": "Quota Sharing",
     "costsPricing": "Pricing",
     "logsProxy": "Proxy Logs",
@@ -987,10 +996,12 @@
     "settingsAppearance": "Appearance",
     "settingsAi": "AI Settings",
     "settingsSecurity": "Security",
+    "settingsAccessTokens": "__MISSING__:Access Tokens",
     "settingsFeatureFlags": "Príznaky funkcie",
     "settingsAuthz": "__MISSING__:Authz",
     "settingsRouting": "Routing",
     "settingsResilience": "Resilience",
+    "modelLockout": "__MISSING__:Model Lockout",
     "settingsAdvanced": "Advanced",
     "omniProxySection": "OmniProxy",
     "quotaTracker": "Provider Quota",
@@ -1036,6 +1047,8 @@
     "analyticsCompressionSubtitle": "Token savings stats",
     "analyticsSearchSubtitle": "Search tool analytics",
     "analyticsEvalsSubtitle": "Eval suite results",
+    "providerStats": "__MISSING__:Provider Stats",
+    "providerStatsSubtitle": "__MISSING__:Latency and performance metrics",
     "logsSubtitle": "Application logs",
     "logsProxySubtitle": "Proxy traffic logs",
     "consoleLogsSubtitle": "Console output",
@@ -1055,6 +1068,7 @@
     "agentSkillsSubtitle": "A2A skill registry",
     "mcpSubtitle": "MCP server controls",
     "a2aSubtitle": "A2A protocol server",
+    "pluginsSubtitle": "__MISSING__:Plugin marketplace & installs",
     "mediaSubtitle": "Cached media files",
     "batchFilesSubtitle": "Batch input/output files",
     "settingsSubtitle": "All settings",
@@ -1065,13 +1079,41 @@
     "settingsResilienceSubtitle": "Retries and breakers",
     "settingsAdvancedSubtitle": "Power user options",
     "settingsSecuritySubtitle": "Auth and encryption",
+    "settingsAccessTokensSubtitle": "__MISSING__:Scoped CLI tokens for remote mode",
     "settingsFeatureFlagsSubtitle": "Prepínajte možnosti systému",
     "settingsSidebar": "Sidebar",
     "settingsSidebarSubtitle": "Customize sidebar layout",
     "settingsAuthzSubtitle": "__MISSING__:Route inventory and bypass policy",
     "docsSubtitle": "Documentation",
     "issuesSubtitle": "Report a bug",
-    "changelogSubtitle": "Release notes"
+    "changelogSubtitle": "Release notes",
+    "costsQuotaPlans": "__MISSING__:Plans & Quotas",
+    "costsQuotaPlansSubtitle": "__MISSING__:Configure plans by provider",
+    "activity": "__MISSING__:Activity",
+    "activitySubtitle": "__MISSING__:Friendly feed of recent events",
+    "logsGroup": "__MISSING__:Logs",
+    "systemGroup": "__MISSING__:System",
+    "costsOverview": "__MISSING__:Overview",
+    "costsOverviewSubtitle": "__MISSING__:Consolidated cost analysis",
+    "agentBridge": "__MISSING__:Agent Bridge",
+    "agentBridgeSubtitle": "__MISSING__:Intercept IDE agent traffic",
+    "trafficInspector": "__MISSING__:Traffic Inspector",
+    "trafficInspectorSubtitle": "__MISSING__:Monitor LLM calls + debug any HTTPS traffic",
+    "cliCode": "__MISSING__:CLI Code",
+    "cliCodeSubtitle": "__MISSING__:Code tools pointing to OmniRoute",
+    "cliAgents": "__MISSING__:CLI Agents",
+    "cliAgentsSubtitle": "__MISSING__:Autonomous CLI agents",
+    "acpAgents": "__MISSING__:ACP Agents",
+    "acpAgentsSubtitle": "__MISSING__:CLIs spawned by OmniRoute",
+    "skipToContent": "__MISSING__:Skip to content",
+    "unpinSection": "__MISSING__:Unpin section",
+    "pinSectionOpen": "__MISSING__:Pin section open",
+    "reloadPage": "__MISSING__:Reload Page",
+    "dragReorderSection": "__MISSING__:Drag to reorder section",
+    "dragReorderItem": "__MISSING__:Drag to reorder",
+    "cannotHide": "__MISSING__:This item cannot be hidden",
+    "alwaysVisible": "__MISSING__:Always visible",
+    "groupSeparatorLabel": "__MISSING__:Separator"
   },
   "webhooks": {
     "title": "Webhooky",
@@ -1272,7 +1314,47 @@
     "a2aEvents": "Udalosti",
     "a2aArtifacts": "Artefakty",
     "a2aNoTasks": "Neboli zaznamenané žiadne úlohy A2A.",
-    "a2aLoadingTasks": "Načítavajú sa úlohy A2A..."
+    "a2aLoadingTasks": "Načítavajú sa úlohy A2A...",
+    "actor": "__MISSING__:Actor",
+    "actorPlaceholder": "__MISSING__:Filter by actor",
+    "eventTypes": {
+      "apiKey.activate": "__MISSING__:API Key Activated",
+      "apiKey.ban": "__MISSING__:API Key Banned",
+      "apiKey.deactivate": "__MISSING__:API Key Deactivated",
+      "apiKey.regenerate": "__MISSING__:API Key Regenerated",
+      "apiKey.scopes.grant": "__MISSING__:API Key Scopes Granted",
+      "apiKey.scopes.revoke": "__MISSING__:API Key Scopes Revoked",
+      "apiKey.scopes.update": "__MISSING__:API Key Scopes Updated",
+      "apiKey.unban": "__MISSING__:API Key Unbanned",
+      "auth.login.error": "__MISSING__:Login Error",
+      "auth.login.failed": "__MISSING__:Login Failed",
+      "auth.login.locked": "__MISSING__:Login Locked",
+      "auth.login.misconfigured": "__MISSING__:Login Misconfigured",
+      "auth.login.setup_required": "__MISSING__:Login Setup Required",
+      "auth.login.success": "__MISSING__:Login Success",
+      "auth.logout.success": "__MISSING__:Logout Success",
+      "compliance.cleanup": "__MISSING__:Compliance Cleanup",
+      "provider.credentials.applied": "__MISSING__:Provider Credentials Applied",
+      "provider.credentials.batch_revoked": "__MISSING__:Provider Credentials Batch Revoked",
+      "provider.credentials.bulk_created": "__MISSING__:Provider Credentials Bulk Created",
+      "provider.credentials.bulk_imported": "__MISSING__:Provider Credentials Bulk Imported",
+      "provider.credentials.created": "__MISSING__:Provider Credentials Created",
+      "provider.credentials.imported": "__MISSING__:Provider Credentials Imported",
+      "provider.credentials.revoked": "__MISSING__:Provider Credentials Revoked",
+      "provider.credentials.updated": "__MISSING__:Provider Credentials Updated",
+      "provider.validation.ssrf_blocked": "__MISSING__:Provider SSRF Blocked",
+      "quota.plan.updated": "__MISSING__:Quota Plan Updated",
+      "quota.pool.created": "__MISSING__:Quota Pool Created",
+      "quota.pool.deleted": "__MISSING__:Quota Pool Deleted",
+      "quota.pool.updated": "__MISSING__:Quota Pool Updated",
+      "quota.store.driver_changed": "__MISSING__:Quota Store Driver Changed",
+      "server.start": "__MISSING__:Server Start",
+      "service.reveal_api_key": "__MISSING__:Service API Key Revealed",
+      "settings.update": "__MISSING__:Settings Updated",
+      "settings.update_failed": "__MISSING__:Settings Update Failed",
+      "sync.token.created": "__MISSING__:Sync Token Created",
+      "sync.token.revoked": "__MISSING__:Sync Token Revoked"
+    }
   },
   "themesPage": {
     "title": "Themes",
@@ -1381,7 +1463,8 @@
     "settingsResilienceDescription": "Circuit breaker, retry, and fallback configuration",
     "settingsAdvancedDescription": "Advanced payload rules, request limits, and proxy API settings",
     "mitmProxyDescription": "Configure MITM proxy settings for traffic inspection and debugging",
-    "oneProxyDescription": "Configure 1Proxy settings for advanced proxy chaining"
+    "oneProxyDescription": "Configure 1Proxy settings for advanced proxy chaining",
+    "omniSkillsDescription": "__MISSING__:Install and manage sandbox skills for automated prompt and tool execution"
   },
   "home": {
     "quickStart": "Rýchly štart",
@@ -1612,16 +1695,24 @@
     "ownUsageVisibilityDesc": "Povoliť tomuto kľúču volať vlastný stavový endpoint pre vlastné použitie v USD, percento rozpočtu a súčty tokenov.",
     "sharedAccountQuotaVisibility": "Zdieľaná kvóta účtu",
     "sharedAccountQuotaVisibilityDesc": "Povoliť tomuto kľúču zobraziť zdieľanú upstream kvótu účtu, keď je nakonfigurované jedno explicitné pripojenie.",
+    "localUsageCommand": "__MISSING__:Allow local usage command",
+    "localUsageCommandDesc": "__MISSING__:Allows this API key to use @@om-usage to retrieve cached usage and quota information without calling an upstream provider.",
+    "localUsageCommandBadge": "__MISSING__:Usage cmd",
     "keyCreated": "Kľúč API bol vytvorený",
     "keyCreatedSuccess": "Kľúč bol úspešne vytvorený!",
     "keyCreatedNote": "Skopírujte a uložte tento kľúč teraz – už sa nebude zobrazovať.",
     "done": "Hotovo",
     "savePermissions": "Uložiť povolenia",
-    "endpointRestrictions": "__MISSING__:Allowed Endpoints",
-    "allEndpointsAllowed": "__MISSING__:This key can access all API endpoints.",
-    "endpointsRestricted": "__MISSING__:Restricted to {count} endpoint{count, plural, one {} other {s}}.",
+    "endpointRestrictions": "Allowed Endpoints",
+    "allEndpointsAllowed": "This key can access all API endpoints.",
+    "endpointsRestricted": "Restricted to {count} endpoint{count, plural, one {} other {s}}.",
     "autoResolve": "Auto-Resolve",
     "autoResolveDesc": "Auto-resolve ambiguous model names to native provider for this API key.",
+    "streamDefaultMode": "__MISSING__:Stream Default Compatibility",
+    "streamDefaultModeDesc": "__MISSING__:Controls omitted `stream` flags for this key. JSON mode returns non-streaming responses unless the client explicitly requests SSE.",
+    "streamDefaultLegacy": "__MISSING__:Legacy",
+    "streamDefaultJson": "__MISSING__:JSON Compatible",
+    "streamDefaultBadge": "__MISSING__:JSON stream default",
     "keyActive": "Key Active",
     "keyActiveDesc": "Enable or disable this API key. Disabled keys are immediately rejected with 403.",
     "accessSchedule": "Access Schedule",
@@ -1667,6 +1758,7 @@
     "keyOnlyAvailableAtCreation": "Full key available only at creation time — copy it when you first create the key",
     "modelsCount": "{count, plural, one {# model} other {# models}}",
     "lastUsedOn": "Naposledy: {date}",
+    "viewCostsFor": "__MISSING__:View costs for {name}",
     "editPermissions": "Upraviť povolenia",
     "deleteKey": "Tlačidlo Delete",
     "regenerateKey": "Obnoviť kľúč",
@@ -1708,9 +1800,12 @@
     "shownOf": "__MISSING__:{shown} of {total} shown",
     "emptyFilterTitle": "__MISSING__:No keys match your filters",
     "emptyFilterClear": "__MISSING__:Clear filters",
-    "endpointRestrictions": "Allowed Endpoints",
-    "allEndpointsAllowed": "This key can access all API endpoints.",
-    "endpointsRestricted": "Restricted to {count} endpoint{count, plural, one {} other {s}}."
+    "disableNonPublicModels": "__MISSING__:Disable Non-Public Models",
+    "disableNonPublicModelsDesc": "__MISSING__:Reject requests for models that are not discovered or not marked as public in the provider catalog",
+    "normalKeysSection": "__MISSING__:Normal keys",
+    "quotaKeysSection": "__MISSING__:Quota keys",
+    "quotaPill": "__MISSING__:QUOTA",
+    "quotaModeOnly": "__MISSING__:qtSd-only"
   },
   "auditLog": {
     "title": "Audit Log",
@@ -1845,6 +1940,8 @@
     "freeQuota": "Free quota/mo",
     "scrapeUrl": "URL to scrape",
     "scrapeUrlPlaceholder": "https://example.com",
+    "scrapeUrlRequired": "__MISSING__:URL is required",
+    "scrapeUrlInvalid": "__MISSING__:Invalid URL — it must start with http:// or https://",
     "scrapeExtract": "Extract",
     "scrapeExtracting": "Extracting…",
     "scrapeFullPage": "Full page",
@@ -1858,6 +1955,8 @@
     "scrapeMetadata": "Metadata",
     "scrapeProvider": "Provider",
     "scrapeSize": "Size",
+    "scrapeEmptyState": "__MISSING__:Enter a URL to extract its content",
+    "scrapeProvidersAvailable": "__MISSING__:Available providers: Firecrawl, Jina Reader, Tavily.",
     "compareRun": "Compare",
     "compareRunning": "Comparing…",
     "autoProvider": "Auto (cheapest)",
@@ -2245,6 +2344,8 @@
     "leastLatency": "Najnižšia latencia",
     "comboName": "Kombinovaný názov",
     "comboNamePlaceholder": "moje-kombo",
+    "comboDescription": "__MISSING__:Description",
+    "comboDescriptionPlaceholder": "__MISSING__:Optional note describing this combo",
     "deleteConfirm": "Odstrániť túto kombináciu?",
     "noCombosYet": "Zatiaľ žiadne kombá",
     "comboCreated": "Kombinácia bola úspešne vytvorená",
@@ -2284,6 +2385,8 @@
     "resetAwareDesc": "Vyrovnáva zostávajúcu kvótu oproti 5-hodinovým a týždenným resetom a potom sa v každom kole porovnáva s podobnými skóre",
     "strictRandom": "Strict Random",
     "strictRandomDesc": "Shuffle deck — uses each model once before reshuffling",
+    "fusion": "__MISSING__:Fusion",
+    "fusionDesc": "__MISSING__:Fans the prompt to every panel model in parallel, then a judge model synthesizes one final answer",
     "models": "Modelky",
     "autoBalance": "Automatické vyváženie",
     "advancedSettings": "Rozšírené nastavenia",
@@ -2982,14 +3085,19 @@
     "ngrokStarted": "ngrok tunel začal",
     "ngrokStopped": "tunel ngrok zastavený",
     "ngrokRequestFailed": "Aktualizácia tunela ngrok zlyhala",
-    "tokenSaverSubtitle": "Na každú požiadavku miňte menej žetónov.",
-    "tokenSaverToolOutput": "Výstup nástroja",
-    "tokenSaverLlmOutput": "LLM výstup",
-    "tokenSaverInputCompression": "Vstupná kompresia",
     "apiEndpointsCatalogUnavailable": "Katalóg API nie je k dispozícii",
     "apiEndpointsSearchPlaceholder": "Hľadať koncové body...",
     "apiEndpointsRequiresAuth": "Vyžaduje autorizáciu",
     "apiEndpointsNoMatch": "Vášmu filtru nevyhovujú žiadne koncové body",
+    "vscodeAliasTitle": "__MISSING__:VS Code Token Alias",
+    "vscodeAliasDescriptionReady": "__MISSING__:Ready-to-paste compatibility URLs using the /api/v1/vscode/TOKEN/... endpoint.",
+    "vscodeAliasDescriptionError": "__MISSING__:Showing placeholder URLs because CLI keys could not be loaded in this session.",
+    "vscodeAliasDescriptionLoading": "__MISSING__:Loading CLI keys. Placeholder URLs are shown until a key is available.",
+    "vscodeAliasDescriptionPlaceholder": "__MISSING__:Showing placeholder URLs. Create or activate an API key in CLI Tools to replace TOKEN.",
+    "vscodeAliasManage": "__MISSING__:CLI Tools",
+    "vscodeAliasBaseLabel": "__MISSING__:VS Code base",
+    "vscodeAliasModelsLabel": "__MISSING__:VS Code models",
+    "vscodeAliasChatLabel": "__MISSING__:VS Code chat",
     "localServer": "Lokálny server",
     "cloudOmniroute": "Cloud OmniRoute",
     "copyUrl": "Kopírovať URL",
@@ -3002,7 +3110,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
@@ -3178,42 +3289,187 @@
     "a2aStep3": "__MISSING__:Track and cancel tasks with {code1} and {code2}."
   },
   "memory": {
-    "title": "Memory Management",
-    "description": "View and manage stored memory entries",
-    "memories": "Memories",
-    "totalEntries": "Total Entries",
-    "tokensUsed": "Tokens Used",
-    "hitRate": "Hit Rate",
-    "loading": "Loading memories...",
-    "noMemories": "No memories found",
-    "search": "Search memories...",
-    "allTypes": "All Types",
-    "export": "Export",
-    "import": "Import",
-    "addMemory": "Add Memory",
-    "type": "Type",
-    "key": "Key",
-    "content": "Content",
-    "created": "Created",
-    "actions": "Actions",
-    "delete": "Delete",
-    "factual": "Factual",
-    "episodic": "Episodic",
-    "procedural": "Procedural",
-    "semantic": "Semantic",
     "a": "A",
-    "pipelineOk": "Potrubie je v poriadku ({latencyMs}ms)",
-    "pipelineError": "Chyba potrubia",
-    "healthUnknown": "Zdravie neznáme",
-    "checkingHealth": "Kontroluje sa…",
-    "checkHealth": "Skontrolujte zdravie",
-    "pageInfo": "Strana {page} z {totalPages} (spolu {total})",
-    "previous": "Predchádzajúce",
-    "next": "Ďalej",
+    "actions": "Actions",
+    "addMemory": "Add Memory",
+    "allTypes": "All Types",
     "cancel": "Zrušiť",
-    "save": "Uložiť",
+    "checkHealth": "Skontrolujte zdravie",
+    "checkingHealth": "Kontroluje sa…",
+    "compactOld": "__MISSING__:Compact old",
+    "concept": {
+      "title": "__MISSING__:Conversational Memory",
+      "description": "__MISSING__:OmniRoute learns from every conversation, remembering facts, episodes, procedures, and semantic concepts that make responses more accurate and context-aware.",
+      "howWorksToggle": "__MISSING__:How it works",
+      "howWorksContent": "__MISSING__:1. Automatic extraction: at the end of each response, facts and episodes are detected and saved automatically.\n2. Retrieval: before each response, the most relevant memories are searched via FTS5 (exact), vector (semantic), or hybrid RRF.\n3. Injection: relevant memories are injected into the assistant context to improve response quality.\n4. Management: use this page to view, edit, export, and compact old memories."
+    },
+    "content": "Content",
+    "contentPlaceholder": "Hodnota alebo obsah JSON na zapamätanie",
+    "created": "Created",
+    "delete": "Delete",
+    "deleteConfirmDesc": "__MISSING__:This action cannot be undone. The memory will be permanently removed.",
+    "deleteConfirmTitle": "__MISSING__:Delete memory?",
+    "description": "View and manage stored memory entries",
+    "editMemory": "__MISSING__:Edit memory",
+    "editModal": {
+      "title": "__MISSING__:Edit Memory",
+      "metadataLabel": "__MISSING__:Metadata (JSON)",
+      "metadataInvalid": "__MISSING__:Invalid JSON",
+      "saveFailed": "__MISSING__:Failed to save memory"
+    },
+    "embedding": {
+      "autoLabel": "__MISSING__:Automatic",
+      "autoDesc": "__MISSING__:Uses best available: remote provider > static > transformers",
+      "remoteLabel": "__MISSING__:Remote provider",
+      "remoteDesc": "__MISSING__:Uses embedding via provider API (requires API key)",
+      "staticLabel": "__MISSING__:Static local (potion)",
+      "staticDesc": "__MISSING__:Local embedding without WASM or external dependencies",
+      "transformersLabel": "__MISSING__:Transformers.js (MiniLM)",
+      "transformersDesc": "__MISSING__:Local embedding via @huggingface/transformers (~400MB RAM)",
+      "providerModelLabel": "__MISSING__:Provider / Model",
+      "noRemoteProviders": "__MISSING__:No providers with configured API key",
+      "selectProviderModel": "__MISSING__:Select a model",
+      "staticEnabledLabel": "__MISSING__:Enable Static Potion",
+      "staticEnabledDesc": "__MISSING__:Download and use potion-base-8M model locally",
+      "transformersEnabledLabel": "__MISSING__:Enable Transformers.js",
+      "transformersEnabledDesc": "__MISSING__:Opt-in for local MiniLM (~400MB RAM, ~3s cold start)",
+      "transformersWarning": "__MISSING__:Requires ~400MB RAM and ~3s cold start on the first semantic query."
+    },
+    "emptyState": {
+      "title": "__MISSING__:No memories yet",
+      "description": "__MISSING__:Memories are created automatically from conversations. You can also add them manually using the button above."
+    },
+    "engine": {
+      "statusTitle": "__MISSING__:Engine Status",
+      "embeddingTitle": "__MISSING__:Embedding Source",
+      "rerankTitle": "__MISSING__:Rerank (optional)",
+      "reindexNow": "__MISSING__:Reindex now",
+      "reindexStarted": "__MISSING__:Reindexing started ({pending} pending)",
+      "reindexFailed": "__MISSING__:Failed to start reindexing",
+      "keywordLabel": "__MISSING__:Keyword (FTS5)",
+      "keywordReason": "__MISSING__:Keyword search always available",
+      "embeddingLabel": "__MISSING__:Embedding",
+      "vectorStoreLabel": "__MISSING__:Vector Store",
+      "qdrantLabel": "__MISSING__:Qdrant",
+      "rerankLabel": "__MISSING__:Rerank",
+      "qdrantDisabled": "__MISSING__:Disabled",
+      "qdrantOk": "__MISSING__:Healthy ({latencyMs}ms)",
+      "qdrantError": "__MISSING__:Connection error",
+      "needsReindex": "__MISSING__:{count} memory(ies) need reindexing",
+      "configureCta": "__MISSING__:Configure",
+      "vectorStoreInstallHint": "__MISSING__:To enable vector search: npm install sqlite-vec (needs native Node.js, not WASM), then restart."
+    },
+    "episodic": "Episodic",
+    "export": "Export",
+    "factual": "Factual",
+    "healthUnknown": "Zdravie neznáme",
+    "hitRate": "Hit Rate",
+    "import": "Import",
+    "importError": "__MISSING__:Failed to import file",
+    "importResult": "__MISSING__:{imported} imported, {skipped} skipped",
+    "key": "Key",
     "keyPlaceholder": "napr. používateľské.predvoľby.téma",
-    "contentPlaceholder": "Hodnota alebo obsah JSON na zapamätanie"
+    "loading": "Loading memories...",
+    "memories": "Memories",
+    "next": "Ďalej",
+    "noMemories": "No memories found",
+    "pageInfo": "Strana {page} z {totalPages} (spolu {total})",
+    "pipelineError": "Chyba potrubia",
+    "pipelineOk": "Potrubie je v poriadku ({latencyMs}ms)",
+    "playground": {
+      "infoTitle": "__MISSING__:Memory Playground",
+      "infoDesc": "__MISSING__:Simulate what would be retrieved for a given query. No memories are modified — read-only preview.",
+      "queryLabel": "__MISSING__:Test query",
+      "queryPlaceholder": "__MISSING__:Type a question or test phrase...",
+      "strategyLabel": "__MISSING__:Strategy",
+      "strategyExact": "__MISSING__:Exact (FTS5)",
+      "strategySemantic": "__MISSING__:Semantic (vector)",
+      "strategyHybrid": "__MISSING__:Hybrid (RRF)",
+      "budgetLabel": "__MISSING__:Budget (tokens)",
+      "simulate": "__MISSING__:Simulate",
+      "resultsTitle": "__MISSING__:{count} result(s)",
+      "resolutionTitle": "__MISSING__:Search resolution",
+      "resolutionEmbedding": "__MISSING__:Embedding",
+      "resolutionStore": "__MISSING__:Vector store",
+      "resolutionStrategy": "__MISSING__:Strategy used",
+      "rerankApplied": "__MISSING__:Rerank applied",
+      "fallback": "__MISSING__:Fallback",
+      "noResults": "__MISSING__:No memories found for this query.",
+      "tokensUsed": "__MISSING__:tokens used",
+      "none": "__MISSING__:none",
+      "errorFetch": "__MISSING__:Failed to fetch preview"
+    },
+    "previous": "Predchádzajúce",
+    "procedural": "Procedural",
+    "qdrant": {
+      "title": "__MISSING__:Qdrant (Vector Store Tier 2)",
+      "description": "__MISSING__:Optional Qdrant integration for scalable semantic search",
+      "enableLabel": "__MISSING__:Enable Qdrant",
+      "enableDesc": "__MISSING__:When enabled, Qdrant is used as the primary vector store",
+      "testConnection": "__MISSING__:Test connection",
+      "testing": "__MISSING__:Testing...",
+      "statusActive": "__MISSING__:Active",
+      "statusError": "__MISSING__:Error",
+      "statusDisabled": "__MISSING__:Disabled",
+      "healthOk": "__MISSING__:Connection OK ({latencyMs}ms)",
+      "healthError": "__MISSING__:Connection error",
+      "saved": "__MISSING__:Settings saved",
+      "saveError": "__MISSING__:Failed to save",
+      "portLabel": "__MISSING__:Port",
+      "embeddingModelLabel": "__MISSING__:Embedding Model",
+      "optional": "__MISSING__:optional",
+      "apiKeyKeepPlaceholder": "__MISSING__:Leave blank to keep current key",
+      "apiKeyOptional": "__MISSING__:Leave blank if not using authentication",
+      "removeApiKey": "__MISSING__:Remove",
+      "quickSelectModel": "__MISSING__:Quick select",
+      "searchTestTitle": "__MISSING__:Semantic search test",
+      "searchPlaceholder": "__MISSING__:Type a test query...",
+      "searching": "__MISSING__:Searching...",
+      "search": "__MISSING__:Search",
+      "cleanupTitle": "__MISSING__:Clean up old points",
+      "cleanupDesc": "__MISSING__:Remove Qdrant points for expired memories (retention period).",
+      "cleaning": "__MISSING__:Cleaning...",
+      "cleanNow": "__MISSING__:Clean now",
+      "cleanupSuccess": "__MISSING__:{count} point(s) removed",
+      "cleanupFailed": "__MISSING__:Cleanup failed"
+    },
+    "rerank": {
+      "enableLabel": "__MISSING__:Enable Rerank",
+      "enableDesc": "__MISSING__:Reorders results with a reranking model after search",
+      "warning": "__MISSING__:Rerank adds +200-500ms latency and additional cost per request. Use sparingly.",
+      "providerModelLabel": "__MISSING__:Rerank Provider / Model",
+      "noProviderWithKey": "__MISSING__:No provider with configured API key. Configure a provider to use rerank.",
+      "selectProviderModel": "__MISSING__:Select a provider/model"
+    },
+    "save": "Uložiť",
+    "saving": "__MISSING__:Saving...",
+    "search": "Search memories...",
+    "semantic": "Semantic",
+    "summarize": {
+      "title": "__MISSING__:Compact old memories",
+      "noCandidates": "__MISSING__:No memories eligible for compaction (criteria: >30 days old).",
+      "candidatesDesc": "__MISSING__:{count} memories will be compacted into summaries. This action cannot be undone.",
+      "confirm": "__MISSING__:Compact now"
+    },
+    "tabs": {
+      "memories": "__MISSING__:Memories",
+      "playground": "__MISSING__:Playground",
+      "engine": "__MISSING__:Engine"
+    },
+    "title": "Memory Management",
+    "tokensUsed": "Tokens Used",
+    "tooltip": {
+      "totalEntries": "__MISSING__:Total memories stored for this API key",
+      "tokensUsed": "__MISSING__:Estimated total tokens occupied by active memories",
+      "hitRate": "__MISSING__:Read-by-ID cache hit rate (not semantic recall accuracy)",
+      "factual": "__MISSING__:Objective, permanent facts from user context",
+      "episodic": "__MISSING__:Events and experiences from conversation history",
+      "procedural": "__MISSING__:Procedures, workflows, and instructions the assistant should follow",
+      "semantic": "__MISSING__:Concepts, preferences, and domain knowledge"
+    },
+    "totalEntries": "Total Entries",
+    "type": "Type",
+    "memoryEnabled": "__MISSING__:Memory enabled"
   },
   "skills": {
     "title": "Skills",
@@ -3544,6 +3800,14 @@
     "export": "Export",
     "exporting": "Exporting...",
     "exportFailed": "Export failed",
+    "cleanHistoryButton": "__MISSING__:Clean history",
+    "cleanHistoryTitle": "__MISSING__:Clean log history?",
+    "cleanHistoryMessage": "__MISSING__:This permanently clears all request log rows, legacy detail rows, and local artifact files under DATA_DIR/call_logs. The live page will refresh after cleanup.",
+    "cleanHistoryConfirm": "__MISSING__:Clean history",
+    "cleanHistoryCancel": "__MISSING__:Cancel",
+    "cleanHistorySuccess": "__MISSING__:Cleaned {deleted} log entries, {deletedArtifacts} artifacts, and {deletedDetailedLogs} legacy detail rows.",
+    "cleanHistoryEmpty": "__MISSING__:No request log history was found.",
+    "cleanHistoryFailed": "__MISSING__:Failed to clean log history.",
     "timeRange": "Time Range",
     "lastNHours": "Last {hours}",
     "defaultRange": "default",
@@ -3551,10 +3815,14 @@
       "fetchFailed": "Failed to fetch logs",
       "copyFailed": "Failed to copy log entry",
       "copyLogEntry": "Copy log entry"
-    }
+    },
+    "compressionLogTitle": "__MISSING__:Compression Log",
+    "compressionLogEmpty": "__MISSING__:No compressed requests yet. Compression stats will appear here when requests are processed with compression enabled.",
+    "tokens": "__MISSING__:tokens"
   },
   "onboarding": {
     "welcome": "Vitajte",
+    "tiers": "__MISSING__:Tiers",
     "security": "Bezpečnosť",
     "test": "Test",
     "ready": "Pripravený!",
@@ -3616,6 +3884,7 @@
   },
   "providers": {
     "title": "Poskytovatelia",
+    "Account Deactivated": "__MISSING__:Account Deactivated",
     "allProviders": "Všetci poskytovatelia",
     "audioProviders": "Poskytovatelia zvuku",
     "showFreeOnly": "Iba zadarmo",
@@ -3623,6 +3892,33 @@
     "addFirstProvider": "Pridajte svojho prvého poskytovateľa",
     "addFirstProviderDesc": "Pripojte poskytovateľa AI a spustite smerovanie požiadaviek cez OmniRoute. Môžete použiť bezplatných poskytovateľov, kľúče API alebo účty OAuth.",
     "learnMore": "Zistite viac",
+    "adaptaTutorial": {
+      "title": "__MISSING__:How to connect Adapta Web",
+      "introPrefix": "__MISSING__:Adapta authenticates through Clerk. The token",
+      "introSuffix": "__MISSING__:is a long-lived JWT that lets OmniRoute refresh sessions automatically.",
+      "or": "__MISSING__:or",
+      "step1Title": "__MISSING__:Open Adapta chat",
+      "step1DescPrefix": "__MISSING__:Open",
+      "step1DescSuffix": "__MISSING__:and sign in with your Gold or Business account.",
+      "step2Title": "__MISSING__:Open DevTools",
+      "step2DescPrefix": "__MISSING__:Press",
+      "step2DescSuffix": "__MISSING__:to open Developer Tools.",
+      "step3Title": "__MISSING__:Go to Application → Cookies",
+      "step3DescPrefix": "__MISSING__:In the",
+      "step3DescMiddle": "__MISSING__:expand",
+      "step3DescSuffix": "__MISSING__:and click",
+      "step4Title": "__MISSING__:Copy the cookie value for",
+      "step4DescPrefix": "__MISSING__:Find the cookie named",
+      "step4DescMiddle": "__MISSING__:in the list. Click it and copy the content from the",
+      "step4DescSuffix": "__MISSING__:column. It starts with",
+      "step5Title": "__MISSING__:Paste it here and save",
+      "step5DescPrefix": "__MISSING__:Click",
+      "step5DescMiddle": "__MISSING__:paste the",
+      "step5DescSuffix": "__MISSING__:value into the API Key field, then save. OmniRoute will refresh the session automatically.",
+      "tipLabel": "__MISSING__:Tip:",
+      "tipPrefix": "__MISSING__:The",
+      "tipSuffix": "__MISSING__:cookie is long-lived, usually for months. You only need to renew it if you sign out or Adapta invalidates the session."
+    },
     "editProvider": "Upraviť poskytovateľa",
     "deleteProvider": "Odstrániť poskytovateľa",
     "noProviders": "Nie sú nakonfigurovaní žiadni poskytovatelia",
@@ -3648,13 +3944,38 @@
     "apiKeyProviders": "Poskytovatelia kľúčov API",
     "compatibleProviders": "Poskytovatelia kompatibilných s kľúčom API",
     "testAll": "Testovať všetko",
+    "distributeProxies": "__MISSING__:Distribute Proxies",
+    "distributing": "__MISSING__:Distributing...",
+    "selectedCount": "__MISSING__:{count, plural, one {# selected} other {# selected}}",
+    "accountsCount": "__MISSING__:{count, plural, one {# account} other {# accounts}}",
     "testAllOAuth": "Otestujte všetky pripojenia OAuth",
     "testAllFree": "Otestujte všetky bezplatné pripojenia",
     "testAllApiKey": "Otestujte všetky pripojenia kľúča API",
     "testAllCompatible": "Otestujte všetky kompatibilné pripojenia",
+    "testAllModels": "__MISSING__:Test all models",
+    "testAllModelsConfirm": "__MISSING__:Test all visible models? Failed models will be hidden if auto-hide is enabled.",
+    "testingAllModels": "__MISSING__:Testing {done}/{total}...",
+    "testAllResults": "__MISSING__:{ok} of {total} models working",
+    "noModelsToTest": "__MISSING__:No models match the current filter",
+    "showAllModels": "__MISSING__:All",
+    "showVisibleOnly": "__MISSING__:Visible only",
+    "freeFilterAll": "__MISSING__:All",
+    "freeFilterFreeOnly": "__MISSING__:Free only",
+    "freeFilterPaidOnly": "__MISSING__:Paid only",
+    "sortFreeFirst": "__MISSING__:Free first",
+    "showHiddenOnly": "__MISSING__:Hidden only",
+    "filterByVisibility": "__MISSING__:Filter by visibility",
+    "autoHideFailed": "__MISSING__:Auto-hide failed models",
+    "autoHideFailedHint": "__MISSING__:When enabled, Test all hides non-transient failures from public catalogs such as /v1/models. Single-model tests never auto-hide.",
     "connected": "{count} Pripojené",
     "errorCount": "{count} Chyba ({code})",
     "errorCountNoCode": "{count} Chyba",
+    "testAllCompleted": "__MISSING__:Tested {total} models: {ok} OK, {failed} failed",
+    "modelAutoHidden": "__MISSING__:Model {model} auto-hidden (test failed)",
+    "filterAll": "__MISSING__:All",
+    "filterVisible": "__MISSING__:Visible only",
+    "filterHidden": "__MISSING__:Hidden only",
+    "modelsHiddenCount": "__MISSING__:{count} hidden",
     "warningCount": "{count} Upozornenie",
     "noConnections": "Žiadne spojenia",
     "expiredBadge": "Expired",
@@ -3764,7 +4085,16 @@
     "batchUpdateNone": "__MISSING__:No connections were updated (they may no longer exist)",
     "batchRetestLimit": "__MISSING__:Retest up to {max} connections at a time",
     "noConnectionsToTest": "__MISSING__:No matching connections to test",
+    "batchDeleteConfirmTitle": "__MISSING__:Delete connections",
+    "batchDeleteConfirmButton": "__MISSING__:Delete",
+    "filterActive": "__MISSING__:Active",
+    "filterError": "__MISSING__:Error",
+    "filterBanned": "__MISSING__:Banned",
+    "filterCreditsExhausted": "__MISSING__:Credits Exhausted",
+    "noFilteredConnections": "__MISSING__:No connections match the current filter.",
     "failedSetAlias": "Nepodarilo sa nastaviť alias",
+    "setAliasSuccess": "__MISSING__:Alias {alias} set",
+    "deleteAliasSuccess": "__MISSING__:Alias {alias} deleted",
     "failedSaveConnection": "Pripojenie sa nepodarilo uložiť",
     "failedSaveConnectionRetry": "Pripojenie sa nepodarilo uložiť. Skúste to znova.",
     "failedRetestConnection": "Nepodarilo sa znova otestovať pripojenie",
@@ -3798,6 +4128,9 @@
     "connectionCount": "{count} pripojení",
     "fetchingModels": "Načítavajú sa dostupné modely...",
     "failedFetchModels": "Nepodarilo sa načítať modely",
+    "noFreeModelsFound": "__MISSING__:No free models found for this provider — nothing imported.",
+    "fetchModelsSuccess": "__MISSING__:Found {count} new models",
+    "fetchModelsFailed": "__MISSING__:Could not auto-fetch models (you can retry from settings)",
     "noModelsFound": "Nenašli sa žiadne modely",
     "importFailed": "Import zlyhal",
     "noNewModelsAdded": "Neboli pridané žiadne nové modely.",
@@ -3806,6 +4139,10 @@
     "importingModelsTitle": "Importovanie modelov",
     "copyModel": "Kopírovať model",
     "filterModels": "Filtrovať modely…",
+    "testAllRateLimited": "__MISSING__:Rate limit reached, stopped early",
+    "hideFailedAuto": "__MISSING__:Auto-hide failed models",
+    "selectAllModels": "Select all",
+    "hideAllModels": "__MISSING__:Hide all",
     "modelsActive": "aktívne",
     "showModel": "Zobraziť model",
     "hideModel": "Skryť model",
@@ -3814,6 +4151,9 @@
     "rateLimitUnprotected": "Nechránené",
     "enableRateLimitProtection": "Kliknutím povolíte ochranu frekvenčného limitu",
     "disableRateLimitProtection": "Kliknutím deaktivujete ochranu limitu frekvencie",
+    "testAllProgress": "__MISSING__:Tested {done}/{total}",
+    "testAllFailedHidden": "__MISSING__:{count} failed models hidden",
+    "testAllDone": "__MISSING__:All models tested",
     "productionKey": "Výrobný kľúč",
     "enterNewApiKey": "Zadajte nový kľúč API",
     "codexApplyModalTitle": "Požiadajte o miestny kódex",
@@ -3889,10 +4229,20 @@
     "errorTypeNetworkError": "Chyba siete",
     "errorTypeTestUnsupported": "Test nie je podporovaný",
     "errorTypeUpstreamError": "Chyba proti prúdu",
+    "errorTypeCreditsExhausted": "__MISSING__:No credits",
+    "errorTypeBanned": "__MISSING__:403 Banned",
     "proxySourceGlobal": "globálne",
     "proxySourceProvider": "Poskytovateľ",
     "proxySourceKey": "kľúč",
     "proxyConfiguredBySource": "Proxy ({source}): {host}",
+    "proxyOn": "__MISSING__:Proxy On",
+    "proxyOff": "__MISSING__:Direct (bypass proxy)",
+    "proxyEnabledTitle": "__MISSING__:Proxy is enabled for this connection",
+    "proxyDisabledTitle": "__MISSING__:Direct connection — bypasses every proxy (including the global proxy) for this connection",
+    "perKeyProxyOn": "__MISSING__:Per-key",
+    "perKeyProxyOff": "__MISSING__:Connection",
+    "perKeyProxyEnabledTitle": "__MISSING__:Per-key proxy assignment enabled for this provider",
+    "perKeyProxyDisabledTitle": "__MISSING__:Per-key proxy assignment disabled for this provider",
     "autoPriority": "Auto: {priority}",
     "proxy": "Proxy",
     "retestAuthentication": "Znova otestujte autentifikáciu",
@@ -3920,6 +4270,12 @@
     "compatProtocolOpenAI": "OpenAI Chat Completions",
     "compatProtocolOpenAIResponses": "OpenAI Responses API",
     "compatProtocolClaude": "Anthropic Messages",
+    "targetFormatLabel": "__MISSING__:Target Format",
+    "targetFormatHint": "__MISSING__:Override the upstream wire format. Use 'Anthropic Messages' to route OpenAI-compatible providers (e.g. opencode-go) through the /v1/messages endpoint.",
+    "targetFormatAuto": "__MISSING__:Default (auto)",
+    "targetFormatGemini": "__MISSING__:Gemini",
+    "targetFormatGeminiCli": "__MISSING__:Gemini CLI",
+    "targetFormatAntigravity": "__MISSING__:Antigravity",
     "compatUpstreamHeadersLabel": "Extra upstream headers",
     "compatUpstreamHeadersHint": "High-privilege setting — same trust level as editing provider API credentials; only trusted admins should use it. Merged after OmniRoute adds auth from the provider API key. If a custom header uses the same name as an existing one (e.g. Authorization), your value fully replaces the auto-generated header (including the Bearer token) — the upstream only sees what you typed, not the key from settings. Misconfiguration can cause 401 or broken upstream auth. One row per header (e.g. extra Authentication for some gateways). Hover or focus the value to preview. Saves on blur, outside click, or closing this panel.",
     "compatUpstreamHeaderName": "Header name",
@@ -3929,6 +4285,8 @@
     "compatBadgeUpstreamHeaders": "Headers",
     "perModelQuotaLabel": "Per Model Quota Label",
     "perModelQuotaDescription": "Per Model Quota Description",
+    "importFreeModelsOnlyLabel": "__MISSING__:Import only free models",
+    "importFreeModelsOnlyHint": "__MISSING__:When enabled, only this provider's free models are imported. Paid models are skipped.",
     "perModelQuotaToggle": "Prepínač kvóty podľa modelu",
     "modelId": "ID modelu",
     "customModelPlaceholder": "napr. gpt-4.5-turbo",
@@ -3964,7 +4322,6 @@
     "email": "Email",
     "healthCheckMinutes": "Kontrola stavu (min)",
     "healthCheckHint": "Interval proaktívneho obnovenia tokenu. 0 = vypnuté.",
-    "selectAllModels": "Select all",
     "deselectAllModels": "Deselect all",
     "modelsActiveCount": "{active}/{total} active",
     "noModelsMatch": "No models match \"{filter}\"",
@@ -3976,6 +4333,9 @@
     "editCompatibleTitle": "Upraviť {type} kompatibilné",
     "compatibleBaseUrlHint": "Root URL of your {type}-compatible API. Use Advanced Settings for custom endpoint paths.",
     "apiKeyForCheck": "API kľúč (na kontrolu)",
+    "testModelIdLabel": "__MISSING__:Model ID (optional)",
+    "testModelIdPlaceholder": "__MISSING__:e.g. my-model-id",
+    "testModelIdHint": "__MISSING__:If the provider lacks a /models endpoint, enter a model ID to validate via /chat/completions instead.",
     "compatibleProdPlaceholder": "{type} Kompatibilné (produkt)",
     "tokenRefreshed": "Token refreshed successfully",
     "tokenRefreshFailed": "Token refresh failed",
@@ -4069,6 +4429,19 @@
     "codexAuthApplyFailed": "Failed to apply Codex auth.json locally",
     "codexAuthExported": "Codex auth.json exported",
     "codexAuthExportFailed": "Failed to export Codex auth.json",
+    "codexCliGuideButton": "__MISSING__:Codex CLI Guide",
+    "codexCliGuideTitle": "__MISSING__:Codex CLI Guide",
+    "codexCliGuideLoading": "__MISSING__:Loading guide...",
+    "codexCliGuideLoadFailed": "__MISSING__:Could not load the guide.",
+    "codexExternalLinkButton": "__MISSING__:External Codex link",
+    "codexExternalLinkModalTitle": "__MISSING__:External Codex link",
+    "codexExternalLinkModalDescription": "__MISSING__:Share this single-use link with the person who will authenticate the Codex account. They open it in their own browser, complete the OpenAI login, and the connection is registered here. The link expires in 15 minutes.",
+    "codexExternalLinkGenerating": "__MISSING__:Generating link...",
+    "codexExternalLinkWaiting": "__MISSING__:Waiting for browser authentication. This window refreshes automatically.",
+    "codexExternalLinkCreateFailed": "__MISSING__:Failed to generate the link.",
+    "codexExternalLinkNetworkError": "__MISSING__:Could not contact the server.",
+    "codexExternalLinkConnected": "__MISSING__:Codex account connected through the external link.",
+    "codexExternalLinkExpired": "__MISSING__:The link expired before completion.",
     "importCodexAuth": "Autorizácia importu",
     "codexImportModalTitle": "Import Codex Auth",
     "codexImportTabSingle": "Slobodný",
@@ -4146,6 +4519,8 @@
     "t3ChatWebCookiePlaceholder": "convex-session-id=abc123...",
     "blockClaudeExtraUsageDescription": "Block Claude Extra Usage Description",
     "blockClaudeExtraUsageLabel": "Block Claude Extra Usage Label",
+    "disableCoolingDescription": "__MISSING__:Skip the transient cooldown so this connection stays eligible even after recoverable errors (terminal states like banned/expired still apply).",
+    "disableCoolingLabel": "__MISSING__:Disable cooldown for this connection",
     "bulkPasteAdded": "{count, plural, one {1 key added} other {# keys added}}",
     "bulkPasteDuplicatesIgnored": "{count, plural, one {1 duplicate skipped} other {# duplicates skipped}}",
     "bulkPasteHint": "Paste one API key per line. Empty lines are ignored and duplicate keys are skipped.",
@@ -4243,6 +4618,17 @@
     "personalAccessTokenLabel": "Personal Access Token Label",
     "qoderPatHint": "Qoder Pat Hint",
     "qoderPatPlaceholder": "Qoder Pat Placeholder",
+    "rateLimitOverridesSection": "__MISSING__:Rate Limit Overrides",
+    "rateLimitOverridesMaxConcurrentHint": "__MISSING__:Max concurrent requests override for this connection. Overrides the account-level cap.",
+    "rateLimitOverridesMaxConcurrentLabel": "__MISSING__:Max Concurrent (Rate Limit)",
+    "rateLimitOverridesMinTimeHint": "__MISSING__:Minimum time (ms) between requests. Overrides the default rate limiter delay.",
+    "rateLimitOverridesMinTimeLabel": "__MISSING__:Min Interval (ms)",
+    "rateLimitOverridesRpmHint": "__MISSING__:Max requests per minute for this connection. Overrides the provider default.",
+    "rateLimitOverridesRpmLabel": "__MISSING__:RPM (Requests/min)",
+    "rateLimitOverridesTpdHint": "__MISSING__:Max tokens per day for this connection. Overrides the provider default.",
+    "rateLimitOverridesTpdLabel": "__MISSING__:TPD (Tokens/day)",
+    "rateLimitOverridesTpmHint": "__MISSING__:Max tokens per minute for this connection. Overrides the provider default.",
+    "rateLimitOverridesTpmLabel": "__MISSING__:TPM (Tokens/min)",
     "refreshOauthTokenTitle": "Refresh Oauth Token Title",
     "regionHint": "Region Hint",
     "regionLabel": "Region Label",
@@ -4257,6 +4643,7 @@
     "searchProvider": "Search Provider",
     "searchProviderDesc": "Search Provider Desc",
     "searchProviders": "Hľadať poskytovateľov...",
+    "searchByModel": "__MISSING__:Search by model…",
     "searchProvidersHeading": "Search Providers Heading",
     "searxngBaseUrlHint": "Searxng Base Url Hint",
     "searxngInfo": "Searxng Info",
@@ -4422,7 +4809,21 @@
     "webNoAuthGuideBody": "{provider} nepotrebuje kľúč API ani súbor cookie. Uložte pripojenie, aby ste mohli používať jeho bezplatný webový koncový bod.",
     "webSessionCredentialValidationFailed": "Overenie poverení relácie zlyhalo. Znova sa prihláste, skopírujte nové poverenia a skúste to znova.",
     "checkCookie": "Skontrolujte súbor cookie",
-    "checkWebToken": "Kontrolný token"
+    "checkWebToken": "Kontrolný token",
+    "huggingchatLabel": "__MISSING__:HuggingChat (Free)",
+    "huggingchatDesc": "__MISSING__:Free LLM chat via huggingface.co/chat",
+    "phindLabel": "__MISSING__:Phind (Free)",
+    "phindDesc": "__MISSING__:Free dev-focused AI chat",
+    "poeWebLabel": "__MISSING__:Poe Web",
+    "poeWebDesc": "__MISSING__:Multi-model chat via poe.com",
+    "veniceWebLabel": "__MISSING__:Venice Web",
+    "veniceWebDesc": "__MISSING__:Privacy-focused AI chat",
+    "v0VercelWebLabel": "__MISSING__:v0 Vercel Web",
+    "v0VercelWebDesc": "__MISSING__:AI code generation via v0.dev",
+    "kimiWebLabel": "__MISSING__:Kimi Web",
+    "kimiWebDesc": "__MISSING__:Chinese market AI chat via kimi.moonshot.cn",
+    "doubaoWebLabel": "__MISSING__:Doubao Web",
+    "doubaoWebDesc": "__MISSING__:ByteDance AI chat via doubao.com"
   },
   "settings": {
     "title": "Nastavenia",
@@ -4528,6 +4929,7 @@
     "memoryDesc": "Persistent cross-session conversational memory",
     "memoryEnabled": "Enable Memory",
     "memoryEnabledDesc": "When enabled, OmniRoute will inject relevant past context.",
+    "memoryTokenCostWarning": "__MISSING__:Heads up: with memory enabled, OmniRoute injects up to {tokens} tokens of retrieved context into every chat request — this increases token usage and cost. To skip injection for a specific request, send the \"x-omniroute-no-memory: true\" header.",
     "maxTokens": "Max Tokens",
     "retentionDays": "Retention",
     "recent": "Recent",
@@ -4566,6 +4968,15 @@
     "modelsDevInfoOrder": "User Override → models.dev → LiteLLM → Hardcoded Default",
     "systemTheme": "Téma systému",
     "debugToggle": "Enable Debug Mode",
+    "homePinProviderQuotaToHome": "Pin Information to Home Page",
+    "homeProviderQuotaLimits": "Provider Quota Limits",
+    "homeProviderQuotaLimitsDesc": "Pin the Provider Quota status container (with Refresh All button) to the top of the Home page.",
+    "homeQuickStart": "Quick Start",
+    "homeQuickStartDesc": "Show the Quick Start panel on the Home page.",
+    "homeProviderTopology": "Provider Topology",
+    "homeProviderTopologyDesc": "Show the Provider Topology on the Home page.",
+    "accountEmailVisibility": "__MISSING__:Account email visibility",
+    "accountEmailVisibilityDesc": "__MISSING__:Show full account emails across providers, combos, logs, quota, and playground screens. Turn this off to mask them by default.",
     "sidebarVisibilityToggle": "Show Sidebar Items",
     "enableCache": "Povoliť vyrovnávaciu pamäť",
     "cacheTTL": "Cache TTL",
@@ -4599,11 +5010,17 @@
     "autoDisableDescription": "Permanently mark provider connections as deactivated if they return specific terminal ban signals (e.g. HTTP 403 'verify your account'). This removes them from the combo rotation.",
     "autoDisableThreshold": "Ban Threshold",
     "autoDisableThresholdDesc": "Consecutive ban signals required before permanent deactivation.",
+    "customBannedSignals": "__MISSING__:Banned Keywords",
+    "customBannedSignalsDesc": "__MISSING__:Additional keywords that trigger permanent account ban detection. Built-in keywords always apply.",
+    "customBannedSignalsPlaceholder": "__MISSING__:e.g. api key revoked",
+    "noCustomBannedSignals": "__MISSING__:No custom keywords. Only built-in keywords are active.",
     "resilienceStructureTitle": "Resilience Structure",
     "resilienceStructureDesc": "Táto stránka iba konfiguruje správanie. Stav živého ističa sa zobrazuje na stránke Zdravie. Opakovanie špecifické pre kombináciu a ovládanie slotu s cyklickou manipuláciou zostávajú na nastaveniach komba.",
     "enableThinking": "Povoliť myslenie",
     "maxThinkingTokens": "Maximálne žetóny myslenia",
     "enableProxy": "Povoliť server proxy",
+    "perKeyProxyEnabled": "__MISSING__:Enable per-key proxy assignment",
+    "perKeyProxyEnabledDesc": "__MISSING__:When enabled, each provider connection can use its own proxy assignment",
     "proxyUrl": "Adresa URL proxy",
     "pricingRates": "Formát cenových sadzieb",
     "currentPricing": "Prehľad aktuálnych cien",
@@ -4683,6 +5100,13 @@
     "globalProxy": "Globálny proxy",
     "globalProxyDesc": "Nakonfigurujte globálny výstupný proxy server pre všetky volania API. Jednotliví poskytovatelia, kombá a kľúče to môžu prepísať.",
     "noGlobalProxy": "Nie je nakonfigurovaný žiadny globálny server proxy",
+    "proxyPool": "__MISSING__:Proxy Pool",
+    "freePool": "__MISSING__:Free Pool",
+    "proxyDocumentation": "__MISSING__:Proxy Documentation",
+    "proxyGlobalConfigTab": "__MISSING__:Global Config",
+    "proxyPoolTab": "__MISSING__:Proxy Pool",
+    "freePoolTab": "__MISSING__:Free Pool",
+    "proxyDocumentationTab": "__MISSING__:Documentation",
     "bulkHealthcheck": "Bulk Healthcheck",
     "bulkHealthcheckDesc": "Test all configured proxies against a target URL to find which ones work.",
     "healthcheckTesting": "Testing...",
@@ -4695,6 +5119,51 @@
     "healthcheckStatus": "Status",
     "healthcheckProxyUrl": "Proxy URL",
     "healthcheckLatency": "Latency",
+    "proxyDocumentationScopeTitle": "__MISSING__:Proxy scope resolution",
+    "proxyDocumentationScopeDescBefore": "__MISSING__:OmniRoute resolves the outbound proxy in priority order: ",
+    "proxyDocumentationScopeOrder": "__MISSING__:combo → account → provider → global",
+    "proxyDocumentationScopeDescAfter": "__MISSING__:. The most specific scope wins.",
+    "proxyDocumentationAddTitle": "__MISSING__:Adding a custom proxy",
+    "proxyDocumentationAddDescBefore": "__MISSING__:Go to the ",
+    "proxyDocumentationAddDescMiddle": "__MISSING__: tab → click ",
+    "proxyDocumentationAddCta": "__MISSING__:+ Add proxy",
+    "proxyDocumentationAddDescAfter": "__MISSING__:. Fill in type (http/https/socks5), host, and port. Optionally assign it to a scope.",
+    "proxyDocumentationBulkTitle": "__MISSING__:Bulk import format",
+    "proxyDocumentationBulkDesc": "__MISSING__:Pipe-delimited fields:",
+    "proxyDocumentationSocks5DescBefore": "__MISSING__:SOCKS5 proxies are disabled by default. Set",
+    "proxyDocumentationFreePoolDesc": "__MISSING__:The Free Pool tab aggregates proxies from 1proxy, Proxifly, and IPLocate. Use ⊕ to test and promote a proxy to your registry. Only proxies that pass the connectivity test are added.",
+    "proxyDocumentationVercelRelayDescBefore": "__MISSING__:The Vercel Relay is an outbound edge relay — not an inbound tunnel. Deploying one sends LLM API calls through Vercel's dynamic IPs, bypassing datacenter geo-blocks and rate limits. The relay is protected by a generated secret header",
+    "proxyDocumentationVercelRelayDescAfter": "__MISSING__:Your Vercel token is used only during deploy and is never stored.",
+    "vercelRelayTokenRequired": "__MISSING__:Token is required",
+    "vercelRelayDeployFailed": "__MISSING__:Deploy failed",
+    "vercelRelayTokenHint": "__MISSING__:Token is used only during deploy — never stored.",
+    "denoRelayTokenRequired": "__MISSING__:Deno Deploy token is required",
+    "denoRelayOrgDomainRequired": "__MISSING__:Organization domain is required",
+    "denoRelayDeployFailed": "__MISSING__:Deno Deploy failed",
+    "denoRelayTokenHint": "__MISSING__:Organization token (prefix ddo_) from console.deno.com → Organization → Settings → Organization Tokens. Used once for deploy and never stored.",
+    "denoRelayOrgDomainHint": "__MISSING__:Your Deno Deploy organization's default domain (e.g. acme.deno.net). The relay will be reachable at https://<app-name>.<org-slug>.deno.net.",
+    "proxyFreePoolFilterProtocol": "__MISSING__:Filter by protocol",
+    "proxyFreePoolProtocol": "__MISSING__:Protocol",
+    "proxyFreePoolCountryPlaceholder": "__MISSING__:Country (e.g. US)",
+    "proxyFreePoolFilterCountry": "__MISSING__:Filter by country",
+    "proxyFreePoolMinQualityPlaceholder": "__MISSING__:Min quality",
+    "proxyFreePoolMinQualityLabel": "__MISSING__:Minimum quality score",
+    "proxyFreePoolSyncAll": "__MISSING__:Sync All",
+    "proxyFreePoolTotal": "__MISSING__:Total",
+    "proxyFreePoolInPool": "__MISSING__:In pool",
+    "proxyFreePoolAvgQuality": "__MISSING__:Avg quality",
+    "proxyFreePoolSelected": "__MISSING__:{count} selected",
+    "proxyFreePoolAddSelected": "__MISSING__:Add selected to pool",
+    "proxyFreePoolAddVisible": "__MISSING__:Add all visible to pool",
+    "proxyFreePoolSource": "__MISSING__:Source",
+    "proxyFreePoolHostPort": "__MISSING__:Host:Port",
+    "proxyFreePoolType": "__MISSING__:Type",
+    "proxyFreePoolCountry": "__MISSING__:Country",
+    "proxyFreePoolQuality": "__MISSING__:Quality",
+    "proxyFreePoolLatency": "__MISSING__:Latency",
+    "proxyFreePoolEmpty": "__MISSING__:No proxies found. Click Sync All to fetch from sources.",
+    "close": "__MISSING__:Close",
+    "cancel": "__MISSING__:Cancel",
     "globalLabel": "globálne",
     "configure": "Konfigurovať",
     "globalSystemPrompt": "Výzva globálneho systému",
@@ -4951,6 +5420,7 @@
     "systemStorage": "Systém a úložisko",
     "allDataLocal": "Všetky údaje uložené lokálne vo vašom počítači",
     "databasePath": "Cesta k databáze",
+    "export": "__MISSING__:Export",
     "exportDatabase": "Exportovať databázu",
     "exportAll": "Exportovať všetko (.tar.gz)",
     "importDatabase": "Importovať databázu",
@@ -5038,6 +5508,11 @@
     "adaptiveVolumeRoutingDesc": "Scale connections dynamically based on payload volume and throughput pressure.",
     "lkgpToggleTitle": "Last Known Good Provider (LKGP)",
     "lkgpToggleDesc": "When enabled, the router remembers which provider last served a successful response and tries it first on subsequent requests.",
+    "echoRequestedModelTitle": "__MISSING__:Echo requested model name in responses",
+    "echoRequestedModelDesc": "__MISSING__:When enabled, the response `model` field echoes the alias or combo name the client requested instead of the upstream model name. Fixes strict clients (e.g. Claude Desktop) that reject a response whose model does not match the request.",
+    "webSearchRouteTitle": "__MISSING__:Web search routing",
+    "webSearchRouteDesc": "__MISSING__:When a request includes a native web_search tool, route the whole request to this model instead of the default — useful for providers that don't implement Anthropic's web_search server tool. Leave blank to disable.",
+    "webSearchRoutePlaceholder": "__MISSING__:e.g. openrouter,anthropic/claude-3.5-sonnet",
     "clearLkgpCache": "Clear LKGP Cache",
     "lkgpCacheCleared": "LKGP cache cleared successfully",
     "lkgpCacheClearFailed": "Failed to clear LKGP cache",
@@ -5102,6 +5577,16 @@
     "clearSyncedPricing": "Clear Synced Pricing",
     "compressionTitle": "Prompt Compression",
     "compressionDesc": "Reduce token usage by compressing prompts before sending to providers",
+    "tokenSaverTitle": "__MISSING__:Token Saver",
+    "tokenSaverSubtitle": "__MISSING__:Spend fewer tokens on every request.",
+    "tokenSaverToolOutput": "__MISSING__:Tool output",
+    "tokenSaverToolOutputDesc": "__MISSING__:Clean git, grep, ls, tree, and log output before it reaches the provider.",
+    "tokenSaverLlmOutput": "__MISSING__:LLM output",
+    "tokenSaverLlmOutputDesc": "__MISSING__:Inject terse response instructions without rewriting provider output.",
+    "tokenSaverInputCompression": "__MISSING__:Input compression",
+    "tokenSaverInputCompressionDesc": "__MISSING__:Rewrite eligible chat history while preserving code, URLs, and intent.",
+    "tokenSaverFineTunePrefix": "__MISSING__:Fine-tune each engine on",
+    "tokenSaverFineTuneSuffix": "__MISSING__:or combine engines per request on",
     "compressionMode": "Compression Mode",
     "compressionModeOff": "Off",
     "compressionModeOffDesc": "No compression applied",
@@ -5121,6 +5606,11 @@
     "compressionUltraMinScore": "Hranica minimálneho skóre",
     "compressionUltraSlmFallback": "Návrat k agresívnemu",
     "compressionUltraModelPath": "Cesta modelu SLM",
+    "compressionUltraEngine": "__MISSING__:Ultra tier",
+    "compressionUltraEngineHeuristic": "__MISSING__:Heuristic (Tier-A, default)",
+    "compressionUltraEngineSlm": "__MISSING__:SLM (LLMLingua-2, opt-in)",
+    "compressionUltraSlmHint": "__MISSING__:SLM downloads a small ONNX model on first use (cold-start) and transparently falls back to the heuristic on timeout or if unavailable.",
+    "compressionUltraSlmPrewarm": "__MISSING__:Pre-warm SLM model on enable",
     "compressionSummarizerEnabled": "Povoliť Summarizer",
     "compressionMaxTokensPerMessage": "Maximálny počet tokenov na správu",
     "compressionMinSavings": "Min",
@@ -5308,13 +5798,22 @@
     "resilienceNo": "Nie",
     "resilienceDefault": "Default",
     "storageDatabaseBackupRetention": "Uchovanie zálohy databázy",
+    "storageDatabaseBackups": "__MISSING__:Database backups",
     "storagePurgeData": "Vyčistiť údaje",
+    "storagePurgeDataDesc": "__MISSING__:Immediately delete all records without applying retention checks. Use with caution.",
+    "storageRetentionCleanup": "__MISSING__:Retention Settings",
+    "storageRetentionCleanupDesc": "__MISSING__:Configure operational record retention and database backup cleanup.",
+    "retentionCallDays": "__MISSING__:Call {count}d",
+    "retentionAppDays": "__MISSING__:App {count}d",
+    "retentionRows": "__MISSING__:{count} rows",
     "retentionQuotaSnapshots": "Snímky kvóty (dni)",
+    "retentionCompressionAnalytics": "__MISSING__:Compression Analytics (days)",
     "retentionMcpAudit": "Audit MCP (dni)",
     "retentionA2aEvents": "Udalosti A2A (dni)",
     "retentionCallLogs": "Denníky hovorov (dni)",
     "retentionUsageHistory": "História používania (dni)",
     "retentionMemoryEntries": "Záznamy pamäte (dni)",
+    "saveRetentionSettings": "__MISSING__:Save retention settings",
     "storageAutoVacuumMode": "Režim automatického vysávania",
     "storageScheduledVacuum": "Plánované vysávanie",
     "storageVacuumHour": "Hodina vákua (0-23)",
@@ -5328,10 +5827,16 @@
     "storageIntegrityOk": "✓ OK",
     "storageIntegrityError": "✗ Chyba",
     "storageUsageTokenBuffer": "Použitie vyrovnávacej pamäte tokenov",
+    "storageUsageTokenBufferDesc": "__MISSING__:Extra tokens added to reported usage to account for system prompt overhead.",
+    "storageUsageTokenBufferHint": "__MISSING__:Set to 0 to report raw provider token counts. Default: 2000.",
+    "storageUsageTokenBufferCurrent": "__MISSING__:Current: {value}",
     "compressionSettingsAutoTriggerMode": "Režim automatického spustenia",
     "compressionSettingsMcpDescriptionCompression": "Kompresia popisu MCP",
+    "mcpAccessibilityTitle": "__MISSING__:MCP accessibility output",
     "compressionSettingsCavemanIntensity": "Intenzita jaskynného muža",
     "compressionSettingsCavemanOutputMode": "Výstupný režim Caveman",
+    "compressionSettingsOutputStyles": "__MISSING__:Output styles",
+    "compressionStylesTileTitle": "__MISSING__:Output styles",
     "compressionSettingsOutputIntensity": "Výstupná intenzita",
     "compressionSettingsAutoClarityBypass": "Obtok automatického jasu",
     "resilienceWaitForCooldown": "Počkajte na Cooldown",
@@ -5347,6 +5852,9 @@
     "cliproxyapiUrl": "URL CLIProxyAPI",
     "cliproxyapiStatus": "Stav CLIProxyAPI",
     "cliproxyapiNotDetected": "Nezistené",
+    "cliproxyapiImportAuthTitle": "__MISSING__:Import accounts from CLIProxyAPI",
+    "cliproxyapiImportAuthDesc": "__MISSING__:Import the OAuth accounts CLIProxyAPI already saved in ~/.cli-proxy-api/ as OmniRoute connections, so you don't have to log in to each account again. Supported account types (Gemini, Codex, Claude, Antigravity, Qwen, Kimi) are imported; others are skipped.",
+    "cliproxyapiImportAuthButton": "__MISSING__:Import accounts",
     "payloadRulesTitle": "Pravidlá užitočného zaťaženia",
     "payloadRulesDesc": "__MISSING__:Configure request payload mutations by model and protocol. Changes are persisted in settings and hot reloaded into the runtime immediately after save.",
     "payloadRuleDefaultTitle": "__MISSING__:default",
@@ -5379,6 +5887,14 @@
     "maxResponseTokensDesc": "__MISSING__:Maximum total tokens allowed in a single response.",
     "modelCooldownsTitle": "Modely v cooldowne",
     "modelCooldownsEmpty": "Momentálne nie sú žiadne modely v cooldown.",
+    "responsesStateTitle": "__MISSING__:Responses State",
+    "responsesStateDesc": "__MISSING__:Control how OmniRoute forwards previous_response_id.",
+    "responsesStateModeLabel": "__MISSING__:previous_response_id handling",
+    "responsesStateModeAuto": "__MISSING__:Auto",
+    "responsesStateModeStrip": "__MISSING__:Strip",
+    "responsesStateModePreserve": "__MISSING__:Preserve",
+    "responsesStateHint": "__MISSING__:Auto strips previous_response_id unless a connection explicitly enables OpenAI Responses storage. Strip is safest for stateless clients such as VS Code Custom Endpoint; context then depends on the client sending full history.",
+    "responsesStateSaveError": "__MISSING__:Failed to update Responses state setting",
     "codexFastTierTitle": "Kódex Fast Tier",
     "codexFastTierDesc": "Globálne vložiť service_tier=priorita pre požiadavky kódexu OpenAI.",
     "codexFastTierHint": "Keď je povolené, OmniRoute pridáva service_tier=priority k odchádzajúcim požiadavkám kódexu pre pripojenia, ktoré ešte nešpecifikujú úroveň. Prioritná vrstva vyžaduje kľúč OpenAI Enterprise API alebo cestu kódexu ChatGPT-auth; ostatné typy kľúčov dostanú od OpenAI chybu súvisiacu s úrovňou. Nastavenia pre jednotlivé pripojenia na stránke poskytovateľa kódexu majú prednosť.",
@@ -5485,6 +6001,15 @@
     "resilienceEnableServerWaitDesc": "Keď je táto funkcia povolená, OmniRoute počká, kým uplynie prvé ochladzovanie, a automaticky sa zopakuje.",
     "resilienceMaxAttempts": "Maximálny počet pokusov",
     "resilienceMaxWaitPerAttempt": "Maximálne čakanie na pokus",
+    "resilienceProviderCooldownTitle": "__MISSING__:Provider Cooldown",
+    "resilienceProviderCooldownScope": "__MISSING__:All combo requests",
+    "resilienceProviderCooldownTrigger": "__MISSING__:When a provider/connection fails",
+    "resilienceProviderCooldownEffect": "__MISSING__:Skips the failed provider for a cooldown period before retrying",
+    "resilienceProviderCooldownDesc": "__MISSING__:Prevents subsequent requests from re-walking the same failing providers. Cooldown scales exponentially with consecutive failures.",
+    "resilienceProviderCooldownEnabled": "__MISSING__:Enable global provider cooldown",
+    "resilienceProviderCooldownEnabledDesc": "__MISSING__:When enabled, failed providers are tracked globally and skipped for a cooldown period.",
+    "resilienceProviderCooldownMin": "__MISSING__:Minimum cooldown",
+    "resilienceProviderCooldownMax": "__MISSING__:Maximum cooldown",
     "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
     "forcedFingerprintBadge": "Required",
     "codexSessionAffinityTitle": "Afinita relácie kódexu",
@@ -5506,13 +6031,45 @@
     "vercelRelayFreeTierNote": "__MISSING__:Relays are lightweight proxy endpoints deployed on Vercel's free tier to bypass local network/region limitations.",
     "vercelRelayDeploying": "__MISSING__:Deploying...",
     "vercelRelayDeploy": "__MISSING__:Deploy",
-    "homePinProviderQuotaToHome": "Pin Information to Home Page",
-    "homeProviderQuotaLimits": "Provider Quota Limits",
-    "homeProviderQuotaLimitsDesc": "Pin the Provider Quota status container (with Refresh All button) to the top of the Home page.",
-    "homeQuickStart": "Quick Start",
-    "homeQuickStartDesc": "Show the Quick Start panel on the Home page.",
-    "homeProviderTopology": "Provider Topology",
-    "homeProviderTopologyDesc": "Show the Provider Topology on the Home page."
+    "deployRelayButton": "__MISSING__:Deploy Relay",
+    "denoRelayButton": "__MISSING__:Deploy Deno Relay",
+    "denoRelayModalTitle": "__MISSING__:Deploy Deno Relay",
+    "denoRelayWarning": "__MISSING__:Warning: A Deno Deploy organization token is required. This token will only be used to create the relay app and will never be stored by OmniRoute.",
+    "denoRelayTokenLabel": "__MISSING__:Deno Deploy Organization Token",
+    "denoRelayOrgDomainLabel": "__MISSING__:Organization Domain",
+    "denoRelayProjectNameLabel": "__MISSING__:Deno App Name",
+    "denoRelayFreeTierNote": "__MISSING__:Deno Deploy v2 runs on a global edge network. Free tier: 1M requests & 100GiB outbound traffic per month, no per-request CPU limits, up to 20 active apps & 50 custom domains.",
+    "denoRelayDeploying": "__MISSING__:Deploying...",
+    "denoRelayDeploy": "__MISSING__:Deploy",
+    "cloudflareRelaySuccess": "__MISSING__:Cloudflare Relay deployed successfully",
+    "cloudflareRelayButton": "__MISSING__:Deploy Cloudflare Relay",
+    "cloudflareRelayModalTitle": "__MISSING__:Deploy Cloudflare Worker Relay",
+    "cloudflareRelayWarning": "__MISSING__:Deploys a Cloudflare Worker that proxies LLM requests through Cloudflare's edge network — masking the host IP behind dynamic Cloudflare addresses. The Worker enforces a one-time auth secret so the public workers.dev URL cannot be reused as an open relay.",
+    "cloudflareRelayTokenHowto": "__MISSING__:Create the API token under My Profile -> API Tokens -> Create Token -> Custom Token -> Account / Workers Scripts / Edit.",
+    "cloudflareRelayAccountIdLabel": "__MISSING__:Cloudflare Account ID",
+    "cloudflareRelayAccountIdHint": "__MISSING__:Found on the right side of the Cloudflare dashboard overview page.",
+    "cloudflareRelayApiTokenLabel": "__MISSING__:Cloudflare API Token",
+    "cloudflareRelayApiTokenHint": "__MISSING__:Requires 'Workers Scripts: Edit' permission. The token is used only at deploy time and is never stored.",
+    "cloudflareRelayProjectNameLabel": "__MISSING__:Worker Name",
+    "cloudflareRelayFreeTierNote": "__MISSING__:Free tier: 100,000 requests/day per Cloudflare account.",
+    "cloudflareRelayDeploying": "__MISSING__:Deploying...",
+    "cloudflareRelayDeploy": "__MISSING__:Deploy",
+    "cloudflareRelayCredsRequired": "__MISSING__:Account ID and API Token are required",
+    "cloudflareRelayDeployFailed": "__MISSING__:Deploy failed",
+    "modelLockout": "__MISSING__:Model Lockout",
+    "modelLockoutPageDescription": "__MISSING__:Configure which HTTP error codes trigger per-model lockout and control the cooldown behavior.",
+    "modelLockoutEnabled": "__MISSING__:Enable Model Lockout",
+    "modelLockoutEnabledDescription": "__MISSING__:When enabled, models that fail with configured error codes are temporarily locked to prevent retry loops.",
+    "modelLockoutErrorCodes": "__MISSING__:Error Codes",
+    "modelLockoutErrorCodesDescription": "__MISSING__:HTTP status codes that trigger model lockout. Type a code and click Add, or select from suggestions.",
+    "modelLockoutBaseCooldown": "__MISSING__:Base Cooldown (ms)",
+    "modelLockoutBaseCooldownDescription": "__MISSING__:Initial cooldown duration in milliseconds before a model can be retried.",
+    "modelLockoutMaxCooldown": "__MISSING__:Max Cooldown (ms)",
+    "modelLockoutMaxCooldownDescription": "__MISSING__:Maximum cooldown duration in milliseconds. Prevents excessively long lockouts.",
+    "modelLockoutExponentialBackoff": "__MISSING__:Exponential Backoff",
+    "modelLockoutExponentialBackoffDescription": "__MISSING__:When enabled, each consecutive failure increases the cooldown duration exponentially.",
+    "modelLockoutMaxBackoffSteps": "__MISSING__:Max Backoff Steps",
+    "modelLockoutMaxBackoffStepsDescription": "__MISSING__:Maximum number of backoff steps before the cooldown stops growing. The Max Cooldown cap is reached first in most configurations, making this a safety ceiling for when Max Cooldown is raised."
   },
   "contextRtk": {
     "title": "RTK Engine",
@@ -5563,7 +6120,21 @@
     "searchFilters": "Vyhľadávať filtre...",
     "tooltipDedup": "Ako agresívne odstrániť opakované čiary.",
     "tooltipMaxChars": "Maximálny počet znakov na výstupný blok.",
-    "tooltipMaxLines": "Maximálny počet riadkov, ktoré sa majú zachovať z výstupu príkazu. Prebytok je skrátený."
+    "tooltipMaxLines": "Maximálny počet riadkov, ktoré sa majú zachovať z výstupu príkazu. Prebytok je skrátený.",
+    "learnDiscoverTitle": "__MISSING__:Learn & Discover filters",
+    "learnDiscoverDesc": "__MISSING__:Mine your captured command output (Raw Output retention must be on) to suggest new RTK filters. Suggestions only — you review and save them.",
+    "discoverHeading": "__MISSING__:Discover repeated noise",
+    "discoverButton": "__MISSING__:Scan samples",
+    "discoverScanning": "__MISSING__:Scanning…",
+    "discoverEmpty": "__MISSING__:No repeated noise found. Enable Raw Output retention and run a few commands first.",
+    "discoverSamples": "__MISSING__:{count} sample(s) scanned",
+    "discoverHits": "__MISSING__:{hits}× across samples",
+    "learnHeading": "__MISSING__:Learn a filter for a command",
+    "learnCommandPlaceholder": "__MISSING__:e.g. npm install",
+    "learnButton": "__MISSING__:Suggest filter",
+    "learnEmpty": "__MISSING__:No suggestion yet. Type a command you have run and scan.",
+    "learnSamplesUsed": "__MISSING__:Learned from {count} matching sample(s)",
+    "suggestionError": "__MISSING__:Could not load suggestions. Check management auth and try again."
   },
   "contextCombos": {
     "title": "Compression Combos",
@@ -5853,7 +6424,80 @@
     "routeConnectionLabel": "Pripojenie",
     "scenarioVision": "Vízia (porozumenie obrazu)",
     "scenarioSchemaCoercion": "Nátlak na schému (štruktúrovaný výstup)",
-    "techniques": "Techniky:"
+    "techniques": "Techniky:",
+    "friendlyTitle": "__MISSING__:Translator",
+    "friendlySubtitle": "__MISSING__:Use your existing app with any provider — without rewriting code.",
+    "conceptHeadline": "__MISSING__:Your app speaks one API's \"language\". The Translator converts it to use another provider.",
+    "conceptDiagramAppLabel": "__MISSING__:Your app",
+    "conceptDiagramSourceLabel": "__MISSING__:Source format",
+    "conceptDiagramHubLabel": "__MISSING__:OpenAI (hub)",
+    "conceptDiagramTargetLabel": "__MISSING__:Target provider",
+    "conceptDiagramExampleApp": "__MISSING__:e.g. Anthropic SDK",
+    "conceptDiagramExampleSource": "__MISSING__:claude",
+    "conceptDiagramExampleTarget": "__MISSING__:Gemini",
+    "conceptHowItWorksToggle": "__MISSING__:How it works",
+    "conceptHowItWorksBody": "__MISSING__:Your app sends a request in its own format. The Translator detects the format, converts it through OpenAI as an intermediate hub (or directly when a direct translator is available), sends it to the chosen provider, and returns the response converted back to your app's format.",
+    "tabTranslate": "__MISSING__:Translate",
+    "tabMonitor": "__MISSING__:Monitor",
+    "tabTranslateAriaLabel": "__MISSING__:Go to the Translate tab",
+    "tabMonitorAriaLabel": "__MISSING__:Go to the Monitor tab",
+    "simpleAppUsesLabel": "__MISSING__:My app uses",
+    "simpleAppUsesHint": "__MISSING__:The API format your app speaks (e.g. Anthropic SDK = claude).",
+    "simpleSendToLabel": "__MISSING__:Send to",
+    "simpleSendToHint": "__MISSING__:Where to actually send the request (a provider connected in OmniRoute).",
+    "simpleStartWithLabel": "__MISSING__:Start with",
+    "simpleStartWithExamplePlaceholder": "__MISSING__:Select a ready-made example",
+    "simpleStartWithCustomOption": "__MISSING__:Paste your request (advanced)",
+    "simpleModeLabel": "__MISSING__:Mode",
+    "simpleModePreview": "__MISSING__:Preview translation only",
+    "simpleModeSend": "__MISSING__:Send and see response",
+    "simpleAdvancedToggle": "__MISSING__:Advanced",
+    "simpleInputPanelTitle": "__MISSING__:Input",
+    "simpleInputPanelHint": "__MISSING__:Free-text message or ready-made example",
+    "simpleResultPanelTitle": "__MISSING__:Translation + Response",
+    "narratedDetected": "__MISSING__:✓ Detected: {format}",
+    "narratedTranslating": "__MISSING__:Translating to {target}...",
+    "narratedSending": "__MISSING__:Sending to {target}...",
+    "narratedSuccess": "__MISSING__:→ translated to {target} · response in {latency}ms",
+    "narratedError": "__MISSING__:Failed: {reason}",
+    "narratedSeeTranslatedJson": "__MISSING__:see translated JSON",
+    "narratedSeePipeline": "__MISSING__:see pipeline",
+    "advancedSectionTitle": "__MISSING__:Advanced",
+    "advancedSectionSubtitle": "__MISSING__:Raw JSON, pipeline and technical tools. Everything here is the same as the old tabs — just reorganized.",
+    "advancedRawJsonTitle": "__MISSING__:Raw JSON (auto-detect + Monaco)",
+    "advancedRawJsonSubtitle": "__MISSING__:Paste a JSON request; the format is detected automatically.",
+    "advancedPipelineTitle": "__MISSING__:OpenAI intermediate pipeline",
+    "advancedPipelineSubtitle": "__MISSING__:Visualize each translation step (hub-and-spoke).",
+    "advancedStreamTransformTitle": "__MISSING__:Stream Transformer (Chat → Responses SSE)",
+    "advancedStreamTransformSubtitle": "__MISSING__:Converts Chat Completions SSE into Responses API.",
+    "advancedTestBenchTitle": "__MISSING__:Test Bench (8 scenarios)",
+    "advancedTestBenchSubtitle": "__MISSING__:Runs all scenarios and reports pass/fail + compatibility %.",
+    "advancedCompressionTitle": "__MISSING__:Compression Preview",
+    "advancedCompressionSubtitle": "__MISSING__:Estimate token savings across different compression modes.",
+    "monitorOriginHint": "__MISSING__:Events generated by Translate or the main pipeline appear here in real time.",
+    "monitorEmptyCta": "__MISSING__:Go to the Translate tab and send a request — it will appear here.",
+    "monitorOpenTranslateButton": "__MISSING__:Go to Translate",
+    "pipelineStepClientRequest": "__MISSING__:Client Request",
+    "pipelineStepClientRequestDesc": "__MISSING__:Request received in client format",
+    "pipelineStepFormatDetected": "__MISSING__:Format Detected",
+    "pipelineStepFormatDetectedDesc": "__MISSING__:Auto-detected source format",
+    "pipelineStepOpenAIIntermediate": "__MISSING__:OpenAI Intermediate",
+    "pipelineStepOpenAIIntermediateDesc": "__MISSING__:Translated to OpenAI hub format",
+    "pipelineStepProviderFormat": "__MISSING__:Provider Format",
+    "pipelineStepProviderFormatDesc": "__MISSING__:Translated to provider target format",
+    "pipelineStepProviderResponse": "__MISSING__:Provider Response",
+    "pipelineStepProviderResponseDesc": "__MISSING__:Streaming response from provider",
+    "conceptDiagramArrow1": "__MISSING__:speaks",
+    "conceptDiagramArrow2": "__MISSING__:translates",
+    "conceptDiagramArrow3": "__MISSING__:converts",
+    "conceptDiagramExampleHub": "__MISSING__:OpenAI",
+    "conceptDiagramHubTooltip": "__MISSING__:Intermediate hub used by the translator to convert between formats that don't have a direct mapping.",
+    "conceptDiagramSourceTooltip": "__MISSING__:The API format your app speaks (e.g., Anthropic SDK = claude).",
+    "conceptDiagramTargetTooltip": "__MISSING__:The provider where the request will actually be sent.",
+    "compressionEmptyHint": "__MISSING__:Fill in the input field on the Translate tab (Simple Controls or Raw JSON) to enable the preview.",
+    "compressionModeLabel": "__MISSING__:Compression mode",
+    "compressionPreviewButton": "__MISSING__:Preview Compression",
+    "compressionPreviewing": "__MISSING__:Previewing…"
   },
   "usage": {
     "title": "Použitie",
@@ -6010,6 +6654,8 @@
     "notApplicable": "N/A",
     "rawPlanWithValue": "Nespracovaný plán: {plan}",
     "noPlanFromProvider": "Žiadny plán od poskytovateľa",
+    "tokenExpiresIn": "__MISSING__:Token expires in {time}",
+    "tokenExpired": "__MISSING__:Token expired",
     "noQuotaData": "Žiadne údaje o kvóte",
     "cardExpand": "__MISSING__:Expand",
     "cardCollapse": "__MISSING__:Collapse",
@@ -6159,6 +6805,11 @@
     "quotaCutoffsButtonDefault": "Predvolené",
     "quotaCutoffsButtonHelp": "Upravte minimálne zostávajúce limity kvót pre tento účet.",
     "quotaCutoffsButtonDisabled": "Pre tento účet zatiaľ nie sú k dispozícii žiadne kvóty.",
+    "deactivateAccount": "__MISSING__:Deactivate account (stop routing)",
+    "activateAccount": "__MISSING__:Activate account (resume routing)",
+    "accountActivated": "__MISSING__:Account activated",
+    "accountDeactivated": "__MISSING__:Account deactivated",
+    "toggleActiveFailed": "__MISSING__:Failed to update account status",
     "quotaCutoffsTitle": "Limity kvót pre {name} ({provider})",
     "quotaCutoffsExplainer": "Prepíšte minimálne zostávajúce percento kvóty, keď sa tento účet prestane vyberať pre každé okno kvóty. Ak chcete zdediť predvolené nastavenia poskytovateľa, nechajte pole prázdne.",
     "quotaCutoffsDefaultHint": "Predvolená minimálna zostávajúca hodnota: {default}%",
@@ -6179,6 +6830,7 @@
     "budgetColDailyLim": "Denná lim",
     "budgetColMonthlyLim": "Mesačná lim",
     "budgetColUsedPct": "Použité %",
+    "percentUsed": "__MISSING__:{pct}% used",
     "budgetLoading": "Načítava sa…",
     "budgetNoKeysMatch": "Filtrom nevyhovujú žiadne kľúče",
     "budgetLinearExtrapolation": "lineárna extrapolácia",
@@ -7124,6 +7776,11 @@
     "modalEditTitle": "Modal Edit Title",
     "labelName": "Label Name",
     "labelType": "Typ",
+    "labelFamily": "__MISSING__:IP family",
+    "familyAuto": "__MISSING__:Auto (dual-stack)",
+    "familyIpv4": "__MISSING__:IPv4 only",
+    "familyIpv6": "__MISSING__:IPv6 only",
+    "familyHint": "__MISSING__:Egress address family. Auto keeps dual-stack; IPv4/IPv6 pin this proxy to that family (prevents a v4 leak under an IPv6-only proxy).",
     "labelHost": "Hostiteľ",
     "labelPort": "Port",
     "labelUsername": "Používateľské meno",
@@ -7266,7 +7923,16 @@
     "improveConfirm": "Improve",
     "exportCode": "Export code",
     "exportCodeTitle": "Export Code",
+    "exportShort": "__MISSING__:Export",
     "noStateToExport": "No playground state available to export.",
+    "closeExportModal": "__MISSING__:Close export modal",
+    "close": "__MISSING__:Close",
+    "exportRealKeyWarning": "__MISSING__:Security warning: export blocked — a real API key was detected in the output. Please reset your API key and try again.",
+    "placeholderHintPrefix": "__MISSING__:Replace",
+    "placeholderHintSuffix": "__MISSING__:with your actual API key, or set it as an environment variable.",
+    "copyLangCode": "__MISSING__:Copy {language} code",
+    "loadingPresets": "__MISSING__:Loading…",
+    "loadPresetPlaceholder": "__MISSING__:Load preset…",
     "copyCode": "Copy",
     "copiedCode": "Copied!",
     "addModel": "+ Add model",
@@ -7291,7 +7957,27 @@
     "invalidJson": "Invalid JSON",
     "running": "Running…",
     "runLabel": "Run",
-    "enterToolResult": "Enter tool result…"
+    "enterToolResult": "Enter tool result…",
+    "build": {
+      "step1Label": "__MISSING__:What to test?",
+      "step2Label": "__MISSING__:Configure",
+      "step3Label": "__MISSING__:Run",
+      "step1Title": "__MISSING__:What do you want to test?",
+      "step1Subtitle": "__MISSING__:Choose the capability you want to explore in this session.",
+      "step2Title": "__MISSING__:Configure",
+      "step2Subtitle": "__MISSING__:Set up the tools or JSON schema that will be used in the request.",
+      "step3Title": "__MISSING__:Run",
+      "modeToolsTitle": "__MISSING__:Tools",
+      "modeToolsDesc": "__MISSING__:Test function calling — define tools and see how the model invokes them.",
+      "modeJsonTitle": "__MISSING__:JSON",
+      "modeJsonDesc": "__MISSING__:Test structured output — constrain the response to a JSON schema.",
+      "modeBothTitle": "__MISSING__:Tools + JSON",
+      "modeBothDesc": "__MISSING__:Combine function calling and structured output in a single request.",
+      "backButton": "__MISSING__:Back",
+      "nextButton": "__MISSING__:Next",
+      "runButton": "__MISSING__:Run",
+      "promptPlaceholder": "__MISSING__:Enter your message… (Enter to send, Shift+Enter for newline)"
+    }
   },
   "miniPlayground": {
     "endpoint": "__MISSING__:Endpoint",
@@ -7395,7 +8081,9 @@
     "loadingLogs": "Loading logs...",
     "noLogs": "No logs yet. Make some API calls to see them here.",
     "noMatchingLogs": "No logs matching current filters.",
-    "callLogsInfo": "Call logs are also saved as JSON files to {dataDir} and rotated based on {retentionDays} and {maxEntries}."
+    "callLogsInfo": "Call logs are also saved as JSON files to {dataDir} and rotated based on {retentionDays} and {maxEntries}.",
+    "loadMore": "__MISSING__:Load More",
+    "loadingMore": "__MISSING__:Loading more..."
   },
   "proxyLogger": {
     "filterAll": "All",
@@ -7432,7 +8120,8 @@
     "loadingProxyLogs": "Loading proxy logs...",
     "noProxyLogs": "No proxy logs yet. Configure proxies and make API calls to see them here.",
     "noMatchingLogs": "No logs match the current filters.",
-    "tlsFingerprint": "Chrome 124 TLS Fingerprint"
+    "tlsFingerprint": "Chrome 124 TLS Fingerprint",
+    "colPublicIp": "__MISSING__:Public IP"
   },
   "endpointOptions": {
     "speech": "Speech",
@@ -7572,7 +8261,86 @@
     "betaConfigSavedSuffix": "(zatiaľ nie je na serveri uložená). Presadzovanie limitu na žiadosť ešte nie je zapojené do proxy kanála. Táto obrazovka vám umožňuje navrhnúť a vizualizovať rozdelenie kvóty; skutočné presadzovanie pristane v budúcej iterácii s perzistenciou DB a odpočúvaním hovorov proti prúdu.",
     "policyLabel": "Pravidlá:",
     "resetIn": "resetovať v",
-    "quotaTotal": "celkom"
+    "quotaTotal": "celkom",
+    "kpiAvgUtilization": "__MISSING__:Avg utilization",
+    "kpiBorrowingNow": "__MISSING__:Borrowing now",
+    "conceptTitle": "__MISSING__:How Quota Share works",
+    "conceptIntro": "__MISSING__:Quota Share divides a provider's quota among multiple API keys using work-conserving fair-share: each key receives a proportional slice but can borrow from the free balance without exceeding the global cap.",
+    "conceptFairShare": "__MISSING__:Fair-share: each key receives quota proportional to its configured weight",
+    "conceptBorrowing": "__MISSING__:Borrowing: keys can consume free balance from others without breaching the cap",
+    "conceptGlobalCap": "__MISSING__:Hard global cap: the provider's absolute limit is never exceeded",
+    "conceptWindows": "__MISSING__:Windows: 5h, hourly, daily, weekly, monthly — each tracked independently",
+    "conceptKeyHowTitle": "__MISSING__:Enabling a key for quota",
+    "conceptKeyHowDesc": "__MISSING__:Create the key normally in API Keys — it appears in the wizard's key step automatically. Tick Exclusive there to make it quota-only. No separate enable step.",
+    "conceptExclusiveTitle": "__MISSING__:What \"Exclusive\" does",
+    "conceptExclusiveDesc": "__MISSING__:An exclusive key only sees/uses the pool's quotaShared-* models — every other model is hidden from its /v1/models and blocked.",
+    "burnRateTitle": "__MISSING__:Burn rate",
+    "burnRateExhaustsIn": "__MISSING__:Exhausts in",
+    "dimensionResetIn": "__MISSING__:Resets in",
+    "realConsumedColumn": "__MISSING__:Consumed",
+    "deficitColumn": "__MISSING__:Deficit",
+    "borrowingIndicator": "__MISSING__:borrowing",
+    "migratedFromLocalStorageNotice": "__MISSING__:Pools successfully migrated from localStorage.",
+    "policyCapAbsoluteLabel": "__MISSING__:Absolute cap",
+    "policyCapAbsolutePlaceholder": "__MISSING__:Numeric limit (optional)",
+    "multiDimensionLabel": "__MISSING__:Multi-dimension",
+    "stackedBarTitle": "__MISSING__:Slices by API key",
+    "usedSuffix": "__MISSING__:used {percent}%",
+    "wizardTitle": "__MISSING__:New quota pool",
+    "editPoolTitle": "__MISSING__:Edit pool",
+    "saveChanges": "__MISSING__:Save changes",
+    "wizardStep1Label": "__MISSING__:Account",
+    "wizardStep2Label": "__MISSING__:Limit",
+    "wizardStep3Label": "__MISSING__:Keys",
+    "wizardStep1Title": "__MISSING__:Choose provider connection",
+    "wizardStep1Subtitle": "__MISSING__:Select the provider account this pool will share quota for, set a name and default policy.",
+    "wizardStep2Title": "__MISSING__:Configure quota dimensions",
+    "wizardStep2Subtitle": "__MISSING__:Define the quota plan dimensions (unit, window, limit) for the chosen connection. Leave unchanged to keep current settings.",
+    "wizardStep3Title": "__MISSING__:Allocate API keys",
+    "wizardStep3Subtitle": "__MISSING__:Assign API keys to this pool with weight % allocations and optional caps.",
+    "wizardPoolNameLabel": "__MISSING__:Pool name",
+    "wizardPoolNamePlaceholder": "__MISSING__:My quota pool",
+    "wizardNext": "__MISSING__:Next",
+    "wizardBack": "__MISSING__:Back",
+    "wizardCreatePool": "__MISSING__:Create pool",
+    "wizardDimensionsEditedNotice": "__MISSING__:Dimensions edited — will be saved as a manual override when the pool is created.",
+    "wizardExclusiveLabel": "__MISSING__:Exclusive quota",
+    "wizardExclusiveHint": "__MISSING__:When enabled, these API keys will only be allowed to use this pool's virtual models (allowedQuotas reconciliation is applied on save).",
+    "wizardPreviewLabel": "__MISSING__:Virtual model names preview",
+    "wizardConnectionsLabel": "__MISSING__:Provider connections",
+    "wizardPrimaryBadge": "__MISSING__:primary",
+    "wizardAdditionalConnectionsNote": "__MISSING__:Additional connections use their catalog default limits (editable later).",
+    "wizardSingleProviderNote": "__MISSING__:A pool uses a single provider",
+    "wizardPreviewMoreModels": "__MISSING__:+{count} more",
+    "accountQuotaTitle": "__MISSING__:Account quota",
+    "accountQuotaNone": "__MISSING__:—",
+    "logTitle": "__MISSING__:Usage log",
+    "logEmpty": "__MISSING__:No usage yet",
+    "groupLabel": "__MISSING__:Group",
+    "newGroup": "__MISSING__:New group",
+    "renameGroup": "__MISSING__:Rename group",
+    "groupSelectHint": "__MISSING__:Filter pools by group",
+    "groupAllocationNote": "__MISSING__:Allocations apply to all pools in this group via the shared quota layer.",
+    "groupNamePrompt": "__MISSING__:Enter group name",
+    "wizardGroupLabel": "__MISSING__:Group",
+    "allGroups": "__MISSING__:All groups",
+    "endpointsTitle": "__MISSING__:Available endpoints",
+    "endpointsHint": "__MISSING__:Call these virtual models with any allocated key — routing + quota are handled per group.",
+    "previewForKey": "__MISSING__:Preview for key",
+    "previewKeyNone": "__MISSING__:(all endpoints)",
+    "endpointsBaseUrl": "__MISSING__:Base URL",
+    "endpointsCollapse": "__MISSING__:Collapse",
+    "endpointsExpand": "__MISSING__:Expand",
+    "endpointsAnthropicNote": "__MISSING__:Anthropic-native",
+    "endpointsResponsesNote": "__MISSING__:OpenAI Responses — codex/github",
+    "endpointsWsNote": "__MISSING__:WebSocket — codex only",
+    "betaText": "__MISSING__:Quota Share is functional but bugs are expected. Found one? Please report it.",
+    "betaReportLink": "__MISSING__:Report an issue",
+    "deleteGroup": "__MISSING__:Delete group",
+    "deleteGroupConfirm": "__MISSING__:Delete this group? Its pools must be reassigned or removed first.",
+    "deleteGroupHasPools": "__MISSING__:This group still has pools — reassign or delete them first.",
+    "ungroupedTitle": "__MISSING__:Ungrouped",
+    "ungroupedHint": "__MISSING__:These pools are not assigned to a known group. Edit a pool to move it into a real group."
   },
   "plugins": {
     "title": "Plugins",
@@ -7608,6 +8376,571 @@
     "status": "Status",
     "enabled": "Enabled",
     "disabled": "Disabled",
+    "installedTab": "__MISSING__:Installed",
+    "marketplaceTab": "__MISSING__:Marketplace",
+    "marketplaceUrlLabel": "__MISSING__:Custom Marketplace URL",
+    "marketplaceUrlPlaceholder": "__MISSING__:Leave empty for official Omniroute registry",
+    "saveMarketplaceUrl": "__MISSING__:Save & Reload",
+    "marketplaceUrlSaved": "__MISSING__:Marketplace URL updated",
+    "marketplaceEmpty": "__MISSING__:No plugins found in marketplace.",
+    "verified": "__MISSING__:Verified",
+    "install": "__MISSING__:Install",
+    "installedFromMarketplace": "__MISSING__:Plugin {name} installed!",
     "hooks": "Hooks"
+  },
+  "quotaPlans": {
+    "title": "__MISSING__:Plans & Quotas",
+    "description": "__MISSING__:Configure quota plans per provider — dimensions (%, requests, tokens, $) and time windows",
+    "providerLabel": "__MISSING__:Provider / Connection",
+    "detectedPlanLabel": "__MISSING__:Detected plan",
+    "manualPlanLabel": "__MISSING__:Manual override",
+    "unconfiguredLabel": "__MISSING__:Not configured — manual required",
+    "dimensionLabel": "__MISSING__:Dimensions",
+    "addDimension": "__MISSING__:Add dimension",
+    "removeDimension": "__MISSING__:Remove",
+    "limitLabel": "__MISSING__:Limit",
+    "unitOptions": {
+      "percent": "__MISSING__:%",
+      "requests": "__MISSING__:requests",
+      "tokens": "__MISSING__:tokens",
+      "usd": "__MISSING__:USD ($)"
+    },
+    "windowOptions": {
+      "5h": "__MISSING__:5 hours",
+      "hourly": "__MISSING__:Hourly",
+      "daily": "__MISSING__:Daily",
+      "weekly": "__MISSING__:Weekly",
+      "monthly": "__MISSING__:Monthly"
+    },
+    "useCatalogButton": "__MISSING__:Use catalog",
+    "saveOverrideButton": "__MISSING__:Save override",
+    "revertToCatalogButton": "__MISSING__:Revert to catalog",
+    "unknownProviderNotice": "__MISSING__:Select a provider on the left to configure its quota plan.",
+    "catalogTitle": "__MISSING__:Known catalog",
+    "catalogDescription": "__MISSING__:Automatically detected plans for the following providers:"
+  },
+  "activity": {
+    "title": "__MISSING__:Activity",
+    "description": "__MISSING__:Recent events feed",
+    "emptyTitle": "__MISSING__:No activity yet",
+    "emptyDescription": "__MISSING__:When you add providers, create combos, or rotate keys, events will appear here.",
+    "todayHeader": "__MISSING__:Today",
+    "yesterdayHeader": "__MISSING__:Yesterday",
+    "filterAll": "__MISSING__:All",
+    "filterProviders": "__MISSING__:Providers",
+    "filterCombos": "__MISSING__:Combos",
+    "filterApiKeys": "__MISSING__:API Keys",
+    "filterSettings": "__MISSING__:Settings",
+    "filterQuota": "__MISSING__:Quota",
+    "filterAuth": "__MISSING__:Auth",
+    "filterSystem": "__MISSING__:System",
+    "relative": {
+      "justNow": "__MISSING__:just now",
+      "minutesAgo": "__MISSING__:{n} min ago",
+      "hoursAgo": "__MISSING__:{n} h ago",
+      "yesterday": "__MISSING__:yesterday",
+      "daysAgo": "__MISSING__:{n} days ago"
+    },
+    "eventVerb": {
+      "providerAdded": "__MISSING__:{actor} added provider {target}",
+      "providerRemoved": "__MISSING__:{actor} removed provider {target}",
+      "providerTested": "__MISSING__:{actor} tested provider {target}",
+      "comboCreated": "__MISSING__:{actor} created combo {target}",
+      "comboUpdated": "__MISSING__:{actor} updated combo {target}",
+      "comboDeleted": "__MISSING__:{actor} removed combo {target}",
+      "apiKeyCreated": "__MISSING__:{actor} created API key {target}",
+      "apiKeyRevoked": "__MISSING__:{actor} revoked API key {target}",
+      "apiKeyRotated": "__MISSING__:{actor} rotated API key {target}",
+      "budgetThreshold": "__MISSING__:Budget threshold reached for {target}",
+      "settingUpdated": "__MISSING__:{actor} updated setting {target}",
+      "authLogin": "__MISSING__:{actor} signed in",
+      "authLogout": "__MISSING__:{actor} signed out",
+      "cloudAgentSession": "__MISSING__:Cloud agent session started for {target}",
+      "mcpToolRegistered": "__MISSING__:MCP tool {target} registered",
+      "webhookCreated": "__MISSING__:{actor} created webhook {target}",
+      "webhookDeleted": "__MISSING__:{actor} removed webhook {target}",
+      "quotaPoolCreated": "__MISSING__:{actor} created quota pool {target}",
+      "quotaPoolUpdated": "__MISSING__:{actor} updated quota pool {target}",
+      "quotaPoolDeleted": "__MISSING__:{actor} removed quota pool {target}",
+      "quotaPlanUpdated": "__MISSING__:{actor} updated quota plan {target}",
+      "quotaStoreDriverChanged": "__MISSING__:QuotaStore driver changed",
+      "updateApplied": "__MISSING__:Update {target} applied",
+      "deployCompleted": "__MISSING__:Deploy completed",
+      "skillInstalled": "__MISSING__:{actor} installed skill {target}",
+      "skillRemoved": "__MISSING__:{actor} removed skill {target}",
+      "providerCredentialsCreated": "__MISSING__:{actor} created credentials for {target}",
+      "providerCredentialsApplied": "__MISSING__:Credentials for {target} applied",
+      "providerCredentialsUpdated": "__MISSING__:{actor} updated credentials for {target}",
+      "providerCredentialsRevoked": "__MISSING__:{actor} revoked credentials for {target}",
+      "providerCredentialsBatchRevoked": "__MISSING__:{actor} batch-revoked credentials",
+      "providerCredentialsBatchUpdated": "__MISSING__:{actor} batch-updated credentials",
+      "providerCredentialsBulkCreated": "__MISSING__:{actor} bulk-created credentials",
+      "providerCredentialsBulkImported": "__MISSING__:{actor} bulk-imported credentials",
+      "providerCredentialsImported": "__MISSING__:{actor} imported credentials",
+      "providerSsrfBlocked": "__MISSING__:SSRF attempt blocked for {target}",
+      "authLoginSuccess": "__MISSING__:{actor} signed in",
+      "authLoginError": "__MISSING__:Login error for {actor}",
+      "authLoginFailed": "__MISSING__:Login failed for {actor}",
+      "authLoginLocked": "__MISSING__:{actor} locked out after too many attempts",
+      "authLoginMisconfigured": "__MISSING__:Auth configuration invalid",
+      "authLoginSetupRequired": "__MISSING__:Auth setup required",
+      "authLogoutSuccess": "__MISSING__:{actor} signed out",
+      "syncTokenCreated": "__MISSING__:{actor} created sync token",
+      "syncTokenRevoked": "__MISSING__:{actor} revoked sync token",
+      "settingsUpdate": "__MISSING__:{actor} updated settings",
+      "settingsUpdateFailed": "__MISSING__:Settings update failed",
+      "serviceRevealApiKey": "__MISSING__:{actor} revealed API key for {target}",
+      "genericEvent": "__MISSING__:{actor} {target}"
+    }
+  },
+  "agentBridge": {
+    "title": "__MISSING__:AgentBridge",
+    "subtitle": "__MISSING__:Use IDE agents with OmniRoute models — no config required",
+    "riskBannerTitle": "__MISSING__:Use at your own risk",
+    "riskBannerBody": "__MISSING__:AgentBridge intercepts HTTPS traffic from IDE agents. By activating it you accept responsibility for compliance with the terms of service of each agent. Never use on devices or networks where TLS inspection is prohibited.",
+    "riskBannerDismiss": "__MISSING__:Dismiss",
+    "serverCardTitle": "__MISSING__:AgentBridge Server",
+    "statusRunning": "__MISSING__:Running",
+    "statusStopped": "__MISSING__:Stopped",
+    "statusActive": "__MISSING__:Active",
+    "statusDnsOff": "__MISSING__:DNS off",
+    "statusSetupRequired": "__MISSING__:Setup required",
+    "statusInvestigating": "__MISSING__:Investigating",
+    "serverPort": "__MISSING__:Port",
+    "serverConns": "__MISSING__:Connections",
+    "serverIntercepted": "__MISSING__:Intercepted",
+    "serverLastStarted": "__MISSING__:Last started",
+    "startServer": "__MISSING__:Start",
+    "stopServer": "__MISSING__:Stop",
+    "restartServer": "__MISSING__:Restart",
+    "trustCert": "__MISSING__:Trust Cert",
+    "downloadCert": "__MISSING__:Download Cert",
+    "regenerateCert": "__MISSING__:Regenerate Cert",
+    "starting": "__MISSING__:Starting…",
+    "stopping": "__MISSING__:Stopping…",
+    "restarting": "__MISSING__:Restarting…",
+    "trusting": "__MISSING__:Trusting…",
+    "regenerating": "__MISSING__:Regenerating…",
+    "upstreamCaLabel": "__MISSING__:Upstream CA Certificate (corporate)",
+    "upstreamCaPlaceholder": "__MISSING__:/etc/ssl/certs/corp-ca.pem",
+    "upstreamCaTest": "__MISSING__:Test TLS",
+    "upstreamCaTestOk": "__MISSING__:TLS test passed",
+    "upstreamCaTestError": "__MISSING__:TLS test failed — check the path and CA file",
+    "bypassSectionTitle": "__MISSING__:Bypass List",
+    "bypassSectionDesc": "__MISSING__:Hosts matching these patterns are tunneled directly (no TLS decryption). Defaults include banks, .gov, and corporate SSO.",
+    "bypassDefaultsLabel": "__MISSING__:Default bypass patterns (read-only)",
+    "bypassUserLabel": "__MISSING__:Custom bypass patterns (one per line, glob or regex)",
+    "saveBypassList": "__MISSING__:Save bypass list",
+    "agentListTitle": "__MISSING__:IDE Agents",
+    "filterAll": "__MISSING__:All",
+    "filterActive": "__MISSING__:Active",
+    "filterSetupRequired": "__MISSING__:Setup required",
+    "filterInvestigating": "__MISSING__:Investigating",
+    "searchAgents": "__MISSING__:Search agents…",
+    "noAgentsMatch": "__MISSING__:No agents match the current filter",
+    "agentHosts": "__MISSING__:Intercepted hosts",
+    "certTrusted": "__MISSING__:Certificate trusted",
+    "certNotTrusted": "__MISSING__:Certificate not trusted",
+    "investigatingNotice": "__MISSING__:This agent is under investigation. Hosts and API surface are still being confirmed. Setup will be available once the upstream API is documented.",
+    "modelMappingsLabel": "__MISSING__:Model mappings",
+    "sourceModel": "__MISSING__:Source model (agent native)",
+    "targetModel": "__MISSING__:Target model (OmniRoute)",
+    "noMappings": "__MISSING__:No model mappings configured. Run setup wizard to auto-detect models.",
+    "selectModel": "__MISSING__:Select…",
+    "saveMappings": "__MISSING__:Save mappings",
+    "setupWizard": "__MISSING__:Setup wizard",
+    "startDns": "__MISSING__:Start DNS",
+    "stopDns": "__MISSING__:Stop DNS",
+    "toggling": "__MISSING__:Toggling…",
+    "viewTraffic": "__MISSING__:View traffic",
+    "emptyNoProvidersTitle": "__MISSING__:No providers configured yet",
+    "emptyNoProvidersBody": "__MISSING__:To use AgentBridge, first connect at least one provider. It will be the destination where IDE requests are routed.",
+    "emptyGoToProviders": "__MISSING__:Go to Providers",
+    "wizardTitle": "__MISSING__:Setup wizard",
+    "wizardSubtitle": "__MISSING__:3-step setup",
+    "wizardStep1Label": "__MISSING__:Verify",
+    "wizardStep2Label": "__MISSING__:DNS",
+    "wizardStep3Label": "__MISSING__:Mappings",
+    "wizardStep1Desc": "__MISSING__:Confirm the server is running and the certificate is installed.",
+    "wizardStep2Desc": "__MISSING__:The following entries will be added to /etc/hosts to redirect traffic through AgentBridge:",
+    "wizardStep3Desc": "__MISSING__:You can now configure model mappings in the agent card. Restart the IDE to apply changes.",
+    "wizardStep3Success": "__MISSING__:Agent is configured!",
+    "wizardServerCheck": "__MISSING__:AgentBridge server",
+    "wizardRunning": "__MISSING__:running",
+    "wizardNotRunning": "__MISSING__:not running",
+    "wizardCertCheck": "__MISSING__:Certificate",
+    "wizardTrusted": "__MISSING__:trusted",
+    "wizardNotTrusted": "__MISSING__:not yet trusted — use Trust Cert button",
+    "wizardTutorialTitle": "__MISSING__:Setup instructions:",
+    "wizardEnableDns": "__MISSING__:Add /etc/hosts entries",
+    "wizardDnsAlreadyEnabled": "__MISSING__:DNS already enabled for this agent",
+    "enablingDns": "__MISSING__:Enabling…",
+    "modelSelectorTitle": "__MISSING__:Select target model",
+    "modelSelectorSearch": "__MISSING__:Search models…",
+    "noModelsFound": "__MISSING__:No models found",
+    "quickLinks": "__MISSING__:Quick links",
+    "quickLinkProviders": "__MISSING__:Configure providers",
+    "quickLinkInspector": "__MISSING__:View traffic in Traffic Inspector",
+    "maintenanceTitle": "__MISSING__:Maintenance & Diagnostics",
+    "maintenanceSubtitle": "__MISSING__:Self-test the capture pipeline, undo leftover system state, and move your setup between machines.",
+    "orphanedStateWarning": "__MISSING__:A previous session left system state behind (DNS spoof, CA, or system proxy). Run Repair to clean it up.",
+    "diagnose": "__MISSING__:Diagnose",
+    "diagnosing": "__MISSING__:Diagnosing…",
+    "diagnoseHealthy": "__MISSING__:Capture pipeline is healthy.",
+    "diagnoseUnhealthy": "__MISSING__:Capture pipeline has problems:",
+    "repair": "__MISSING__:Repair",
+    "repairing": "__MISSING__:Repairing…",
+    "repairDone": "__MISSING__:Repaired: {items}",
+    "repairNothing": "__MISSING__:Nothing to repair — system state is clean.",
+    "removeCa": "__MISSING__:Remove CA",
+    "removeCaConfirm": "__MISSING__:Remove CA?",
+    "removeCaDone": "__MISSING__:MITM root CA removed from the OS trust store.",
+    "removing": "__MISSING__:Removing…",
+    "confirm": "__MISSING__:Confirm",
+    "exportConfig": "__MISSING__:Export config",
+    "exporting": "__MISSING__:Exporting…",
+    "importConfig": "__MISSING__:Import config",
+    "importing": "__MISSING__:Importing…",
+    "importInvalidJson": "__MISSING__:The selected file is not valid JSON.",
+    "importDone": "__MISSING__:Imported {bypass} bypass · {hosts} hosts · {agents} agents",
+    "save": "__MISSING__:Save",
+    "saving": "__MISSING__:Saving…",
+    "cancel": "__MISSING__:Cancel",
+    "back": "__MISSING__:Back",
+    "next": "__MISSING__:Next",
+    "done": "__MISSING__:Done",
+    "loading": "__MISSING__:Loading…",
+    "riskNoticeTitle": "__MISSING__:Risk acknowledgment",
+    "riskNoticeBody": "__MISSING__:AgentBridge will intercept HTTPS traffic from this agent by redirecting its API hosts via DNS. Only enable if you accept responsibility for compliance with the agent's terms of service and any applicable network policies.",
+    "pageMoved": {
+      "goNow": "__MISSING__:Go now",
+      "message": "__MISSING__:The MITM Proxy now lives under AgentBridge.",
+      "title": "__MISSING__:This page has moved"
+    }
+  },
+  "trafficInspector": {
+    "title": "__MISSING__:Traffic Inspector",
+    "subtitle": "__MISSING__:Monitor LLM calls and debug any application's HTTPS traffic",
+    "captureModesTitle": "__MISSING__:Capture Modes",
+    "agentBridgeMode": "__MISSING__:AgentBridge",
+    "agentBridgeModeDesc": "__MISSING__:Capture traffic from all connected IDE agents",
+    "customHostsMode": "__MISSING__:Custom Hosts",
+    "customHostsModeDesc": "__MISSING__:Add specific hosts to intercept",
+    "httpProxyMode": "__MISSING__:HTTP Proxy",
+    "httpProxyModeDesc": "__MISSING__:Use HTTP_PROXY environment variable",
+    "systemWideMode": "__MISSING__:System-wide",
+    "systemWideModeDesc": "__MISSING__:Intercept all system traffic (advanced)",
+    "tproxyMode": "__MISSING__:TPROXY Decrypt",
+    "tproxyModeUnavailable": "__MISSING__:TPROXY decrypt requires Linux + root + the native addon",
+    "filterBarTitle": "__MISSING__:Filters",
+    "profileLlmOnly": "__MISSING__:LLM only",
+    "profileCustom": "__MISSING__:Custom",
+    "profileAll": "__MISSING__:All",
+    "filterHost": "__MISSING__:Filter host…",
+    "filterAgent": "__MISSING__:Agent",
+    "filterStatus": "__MISSING__:Status",
+    "pauseBtn": "__MISSING__:Pause",
+    "resumeBtn": "__MISSING__:Resume",
+    "clearBtn": "__MISSING__:Clear",
+    "exportHar": "__MISSING__:Export .har",
+    "recordSession": "__MISSING__:REC",
+    "stopSession": "__MISSING__:Stop",
+    "liveBadge": "__MISSING__:live",
+    "offlineBadge": "__MISSING__:offline",
+    "noRequests": "__MISSING__:No requests captured yet.",
+    "noRequestsDesc": "__MISSING__:Make sure AgentBridge is running or enable another capture mode.",
+    "selectRequest": "__MISSING__:Select a request to inspect it.",
+    "tabConversation": "__MISSING__:Conversation",
+    "tabHeaders": "__MISSING__:Headers",
+    "tabRequest": "__MISSING__:Request",
+    "tabResponse": "__MISSING__:Response",
+    "tabTiming": "__MISSING__:Timing",
+    "tabLlm": "__MISSING__:LLM",
+    "tabStats": "__MISSING__:Stats",
+    "requestHeaders": "__MISSING__:Request Headers",
+    "responseHeaders": "__MISSING__:Response Headers",
+    "rawEvents": "__MISSING__:Raw events",
+    "mergedView": "__MISSING__:Merged view",
+    "noBody": "__MISSING__:No body.",
+    "streaming": "__MISSING__:streaming…",
+    "manageHosts": "__MISSING__:Manage hosts",
+    "copySnippet": "__MISSING__:Copy proxy snippet",
+    "addHost": "__MISSING__:Add",
+    "hostPlaceholder": "__MISSING__:api.openai.com",
+    "noHostsYet": "__MISSING__:No custom hosts added yet.",
+    "noSessionsYet": "__MISSING__:No sessions yet",
+    "allTraffic": "__MISSING__:All traffic (no session)",
+    "sessionsDropdown": "__MISSING__:Sessions",
+    "annotationPlaceholder": "__MISSING__:Add a note…",
+    "contextFingerprint": "__MISSING__:Context fingerprint",
+    "llmProvider": "__MISSING__:Detected provider",
+    "llmApiKind": "__MISSING__:API kind",
+    "llmModel": "__MISSING__:Model",
+    "llmMessages": "__MISSING__:Messages",
+    "llmStream": "__MISSING__:Stream",
+    "llmMappedTo": "__MISSING__:Mapped to",
+    "llmCostEstimate": "__MISSING__:Cost estimate",
+    "systemProxyExitWarning": "__MISSING__:System-wide proxy still active — leave page anyway?",
+    "customHostsTitle": "__MISSING__:Custom Hosts",
+    "loading": "__MISSING__:Loading…",
+    "copied": "__MISSING__:Copied!",
+    "copy": "__MISSING__:Copy",
+    "httpProxyTitle": "__MISSING__:HTTP Proxy Snippet — port {port}",
+    "notRecording": "__MISSING__:Not recording",
+    "anyStatus": "__MISSING__:Any status",
+    "liveOnly": "__MISSING__:Live",
+    "viewingRecordedSession": "__MISSING__:Viewing recorded session",
+    "backToLive": "__MISSING__:Back to live",
+    "untitledSession": "__MISSING__:Untitled session",
+    "contextHistory": "__MISSING__:Context History",
+    "modelResponse": "__MISSING__:Model Response",
+    "conversationNoMessages": "__MISSING__:No messages found in this request.",
+    "conversationNotAvailable": "__MISSING__:Conversation data not available. This may not be an LLM request or the body could not be parsed.",
+    "loadingCharts": "__MISSING__:Loading charts…",
+    "statsErrors": "__MISSING__:Errors",
+    "statsLatency": "__MISSING__:Latency (last 50 requests)",
+    "statsNoData": "__MISSING__:No requests yet. Start a session recording to capture data for stats.",
+    "statsStatusDistribution": "__MISSING__:Status distribution",
+    "statsSuccessful": "__MISSING__:Successful",
+    "statsTotalRequests": "__MISSING__:Total requests",
+    "timingProxyOverhead": "__MISSING__:Proxy overhead",
+    "timingUpstreamResponse": "__MISSING__:Upstream response",
+    "timingNoData": "__MISSING__:No timing data available.",
+    "timingTotalLatency": "__MISSING__:Total latency",
+    "timingTimestamp": "__MISSING__:Timestamp",
+    "timingMethod": "__MISSING__:Method",
+    "timingStatus": "__MISSING__:Status",
+    "timingRequestSize": "__MISSING__:Request size",
+    "timingResponseSize": "__MISSING__:Response size",
+    "pausedNewBadge": "__MISSING__:{count} new",
+    "clearContextFilter": "__MISSING__:clear"
+  },
+  "cliCommon": {
+    "concept": {
+      "code": {
+        "title": "__MISSING__:CLI Code",
+        "phrase": "__MISSING__:Code tools you point at OmniRoute",
+        "flow": "__MISSING__:You → CLI Code → OmniRoute → Provider",
+        "seeOther": "__MISSING__:See →"
+      },
+      "agent": {
+        "title": "__MISSING__:CLI Agents",
+        "phrase": "__MISSING__:Broad-purpose autonomous CLI agents you point at OmniRoute",
+        "flow": "__MISSING__:You → CLI Agent → OmniRoute → Provider",
+        "seeOther": "__MISSING__:See →"
+      },
+      "acp": {
+        "title": "__MISSING__:ACP Agents",
+        "phrase": "__MISSING__:CLIs that OmniRoute spawns as execution backend (reverse flow)",
+        "flow": "__MISSING__:Client → OmniRoute → spawn CLI (stdio/ACP) → response",
+        "seeOther": "__MISSING__:See →"
+      }
+    },
+    "comparison": {
+      "title": "__MISSING__:Understand the 3 CLI types in OmniRoute",
+      "thisPage": "__MISSING__:This page",
+      "open": "__MISSING__:Open →",
+      "code": {
+        "title": "__MISSING__:Code tool",
+        "desc": "__MISSING__:Points to Omni",
+        "flow": "__MISSING__:you → CLI → Omni → provider",
+        "examples": "__MISSING__:e.g.: claude, codex"
+      },
+      "agent": {
+        "title": "__MISSING__:Broad autonomous agent",
+        "desc": "__MISSING__:Points to Omni",
+        "flow": "__MISSING__:you → agent → Omni",
+        "examples": "__MISSING__:e.g.: hermes, goose"
+      },
+      "acp": {
+        "title": "__MISSING__:CLI used as backend by Omni",
+        "desc": "__MISSING__:Reverse execution",
+        "flow": "__MISSING__:Omni → spawn CLI → resp",
+        "examples": "__MISSING__:e.g.: claude, codex (ACP)"
+      }
+    },
+    "card": {
+      "detected": "__MISSING__:Detected",
+      "notDetected": "__MISSING__:Not detected",
+      "configured": "__MISSING__:Configured",
+      "notConfigured": "__MISSING__:Not configured",
+      "configure": "__MISSING__:Configure →",
+      "howToInstall": "__MISSING__:How to install →",
+      "manualConfig": "__MISSING__:Manual config",
+      "installGuide": "__MISSING__:Install guide",
+      "endpointLabel": "__MISSING__:Endpoint",
+      "baseUrlFull": "__MISSING__:Full Base URL",
+      "baseUrlPartial": "__MISSING__:Partial Base URL",
+      "refreshDetection": "__MISSING__:Refresh detection",
+      "alsoAcp": "__MISSING__:also ACP",
+      "connectProviderHint": "__MISSING__:Connect a provider in Providers"
+    },
+    "detail": {
+      "back": "__MISSING__:Back",
+      "apply": "__MISSING__:Save",
+      "reset": "__MISSING__:Clear",
+      "manualConfig": "__MISSING__:Manual configuration",
+      "vendor": "__MISSING__:Vendor",
+      "category": "__MISSING__:Type",
+      "detectionStatus": "__MISSING__:Detection",
+      "configStatus": "__MISSING__:Configuration",
+      "baseUrlLabel": "__MISSING__:Base URL",
+      "apiKeyLabel": "__MISSING__:API Key",
+      "modelMappingLabel": "__MISSING__:Model mapping",
+      "noActiveProviders": "__MISSING__:No active providers.",
+      "noActiveProvidersDesc": "__MISSING__:Go to Providers to connect at least 1 provider before configuring the CLI.",
+      "openProviders": "__MISSING__:Open Providers →"
+    }
+  },
+  "cliCode": {
+    "pageTitle": "__MISSING__:CLI Code's",
+    "pageSubtitle": "__MISSING__:Code tools pointing to OmniRoute",
+    "searchPlaceholder": "__MISSING__:Search CLI…",
+    "filterDetectionLabel": "__MISSING__:Detection",
+    "filterBaseUrlLabel": "__MISSING__:Base URL",
+    "detectionAll": "__MISSING__:All",
+    "detectionInstalled": "__MISSING__:Installed",
+    "detectionNotFound": "__MISSING__:Not found",
+    "baseUrlAll": "__MISSING__:All",
+    "baseUrlFull": "__MISSING__:Full",
+    "baseUrlPartial": "__MISSING__:Partial"
+  },
+  "cliAgents": {
+    "pageTitle": "__MISSING__:CLI Agents",
+    "pageSubtitle": "__MISSING__:Broad-purpose autonomous CLI agents",
+    "refreshDetection": "__MISSING__:Refresh detection",
+    "searchPlaceholder": "__MISSING__:Search agent…",
+    "detectionFilterLabel": "__MISSING__:Detection",
+    "detectionAll": "__MISSING__:All",
+    "detectionInstalled": "__MISSING__:Installed",
+    "detectionNotInstalled": "__MISSING__:Not installed",
+    "visibleCount": "__MISSING__:{count} visible",
+    "emptyState": "__MISSING__:No CLI agents found with the current filters."
+  },
+  "acpAgents": {
+    "pageTitle": "__MISSING__:ACP Agents",
+    "pageSubtitle": "__MISSING__:CLIs that OmniRoute spawns as execution backend",
+    "scanning": "__MISSING__:Detecting agents…",
+    "refresh": "__MISSING__:Refresh",
+    "setupGuideTitle": "__MISSING__:Setup guide",
+    "setupGuideDetectCliTitle": "__MISSING__:Detect CLI",
+    "setupGuideDetectCliDesc": "__MISSING__:Agents are identified by running the --version command in PATH.",
+    "setupGuideCustomAgentTitle": "__MISSING__:Add custom agent",
+    "setupGuideCustomAgentDesc": "__MISSING__:Fill in the form below to register a custom CLI agent.",
+    "setupGuideCommandMissingTitle": "__MISSING__:Command not found",
+    "setupGuideCommandMissingDesc": "__MISSING__:Check that the binary is in PATH.",
+    "fingerprintSettingsHint": "__MISSING__:Configure routing and fingerprints in",
+    "settingsRoutingLink": "__MISSING__:Settings → Routing",
+    "installed": "__MISSING__:Installed",
+    "notFound": "__MISSING__:Not found",
+    "builtIn": "__MISSING__:Built-in",
+    "custom": "__MISSING__:Custom",
+    "agentUseCaseHint": "__MISSING__:Available for spawn via ACP.",
+    "remove": "__MISSING__:Remove",
+    "addCustomAgent": "__MISSING__:Add custom agent",
+    "addCustomAgentDesc": "__MISSING__:Register a custom CLI agent to be spawned via ACP.",
+    "addAgent": "__MISSING__:Add agent",
+    "agentName": "__MISSING__:Name",
+    "agentNamePlaceholder": "__MISSING__:e.g.: My Agent",
+    "binaryName": "__MISSING__:Binary",
+    "binaryNamePlaceholder": "__MISSING__:e.g.: myagent",
+    "versionCommand": "__MISSING__:Version command",
+    "versionCommandPlaceholder": "__MISSING__:e.g.: myagent --version",
+    "spawnArgs": "__MISSING__:Spawn arguments",
+    "spawnArgsPlaceholder": "__MISSING__:e.g.: --quiet, --json",
+    "cliCodeRedirectCta": "__MISSING__:Open CLI Code"
+  },
+  "agentSkills": {
+    "pageTitle": "__MISSING__:Agent Skills",
+    "pageSubtitle": "__MISSING__:Teach your agent to operate OmniRoute — 22 API areas + 20 CLI families",
+    "conceptCard": {
+      "agent": {
+        "title": "__MISSING__:Agent Skills — Outbound",
+        "description": "__MISSING__:Agent Skills are machine-readable SKILL.md documents that external AI agents (Claude Code, Cursor, Copilot…) fetch from GitHub to learn how to operate OmniRoute via REST or CLI. They are read by the agent, not executed by OmniRoute.",
+        "crossLinkLabel": "__MISSING__:Understand the difference →"
+      },
+      "omni": {
+        "title": "__MISSING__:Omni Skills — Inbound",
+        "description": "__MISSING__:Omni Skills are sandbox tools that OmniRoute injects into the model's context on every request. They are executed by OmniRoute, not read by the agent.",
+        "crossLinkLabel": "__MISSING__:Understand the difference →"
+      },
+      "comparison": {
+        "colAgent": "__MISSING__:Agent Skills",
+        "colOmni": "__MISSING__:Omni Skills",
+        "whatIs": {
+          "label": "__MISSING__:What it is",
+          "agent": "__MISSING__:Machine-readable SKILL.md that teaches an external agent to operate OmniRoute",
+          "omni": "__MISSING__:Executable tools that OmniRoute injects as tools into LLM requests"
+        },
+        "direction": {
+          "label": "__MISSING__:Direction",
+          "agent": "__MISSING__:Outbound — external agent learns to control OmniRoute",
+          "omni": "__MISSING__:Inbound — OmniRoute gives tools to models passing through it"
+        },
+        "executor": {
+          "label": "__MISSING__:Executor",
+          "agent": "__MISSING__:External agent (reads markdown → acts via API/CLI)",
+          "omni": "__MISSING__:OmniRoute itself (intercepts tool_calls, Docker sandbox)"
+        },
+        "storage": {
+          "label": "__MISSING__:Storage",
+          "agent": "__MISSING__:Dynamic catalog (/api/agent-skills) → SKILL.md on GitHub",
+          "omni": "__MISSING__:SQLite (SkillsMP / skills.sh / local)"
+        },
+        "tagline": {
+          "label": "__MISSING__:Tagline",
+          "agent": "__MISSING__:Teach your agent to use OmniRoute",
+          "omni": "__MISSING__:Give executable tools to OmniRoute models"
+        }
+      }
+    },
+    "filters": {
+      "category": "__MISSING__:Category",
+      "area": "__MISSING__:Area",
+      "searchPlaceholder": "__MISSING__:Search skills…"
+    },
+    "categoryApi": "__MISSING__:API",
+    "categoryCli": "__MISSING__:CLI",
+    "categoryConfig": "__MISSING__:Config",
+    "filterAll": "__MISSING__:All",
+    "coverageLabel": "__MISSING__:Coverage",
+    "mcpUrl": "__MISSING__:MCP URL",
+    "a2aLink": "__MISSING__:A2A",
+    "copyUrl": "__MISSING__:Copy URL",
+    "viewOnGithub": "__MISSING__:View on GitHub",
+    "previewLoading": "__MISSING__:Loading skill documentation…",
+    "previewError": "__MISSING__:Failed to load skill documentation.",
+    "previewEmpty": "__MISSING__:Select a skill to preview its documentation.",
+    "generateButton": "__MISSING__:Generate missing skills",
+    "coverageBar": {
+      "complete": "__MISSING__:Complete",
+      "partial": "__MISSING__:Partial"
+    },
+    "noSkillsFound": "__MISSING__:No skills found matching your filters.",
+    "regenerateConfirm": "__MISSING__:This will regenerate all missing SKILL.md files. Continue?",
+    "regenerateRunning": "__MISSING__:Regenerating skills…",
+    "regenerateSuccess": "__MISSING__:Skills regenerated successfully.",
+    "regenerateError": "__MISSING__:Failed to regenerate skills."
+  },
+  "freeProviderRankingsPage": {
+    "title": "__MISSING__:Free Provider Rankings",
+    "subtitle": "__MISSING__:Best free providers ranked by model ELO scores from Arena AI leaderboards",
+    "loading": "__MISSING__:Loading rankings...",
+    "errorLoading": "__MISSING__:Failed to load rankings",
+    "emptyState": "__MISSING__:No rankings available yet. Arena ELO data syncs on startup (daily) — check back shortly, or trigger a manual sync. Disable Arena ELO Sync in Feature Flags or set ARENA_ELO_SYNC_ENABLED=false to opt out.",
+    "bestModel": "__MISSING__:Best",
+    "allCategories": "__MISSING__:All Categories",
+    "categoryDefault": "__MISSING__:Default",
+    "categoryCoding": "__MISSING__:Coding",
+    "categoryReview": "__MISSING__:Review",
+    "categoryDocumentation": "__MISSING__:Documentation",
+    "categoryDebugging": "__MISSING__:Debugging",
+    "colRank": "__MISSING__:Rank",
+    "colProvider": "__MISSING__:Provider",
+    "colTopModel": "__MISSING__:Top Model",
+    "colScore": "__MISSING__:Score",
+    "colAvgScore": "__MISSING__:Avg Score",
+    "colModels": "__MISSING__:Models",
+    "colType": "__MISSING__:Type"
   }
 }
diff --git a/src/i18n/messages/sv.json b/src/i18n/messages/sv.json
index d5efaf3636..bfda1196e3 100644
--- a/src/i18n/messages/sv.json
+++ b/src/i18n/messages/sv.json
@@ -393,6 +393,7 @@
     "cloudBenefitAccess": "Cloud Benefit Access",
     "maxRetries": "Max Retries",
     "queueTimeout": "Queue Timeout",
+    "queueDepth": "__MISSING__:Queue Depth",
     "addProvider": "Add Provider",
     "realtime": "Realtime",
     "totalTranslations": "Total Translations",
@@ -709,6 +710,7 @@
     "batchFilesListFilesTable": "Filer",
     "batchPageLoadingMore": "Läser in mer...",
     "recommended": "__MISSING__:Recommended",
+    "understand": "__MISSING__:I understand",
     "batchConceptTitle": "Batch processing",
     "batchConceptSubtitle": "Process thousands of requests asynchronously at ~50% of the cost (24h window). Ideal for evaluations, classification, and embeddings.",
     "batchConceptHowItWorks": "How it works",
@@ -773,36 +775,13 @@
     "filesListUploadButton": "Upload",
     "filesListUsedByColumn": "Used by",
     "filesListUsedByNone": "None",
-    "filesListDelete": "Delete",
-    "filesListDownload": "Download",
-    "batchDetailActionCancel": "Cancel batch",
-    "batchDetailActionRetry": "Retry failed requests",
-    "batchDetailCancelling": "Cancelling…",
-    "batchDetailRetrying": "Preparing retry…",
-    "batchDetailCancelConfirm": "Cancel this batch? In-progress requests will stop.",
-    "batchActionCancelError": "Failed to cancel batch. Try again.",
-    "batchActionRetryError": "Failed to retry failed requests. Try again.",
-    "batchConceptRetentionNote": "Results and error files are retained for 30 days (Anthropic: 29 days)",
     "filesListUsedByRoleInput": "input",
     "filesListUsedByRoleOutput": "output",
     "filesListUsedByRoleError": "error",
-    "batchListProgressPartial": "(partial)",
     "filesListSizeColumn": "Size",
+    "batchListProgressPartial": "(partial)",
     "batchListProviderColumn": "Provider",
     "batchListProviderUnknown": "—",
-    "batchListBatchCreated": "Batch {id} created — refreshing list…",
-    "batchListBatchCreatedDismiss": "Dismiss",
-    "batchListRefreshing": "Refreshing…",
-    "batchListRefresh": "Refresh",
-    "uploadFileModalRemove": "Remove",
-    "uploadFileModalUploading": "Uploading…",
-    "wizardInputReading": "Reading file…",
-    "wizardInputReady": "Ready",
-    "wizardInputLargeFileLabel": "Large file — sampling validation",
-    "wizardInputCsvJsonlReady": "JSONL generated — ready to validate.",
-    "wizardInputLargeFileWarning": "Large file detected — validation runs by sampling (first 5 MB + last 100 KB). Full validation happens server-side.",
-    "wizardCostWindow24h": "24h completion window",
-    "wizardValidationFieldsOk": "required fields valid",
     "batchListProviderOther": "Other",
     "batchListTitle": "Batches",
     "batchListCount": "{count} batches",
@@ -839,8 +818,33 @@
     "wizardCostWindow": "Window",
     "wizardDestinationSelectProvider": "Select a provider…",
     "wizardDestinationSelectModel": "Select a model…",
-    "wizardDestinationConnectProvider": "Connect a provider"
+    "wizardDestinationConnectProvider": "Connect a provider",
+    "batchListBatchCreated": "Batch {id} created — refreshing list…",
+    "batchListBatchCreatedDismiss": "Dismiss",
+    "batchListRefreshing": "Refreshing…",
+    "batchListRefresh": "Refresh",
+    "uploadFileModalRemove": "Remove",
+    "uploadFileModalUploading": "Uploading…",
+    "wizardInputReading": "Reading file…",
+    "wizardInputReady": "Ready",
+    "wizardInputLargeFileLabel": "Large file — sampling validation",
+    "wizardInputCsvJsonlReady": "JSONL generated — ready to validate.",
+    "wizardInputLargeFileWarning": "Large file detected — validation runs by sampling (first 5 MB + last 100 KB). Full validation happens server-side.",
+    "wizardCostWindow24h": "24h completion window",
+    "wizardValidationFieldsOk": "required fields valid",
+    "filesListDelete": "Delete",
+    "filesListDownload": "Download",
+    "batchDetailActionCancel": "Cancel batch",
+    "batchDetailActionRetry": "Retry failed requests",
+    "batchDetailCancelling": "Cancelling…",
+    "batchDetailRetrying": "Preparing retry…",
+    "batchDetailCancelConfirm": "Cancel this batch? In-progress requests will stop.",
+    "batchActionCancelError": "Failed to cancel batch. Try again.",
+    "batchActionRetryError": "Failed to retry failed requests. Try again.",
+    "batchConceptRetentionNote": "Results and error files are retained for 30 days (Anthropic: 29 days)"
   },
+  "featureFlagOmnirouteEmergencyFallbackDescription": "__MISSING__:Route budget-exhausted requests to the emergency free fallback provider/model.",
+  "featureFlagArenaEloSyncEnabledDescription": "__MISSING__:Enable periodic Arena AI leaderboard ELO sync for model intelligence rankings.",
   "sidebar": {
     "home": "Hem",
     "dashboard": "Instrumentpanel",
@@ -968,6 +972,7 @@
     "aiFeaturesSection": "AI Features",
     "mcp": "MCP",
     "a2a": "A2A",
+    "plugins": "__MISSING__:Plugins",
     "apiEndpoints": "API Endpoints",
     "batchFiles": "Files",
     "analyticsEvals": "Evals",
@@ -976,6 +981,10 @@
     "analyticsComboHealth": "Combo Health",
     "analyticsCompression": "Compression",
     "costsBudget": "Budget",
+    "costsFreeTiers": "__MISSING__:Free-Tier Budget",
+    "costsFreeTiersSubtitle": "__MISSING__:Monthly free-token allowances",
+    "freeProviderRankings": "__MISSING__:Free Provider Rankings",
+    "freeProviderRankingsSubtitle": "__MISSING__:Best free providers ranked by model ELO scores",
     "costsQuotaShare": "Quota Sharing",
     "costsPricing": "Pricing",
     "logsProxy": "Proxy Logs",
@@ -987,10 +996,12 @@
     "settingsAppearance": "Appearance",
     "settingsAi": "AI Settings",
     "settingsSecurity": "Security",
+    "settingsAccessTokens": "__MISSING__:Access Tokens",
     "settingsFeatureFlags": "Funktionsflaggor",
     "settingsAuthz": "__MISSING__:Authz",
     "settingsRouting": "Routing",
     "settingsResilience": "Resilience",
+    "modelLockout": "__MISSING__:Model Lockout",
     "settingsAdvanced": "Advanced",
     "omniProxySection": "OmniProxy",
     "quotaTracker": "Provider Quota",
@@ -1036,6 +1047,8 @@
     "analyticsCompressionSubtitle": "Token savings stats",
     "analyticsSearchSubtitle": "Search tool analytics",
     "analyticsEvalsSubtitle": "Eval suite results",
+    "providerStats": "__MISSING__:Provider Stats",
+    "providerStatsSubtitle": "__MISSING__:Latency and performance metrics",
     "logsSubtitle": "Application logs",
     "logsProxySubtitle": "Proxy traffic logs",
     "consoleLogsSubtitle": "Console output",
@@ -1055,6 +1068,7 @@
     "agentSkillsSubtitle": "A2A skill registry",
     "mcpSubtitle": "MCP server controls",
     "a2aSubtitle": "A2A protocol server",
+    "pluginsSubtitle": "__MISSING__:Plugin marketplace & installs",
     "mediaSubtitle": "Cached media files",
     "batchFilesSubtitle": "Batch input/output files",
     "settingsSubtitle": "All settings",
@@ -1065,13 +1079,41 @@
     "settingsResilienceSubtitle": "Retries and breakers",
     "settingsAdvancedSubtitle": "Power user options",
     "settingsSecuritySubtitle": "Auth and encryption",
+    "settingsAccessTokensSubtitle": "__MISSING__:Scoped CLI tokens for remote mode",
     "settingsFeatureFlagsSubtitle": "Växla systemfunktioner",
     "settingsSidebar": "Sidebar",
     "settingsSidebarSubtitle": "Customize sidebar layout",
     "settingsAuthzSubtitle": "__MISSING__:Route inventory and bypass policy",
     "docsSubtitle": "Documentation",
     "issuesSubtitle": "Report a bug",
-    "changelogSubtitle": "Release notes"
+    "changelogSubtitle": "Release notes",
+    "costsQuotaPlans": "__MISSING__:Plans & Quotas",
+    "costsQuotaPlansSubtitle": "__MISSING__:Configure plans by provider",
+    "activity": "__MISSING__:Activity",
+    "activitySubtitle": "__MISSING__:Friendly feed of recent events",
+    "logsGroup": "__MISSING__:Logs",
+    "systemGroup": "__MISSING__:System",
+    "costsOverview": "__MISSING__:Overview",
+    "costsOverviewSubtitle": "__MISSING__:Consolidated cost analysis",
+    "agentBridge": "__MISSING__:Agent Bridge",
+    "agentBridgeSubtitle": "__MISSING__:Intercept IDE agent traffic",
+    "trafficInspector": "__MISSING__:Traffic Inspector",
+    "trafficInspectorSubtitle": "__MISSING__:Monitor LLM calls + debug any HTTPS traffic",
+    "cliCode": "__MISSING__:CLI Code",
+    "cliCodeSubtitle": "__MISSING__:Code tools pointing to OmniRoute",
+    "cliAgents": "__MISSING__:CLI Agents",
+    "cliAgentsSubtitle": "__MISSING__:Autonomous CLI agents",
+    "acpAgents": "__MISSING__:ACP Agents",
+    "acpAgentsSubtitle": "__MISSING__:CLIs spawned by OmniRoute",
+    "skipToContent": "__MISSING__:Skip to content",
+    "unpinSection": "__MISSING__:Unpin section",
+    "pinSectionOpen": "__MISSING__:Pin section open",
+    "reloadPage": "__MISSING__:Reload Page",
+    "dragReorderSection": "__MISSING__:Drag to reorder section",
+    "dragReorderItem": "__MISSING__:Drag to reorder",
+    "cannotHide": "__MISSING__:This item cannot be hidden",
+    "alwaysVisible": "__MISSING__:Always visible",
+    "groupSeparatorLabel": "__MISSING__:Separator"
   },
   "webhooks": {
     "title": "Webhooks",
@@ -1272,7 +1314,47 @@
     "a2aEvents": "Händelser",
     "a2aArtifacts": "Artefakter",
     "a2aNoTasks": "Inga A2A-uppgifter registrerade.",
-    "a2aLoadingTasks": "Laddar A2A-uppgifter..."
+    "a2aLoadingTasks": "Laddar A2A-uppgifter...",
+    "actor": "__MISSING__:Actor",
+    "actorPlaceholder": "__MISSING__:Filter by actor",
+    "eventTypes": {
+      "apiKey.activate": "__MISSING__:API Key Activated",
+      "apiKey.ban": "__MISSING__:API Key Banned",
+      "apiKey.deactivate": "__MISSING__:API Key Deactivated",
+      "apiKey.regenerate": "__MISSING__:API Key Regenerated",
+      "apiKey.scopes.grant": "__MISSING__:API Key Scopes Granted",
+      "apiKey.scopes.revoke": "__MISSING__:API Key Scopes Revoked",
+      "apiKey.scopes.update": "__MISSING__:API Key Scopes Updated",
+      "apiKey.unban": "__MISSING__:API Key Unbanned",
+      "auth.login.error": "__MISSING__:Login Error",
+      "auth.login.failed": "__MISSING__:Login Failed",
+      "auth.login.locked": "__MISSING__:Login Locked",
+      "auth.login.misconfigured": "__MISSING__:Login Misconfigured",
+      "auth.login.setup_required": "__MISSING__:Login Setup Required",
+      "auth.login.success": "__MISSING__:Login Success",
+      "auth.logout.success": "__MISSING__:Logout Success",
+      "compliance.cleanup": "__MISSING__:Compliance Cleanup",
+      "provider.credentials.applied": "__MISSING__:Provider Credentials Applied",
+      "provider.credentials.batch_revoked": "__MISSING__:Provider Credentials Batch Revoked",
+      "provider.credentials.bulk_created": "__MISSING__:Provider Credentials Bulk Created",
+      "provider.credentials.bulk_imported": "__MISSING__:Provider Credentials Bulk Imported",
+      "provider.credentials.created": "__MISSING__:Provider Credentials Created",
+      "provider.credentials.imported": "__MISSING__:Provider Credentials Imported",
+      "provider.credentials.revoked": "__MISSING__:Provider Credentials Revoked",
+      "provider.credentials.updated": "__MISSING__:Provider Credentials Updated",
+      "provider.validation.ssrf_blocked": "__MISSING__:Provider SSRF Blocked",
+      "quota.plan.updated": "__MISSING__:Quota Plan Updated",
+      "quota.pool.created": "__MISSING__:Quota Pool Created",
+      "quota.pool.deleted": "__MISSING__:Quota Pool Deleted",
+      "quota.pool.updated": "__MISSING__:Quota Pool Updated",
+      "quota.store.driver_changed": "__MISSING__:Quota Store Driver Changed",
+      "server.start": "__MISSING__:Server Start",
+      "service.reveal_api_key": "__MISSING__:Service API Key Revealed",
+      "settings.update": "__MISSING__:Settings Updated",
+      "settings.update_failed": "__MISSING__:Settings Update Failed",
+      "sync.token.created": "__MISSING__:Sync Token Created",
+      "sync.token.revoked": "__MISSING__:Sync Token Revoked"
+    }
   },
   "themesPage": {
     "title": "Themes",
@@ -1381,7 +1463,8 @@
     "settingsResilienceDescription": "Circuit breaker, retry, and fallback configuration",
     "settingsAdvancedDescription": "Advanced payload rules, request limits, and proxy API settings",
     "mitmProxyDescription": "Configure MITM proxy settings for traffic inspection and debugging",
-    "oneProxyDescription": "Configure 1Proxy settings for advanced proxy chaining"
+    "oneProxyDescription": "Configure 1Proxy settings for advanced proxy chaining",
+    "omniSkillsDescription": "__MISSING__:Install and manage sandbox skills for automated prompt and tool execution"
   },
   "home": {
     "quickStart": "Snabbstart",
@@ -1612,16 +1695,24 @@
     "ownUsageVisibilityDesc": "Tillåt denna nyckel att anropa sin status-endpoint för egen USD-användning, budgetprocent och tokensummor.",
     "sharedAccountQuotaVisibility": "Delad kontokvot",
     "sharedAccountQuotaVisibilityDesc": "Tillåt denna nyckel att se delad upstream-kontokvot när en explicit anslutning är konfigurerad.",
+    "localUsageCommand": "__MISSING__:Allow local usage command",
+    "localUsageCommandDesc": "__MISSING__:Allows this API key to use @@om-usage to retrieve cached usage and quota information without calling an upstream provider.",
+    "localUsageCommandBadge": "__MISSING__:Usage cmd",
     "keyCreated": "API-nyckel skapad",
     "keyCreatedSuccess": "Nyckel skapad framgångsrikt!",
     "keyCreatedNote": "Kopiera och lagra den här nyckeln nu – den kommer inte att visas igen.",
     "done": "Klart",
     "savePermissions": "Spara behörigheter",
-    "endpointRestrictions": "__MISSING__:Allowed Endpoints",
-    "allEndpointsAllowed": "__MISSING__:This key can access all API endpoints.",
-    "endpointsRestricted": "__MISSING__:Restricted to {count} endpoint{count, plural, one {} other {s}}.",
+    "endpointRestrictions": "Allowed Endpoints",
+    "allEndpointsAllowed": "This key can access all API endpoints.",
+    "endpointsRestricted": "Restricted to {count} endpoint{count, plural, one {} other {s}}.",
     "autoResolve": "Auto-Resolve",
     "autoResolveDesc": "Auto-resolve ambiguous model names to native provider for this API key.",
+    "streamDefaultMode": "__MISSING__:Stream Default Compatibility",
+    "streamDefaultModeDesc": "__MISSING__:Controls omitted `stream` flags for this key. JSON mode returns non-streaming responses unless the client explicitly requests SSE.",
+    "streamDefaultLegacy": "__MISSING__:Legacy",
+    "streamDefaultJson": "__MISSING__:JSON Compatible",
+    "streamDefaultBadge": "__MISSING__:JSON stream default",
     "keyActive": "Key Active",
     "keyActiveDesc": "Enable or disable this API key. Disabled keys are immediately rejected with 403.",
     "accessSchedule": "Access Schedule",
@@ -1667,6 +1758,7 @@
     "keyOnlyAvailableAtCreation": "Full key available only at creation time — copy it when you first create the key",
     "modelsCount": "{count, plural, one {# model} other {# models}}",
     "lastUsedOn": "Senaste: {date}",
+    "viewCostsFor": "__MISSING__:View costs for {name}",
     "editPermissions": "Redigera behörigheter",
     "deleteKey": "Ta bort nyckel",
     "regenerateKey": "Återskapa nyckel",
@@ -1708,9 +1800,12 @@
     "shownOf": "__MISSING__:{shown} of {total} shown",
     "emptyFilterTitle": "__MISSING__:No keys match your filters",
     "emptyFilterClear": "__MISSING__:Clear filters",
-    "endpointRestrictions": "Allowed Endpoints",
-    "allEndpointsAllowed": "This key can access all API endpoints.",
-    "endpointsRestricted": "Restricted to {count} endpoint{count, plural, one {} other {s}}."
+    "disableNonPublicModels": "__MISSING__:Disable Non-Public Models",
+    "disableNonPublicModelsDesc": "__MISSING__:Reject requests for models that are not discovered or not marked as public in the provider catalog",
+    "normalKeysSection": "__MISSING__:Normal keys",
+    "quotaKeysSection": "__MISSING__:Quota keys",
+    "quotaPill": "__MISSING__:QUOTA",
+    "quotaModeOnly": "__MISSING__:qtSd-only"
   },
   "auditLog": {
     "title": "Revisionslogg",
@@ -1845,6 +1940,8 @@
     "freeQuota": "Free quota/mo",
     "scrapeUrl": "URL to scrape",
     "scrapeUrlPlaceholder": "https://example.com",
+    "scrapeUrlRequired": "__MISSING__:URL is required",
+    "scrapeUrlInvalid": "__MISSING__:Invalid URL — it must start with http:// or https://",
     "scrapeExtract": "Extract",
     "scrapeExtracting": "Extracting…",
     "scrapeFullPage": "Full page",
@@ -1858,6 +1955,8 @@
     "scrapeMetadata": "Metadata",
     "scrapeProvider": "Provider",
     "scrapeSize": "Size",
+    "scrapeEmptyState": "__MISSING__:Enter a URL to extract its content",
+    "scrapeProvidersAvailable": "__MISSING__:Available providers: Firecrawl, Jina Reader, Tavily.",
     "compareRun": "Compare",
     "compareRunning": "Comparing…",
     "autoProvider": "Auto (cheapest)",
@@ -2245,6 +2344,8 @@
     "leastLatency": "Minsta latens",
     "comboName": "Kombinationsnamn",
     "comboNamePlaceholder": "min-kombo",
+    "comboDescription": "__MISSING__:Description",
+    "comboDescriptionPlaceholder": "__MISSING__:Optional note describing this combo",
     "deleteConfirm": "Vill du ta bort den här kombinationen?",
     "noCombosYet": "Inga kombinationer än",
     "comboCreated": "Kombinationen skapades framgångsrikt",
@@ -2284,6 +2385,8 @@
     "resetAwareDesc": "Balanserar återstående kvot mot 5 timmars och veckovisa återställningar och slår sedan runt liknande resultat",
     "strictRandom": "Strict Random",
     "strictRandomDesc": "Shuffle deck — uses each model once before reshuffling",
+    "fusion": "__MISSING__:Fusion",
+    "fusionDesc": "__MISSING__:Fans the prompt to every panel model in parallel, then a judge model synthesizes one final answer",
     "models": "Modeller",
     "autoBalance": "Automatisk balansering",
     "advancedSettings": "Avancerade inställningar",
@@ -2982,14 +3085,19 @@
     "ngrokStarted": "ngroktunneln startade",
     "ngrokStopped": "ngroktunneln stannade",
     "ngrokRequestFailed": "Det gick inte att uppdatera ngrok-tunneln",
-    "tokenSaverSubtitle": "Spendera mindre tokens på varje begäran.",
-    "tokenSaverToolOutput": "Verktygsutgång",
-    "tokenSaverLlmOutput": "LLM-utgång",
-    "tokenSaverInputCompression": "Ingångskomprimering",
     "apiEndpointsCatalogUnavailable": "API-katalogen är inte tillgänglig",
     "apiEndpointsSearchPlaceholder": "Sök efter slutpunkter...",
     "apiEndpointsRequiresAuth": "Kräver autentisering",
     "apiEndpointsNoMatch": "Inga slutpunkter matchar ditt filter",
+    "vscodeAliasTitle": "__MISSING__:VS Code Token Alias",
+    "vscodeAliasDescriptionReady": "__MISSING__:Ready-to-paste compatibility URLs using the /api/v1/vscode/TOKEN/... endpoint.",
+    "vscodeAliasDescriptionError": "__MISSING__:Showing placeholder URLs because CLI keys could not be loaded in this session.",
+    "vscodeAliasDescriptionLoading": "__MISSING__:Loading CLI keys. Placeholder URLs are shown until a key is available.",
+    "vscodeAliasDescriptionPlaceholder": "__MISSING__:Showing placeholder URLs. Create or activate an API key in CLI Tools to replace TOKEN.",
+    "vscodeAliasManage": "__MISSING__:CLI Tools",
+    "vscodeAliasBaseLabel": "__MISSING__:VS Code base",
+    "vscodeAliasModelsLabel": "__MISSING__:VS Code models",
+    "vscodeAliasChatLabel": "__MISSING__:VS Code chat",
     "localServer": "Lokal server",
     "cloudOmniroute": "Cloud OmniRoute",
     "copyUrl": "Kopiera URL",
@@ -3002,7 +3110,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
@@ -3178,42 +3289,187 @@
     "a2aStep3": "__MISSING__:Track and cancel tasks with {code1} and {code2}."
   },
   "memory": {
-    "title": "Memory Management",
-    "description": "View and manage stored memory entries",
-    "memories": "Memories",
-    "totalEntries": "Total Entries",
-    "tokensUsed": "Tokens Used",
-    "hitRate": "Hit Rate",
-    "loading": "Loading memories...",
-    "noMemories": "No memories found",
-    "search": "Search memories...",
-    "allTypes": "All Types",
-    "export": "Export",
-    "import": "Import",
-    "addMemory": "Add Memory",
-    "type": "Type",
-    "key": "Key",
-    "content": "Content",
-    "created": "Created",
-    "actions": "Actions",
-    "delete": "Delete",
-    "factual": "Factual",
-    "episodic": "Episodic",
-    "procedural": "Procedural",
-    "semantic": "Semantic",
     "a": "A",
-    "pipelineOk": "Pipeline OK ({latencyMs}ms)",
-    "pipelineError": "Rörledningsfel",
-    "healthUnknown": "Hälsa okänd",
-    "checkingHealth": "Kontrollerar...",
-    "checkHealth": "Kontrollera hälsan",
-    "pageInfo": "Sida {page} av {totalPages} ({total} totalt)",
-    "previous": "Föregående",
-    "next": "Nästa",
+    "actions": "Actions",
+    "addMemory": "Add Memory",
+    "allTypes": "All Types",
     "cancel": "Avbryt",
-    "save": "Spara",
+    "checkHealth": "Kontrollera hälsan",
+    "checkingHealth": "Kontrollerar...",
+    "compactOld": "__MISSING__:Compact old",
+    "concept": {
+      "title": "__MISSING__:Conversational Memory",
+      "description": "__MISSING__:OmniRoute learns from every conversation, remembering facts, episodes, procedures, and semantic concepts that make responses more accurate and context-aware.",
+      "howWorksToggle": "__MISSING__:How it works",
+      "howWorksContent": "__MISSING__:1. Automatic extraction: at the end of each response, facts and episodes are detected and saved automatically.\n2. Retrieval: before each response, the most relevant memories are searched via FTS5 (exact), vector (semantic), or hybrid RRF.\n3. Injection: relevant memories are injected into the assistant context to improve response quality.\n4. Management: use this page to view, edit, export, and compact old memories."
+    },
+    "content": "Content",
+    "contentPlaceholder": "Värde eller JSON-innehåll att komma ihåg",
+    "created": "Created",
+    "delete": "Delete",
+    "deleteConfirmDesc": "__MISSING__:This action cannot be undone. The memory will be permanently removed.",
+    "deleteConfirmTitle": "__MISSING__:Delete memory?",
+    "description": "View and manage stored memory entries",
+    "editMemory": "__MISSING__:Edit memory",
+    "editModal": {
+      "title": "__MISSING__:Edit Memory",
+      "metadataLabel": "__MISSING__:Metadata (JSON)",
+      "metadataInvalid": "__MISSING__:Invalid JSON",
+      "saveFailed": "__MISSING__:Failed to save memory"
+    },
+    "embedding": {
+      "autoLabel": "__MISSING__:Automatic",
+      "autoDesc": "__MISSING__:Uses best available: remote provider > static > transformers",
+      "remoteLabel": "__MISSING__:Remote provider",
+      "remoteDesc": "__MISSING__:Uses embedding via provider API (requires API key)",
+      "staticLabel": "__MISSING__:Static local (potion)",
+      "staticDesc": "__MISSING__:Local embedding without WASM or external dependencies",
+      "transformersLabel": "__MISSING__:Transformers.js (MiniLM)",
+      "transformersDesc": "__MISSING__:Local embedding via @huggingface/transformers (~400MB RAM)",
+      "providerModelLabel": "__MISSING__:Provider / Model",
+      "noRemoteProviders": "__MISSING__:No providers with configured API key",
+      "selectProviderModel": "__MISSING__:Select a model",
+      "staticEnabledLabel": "__MISSING__:Enable Static Potion",
+      "staticEnabledDesc": "__MISSING__:Download and use potion-base-8M model locally",
+      "transformersEnabledLabel": "__MISSING__:Enable Transformers.js",
+      "transformersEnabledDesc": "__MISSING__:Opt-in for local MiniLM (~400MB RAM, ~3s cold start)",
+      "transformersWarning": "__MISSING__:Requires ~400MB RAM and ~3s cold start on the first semantic query."
+    },
+    "emptyState": {
+      "title": "__MISSING__:No memories yet",
+      "description": "__MISSING__:Memories are created automatically from conversations. You can also add them manually using the button above."
+    },
+    "engine": {
+      "statusTitle": "__MISSING__:Engine Status",
+      "embeddingTitle": "__MISSING__:Embedding Source",
+      "rerankTitle": "__MISSING__:Rerank (optional)",
+      "reindexNow": "__MISSING__:Reindex now",
+      "reindexStarted": "__MISSING__:Reindexing started ({pending} pending)",
+      "reindexFailed": "__MISSING__:Failed to start reindexing",
+      "keywordLabel": "__MISSING__:Keyword (FTS5)",
+      "keywordReason": "__MISSING__:Keyword search always available",
+      "embeddingLabel": "__MISSING__:Embedding",
+      "vectorStoreLabel": "__MISSING__:Vector Store",
+      "qdrantLabel": "__MISSING__:Qdrant",
+      "rerankLabel": "__MISSING__:Rerank",
+      "qdrantDisabled": "__MISSING__:Disabled",
+      "qdrantOk": "__MISSING__:Healthy ({latencyMs}ms)",
+      "qdrantError": "__MISSING__:Connection error",
+      "needsReindex": "__MISSING__:{count} memory(ies) need reindexing",
+      "configureCta": "__MISSING__:Configure",
+      "vectorStoreInstallHint": "__MISSING__:To enable vector search: npm install sqlite-vec (needs native Node.js, not WASM), then restart."
+    },
+    "episodic": "Episodic",
+    "export": "Export",
+    "factual": "Factual",
+    "healthUnknown": "Hälsa okänd",
+    "hitRate": "Hit Rate",
+    "import": "Import",
+    "importError": "__MISSING__:Failed to import file",
+    "importResult": "__MISSING__:{imported} imported, {skipped} skipped",
+    "key": "Key",
     "keyPlaceholder": "t.ex. användare.preferenser.tema",
-    "contentPlaceholder": "Värde eller JSON-innehåll att komma ihåg"
+    "loading": "Loading memories...",
+    "memories": "Memories",
+    "next": "Nästa",
+    "noMemories": "No memories found",
+    "pageInfo": "Sida {page} av {totalPages} ({total} totalt)",
+    "pipelineError": "Rörledningsfel",
+    "pipelineOk": "Pipeline OK ({latencyMs}ms)",
+    "playground": {
+      "infoTitle": "__MISSING__:Memory Playground",
+      "infoDesc": "__MISSING__:Simulate what would be retrieved for a given query. No memories are modified — read-only preview.",
+      "queryLabel": "__MISSING__:Test query",
+      "queryPlaceholder": "__MISSING__:Type a question or test phrase...",
+      "strategyLabel": "__MISSING__:Strategy",
+      "strategyExact": "__MISSING__:Exact (FTS5)",
+      "strategySemantic": "__MISSING__:Semantic (vector)",
+      "strategyHybrid": "__MISSING__:Hybrid (RRF)",
+      "budgetLabel": "__MISSING__:Budget (tokens)",
+      "simulate": "__MISSING__:Simulate",
+      "resultsTitle": "__MISSING__:{count} result(s)",
+      "resolutionTitle": "__MISSING__:Search resolution",
+      "resolutionEmbedding": "__MISSING__:Embedding",
+      "resolutionStore": "__MISSING__:Vector store",
+      "resolutionStrategy": "__MISSING__:Strategy used",
+      "rerankApplied": "__MISSING__:Rerank applied",
+      "fallback": "__MISSING__:Fallback",
+      "noResults": "__MISSING__:No memories found for this query.",
+      "tokensUsed": "__MISSING__:tokens used",
+      "none": "__MISSING__:none",
+      "errorFetch": "__MISSING__:Failed to fetch preview"
+    },
+    "previous": "Föregående",
+    "procedural": "Procedural",
+    "qdrant": {
+      "title": "__MISSING__:Qdrant (Vector Store Tier 2)",
+      "description": "__MISSING__:Optional Qdrant integration for scalable semantic search",
+      "enableLabel": "__MISSING__:Enable Qdrant",
+      "enableDesc": "__MISSING__:When enabled, Qdrant is used as the primary vector store",
+      "testConnection": "__MISSING__:Test connection",
+      "testing": "__MISSING__:Testing...",
+      "statusActive": "__MISSING__:Active",
+      "statusError": "__MISSING__:Error",
+      "statusDisabled": "__MISSING__:Disabled",
+      "healthOk": "__MISSING__:Connection OK ({latencyMs}ms)",
+      "healthError": "__MISSING__:Connection error",
+      "saved": "__MISSING__:Settings saved",
+      "saveError": "__MISSING__:Failed to save",
+      "portLabel": "__MISSING__:Port",
+      "embeddingModelLabel": "__MISSING__:Embedding Model",
+      "optional": "__MISSING__:optional",
+      "apiKeyKeepPlaceholder": "__MISSING__:Leave blank to keep current key",
+      "apiKeyOptional": "__MISSING__:Leave blank if not using authentication",
+      "removeApiKey": "__MISSING__:Remove",
+      "quickSelectModel": "__MISSING__:Quick select",
+      "searchTestTitle": "__MISSING__:Semantic search test",
+      "searchPlaceholder": "__MISSING__:Type a test query...",
+      "searching": "__MISSING__:Searching...",
+      "search": "__MISSING__:Search",
+      "cleanupTitle": "__MISSING__:Clean up old points",
+      "cleanupDesc": "__MISSING__:Remove Qdrant points for expired memories (retention period).",
+      "cleaning": "__MISSING__:Cleaning...",
+      "cleanNow": "__MISSING__:Clean now",
+      "cleanupSuccess": "__MISSING__:{count} point(s) removed",
+      "cleanupFailed": "__MISSING__:Cleanup failed"
+    },
+    "rerank": {
+      "enableLabel": "__MISSING__:Enable Rerank",
+      "enableDesc": "__MISSING__:Reorders results with a reranking model after search",
+      "warning": "__MISSING__:Rerank adds +200-500ms latency and additional cost per request. Use sparingly.",
+      "providerModelLabel": "__MISSING__:Rerank Provider / Model",
+      "noProviderWithKey": "__MISSING__:No provider with configured API key. Configure a provider to use rerank.",
+      "selectProviderModel": "__MISSING__:Select a provider/model"
+    },
+    "save": "Spara",
+    "saving": "__MISSING__:Saving...",
+    "search": "Search memories...",
+    "semantic": "Semantic",
+    "summarize": {
+      "title": "__MISSING__:Compact old memories",
+      "noCandidates": "__MISSING__:No memories eligible for compaction (criteria: >30 days old).",
+      "candidatesDesc": "__MISSING__:{count} memories will be compacted into summaries. This action cannot be undone.",
+      "confirm": "__MISSING__:Compact now"
+    },
+    "tabs": {
+      "memories": "__MISSING__:Memories",
+      "playground": "__MISSING__:Playground",
+      "engine": "__MISSING__:Engine"
+    },
+    "title": "Memory Management",
+    "tokensUsed": "Tokens Used",
+    "tooltip": {
+      "totalEntries": "__MISSING__:Total memories stored for this API key",
+      "tokensUsed": "__MISSING__:Estimated total tokens occupied by active memories",
+      "hitRate": "__MISSING__:Read-by-ID cache hit rate (not semantic recall accuracy)",
+      "factual": "__MISSING__:Objective, permanent facts from user context",
+      "episodic": "__MISSING__:Events and experiences from conversation history",
+      "procedural": "__MISSING__:Procedures, workflows, and instructions the assistant should follow",
+      "semantic": "__MISSING__:Concepts, preferences, and domain knowledge"
+    },
+    "totalEntries": "Total Entries",
+    "type": "Type",
+    "memoryEnabled": "__MISSING__:Memory enabled"
   },
   "skills": {
     "title": "Skills",
@@ -3544,6 +3800,14 @@
     "export": "Export",
     "exporting": "Exporting...",
     "exportFailed": "Export failed",
+    "cleanHistoryButton": "__MISSING__:Clean history",
+    "cleanHistoryTitle": "__MISSING__:Clean log history?",
+    "cleanHistoryMessage": "__MISSING__:This permanently clears all request log rows, legacy detail rows, and local artifact files under DATA_DIR/call_logs. The live page will refresh after cleanup.",
+    "cleanHistoryConfirm": "__MISSING__:Clean history",
+    "cleanHistoryCancel": "__MISSING__:Cancel",
+    "cleanHistorySuccess": "__MISSING__:Cleaned {deleted} log entries, {deletedArtifacts} artifacts, and {deletedDetailedLogs} legacy detail rows.",
+    "cleanHistoryEmpty": "__MISSING__:No request log history was found.",
+    "cleanHistoryFailed": "__MISSING__:Failed to clean log history.",
     "timeRange": "Time Range",
     "lastNHours": "Last {hours}",
     "defaultRange": "default",
@@ -3551,10 +3815,14 @@
       "fetchFailed": "Failed to fetch logs",
       "copyFailed": "Failed to copy log entry",
       "copyLogEntry": "Copy log entry"
-    }
+    },
+    "compressionLogTitle": "__MISSING__:Compression Log",
+    "compressionLogEmpty": "__MISSING__:No compressed requests yet. Compression stats will appear here when requests are processed with compression enabled.",
+    "tokens": "__MISSING__:tokens"
   },
   "onboarding": {
     "welcome": "Välkommen",
+    "tiers": "__MISSING__:Tiers",
     "security": "Säkerhet",
     "test": "Testa",
     "ready": "Klart!",
@@ -3616,6 +3884,7 @@
   },
   "providers": {
     "title": "Leverantörer",
+    "Account Deactivated": "__MISSING__:Account Deactivated",
     "allProviders": "Alla leverantörer",
     "audioProviders": "Ljudleverantörer",
     "showFreeOnly": "Endast gratis",
@@ -3623,6 +3892,33 @@
     "addFirstProvider": "Lägg till din första leverantör",
     "addFirstProviderDesc": "Anslut en AI-leverantör för att börja dirigera förfrågningar via OmniRoute. Du kan använda kostnadsfria leverantörer, API-nycklar eller OAuth-konton.",
     "learnMore": "Läs mer",
+    "adaptaTutorial": {
+      "title": "__MISSING__:How to connect Adapta Web",
+      "introPrefix": "__MISSING__:Adapta authenticates through Clerk. The token",
+      "introSuffix": "__MISSING__:is a long-lived JWT that lets OmniRoute refresh sessions automatically.",
+      "or": "__MISSING__:or",
+      "step1Title": "__MISSING__:Open Adapta chat",
+      "step1DescPrefix": "__MISSING__:Open",
+      "step1DescSuffix": "__MISSING__:and sign in with your Gold or Business account.",
+      "step2Title": "__MISSING__:Open DevTools",
+      "step2DescPrefix": "__MISSING__:Press",
+      "step2DescSuffix": "__MISSING__:to open Developer Tools.",
+      "step3Title": "__MISSING__:Go to Application → Cookies",
+      "step3DescPrefix": "__MISSING__:In the",
+      "step3DescMiddle": "__MISSING__:expand",
+      "step3DescSuffix": "__MISSING__:and click",
+      "step4Title": "__MISSING__:Copy the cookie value for",
+      "step4DescPrefix": "__MISSING__:Find the cookie named",
+      "step4DescMiddle": "__MISSING__:in the list. Click it and copy the content from the",
+      "step4DescSuffix": "__MISSING__:column. It starts with",
+      "step5Title": "__MISSING__:Paste it here and save",
+      "step5DescPrefix": "__MISSING__:Click",
+      "step5DescMiddle": "__MISSING__:paste the",
+      "step5DescSuffix": "__MISSING__:value into the API Key field, then save. OmniRoute will refresh the session automatically.",
+      "tipLabel": "__MISSING__:Tip:",
+      "tipPrefix": "__MISSING__:The",
+      "tipSuffix": "__MISSING__:cookie is long-lived, usually for months. You only need to renew it if you sign out or Adapta invalidates the session."
+    },
     "editProvider": "Redigera leverantör",
     "deleteProvider": "Ta bort leverantör",
     "noProviders": "Inga leverantörer har konfigurerats",
@@ -3648,13 +3944,38 @@
     "apiKeyProviders": "API-nyckelleverantörer",
     "compatibleProviders": "API-nyckelkompatibla leverantörer",
     "testAll": "Testa alla",
+    "distributeProxies": "__MISSING__:Distribute Proxies",
+    "distributing": "__MISSING__:Distributing...",
+    "selectedCount": "__MISSING__:{count, plural, one {# selected} other {# selected}}",
+    "accountsCount": "__MISSING__:{count, plural, one {# account} other {# accounts}}",
     "testAllOAuth": "Testa alla OAuth-anslutningar",
     "testAllFree": "Testa alla gratisanslutningar",
     "testAllApiKey": "Testa alla API-nyckelanslutningar",
     "testAllCompatible": "Testa alla kompatibla anslutningar",
+    "testAllModels": "__MISSING__:Test all models",
+    "testAllModelsConfirm": "__MISSING__:Test all visible models? Failed models will be hidden if auto-hide is enabled.",
+    "testingAllModels": "__MISSING__:Testing {done}/{total}...",
+    "testAllResults": "__MISSING__:{ok} of {total} models working",
+    "noModelsToTest": "__MISSING__:No models match the current filter",
+    "showAllModels": "__MISSING__:All",
+    "showVisibleOnly": "__MISSING__:Visible only",
+    "freeFilterAll": "__MISSING__:All",
+    "freeFilterFreeOnly": "__MISSING__:Free only",
+    "freeFilterPaidOnly": "__MISSING__:Paid only",
+    "sortFreeFirst": "__MISSING__:Free first",
+    "showHiddenOnly": "__MISSING__:Hidden only",
+    "filterByVisibility": "__MISSING__:Filter by visibility",
+    "autoHideFailed": "__MISSING__:Auto-hide failed models",
+    "autoHideFailedHint": "__MISSING__:When enabled, Test all hides non-transient failures from public catalogs such as /v1/models. Single-model tests never auto-hide.",
     "connected": "{count} Ansluten",
     "errorCount": "{count} Fel ({code})",
     "errorCountNoCode": "{count} Fel",
+    "testAllCompleted": "__MISSING__:Tested {total} models: {ok} OK, {failed} failed",
+    "modelAutoHidden": "__MISSING__:Model {model} auto-hidden (test failed)",
+    "filterAll": "__MISSING__:All",
+    "filterVisible": "__MISSING__:Visible only",
+    "filterHidden": "__MISSING__:Hidden only",
+    "modelsHiddenCount": "__MISSING__:{count} hidden",
     "warningCount": "{count} Varning",
     "noConnections": "Inga anslutningar",
     "expiredBadge": "Expired",
@@ -3764,7 +4085,16 @@
     "batchUpdateNone": "__MISSING__:No connections were updated (they may no longer exist)",
     "batchRetestLimit": "__MISSING__:Retest up to {max} connections at a time",
     "noConnectionsToTest": "__MISSING__:No matching connections to test",
+    "batchDeleteConfirmTitle": "__MISSING__:Delete connections",
+    "batchDeleteConfirmButton": "__MISSING__:Delete",
+    "filterActive": "__MISSING__:Active",
+    "filterError": "__MISSING__:Error",
+    "filterBanned": "__MISSING__:Banned",
+    "filterCreditsExhausted": "__MISSING__:Credits Exhausted",
+    "noFilteredConnections": "__MISSING__:No connections match the current filter.",
     "failedSetAlias": "Det gick inte att ange alias",
+    "setAliasSuccess": "__MISSING__:Alias {alias} set",
+    "deleteAliasSuccess": "__MISSING__:Alias {alias} deleted",
     "failedSaveConnection": "Det gick inte att spara anslutningen",
     "failedSaveConnectionRetry": "Det gick inte att spara anslutningen. Försök igen.",
     "failedRetestConnection": "Det gick inte att testa om anslutningen",
@@ -3798,6 +4128,9 @@
     "connectionCount": "{count} anslutning(ar)",
     "fetchingModels": "Hämtar tillgängliga modeller...",
     "failedFetchModels": "Det gick inte att hämta modeller",
+    "noFreeModelsFound": "__MISSING__:No free models found for this provider — nothing imported.",
+    "fetchModelsSuccess": "__MISSING__:Found {count} new models",
+    "fetchModelsFailed": "__MISSING__:Could not auto-fetch models (you can retry from settings)",
     "noModelsFound": "Inga modeller hittades",
     "importFailed": "Importen misslyckades",
     "noNewModelsAdded": "Inga nya modeller tillkom.",
@@ -3806,6 +4139,10 @@
     "importingModelsTitle": "Importera modeller",
     "copyModel": "Kopiera modell",
     "filterModels": "Filtrera modeller…",
+    "testAllRateLimited": "__MISSING__:Rate limit reached, stopped early",
+    "hideFailedAuto": "__MISSING__:Auto-hide failed models",
+    "selectAllModels": "Select all",
+    "hideAllModels": "__MISSING__:Hide all",
     "modelsActive": "aktiva",
     "showModel": "Visa modell",
     "hideModel": "Dölj modell",
@@ -3814,6 +4151,9 @@
     "rateLimitUnprotected": "Oskyddad",
     "enableRateLimitProtection": "Klicka för att aktivera hastighetsgränsskydd",
     "disableRateLimitProtection": "Klicka för att inaktivera skyddet för hastighetsgränsen",
+    "testAllProgress": "__MISSING__:Tested {done}/{total}",
+    "testAllFailedHidden": "__MISSING__:{count} failed models hidden",
+    "testAllDone": "__MISSING__:All models tested",
     "productionKey": "Produktionsnyckel",
     "enterNewApiKey": "Ange ny API-nyckel",
     "codexApplyModalTitle": "Ansök till Local Codex",
@@ -3889,10 +4229,20 @@
     "errorTypeNetworkError": "Nätverksfel",
     "errorTypeTestUnsupported": "Testet stöds inte",
     "errorTypeUpstreamError": "Uppströmsfel",
+    "errorTypeCreditsExhausted": "__MISSING__:No credits",
+    "errorTypeBanned": "__MISSING__:403 Banned",
     "proxySourceGlobal": "Global",
     "proxySourceProvider": "Leverantör",
     "proxySourceKey": "Nyckel",
     "proxyConfiguredBySource": "Proxy ({source}): {host}",
+    "proxyOn": "__MISSING__:Proxy On",
+    "proxyOff": "__MISSING__:Direct (bypass proxy)",
+    "proxyEnabledTitle": "__MISSING__:Proxy is enabled for this connection",
+    "proxyDisabledTitle": "__MISSING__:Direct connection — bypasses every proxy (including the global proxy) for this connection",
+    "perKeyProxyOn": "__MISSING__:Per-key",
+    "perKeyProxyOff": "__MISSING__:Connection",
+    "perKeyProxyEnabledTitle": "__MISSING__:Per-key proxy assignment enabled for this provider",
+    "perKeyProxyDisabledTitle": "__MISSING__:Per-key proxy assignment disabled for this provider",
     "autoPriority": "Auto: {priority}",
     "proxy": "Proxy",
     "retestAuthentication": "Testa om autentisering",
@@ -3920,6 +4270,12 @@
     "compatProtocolOpenAI": "OpenAI Chat Completions",
     "compatProtocolOpenAIResponses": "OpenAI Responses API",
     "compatProtocolClaude": "Anthropic Messages",
+    "targetFormatLabel": "__MISSING__:Target Format",
+    "targetFormatHint": "__MISSING__:Override the upstream wire format. Use 'Anthropic Messages' to route OpenAI-compatible providers (e.g. opencode-go) through the /v1/messages endpoint.",
+    "targetFormatAuto": "__MISSING__:Default (auto)",
+    "targetFormatGemini": "__MISSING__:Gemini",
+    "targetFormatGeminiCli": "__MISSING__:Gemini CLI",
+    "targetFormatAntigravity": "__MISSING__:Antigravity",
     "compatUpstreamHeadersLabel": "Extra upstream headers",
     "compatUpstreamHeadersHint": "High-privilege setting — same trust level as editing provider API credentials; only trusted admins should use it. Merged after OmniRoute adds auth from the provider API key. If a custom header uses the same name as an existing one (e.g. Authorization), your value fully replaces the auto-generated header (including the Bearer token) — the upstream only sees what you typed, not the key from settings. Misconfiguration can cause 401 or broken upstream auth. One row per header (e.g. extra Authentication for some gateways). Hover or focus the value to preview. Saves on blur, outside click, or closing this panel.",
     "compatUpstreamHeaderName": "Header name",
@@ -3929,6 +4285,8 @@
     "compatBadgeUpstreamHeaders": "Headers",
     "perModelQuotaLabel": "Per Model Quota Label",
     "perModelQuotaDescription": "Per Model Quota Description",
+    "importFreeModelsOnlyLabel": "__MISSING__:Import only free models",
+    "importFreeModelsOnlyHint": "__MISSING__:When enabled, only this provider's free models are imported. Paid models are skipped.",
     "perModelQuotaToggle": "Växla kvot per modell",
     "modelId": "Modell ID",
     "customModelPlaceholder": "t.ex. gpt-4.5-turbo",
@@ -3964,7 +4322,6 @@
     "email": "E-post",
     "healthCheckMinutes": "Hälsokontroll (min)",
     "healthCheckHint": "Proaktivt uppdateringsintervall för token. 0 = inaktiverad.",
-    "selectAllModels": "Select all",
     "deselectAllModels": "Deselect all",
     "modelsActiveCount": "{active}/{total} active",
     "noModelsMatch": "No models match \"{filter}\"",
@@ -3976,6 +4333,9 @@
     "editCompatibleTitle": "Redigera {type} Kompatibel",
     "compatibleBaseUrlHint": "Root URL of your {type}-compatible API. Use Advanced Settings for custom endpoint paths.",
     "apiKeyForCheck": "API-nyckel (för kontroll)",
+    "testModelIdLabel": "__MISSING__:Model ID (optional)",
+    "testModelIdPlaceholder": "__MISSING__:e.g. my-model-id",
+    "testModelIdHint": "__MISSING__:If the provider lacks a /models endpoint, enter a model ID to validate via /chat/completions instead.",
     "compatibleProdPlaceholder": "{type} Kompatibel (Prod)",
     "tokenRefreshed": "Token refreshed successfully",
     "tokenRefreshFailed": "Token refresh failed",
@@ -4069,6 +4429,19 @@
     "codexAuthApplyFailed": "Failed to apply Codex auth.json locally",
     "codexAuthExported": "Codex auth.json exported",
     "codexAuthExportFailed": "Failed to export Codex auth.json",
+    "codexCliGuideButton": "__MISSING__:Codex CLI Guide",
+    "codexCliGuideTitle": "__MISSING__:Codex CLI Guide",
+    "codexCliGuideLoading": "__MISSING__:Loading guide...",
+    "codexCliGuideLoadFailed": "__MISSING__:Could not load the guide.",
+    "codexExternalLinkButton": "__MISSING__:External Codex link",
+    "codexExternalLinkModalTitle": "__MISSING__:External Codex link",
+    "codexExternalLinkModalDescription": "__MISSING__:Share this single-use link with the person who will authenticate the Codex account. They open it in their own browser, complete the OpenAI login, and the connection is registered here. The link expires in 15 minutes.",
+    "codexExternalLinkGenerating": "__MISSING__:Generating link...",
+    "codexExternalLinkWaiting": "__MISSING__:Waiting for browser authentication. This window refreshes automatically.",
+    "codexExternalLinkCreateFailed": "__MISSING__:Failed to generate the link.",
+    "codexExternalLinkNetworkError": "__MISSING__:Could not contact the server.",
+    "codexExternalLinkConnected": "__MISSING__:Codex account connected through the external link.",
+    "codexExternalLinkExpired": "__MISSING__:The link expired before completion.",
     "importCodexAuth": "Importera auth",
     "codexImportModalTitle": "Importera Codex Auth",
     "codexImportTabSingle": "Singel",
@@ -4146,6 +4519,8 @@
     "t3ChatWebCookiePlaceholder": "convex-session-id=abc123...",
     "blockClaudeExtraUsageDescription": "Block Claude Extra Usage Description",
     "blockClaudeExtraUsageLabel": "Block Claude Extra Usage Label",
+    "disableCoolingDescription": "__MISSING__:Skip the transient cooldown so this connection stays eligible even after recoverable errors (terminal states like banned/expired still apply).",
+    "disableCoolingLabel": "__MISSING__:Disable cooldown for this connection",
     "bulkPasteAdded": "{count, plural, one {1 key added} other {# keys added}}",
     "bulkPasteDuplicatesIgnored": "{count, plural, one {1 duplicate skipped} other {# duplicates skipped}}",
     "bulkPasteHint": "Paste one API key per line. Empty lines are ignored and duplicate keys are skipped.",
@@ -4243,6 +4618,17 @@
     "personalAccessTokenLabel": "Personal Access Token Label",
     "qoderPatHint": "Qoder Pat Hint",
     "qoderPatPlaceholder": "Qoder Pat Placeholder",
+    "rateLimitOverridesSection": "__MISSING__:Rate Limit Overrides",
+    "rateLimitOverridesMaxConcurrentHint": "__MISSING__:Max concurrent requests override for this connection. Overrides the account-level cap.",
+    "rateLimitOverridesMaxConcurrentLabel": "__MISSING__:Max Concurrent (Rate Limit)",
+    "rateLimitOverridesMinTimeHint": "__MISSING__:Minimum time (ms) between requests. Overrides the default rate limiter delay.",
+    "rateLimitOverridesMinTimeLabel": "__MISSING__:Min Interval (ms)",
+    "rateLimitOverridesRpmHint": "__MISSING__:Max requests per minute for this connection. Overrides the provider default.",
+    "rateLimitOverridesRpmLabel": "__MISSING__:RPM (Requests/min)",
+    "rateLimitOverridesTpdHint": "__MISSING__:Max tokens per day for this connection. Overrides the provider default.",
+    "rateLimitOverridesTpdLabel": "__MISSING__:TPD (Tokens/day)",
+    "rateLimitOverridesTpmHint": "__MISSING__:Max tokens per minute for this connection. Overrides the provider default.",
+    "rateLimitOverridesTpmLabel": "__MISSING__:TPM (Tokens/min)",
     "refreshOauthTokenTitle": "Refresh Oauth Token Title",
     "regionHint": "Region Hint",
     "regionLabel": "Region Label",
@@ -4257,6 +4643,7 @@
     "searchProvider": "Search Provider",
     "searchProviderDesc": "Search Provider Desc",
     "searchProviders": "Sök efter leverantörer...",
+    "searchByModel": "__MISSING__:Search by model…",
     "searchProvidersHeading": "Search Providers Heading",
     "searxngBaseUrlHint": "Searxng Base Url Hint",
     "searxngInfo": "Searxng Info",
@@ -4422,7 +4809,21 @@
     "webNoAuthGuideBody": "{provider} behöver ingen API-nyckel eller cookie. Spara anslutningen för att använda dess kostnadsfria webbslutpunkt.",
     "webSessionCredentialValidationFailed": "Validering av autentiseringsuppgifter för session misslyckades. Logga in igen, kopiera en ny inloggningsinformation och försök igen.",
     "checkCookie": "Kontrollera kakan",
-    "checkWebToken": "Kontrollera token"
+    "checkWebToken": "Kontrollera token",
+    "huggingchatLabel": "__MISSING__:HuggingChat (Free)",
+    "huggingchatDesc": "__MISSING__:Free LLM chat via huggingface.co/chat",
+    "phindLabel": "__MISSING__:Phind (Free)",
+    "phindDesc": "__MISSING__:Free dev-focused AI chat",
+    "poeWebLabel": "__MISSING__:Poe Web",
+    "poeWebDesc": "__MISSING__:Multi-model chat via poe.com",
+    "veniceWebLabel": "__MISSING__:Venice Web",
+    "veniceWebDesc": "__MISSING__:Privacy-focused AI chat",
+    "v0VercelWebLabel": "__MISSING__:v0 Vercel Web",
+    "v0VercelWebDesc": "__MISSING__:AI code generation via v0.dev",
+    "kimiWebLabel": "__MISSING__:Kimi Web",
+    "kimiWebDesc": "__MISSING__:Chinese market AI chat via kimi.moonshot.cn",
+    "doubaoWebLabel": "__MISSING__:Doubao Web",
+    "doubaoWebDesc": "__MISSING__:ByteDance AI chat via doubao.com"
   },
   "settings": {
     "title": "Inställningar",
@@ -4528,6 +4929,7 @@
     "memoryDesc": "Persistent cross-session conversational memory",
     "memoryEnabled": "Enable Memory",
     "memoryEnabledDesc": "When enabled, OmniRoute will inject relevant past context.",
+    "memoryTokenCostWarning": "__MISSING__:Heads up: with memory enabled, OmniRoute injects up to {tokens} tokens of retrieved context into every chat request — this increases token usage and cost. To skip injection for a specific request, send the \"x-omniroute-no-memory: true\" header.",
     "maxTokens": "Max Tokens",
     "retentionDays": "Retention",
     "recent": "Recent",
@@ -4566,6 +4968,15 @@
     "modelsDevInfoOrder": "User Override → models.dev → LiteLLM → Hardcoded Default",
     "systemTheme": "Systemtema",
     "debugToggle": "Enable Debug Mode",
+    "homePinProviderQuotaToHome": "Pin Information to Home Page",
+    "homeProviderQuotaLimits": "Provider Quota Limits",
+    "homeProviderQuotaLimitsDesc": "Pin the Provider Quota status container (with Refresh All button) to the top of the Home page.",
+    "homeQuickStart": "Quick Start",
+    "homeQuickStartDesc": "Show the Quick Start panel on the Home page.",
+    "homeProviderTopology": "Provider Topology",
+    "homeProviderTopologyDesc": "Show the Provider Topology on the Home page.",
+    "accountEmailVisibility": "__MISSING__:Account email visibility",
+    "accountEmailVisibilityDesc": "__MISSING__:Show full account emails across providers, combos, logs, quota, and playground screens. Turn this off to mask them by default.",
     "sidebarVisibilityToggle": "Show Sidebar Items",
     "enableCache": "Aktivera cache",
     "cacheTTL": "Cache TTL",
@@ -4599,11 +5010,17 @@
     "autoDisableDescription": "Permanently mark provider connections as deactivated if they return specific terminal ban signals (e.g. HTTP 403 'verify your account'). This removes them from the combo rotation.",
     "autoDisableThreshold": "Ban Threshold",
     "autoDisableThresholdDesc": "Consecutive ban signals required before permanent deactivation.",
+    "customBannedSignals": "__MISSING__:Banned Keywords",
+    "customBannedSignalsDesc": "__MISSING__:Additional keywords that trigger permanent account ban detection. Built-in keywords always apply.",
+    "customBannedSignalsPlaceholder": "__MISSING__:e.g. api key revoked",
+    "noCustomBannedSignals": "__MISSING__:No custom keywords. Only built-in keywords are active.",
     "resilienceStructureTitle": "Resilience Structure",
     "resilienceStructureDesc": "Den här sidan konfigurerar bara beteende. Live breaker-tillstånd visas på hälsosidan. Kombinationsspecifikt försök igen och round-robin slotkontroll förblir på kombinationsinställningar.",
     "enableThinking": "Aktivera tänkande",
     "maxThinkingTokens": "Max Thinking Tokens",
     "enableProxy": "Aktivera proxy",
+    "perKeyProxyEnabled": "__MISSING__:Enable per-key proxy assignment",
+    "perKeyProxyEnabledDesc": "__MISSING__:When enabled, each provider connection can use its own proxy assignment",
     "proxyUrl": "Proxy-URL",
     "pricingRates": "Priser Format",
     "currentPricing": "Aktuell prisöversikt",
@@ -4683,6 +5100,13 @@
     "globalProxy": "Global proxy",
     "globalProxyDesc": "Konfigurera en global utgående proxy för alla API-anrop. Enskilda leverantörer, kombinationer och nycklar kan åsidosätta detta.",
     "noGlobalProxy": "Ingen global proxy konfigurerad",
+    "proxyPool": "__MISSING__:Proxy Pool",
+    "freePool": "__MISSING__:Free Pool",
+    "proxyDocumentation": "__MISSING__:Proxy Documentation",
+    "proxyGlobalConfigTab": "__MISSING__:Global Config",
+    "proxyPoolTab": "__MISSING__:Proxy Pool",
+    "freePoolTab": "__MISSING__:Free Pool",
+    "proxyDocumentationTab": "__MISSING__:Documentation",
     "bulkHealthcheck": "Bulk Healthcheck",
     "bulkHealthcheckDesc": "Test all configured proxies against a target URL to find which ones work.",
     "healthcheckTesting": "Testing...",
@@ -4695,6 +5119,51 @@
     "healthcheckStatus": "Status",
     "healthcheckProxyUrl": "Proxy URL",
     "healthcheckLatency": "Latency",
+    "proxyDocumentationScopeTitle": "__MISSING__:Proxy scope resolution",
+    "proxyDocumentationScopeDescBefore": "__MISSING__:OmniRoute resolves the outbound proxy in priority order: ",
+    "proxyDocumentationScopeOrder": "__MISSING__:combo → account → provider → global",
+    "proxyDocumentationScopeDescAfter": "__MISSING__:. The most specific scope wins.",
+    "proxyDocumentationAddTitle": "__MISSING__:Adding a custom proxy",
+    "proxyDocumentationAddDescBefore": "__MISSING__:Go to the ",
+    "proxyDocumentationAddDescMiddle": "__MISSING__: tab → click ",
+    "proxyDocumentationAddCta": "__MISSING__:+ Add proxy",
+    "proxyDocumentationAddDescAfter": "__MISSING__:. Fill in type (http/https/socks5), host, and port. Optionally assign it to a scope.",
+    "proxyDocumentationBulkTitle": "__MISSING__:Bulk import format",
+    "proxyDocumentationBulkDesc": "__MISSING__:Pipe-delimited fields:",
+    "proxyDocumentationSocks5DescBefore": "__MISSING__:SOCKS5 proxies are disabled by default. Set",
+    "proxyDocumentationFreePoolDesc": "__MISSING__:The Free Pool tab aggregates proxies from 1proxy, Proxifly, and IPLocate. Use ⊕ to test and promote a proxy to your registry. Only proxies that pass the connectivity test are added.",
+    "proxyDocumentationVercelRelayDescBefore": "__MISSING__:The Vercel Relay is an outbound edge relay — not an inbound tunnel. Deploying one sends LLM API calls through Vercel's dynamic IPs, bypassing datacenter geo-blocks and rate limits. The relay is protected by a generated secret header",
+    "proxyDocumentationVercelRelayDescAfter": "__MISSING__:Your Vercel token is used only during deploy and is never stored.",
+    "vercelRelayTokenRequired": "__MISSING__:Token is required",
+    "vercelRelayDeployFailed": "__MISSING__:Deploy failed",
+    "vercelRelayTokenHint": "__MISSING__:Token is used only during deploy — never stored.",
+    "denoRelayTokenRequired": "__MISSING__:Deno Deploy token is required",
+    "denoRelayOrgDomainRequired": "__MISSING__:Organization domain is required",
+    "denoRelayDeployFailed": "__MISSING__:Deno Deploy failed",
+    "denoRelayTokenHint": "__MISSING__:Organization token (prefix ddo_) from console.deno.com → Organization → Settings → Organization Tokens. Used once for deploy and never stored.",
+    "denoRelayOrgDomainHint": "__MISSING__:Your Deno Deploy organization's default domain (e.g. acme.deno.net). The relay will be reachable at https://<app-name>.<org-slug>.deno.net.",
+    "proxyFreePoolFilterProtocol": "__MISSING__:Filter by protocol",
+    "proxyFreePoolProtocol": "__MISSING__:Protocol",
+    "proxyFreePoolCountryPlaceholder": "__MISSING__:Country (e.g. US)",
+    "proxyFreePoolFilterCountry": "__MISSING__:Filter by country",
+    "proxyFreePoolMinQualityPlaceholder": "__MISSING__:Min quality",
+    "proxyFreePoolMinQualityLabel": "__MISSING__:Minimum quality score",
+    "proxyFreePoolSyncAll": "__MISSING__:Sync All",
+    "proxyFreePoolTotal": "__MISSING__:Total",
+    "proxyFreePoolInPool": "__MISSING__:In pool",
+    "proxyFreePoolAvgQuality": "__MISSING__:Avg quality",
+    "proxyFreePoolSelected": "__MISSING__:{count} selected",
+    "proxyFreePoolAddSelected": "__MISSING__:Add selected to pool",
+    "proxyFreePoolAddVisible": "__MISSING__:Add all visible to pool",
+    "proxyFreePoolSource": "__MISSING__:Source",
+    "proxyFreePoolHostPort": "__MISSING__:Host:Port",
+    "proxyFreePoolType": "__MISSING__:Type",
+    "proxyFreePoolCountry": "__MISSING__:Country",
+    "proxyFreePoolQuality": "__MISSING__:Quality",
+    "proxyFreePoolLatency": "__MISSING__:Latency",
+    "proxyFreePoolEmpty": "__MISSING__:No proxies found. Click Sync All to fetch from sources.",
+    "close": "__MISSING__:Close",
+    "cancel": "__MISSING__:Cancel",
     "globalLabel": "Global",
     "configure": "Konfigurera",
     "globalSystemPrompt": "Global System Prompt",
@@ -4951,6 +5420,7 @@
     "systemStorage": "System & lagring",
     "allDataLocal": "All data lagrad lokalt på din maskin",
     "databasePath": "Databasväg",
+    "export": "__MISSING__:Export",
     "exportDatabase": "Exportera databas",
     "exportAll": "Exportera alla (.tar.gz)",
     "importDatabase": "Importera databas",
@@ -5038,6 +5508,11 @@
     "adaptiveVolumeRoutingDesc": "Scale connections dynamically based on payload volume and throughput pressure.",
     "lkgpToggleTitle": "Last Known Good Provider (LKGP)",
     "lkgpToggleDesc": "When enabled, the router remembers which provider last served a successful response and tries it first on subsequent requests.",
+    "echoRequestedModelTitle": "__MISSING__:Echo requested model name in responses",
+    "echoRequestedModelDesc": "__MISSING__:When enabled, the response `model` field echoes the alias or combo name the client requested instead of the upstream model name. Fixes strict clients (e.g. Claude Desktop) that reject a response whose model does not match the request.",
+    "webSearchRouteTitle": "__MISSING__:Web search routing",
+    "webSearchRouteDesc": "__MISSING__:When a request includes a native web_search tool, route the whole request to this model instead of the default — useful for providers that don't implement Anthropic's web_search server tool. Leave blank to disable.",
+    "webSearchRoutePlaceholder": "__MISSING__:e.g. openrouter,anthropic/claude-3.5-sonnet",
     "clearLkgpCache": "Clear LKGP Cache",
     "lkgpCacheCleared": "LKGP cache cleared successfully",
     "lkgpCacheClearFailed": "Failed to clear LKGP cache",
@@ -5102,6 +5577,16 @@
     "clearSyncedPricing": "Clear Synced Pricing",
     "compressionTitle": "Prompt Compression",
     "compressionDesc": "Reduce token usage by compressing prompts before sending to providers",
+    "tokenSaverTitle": "__MISSING__:Token Saver",
+    "tokenSaverSubtitle": "__MISSING__:Spend fewer tokens on every request.",
+    "tokenSaverToolOutput": "__MISSING__:Tool output",
+    "tokenSaverToolOutputDesc": "__MISSING__:Clean git, grep, ls, tree, and log output before it reaches the provider.",
+    "tokenSaverLlmOutput": "__MISSING__:LLM output",
+    "tokenSaverLlmOutputDesc": "__MISSING__:Inject terse response instructions without rewriting provider output.",
+    "tokenSaverInputCompression": "__MISSING__:Input compression",
+    "tokenSaverInputCompressionDesc": "__MISSING__:Rewrite eligible chat history while preserving code, URLs, and intent.",
+    "tokenSaverFineTunePrefix": "__MISSING__:Fine-tune each engine on",
+    "tokenSaverFineTuneSuffix": "__MISSING__:or combine engines per request on",
     "compressionMode": "Compression Mode",
     "compressionModeOff": "Off",
     "compressionModeOffDesc": "No compression applied",
@@ -5121,6 +5606,11 @@
     "compressionUltraMinScore": "Minsta poängtröskel",
     "compressionUltraSlmFallback": "Fallback till aggressiv",
     "compressionUltraModelPath": "SLM modellväg",
+    "compressionUltraEngine": "__MISSING__:Ultra tier",
+    "compressionUltraEngineHeuristic": "__MISSING__:Heuristic (Tier-A, default)",
+    "compressionUltraEngineSlm": "__MISSING__:SLM (LLMLingua-2, opt-in)",
+    "compressionUltraSlmHint": "__MISSING__:SLM downloads a small ONNX model on first use (cold-start) and transparently falls back to the heuristic on timeout or if unavailable.",
+    "compressionUltraSlmPrewarm": "__MISSING__:Pre-warm SLM model on enable",
     "compressionSummarizerEnabled": "Aktivera Summarizer",
     "compressionMaxTokensPerMessage": "Max tokens per meddelande",
     "compressionMinSavings": "Minsta spartröskel",
@@ -5308,13 +5798,22 @@
     "resilienceNo": "Nej",
     "resilienceDefault": "Default",
     "storageDatabaseBackupRetention": "Databassäkerhetskopiering",
+    "storageDatabaseBackups": "__MISSING__:Database backups",
     "storagePurgeData": "Rensa data",
+    "storagePurgeDataDesc": "__MISSING__:Immediately delete all records without applying retention checks. Use with caution.",
+    "storageRetentionCleanup": "__MISSING__:Retention Settings",
+    "storageRetentionCleanupDesc": "__MISSING__:Configure operational record retention and database backup cleanup.",
+    "retentionCallDays": "__MISSING__:Call {count}d",
+    "retentionAppDays": "__MISSING__:App {count}d",
+    "retentionRows": "__MISSING__:{count} rows",
     "retentionQuotaSnapshots": "Kvotsögonblicksbilder (dagar)",
+    "retentionCompressionAnalytics": "__MISSING__:Compression Analytics (days)",
     "retentionMcpAudit": "MCP-revision (dagar)",
     "retentionA2aEvents": "A2A-evenemang (dagar)",
     "retentionCallLogs": "Samtalsloggar (dagar)",
     "retentionUsageHistory": "Användningshistorik (dagar)",
     "retentionMemoryEntries": "Minnesposter (dagar)",
+    "saveRetentionSettings": "__MISSING__:Save retention settings",
     "storageAutoVacuumMode": "Autovakuumläge",
     "storageScheduledVacuum": "Schemalagt vakuum",
     "storageVacuumHour": "Vakuumtimme (0-23)",
@@ -5328,10 +5827,16 @@
     "storageIntegrityOk": "✓ OK",
     "storageIntegrityError": "✗ Fel",
     "storageUsageTokenBuffer": "Användningstokenbuffert",
+    "storageUsageTokenBufferDesc": "__MISSING__:Extra tokens added to reported usage to account for system prompt overhead.",
+    "storageUsageTokenBufferHint": "__MISSING__:Set to 0 to report raw provider token counts. Default: 2000.",
+    "storageUsageTokenBufferCurrent": "__MISSING__:Current: {value}",
     "compressionSettingsAutoTriggerMode": "Auto trigger läge",
     "compressionSettingsMcpDescriptionCompression": "MCP-beskrivningskomprimering",
+    "mcpAccessibilityTitle": "__MISSING__:MCP accessibility output",
     "compressionSettingsCavemanIntensity": "Grottmänniska intensitet",
     "compressionSettingsCavemanOutputMode": "Grottmansutgångsläge",
+    "compressionSettingsOutputStyles": "__MISSING__:Output styles",
+    "compressionStylesTileTitle": "__MISSING__:Output styles",
     "compressionSettingsOutputIntensity": "Utgångsintensitet",
     "compressionSettingsAutoClarityBypass": "Automatisk förbikoppling av klarhet",
     "resilienceWaitForCooldown": "Vänta på nedkylning",
@@ -5347,6 +5852,9 @@
     "cliproxyapiUrl": "CLIProxyAPI URL",
     "cliproxyapiStatus": "CLIProxyAPI-status",
     "cliproxyapiNotDetected": "Inte upptäckt",
+    "cliproxyapiImportAuthTitle": "__MISSING__:Import accounts from CLIProxyAPI",
+    "cliproxyapiImportAuthDesc": "__MISSING__:Import the OAuth accounts CLIProxyAPI already saved in ~/.cli-proxy-api/ as OmniRoute connections, so you don't have to log in to each account again. Supported account types (Gemini, Codex, Claude, Antigravity, Qwen, Kimi) are imported; others are skipped.",
+    "cliproxyapiImportAuthButton": "__MISSING__:Import accounts",
     "payloadRulesTitle": "Regler för nyttolast",
     "payloadRulesDesc": "__MISSING__:Configure request payload mutations by model and protocol. Changes are persisted in settings and hot reloaded into the runtime immediately after save.",
     "payloadRuleDefaultTitle": "__MISSING__:default",
@@ -5379,6 +5887,14 @@
     "maxResponseTokensDesc": "__MISSING__:Maximum total tokens allowed in a single response.",
     "modelCooldownsTitle": "Modeller i cooldown",
     "modelCooldownsEmpty": "Inga modeller i cooldown just nu.",
+    "responsesStateTitle": "__MISSING__:Responses State",
+    "responsesStateDesc": "__MISSING__:Control how OmniRoute forwards previous_response_id.",
+    "responsesStateModeLabel": "__MISSING__:previous_response_id handling",
+    "responsesStateModeAuto": "__MISSING__:Auto",
+    "responsesStateModeStrip": "__MISSING__:Strip",
+    "responsesStateModePreserve": "__MISSING__:Preserve",
+    "responsesStateHint": "__MISSING__:Auto strips previous_response_id unless a connection explicitly enables OpenAI Responses storage. Strip is safest for stateless clients such as VS Code Custom Endpoint; context then depends on the client sending full history.",
+    "responsesStateSaveError": "__MISSING__:Failed to update Responses state setting",
     "codexFastTierTitle": "Codex Fast Tier",
     "codexFastTierDesc": "Globalt injicera service_tier=prioritet för OpenAI Codex-förfrågningar.",
     "codexFastTierHint": "När det är aktiverat lägger OmniRoute till service_tier=prioritet till utgående Codex-förfrågningar för anslutningar som inte redan anger en nivå. Prioritetsnivån kräver en OpenAI Enterprise API-nyckel eller ChatGPT-auth Codex-sökvägen; andra nyckeltyper kommer att få ett nivårelaterat fel från OpenAI. Inställningar per anslutning på Codex-leverantörssidan har företräde.",
@@ -5485,6 +6001,15 @@
     "resilienceEnableServerWaitDesc": "När den är aktiverad väntar OmniRoute på att den första nedkylningen ska löpa ut och försöker automatiskt igen.",
     "resilienceMaxAttempts": "Maximalt antal försök",
     "resilienceMaxWaitPerAttempt": "Maximal väntetid per försök",
+    "resilienceProviderCooldownTitle": "__MISSING__:Provider Cooldown",
+    "resilienceProviderCooldownScope": "__MISSING__:All combo requests",
+    "resilienceProviderCooldownTrigger": "__MISSING__:When a provider/connection fails",
+    "resilienceProviderCooldownEffect": "__MISSING__:Skips the failed provider for a cooldown period before retrying",
+    "resilienceProviderCooldownDesc": "__MISSING__:Prevents subsequent requests from re-walking the same failing providers. Cooldown scales exponentially with consecutive failures.",
+    "resilienceProviderCooldownEnabled": "__MISSING__:Enable global provider cooldown",
+    "resilienceProviderCooldownEnabledDesc": "__MISSING__:When enabled, failed providers are tracked globally and skipped for a cooldown period.",
+    "resilienceProviderCooldownMin": "__MISSING__:Minimum cooldown",
+    "resilienceProviderCooldownMax": "__MISSING__:Maximum cooldown",
     "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
     "forcedFingerprintBadge": "Required",
     "codexSessionAffinityTitle": "Codex session affinitet",
@@ -5506,13 +6031,45 @@
     "vercelRelayFreeTierNote": "__MISSING__:Relays are lightweight proxy endpoints deployed on Vercel's free tier to bypass local network/region limitations.",
     "vercelRelayDeploying": "__MISSING__:Deploying...",
     "vercelRelayDeploy": "__MISSING__:Deploy",
-    "homePinProviderQuotaToHome": "Pin Information to Home Page",
-    "homeProviderQuotaLimits": "Provider Quota Limits",
-    "homeProviderQuotaLimitsDesc": "Pin the Provider Quota status container (with Refresh All button) to the top of the Home page.",
-    "homeQuickStart": "Quick Start",
-    "homeQuickStartDesc": "Show the Quick Start panel on the Home page.",
-    "homeProviderTopology": "Provider Topology",
-    "homeProviderTopologyDesc": "Show the Provider Topology on the Home page."
+    "deployRelayButton": "__MISSING__:Deploy Relay",
+    "denoRelayButton": "__MISSING__:Deploy Deno Relay",
+    "denoRelayModalTitle": "__MISSING__:Deploy Deno Relay",
+    "denoRelayWarning": "__MISSING__:Warning: A Deno Deploy organization token is required. This token will only be used to create the relay app and will never be stored by OmniRoute.",
+    "denoRelayTokenLabel": "__MISSING__:Deno Deploy Organization Token",
+    "denoRelayOrgDomainLabel": "__MISSING__:Organization Domain",
+    "denoRelayProjectNameLabel": "__MISSING__:Deno App Name",
+    "denoRelayFreeTierNote": "__MISSING__:Deno Deploy v2 runs on a global edge network. Free tier: 1M requests & 100GiB outbound traffic per month, no per-request CPU limits, up to 20 active apps & 50 custom domains.",
+    "denoRelayDeploying": "__MISSING__:Deploying...",
+    "denoRelayDeploy": "__MISSING__:Deploy",
+    "cloudflareRelaySuccess": "__MISSING__:Cloudflare Relay deployed successfully",
+    "cloudflareRelayButton": "__MISSING__:Deploy Cloudflare Relay",
+    "cloudflareRelayModalTitle": "__MISSING__:Deploy Cloudflare Worker Relay",
+    "cloudflareRelayWarning": "__MISSING__:Deploys a Cloudflare Worker that proxies LLM requests through Cloudflare's edge network — masking the host IP behind dynamic Cloudflare addresses. The Worker enforces a one-time auth secret so the public workers.dev URL cannot be reused as an open relay.",
+    "cloudflareRelayTokenHowto": "__MISSING__:Create the API token under My Profile -> API Tokens -> Create Token -> Custom Token -> Account / Workers Scripts / Edit.",
+    "cloudflareRelayAccountIdLabel": "__MISSING__:Cloudflare Account ID",
+    "cloudflareRelayAccountIdHint": "__MISSING__:Found on the right side of the Cloudflare dashboard overview page.",
+    "cloudflareRelayApiTokenLabel": "__MISSING__:Cloudflare API Token",
+    "cloudflareRelayApiTokenHint": "__MISSING__:Requires 'Workers Scripts: Edit' permission. The token is used only at deploy time and is never stored.",
+    "cloudflareRelayProjectNameLabel": "__MISSING__:Worker Name",
+    "cloudflareRelayFreeTierNote": "__MISSING__:Free tier: 100,000 requests/day per Cloudflare account.",
+    "cloudflareRelayDeploying": "__MISSING__:Deploying...",
+    "cloudflareRelayDeploy": "__MISSING__:Deploy",
+    "cloudflareRelayCredsRequired": "__MISSING__:Account ID and API Token are required",
+    "cloudflareRelayDeployFailed": "__MISSING__:Deploy failed",
+    "modelLockout": "__MISSING__:Model Lockout",
+    "modelLockoutPageDescription": "__MISSING__:Configure which HTTP error codes trigger per-model lockout and control the cooldown behavior.",
+    "modelLockoutEnabled": "__MISSING__:Enable Model Lockout",
+    "modelLockoutEnabledDescription": "__MISSING__:When enabled, models that fail with configured error codes are temporarily locked to prevent retry loops.",
+    "modelLockoutErrorCodes": "__MISSING__:Error Codes",
+    "modelLockoutErrorCodesDescription": "__MISSING__:HTTP status codes that trigger model lockout. Type a code and click Add, or select from suggestions.",
+    "modelLockoutBaseCooldown": "__MISSING__:Base Cooldown (ms)",
+    "modelLockoutBaseCooldownDescription": "__MISSING__:Initial cooldown duration in milliseconds before a model can be retried.",
+    "modelLockoutMaxCooldown": "__MISSING__:Max Cooldown (ms)",
+    "modelLockoutMaxCooldownDescription": "__MISSING__:Maximum cooldown duration in milliseconds. Prevents excessively long lockouts.",
+    "modelLockoutExponentialBackoff": "__MISSING__:Exponential Backoff",
+    "modelLockoutExponentialBackoffDescription": "__MISSING__:When enabled, each consecutive failure increases the cooldown duration exponentially.",
+    "modelLockoutMaxBackoffSteps": "__MISSING__:Max Backoff Steps",
+    "modelLockoutMaxBackoffStepsDescription": "__MISSING__:Maximum number of backoff steps before the cooldown stops growing. The Max Cooldown cap is reached first in most configurations, making this a safety ceiling for when Max Cooldown is raised."
   },
   "contextRtk": {
     "title": "RTK Engine",
@@ -5563,7 +6120,21 @@
     "searchFilters": "Sökfilter...",
     "tooltipDedup": "Hur aggressivt man tar bort upprepade rader.",
     "tooltipMaxChars": "Maximalt antal tecken per utdatablock.",
-    "tooltipMaxLines": "Maximalt antal rader att hålla från kommandoutmatning. Överskottet är trunkerat."
+    "tooltipMaxLines": "Maximalt antal rader att hålla från kommandoutmatning. Överskottet är trunkerat.",
+    "learnDiscoverTitle": "__MISSING__:Learn & Discover filters",
+    "learnDiscoverDesc": "__MISSING__:Mine your captured command output (Raw Output retention must be on) to suggest new RTK filters. Suggestions only — you review and save them.",
+    "discoverHeading": "__MISSING__:Discover repeated noise",
+    "discoverButton": "__MISSING__:Scan samples",
+    "discoverScanning": "__MISSING__:Scanning…",
+    "discoverEmpty": "__MISSING__:No repeated noise found. Enable Raw Output retention and run a few commands first.",
+    "discoverSamples": "__MISSING__:{count} sample(s) scanned",
+    "discoverHits": "__MISSING__:{hits}× across samples",
+    "learnHeading": "__MISSING__:Learn a filter for a command",
+    "learnCommandPlaceholder": "__MISSING__:e.g. npm install",
+    "learnButton": "__MISSING__:Suggest filter",
+    "learnEmpty": "__MISSING__:No suggestion yet. Type a command you have run and scan.",
+    "learnSamplesUsed": "__MISSING__:Learned from {count} matching sample(s)",
+    "suggestionError": "__MISSING__:Could not load suggestions. Check management auth and try again."
   },
   "contextCombos": {
     "title": "Compression Combos",
@@ -5853,7 +6424,80 @@
     "routeConnectionLabel": "Anslutning",
     "scenarioVision": "Vision (bildförståelse)",
     "scenarioSchemaCoercion": "Schematvång (strukturerad produktion)",
-    "techniques": "Tekniker:"
+    "techniques": "Tekniker:",
+    "friendlyTitle": "__MISSING__:Translator",
+    "friendlySubtitle": "__MISSING__:Use your existing app with any provider — without rewriting code.",
+    "conceptHeadline": "__MISSING__:Your app speaks one API's \"language\". The Translator converts it to use another provider.",
+    "conceptDiagramAppLabel": "__MISSING__:Your app",
+    "conceptDiagramSourceLabel": "__MISSING__:Source format",
+    "conceptDiagramHubLabel": "__MISSING__:OpenAI (hub)",
+    "conceptDiagramTargetLabel": "__MISSING__:Target provider",
+    "conceptDiagramExampleApp": "__MISSING__:e.g. Anthropic SDK",
+    "conceptDiagramExampleSource": "__MISSING__:claude",
+    "conceptDiagramExampleTarget": "__MISSING__:Gemini",
+    "conceptHowItWorksToggle": "__MISSING__:How it works",
+    "conceptHowItWorksBody": "__MISSING__:Your app sends a request in its own format. The Translator detects the format, converts it through OpenAI as an intermediate hub (or directly when a direct translator is available), sends it to the chosen provider, and returns the response converted back to your app's format.",
+    "tabTranslate": "__MISSING__:Translate",
+    "tabMonitor": "__MISSING__:Monitor",
+    "tabTranslateAriaLabel": "__MISSING__:Go to the Translate tab",
+    "tabMonitorAriaLabel": "__MISSING__:Go to the Monitor tab",
+    "simpleAppUsesLabel": "__MISSING__:My app uses",
+    "simpleAppUsesHint": "__MISSING__:The API format your app speaks (e.g. Anthropic SDK = claude).",
+    "simpleSendToLabel": "__MISSING__:Send to",
+    "simpleSendToHint": "__MISSING__:Where to actually send the request (a provider connected in OmniRoute).",
+    "simpleStartWithLabel": "__MISSING__:Start with",
+    "simpleStartWithExamplePlaceholder": "__MISSING__:Select a ready-made example",
+    "simpleStartWithCustomOption": "__MISSING__:Paste your request (advanced)",
+    "simpleModeLabel": "__MISSING__:Mode",
+    "simpleModePreview": "__MISSING__:Preview translation only",
+    "simpleModeSend": "__MISSING__:Send and see response",
+    "simpleAdvancedToggle": "__MISSING__:Advanced",
+    "simpleInputPanelTitle": "__MISSING__:Input",
+    "simpleInputPanelHint": "__MISSING__:Free-text message or ready-made example",
+    "simpleResultPanelTitle": "__MISSING__:Translation + Response",
+    "narratedDetected": "__MISSING__:✓ Detected: {format}",
+    "narratedTranslating": "__MISSING__:Translating to {target}...",
+    "narratedSending": "__MISSING__:Sending to {target}...",
+    "narratedSuccess": "__MISSING__:→ translated to {target} · response in {latency}ms",
+    "narratedError": "__MISSING__:Failed: {reason}",
+    "narratedSeeTranslatedJson": "__MISSING__:see translated JSON",
+    "narratedSeePipeline": "__MISSING__:see pipeline",
+    "advancedSectionTitle": "__MISSING__:Advanced",
+    "advancedSectionSubtitle": "__MISSING__:Raw JSON, pipeline and technical tools. Everything here is the same as the old tabs — just reorganized.",
+    "advancedRawJsonTitle": "__MISSING__:Raw JSON (auto-detect + Monaco)",
+    "advancedRawJsonSubtitle": "__MISSING__:Paste a JSON request; the format is detected automatically.",
+    "advancedPipelineTitle": "__MISSING__:OpenAI intermediate pipeline",
+    "advancedPipelineSubtitle": "__MISSING__:Visualize each translation step (hub-and-spoke).",
+    "advancedStreamTransformTitle": "__MISSING__:Stream Transformer (Chat → Responses SSE)",
+    "advancedStreamTransformSubtitle": "__MISSING__:Converts Chat Completions SSE into Responses API.",
+    "advancedTestBenchTitle": "__MISSING__:Test Bench (8 scenarios)",
+    "advancedTestBenchSubtitle": "__MISSING__:Runs all scenarios and reports pass/fail + compatibility %.",
+    "advancedCompressionTitle": "__MISSING__:Compression Preview",
+    "advancedCompressionSubtitle": "__MISSING__:Estimate token savings across different compression modes.",
+    "monitorOriginHint": "__MISSING__:Events generated by Translate or the main pipeline appear here in real time.",
+    "monitorEmptyCta": "__MISSING__:Go to the Translate tab and send a request — it will appear here.",
+    "monitorOpenTranslateButton": "__MISSING__:Go to Translate",
+    "pipelineStepClientRequest": "__MISSING__:Client Request",
+    "pipelineStepClientRequestDesc": "__MISSING__:Request received in client format",
+    "pipelineStepFormatDetected": "__MISSING__:Format Detected",
+    "pipelineStepFormatDetectedDesc": "__MISSING__:Auto-detected source format",
+    "pipelineStepOpenAIIntermediate": "__MISSING__:OpenAI Intermediate",
+    "pipelineStepOpenAIIntermediateDesc": "__MISSING__:Translated to OpenAI hub format",
+    "pipelineStepProviderFormat": "__MISSING__:Provider Format",
+    "pipelineStepProviderFormatDesc": "__MISSING__:Translated to provider target format",
+    "pipelineStepProviderResponse": "__MISSING__:Provider Response",
+    "pipelineStepProviderResponseDesc": "__MISSING__:Streaming response from provider",
+    "conceptDiagramArrow1": "__MISSING__:speaks",
+    "conceptDiagramArrow2": "__MISSING__:translates",
+    "conceptDiagramArrow3": "__MISSING__:converts",
+    "conceptDiagramExampleHub": "__MISSING__:OpenAI",
+    "conceptDiagramHubTooltip": "__MISSING__:Intermediate hub used by the translator to convert between formats that don't have a direct mapping.",
+    "conceptDiagramSourceTooltip": "__MISSING__:The API format your app speaks (e.g., Anthropic SDK = claude).",
+    "conceptDiagramTargetTooltip": "__MISSING__:The provider where the request will actually be sent.",
+    "compressionEmptyHint": "__MISSING__:Fill in the input field on the Translate tab (Simple Controls or Raw JSON) to enable the preview.",
+    "compressionModeLabel": "__MISSING__:Compression mode",
+    "compressionPreviewButton": "__MISSING__:Preview Compression",
+    "compressionPreviewing": "__MISSING__:Previewing…"
   },
   "usage": {
     "title": "Användning",
@@ -6010,6 +6654,8 @@
     "notApplicable": "N/A",
     "rawPlanWithValue": "Rå plan: {plan}",
     "noPlanFromProvider": "Ingen plan från leverantören",
+    "tokenExpiresIn": "__MISSING__:Token expires in {time}",
+    "tokenExpired": "__MISSING__:Token expired",
     "noQuotaData": "Inga kvotdata",
     "cardExpand": "__MISSING__:Expand",
     "cardCollapse": "__MISSING__:Collapse",
@@ -6159,6 +6805,11 @@
     "quotaCutoffsButtonDefault": "Standard",
     "quotaCutoffsButtonHelp": "Redigera minsta återstående kvot för detta konto.",
     "quotaCutoffsButtonDisabled": "Inga kvotfönster är tillgängliga för det här kontot ännu.",
+    "deactivateAccount": "__MISSING__:Deactivate account (stop routing)",
+    "activateAccount": "__MISSING__:Activate account (resume routing)",
+    "accountActivated": "__MISSING__:Account activated",
+    "accountDeactivated": "__MISSING__:Account deactivated",
+    "toggleActiveFailed": "__MISSING__:Failed to update account status",
     "quotaCutoffsTitle": "Kvotavskärningar för {name} ({provider})",
     "quotaCutoffsExplainer": "Åsidosätt den minsta återstående kvotprocenten där detta konto slutar väljas för varje kvotfönster. Lämna tomt för att ärva standardleverantören.",
     "quotaCutoffsDefaultHint": "Minsta återstående standard: {default}%",
@@ -6179,6 +6830,7 @@
     "budgetColDailyLim": "Daglig lim",
     "budgetColMonthlyLim": "Månatlig lim",
     "budgetColUsedPct": "Använd %",
+    "percentUsed": "__MISSING__:{pct}% used",
     "budgetLoading": "Laddar...",
     "budgetNoKeysMatch": "Inga nycklar matchar filter",
     "budgetLinearExtrapolation": "linjär extrapolering",
@@ -7124,6 +7776,11 @@
     "modalEditTitle": "Modal Edit Title",
     "labelName": "Label Name",
     "labelType": "Typ",
+    "labelFamily": "__MISSING__:IP family",
+    "familyAuto": "__MISSING__:Auto (dual-stack)",
+    "familyIpv4": "__MISSING__:IPv4 only",
+    "familyIpv6": "__MISSING__:IPv6 only",
+    "familyHint": "__MISSING__:Egress address family. Auto keeps dual-stack; IPv4/IPv6 pin this proxy to that family (prevents a v4 leak under an IPv6-only proxy).",
     "labelHost": "Värd",
     "labelPort": "Port",
     "labelUsername": "Användarnamn",
@@ -7266,7 +7923,16 @@
     "improveConfirm": "Improve",
     "exportCode": "Export code",
     "exportCodeTitle": "Export Code",
+    "exportShort": "__MISSING__:Export",
     "noStateToExport": "No playground state available to export.",
+    "closeExportModal": "__MISSING__:Close export modal",
+    "close": "__MISSING__:Close",
+    "exportRealKeyWarning": "__MISSING__:Security warning: export blocked — a real API key was detected in the output. Please reset your API key and try again.",
+    "placeholderHintPrefix": "__MISSING__:Replace",
+    "placeholderHintSuffix": "__MISSING__:with your actual API key, or set it as an environment variable.",
+    "copyLangCode": "__MISSING__:Copy {language} code",
+    "loadingPresets": "__MISSING__:Loading…",
+    "loadPresetPlaceholder": "__MISSING__:Load preset…",
     "copyCode": "Copy",
     "copiedCode": "Copied!",
     "addModel": "+ Add model",
@@ -7291,7 +7957,27 @@
     "invalidJson": "Invalid JSON",
     "running": "Running…",
     "runLabel": "Run",
-    "enterToolResult": "Enter tool result…"
+    "enterToolResult": "Enter tool result…",
+    "build": {
+      "step1Label": "__MISSING__:What to test?",
+      "step2Label": "__MISSING__:Configure",
+      "step3Label": "__MISSING__:Run",
+      "step1Title": "__MISSING__:What do you want to test?",
+      "step1Subtitle": "__MISSING__:Choose the capability you want to explore in this session.",
+      "step2Title": "__MISSING__:Configure",
+      "step2Subtitle": "__MISSING__:Set up the tools or JSON schema that will be used in the request.",
+      "step3Title": "__MISSING__:Run",
+      "modeToolsTitle": "__MISSING__:Tools",
+      "modeToolsDesc": "__MISSING__:Test function calling — define tools and see how the model invokes them.",
+      "modeJsonTitle": "__MISSING__:JSON",
+      "modeJsonDesc": "__MISSING__:Test structured output — constrain the response to a JSON schema.",
+      "modeBothTitle": "__MISSING__:Tools + JSON",
+      "modeBothDesc": "__MISSING__:Combine function calling and structured output in a single request.",
+      "backButton": "__MISSING__:Back",
+      "nextButton": "__MISSING__:Next",
+      "runButton": "__MISSING__:Run",
+      "promptPlaceholder": "__MISSING__:Enter your message… (Enter to send, Shift+Enter for newline)"
+    }
   },
   "miniPlayground": {
     "endpoint": "__MISSING__:Endpoint",
@@ -7395,7 +8081,9 @@
     "loadingLogs": "Loading logs...",
     "noLogs": "No logs yet. Make some API calls to see them here.",
     "noMatchingLogs": "No logs matching current filters.",
-    "callLogsInfo": "Call logs are also saved as JSON files to {dataDir} and rotated based on {retentionDays} and {maxEntries}."
+    "callLogsInfo": "Call logs are also saved as JSON files to {dataDir} and rotated based on {retentionDays} and {maxEntries}.",
+    "loadMore": "__MISSING__:Load More",
+    "loadingMore": "__MISSING__:Loading more..."
   },
   "proxyLogger": {
     "filterAll": "All",
@@ -7432,7 +8120,8 @@
     "loadingProxyLogs": "Loading proxy logs...",
     "noProxyLogs": "No proxy logs yet. Configure proxies and make API calls to see them here.",
     "noMatchingLogs": "No logs match the current filters.",
-    "tlsFingerprint": "Chrome 124 TLS Fingerprint"
+    "tlsFingerprint": "Chrome 124 TLS Fingerprint",
+    "colPublicIp": "__MISSING__:Public IP"
   },
   "endpointOptions": {
     "speech": "Speech",
@@ -7572,7 +8261,86 @@
     "betaConfigSavedSuffix": "(finns ännu inte kvar på servern). Begränsning per begäran är ännu inte kopplad till proxypipeline. Den här skärmen låter dig designa och visualisera kvotfördelningen; verklig verkställighet kommer att landa i en framtida iteration med DB persistens och uppströms samtalsavlyssning.",
     "policyLabel": "Policy:",
     "resetIn": "återställ in",
-    "quotaTotal": "totalt"
+    "quotaTotal": "totalt",
+    "kpiAvgUtilization": "__MISSING__:Avg utilization",
+    "kpiBorrowingNow": "__MISSING__:Borrowing now",
+    "conceptTitle": "__MISSING__:How Quota Share works",
+    "conceptIntro": "__MISSING__:Quota Share divides a provider's quota among multiple API keys using work-conserving fair-share: each key receives a proportional slice but can borrow from the free balance without exceeding the global cap.",
+    "conceptFairShare": "__MISSING__:Fair-share: each key receives quota proportional to its configured weight",
+    "conceptBorrowing": "__MISSING__:Borrowing: keys can consume free balance from others without breaching the cap",
+    "conceptGlobalCap": "__MISSING__:Hard global cap: the provider's absolute limit is never exceeded",
+    "conceptWindows": "__MISSING__:Windows: 5h, hourly, daily, weekly, monthly — each tracked independently",
+    "conceptKeyHowTitle": "__MISSING__:Enabling a key for quota",
+    "conceptKeyHowDesc": "__MISSING__:Create the key normally in API Keys — it appears in the wizard's key step automatically. Tick Exclusive there to make it quota-only. No separate enable step.",
+    "conceptExclusiveTitle": "__MISSING__:What \"Exclusive\" does",
+    "conceptExclusiveDesc": "__MISSING__:An exclusive key only sees/uses the pool's quotaShared-* models — every other model is hidden from its /v1/models and blocked.",
+    "burnRateTitle": "__MISSING__:Burn rate",
+    "burnRateExhaustsIn": "__MISSING__:Exhausts in",
+    "dimensionResetIn": "__MISSING__:Resets in",
+    "realConsumedColumn": "__MISSING__:Consumed",
+    "deficitColumn": "__MISSING__:Deficit",
+    "borrowingIndicator": "__MISSING__:borrowing",
+    "migratedFromLocalStorageNotice": "__MISSING__:Pools successfully migrated from localStorage.",
+    "policyCapAbsoluteLabel": "__MISSING__:Absolute cap",
+    "policyCapAbsolutePlaceholder": "__MISSING__:Numeric limit (optional)",
+    "multiDimensionLabel": "__MISSING__:Multi-dimension",
+    "stackedBarTitle": "__MISSING__:Slices by API key",
+    "usedSuffix": "__MISSING__:used {percent}%",
+    "wizardTitle": "__MISSING__:New quota pool",
+    "editPoolTitle": "__MISSING__:Edit pool",
+    "saveChanges": "__MISSING__:Save changes",
+    "wizardStep1Label": "__MISSING__:Account",
+    "wizardStep2Label": "__MISSING__:Limit",
+    "wizardStep3Label": "__MISSING__:Keys",
+    "wizardStep1Title": "__MISSING__:Choose provider connection",
+    "wizardStep1Subtitle": "__MISSING__:Select the provider account this pool will share quota for, set a name and default policy.",
+    "wizardStep2Title": "__MISSING__:Configure quota dimensions",
+    "wizardStep2Subtitle": "__MISSING__:Define the quota plan dimensions (unit, window, limit) for the chosen connection. Leave unchanged to keep current settings.",
+    "wizardStep3Title": "__MISSING__:Allocate API keys",
+    "wizardStep3Subtitle": "__MISSING__:Assign API keys to this pool with weight % allocations and optional caps.",
+    "wizardPoolNameLabel": "__MISSING__:Pool name",
+    "wizardPoolNamePlaceholder": "__MISSING__:My quota pool",
+    "wizardNext": "__MISSING__:Next",
+    "wizardBack": "__MISSING__:Back",
+    "wizardCreatePool": "__MISSING__:Create pool",
+    "wizardDimensionsEditedNotice": "__MISSING__:Dimensions edited — will be saved as a manual override when the pool is created.",
+    "wizardExclusiveLabel": "__MISSING__:Exclusive quota",
+    "wizardExclusiveHint": "__MISSING__:When enabled, these API keys will only be allowed to use this pool's virtual models (allowedQuotas reconciliation is applied on save).",
+    "wizardPreviewLabel": "__MISSING__:Virtual model names preview",
+    "wizardConnectionsLabel": "__MISSING__:Provider connections",
+    "wizardPrimaryBadge": "__MISSING__:primary",
+    "wizardAdditionalConnectionsNote": "__MISSING__:Additional connections use their catalog default limits (editable later).",
+    "wizardSingleProviderNote": "__MISSING__:A pool uses a single provider",
+    "wizardPreviewMoreModels": "__MISSING__:+{count} more",
+    "accountQuotaTitle": "__MISSING__:Account quota",
+    "accountQuotaNone": "__MISSING__:—",
+    "logTitle": "__MISSING__:Usage log",
+    "logEmpty": "__MISSING__:No usage yet",
+    "groupLabel": "__MISSING__:Group",
+    "newGroup": "__MISSING__:New group",
+    "renameGroup": "__MISSING__:Rename group",
+    "groupSelectHint": "__MISSING__:Filter pools by group",
+    "groupAllocationNote": "__MISSING__:Allocations apply to all pools in this group via the shared quota layer.",
+    "groupNamePrompt": "__MISSING__:Enter group name",
+    "wizardGroupLabel": "__MISSING__:Group",
+    "allGroups": "__MISSING__:All groups",
+    "endpointsTitle": "__MISSING__:Available endpoints",
+    "endpointsHint": "__MISSING__:Call these virtual models with any allocated key — routing + quota are handled per group.",
+    "previewForKey": "__MISSING__:Preview for key",
+    "previewKeyNone": "__MISSING__:(all endpoints)",
+    "endpointsBaseUrl": "__MISSING__:Base URL",
+    "endpointsCollapse": "__MISSING__:Collapse",
+    "endpointsExpand": "__MISSING__:Expand",
+    "endpointsAnthropicNote": "__MISSING__:Anthropic-native",
+    "endpointsResponsesNote": "__MISSING__:OpenAI Responses — codex/github",
+    "endpointsWsNote": "__MISSING__:WebSocket — codex only",
+    "betaText": "__MISSING__:Quota Share is functional but bugs are expected. Found one? Please report it.",
+    "betaReportLink": "__MISSING__:Report an issue",
+    "deleteGroup": "__MISSING__:Delete group",
+    "deleteGroupConfirm": "__MISSING__:Delete this group? Its pools must be reassigned or removed first.",
+    "deleteGroupHasPools": "__MISSING__:This group still has pools — reassign or delete them first.",
+    "ungroupedTitle": "__MISSING__:Ungrouped",
+    "ungroupedHint": "__MISSING__:These pools are not assigned to a known group. Edit a pool to move it into a real group."
   },
   "plugins": {
     "title": "Plugins",
@@ -7608,6 +8376,571 @@
     "status": "Status",
     "enabled": "Enabled",
     "disabled": "Disabled",
+    "installedTab": "__MISSING__:Installed",
+    "marketplaceTab": "__MISSING__:Marketplace",
+    "marketplaceUrlLabel": "__MISSING__:Custom Marketplace URL",
+    "marketplaceUrlPlaceholder": "__MISSING__:Leave empty for official Omniroute registry",
+    "saveMarketplaceUrl": "__MISSING__:Save & Reload",
+    "marketplaceUrlSaved": "__MISSING__:Marketplace URL updated",
+    "marketplaceEmpty": "__MISSING__:No plugins found in marketplace.",
+    "verified": "__MISSING__:Verified",
+    "install": "__MISSING__:Install",
+    "installedFromMarketplace": "__MISSING__:Plugin {name} installed!",
     "hooks": "Hooks"
+  },
+  "quotaPlans": {
+    "title": "__MISSING__:Plans & Quotas",
+    "description": "__MISSING__:Configure quota plans per provider — dimensions (%, requests, tokens, $) and time windows",
+    "providerLabel": "__MISSING__:Provider / Connection",
+    "detectedPlanLabel": "__MISSING__:Detected plan",
+    "manualPlanLabel": "__MISSING__:Manual override",
+    "unconfiguredLabel": "__MISSING__:Not configured — manual required",
+    "dimensionLabel": "__MISSING__:Dimensions",
+    "addDimension": "__MISSING__:Add dimension",
+    "removeDimension": "__MISSING__:Remove",
+    "limitLabel": "__MISSING__:Limit",
+    "unitOptions": {
+      "percent": "__MISSING__:%",
+      "requests": "__MISSING__:requests",
+      "tokens": "__MISSING__:tokens",
+      "usd": "__MISSING__:USD ($)"
+    },
+    "windowOptions": {
+      "5h": "__MISSING__:5 hours",
+      "hourly": "__MISSING__:Hourly",
+      "daily": "__MISSING__:Daily",
+      "weekly": "__MISSING__:Weekly",
+      "monthly": "__MISSING__:Monthly"
+    },
+    "useCatalogButton": "__MISSING__:Use catalog",
+    "saveOverrideButton": "__MISSING__:Save override",
+    "revertToCatalogButton": "__MISSING__:Revert to catalog",
+    "unknownProviderNotice": "__MISSING__:Select a provider on the left to configure its quota plan.",
+    "catalogTitle": "__MISSING__:Known catalog",
+    "catalogDescription": "__MISSING__:Automatically detected plans for the following providers:"
+  },
+  "activity": {
+    "title": "__MISSING__:Activity",
+    "description": "__MISSING__:Recent events feed",
+    "emptyTitle": "__MISSING__:No activity yet",
+    "emptyDescription": "__MISSING__:When you add providers, create combos, or rotate keys, events will appear here.",
+    "todayHeader": "__MISSING__:Today",
+    "yesterdayHeader": "__MISSING__:Yesterday",
+    "filterAll": "__MISSING__:All",
+    "filterProviders": "__MISSING__:Providers",
+    "filterCombos": "__MISSING__:Combos",
+    "filterApiKeys": "__MISSING__:API Keys",
+    "filterSettings": "__MISSING__:Settings",
+    "filterQuota": "__MISSING__:Quota",
+    "filterAuth": "__MISSING__:Auth",
+    "filterSystem": "__MISSING__:System",
+    "relative": {
+      "justNow": "__MISSING__:just now",
+      "minutesAgo": "__MISSING__:{n} min ago",
+      "hoursAgo": "__MISSING__:{n} h ago",
+      "yesterday": "__MISSING__:yesterday",
+      "daysAgo": "__MISSING__:{n} days ago"
+    },
+    "eventVerb": {
+      "providerAdded": "__MISSING__:{actor} added provider {target}",
+      "providerRemoved": "__MISSING__:{actor} removed provider {target}",
+      "providerTested": "__MISSING__:{actor} tested provider {target}",
+      "comboCreated": "__MISSING__:{actor} created combo {target}",
+      "comboUpdated": "__MISSING__:{actor} updated combo {target}",
+      "comboDeleted": "__MISSING__:{actor} removed combo {target}",
+      "apiKeyCreated": "__MISSING__:{actor} created API key {target}",
+      "apiKeyRevoked": "__MISSING__:{actor} revoked API key {target}",
+      "apiKeyRotated": "__MISSING__:{actor} rotated API key {target}",
+      "budgetThreshold": "__MISSING__:Budget threshold reached for {target}",
+      "settingUpdated": "__MISSING__:{actor} updated setting {target}",
+      "authLogin": "__MISSING__:{actor} signed in",
+      "authLogout": "__MISSING__:{actor} signed out",
+      "cloudAgentSession": "__MISSING__:Cloud agent session started for {target}",
+      "mcpToolRegistered": "__MISSING__:MCP tool {target} registered",
+      "webhookCreated": "__MISSING__:{actor} created webhook {target}",
+      "webhookDeleted": "__MISSING__:{actor} removed webhook {target}",
+      "quotaPoolCreated": "__MISSING__:{actor} created quota pool {target}",
+      "quotaPoolUpdated": "__MISSING__:{actor} updated quota pool {target}",
+      "quotaPoolDeleted": "__MISSING__:{actor} removed quota pool {target}",
+      "quotaPlanUpdated": "__MISSING__:{actor} updated quota plan {target}",
+      "quotaStoreDriverChanged": "__MISSING__:QuotaStore driver changed",
+      "updateApplied": "__MISSING__:Update {target} applied",
+      "deployCompleted": "__MISSING__:Deploy completed",
+      "skillInstalled": "__MISSING__:{actor} installed skill {target}",
+      "skillRemoved": "__MISSING__:{actor} removed skill {target}",
+      "providerCredentialsCreated": "__MISSING__:{actor} created credentials for {target}",
+      "providerCredentialsApplied": "__MISSING__:Credentials for {target} applied",
+      "providerCredentialsUpdated": "__MISSING__:{actor} updated credentials for {target}",
+      "providerCredentialsRevoked": "__MISSING__:{actor} revoked credentials for {target}",
+      "providerCredentialsBatchRevoked": "__MISSING__:{actor} batch-revoked credentials",
+      "providerCredentialsBatchUpdated": "__MISSING__:{actor} batch-updated credentials",
+      "providerCredentialsBulkCreated": "__MISSING__:{actor} bulk-created credentials",
+      "providerCredentialsBulkImported": "__MISSING__:{actor} bulk-imported credentials",
+      "providerCredentialsImported": "__MISSING__:{actor} imported credentials",
+      "providerSsrfBlocked": "__MISSING__:SSRF attempt blocked for {target}",
+      "authLoginSuccess": "__MISSING__:{actor} signed in",
+      "authLoginError": "__MISSING__:Login error for {actor}",
+      "authLoginFailed": "__MISSING__:Login failed for {actor}",
+      "authLoginLocked": "__MISSING__:{actor} locked out after too many attempts",
+      "authLoginMisconfigured": "__MISSING__:Auth configuration invalid",
+      "authLoginSetupRequired": "__MISSING__:Auth setup required",
+      "authLogoutSuccess": "__MISSING__:{actor} signed out",
+      "syncTokenCreated": "__MISSING__:{actor} created sync token",
+      "syncTokenRevoked": "__MISSING__:{actor} revoked sync token",
+      "settingsUpdate": "__MISSING__:{actor} updated settings",
+      "settingsUpdateFailed": "__MISSING__:Settings update failed",
+      "serviceRevealApiKey": "__MISSING__:{actor} revealed API key for {target}",
+      "genericEvent": "__MISSING__:{actor} {target}"
+    }
+  },
+  "agentBridge": {
+    "title": "__MISSING__:AgentBridge",
+    "subtitle": "__MISSING__:Use IDE agents with OmniRoute models — no config required",
+    "riskBannerTitle": "__MISSING__:Use at your own risk",
+    "riskBannerBody": "__MISSING__:AgentBridge intercepts HTTPS traffic from IDE agents. By activating it you accept responsibility for compliance with the terms of service of each agent. Never use on devices or networks where TLS inspection is prohibited.",
+    "riskBannerDismiss": "__MISSING__:Dismiss",
+    "serverCardTitle": "__MISSING__:AgentBridge Server",
+    "statusRunning": "__MISSING__:Running",
+    "statusStopped": "__MISSING__:Stopped",
+    "statusActive": "__MISSING__:Active",
+    "statusDnsOff": "__MISSING__:DNS off",
+    "statusSetupRequired": "__MISSING__:Setup required",
+    "statusInvestigating": "__MISSING__:Investigating",
+    "serverPort": "__MISSING__:Port",
+    "serverConns": "__MISSING__:Connections",
+    "serverIntercepted": "__MISSING__:Intercepted",
+    "serverLastStarted": "__MISSING__:Last started",
+    "startServer": "__MISSING__:Start",
+    "stopServer": "__MISSING__:Stop",
+    "restartServer": "__MISSING__:Restart",
+    "trustCert": "__MISSING__:Trust Cert",
+    "downloadCert": "__MISSING__:Download Cert",
+    "regenerateCert": "__MISSING__:Regenerate Cert",
+    "starting": "__MISSING__:Starting…",
+    "stopping": "__MISSING__:Stopping…",
+    "restarting": "__MISSING__:Restarting…",
+    "trusting": "__MISSING__:Trusting…",
+    "regenerating": "__MISSING__:Regenerating…",
+    "upstreamCaLabel": "__MISSING__:Upstream CA Certificate (corporate)",
+    "upstreamCaPlaceholder": "__MISSING__:/etc/ssl/certs/corp-ca.pem",
+    "upstreamCaTest": "__MISSING__:Test TLS",
+    "upstreamCaTestOk": "__MISSING__:TLS test passed",
+    "upstreamCaTestError": "__MISSING__:TLS test failed — check the path and CA file",
+    "bypassSectionTitle": "__MISSING__:Bypass List",
+    "bypassSectionDesc": "__MISSING__:Hosts matching these patterns are tunneled directly (no TLS decryption). Defaults include banks, .gov, and corporate SSO.",
+    "bypassDefaultsLabel": "__MISSING__:Default bypass patterns (read-only)",
+    "bypassUserLabel": "__MISSING__:Custom bypass patterns (one per line, glob or regex)",
+    "saveBypassList": "__MISSING__:Save bypass list",
+    "agentListTitle": "__MISSING__:IDE Agents",
+    "filterAll": "__MISSING__:All",
+    "filterActive": "__MISSING__:Active",
+    "filterSetupRequired": "__MISSING__:Setup required",
+    "filterInvestigating": "__MISSING__:Investigating",
+    "searchAgents": "__MISSING__:Search agents…",
+    "noAgentsMatch": "__MISSING__:No agents match the current filter",
+    "agentHosts": "__MISSING__:Intercepted hosts",
+    "certTrusted": "__MISSING__:Certificate trusted",
+    "certNotTrusted": "__MISSING__:Certificate not trusted",
+    "investigatingNotice": "__MISSING__:This agent is under investigation. Hosts and API surface are still being confirmed. Setup will be available once the upstream API is documented.",
+    "modelMappingsLabel": "__MISSING__:Model mappings",
+    "sourceModel": "__MISSING__:Source model (agent native)",
+    "targetModel": "__MISSING__:Target model (OmniRoute)",
+    "noMappings": "__MISSING__:No model mappings configured. Run setup wizard to auto-detect models.",
+    "selectModel": "__MISSING__:Select…",
+    "saveMappings": "__MISSING__:Save mappings",
+    "setupWizard": "__MISSING__:Setup wizard",
+    "startDns": "__MISSING__:Start DNS",
+    "stopDns": "__MISSING__:Stop DNS",
+    "toggling": "__MISSING__:Toggling…",
+    "viewTraffic": "__MISSING__:View traffic",
+    "emptyNoProvidersTitle": "__MISSING__:No providers configured yet",
+    "emptyNoProvidersBody": "__MISSING__:To use AgentBridge, first connect at least one provider. It will be the destination where IDE requests are routed.",
+    "emptyGoToProviders": "__MISSING__:Go to Providers",
+    "wizardTitle": "__MISSING__:Setup wizard",
+    "wizardSubtitle": "__MISSING__:3-step setup",
+    "wizardStep1Label": "__MISSING__:Verify",
+    "wizardStep2Label": "__MISSING__:DNS",
+    "wizardStep3Label": "__MISSING__:Mappings",
+    "wizardStep1Desc": "__MISSING__:Confirm the server is running and the certificate is installed.",
+    "wizardStep2Desc": "__MISSING__:The following entries will be added to /etc/hosts to redirect traffic through AgentBridge:",
+    "wizardStep3Desc": "__MISSING__:You can now configure model mappings in the agent card. Restart the IDE to apply changes.",
+    "wizardStep3Success": "__MISSING__:Agent is configured!",
+    "wizardServerCheck": "__MISSING__:AgentBridge server",
+    "wizardRunning": "__MISSING__:running",
+    "wizardNotRunning": "__MISSING__:not running",
+    "wizardCertCheck": "__MISSING__:Certificate",
+    "wizardTrusted": "__MISSING__:trusted",
+    "wizardNotTrusted": "__MISSING__:not yet trusted — use Trust Cert button",
+    "wizardTutorialTitle": "__MISSING__:Setup instructions:",
+    "wizardEnableDns": "__MISSING__:Add /etc/hosts entries",
+    "wizardDnsAlreadyEnabled": "__MISSING__:DNS already enabled for this agent",
+    "enablingDns": "__MISSING__:Enabling…",
+    "modelSelectorTitle": "__MISSING__:Select target model",
+    "modelSelectorSearch": "__MISSING__:Search models…",
+    "noModelsFound": "__MISSING__:No models found",
+    "quickLinks": "__MISSING__:Quick links",
+    "quickLinkProviders": "__MISSING__:Configure providers",
+    "quickLinkInspector": "__MISSING__:View traffic in Traffic Inspector",
+    "maintenanceTitle": "__MISSING__:Maintenance & Diagnostics",
+    "maintenanceSubtitle": "__MISSING__:Self-test the capture pipeline, undo leftover system state, and move your setup between machines.",
+    "orphanedStateWarning": "__MISSING__:A previous session left system state behind (DNS spoof, CA, or system proxy). Run Repair to clean it up.",
+    "diagnose": "__MISSING__:Diagnose",
+    "diagnosing": "__MISSING__:Diagnosing…",
+    "diagnoseHealthy": "__MISSING__:Capture pipeline is healthy.",
+    "diagnoseUnhealthy": "__MISSING__:Capture pipeline has problems:",
+    "repair": "__MISSING__:Repair",
+    "repairing": "__MISSING__:Repairing…",
+    "repairDone": "__MISSING__:Repaired: {items}",
+    "repairNothing": "__MISSING__:Nothing to repair — system state is clean.",
+    "removeCa": "__MISSING__:Remove CA",
+    "removeCaConfirm": "__MISSING__:Remove CA?",
+    "removeCaDone": "__MISSING__:MITM root CA removed from the OS trust store.",
+    "removing": "__MISSING__:Removing…",
+    "confirm": "__MISSING__:Confirm",
+    "exportConfig": "__MISSING__:Export config",
+    "exporting": "__MISSING__:Exporting…",
+    "importConfig": "__MISSING__:Import config",
+    "importing": "__MISSING__:Importing…",
+    "importInvalidJson": "__MISSING__:The selected file is not valid JSON.",
+    "importDone": "__MISSING__:Imported {bypass} bypass · {hosts} hosts · {agents} agents",
+    "save": "__MISSING__:Save",
+    "saving": "__MISSING__:Saving…",
+    "cancel": "__MISSING__:Cancel",
+    "back": "__MISSING__:Back",
+    "next": "__MISSING__:Next",
+    "done": "__MISSING__:Done",
+    "loading": "__MISSING__:Loading…",
+    "riskNoticeTitle": "__MISSING__:Risk acknowledgment",
+    "riskNoticeBody": "__MISSING__:AgentBridge will intercept HTTPS traffic from this agent by redirecting its API hosts via DNS. Only enable if you accept responsibility for compliance with the agent's terms of service and any applicable network policies.",
+    "pageMoved": {
+      "goNow": "__MISSING__:Go now",
+      "message": "__MISSING__:The MITM Proxy now lives under AgentBridge.",
+      "title": "__MISSING__:This page has moved"
+    }
+  },
+  "trafficInspector": {
+    "title": "__MISSING__:Traffic Inspector",
+    "subtitle": "__MISSING__:Monitor LLM calls and debug any application's HTTPS traffic",
+    "captureModesTitle": "__MISSING__:Capture Modes",
+    "agentBridgeMode": "__MISSING__:AgentBridge",
+    "agentBridgeModeDesc": "__MISSING__:Capture traffic from all connected IDE agents",
+    "customHostsMode": "__MISSING__:Custom Hosts",
+    "customHostsModeDesc": "__MISSING__:Add specific hosts to intercept",
+    "httpProxyMode": "__MISSING__:HTTP Proxy",
+    "httpProxyModeDesc": "__MISSING__:Use HTTP_PROXY environment variable",
+    "systemWideMode": "__MISSING__:System-wide",
+    "systemWideModeDesc": "__MISSING__:Intercept all system traffic (advanced)",
+    "tproxyMode": "__MISSING__:TPROXY Decrypt",
+    "tproxyModeUnavailable": "__MISSING__:TPROXY decrypt requires Linux + root + the native addon",
+    "filterBarTitle": "__MISSING__:Filters",
+    "profileLlmOnly": "__MISSING__:LLM only",
+    "profileCustom": "__MISSING__:Custom",
+    "profileAll": "__MISSING__:All",
+    "filterHost": "__MISSING__:Filter host…",
+    "filterAgent": "__MISSING__:Agent",
+    "filterStatus": "__MISSING__:Status",
+    "pauseBtn": "__MISSING__:Pause",
+    "resumeBtn": "__MISSING__:Resume",
+    "clearBtn": "__MISSING__:Clear",
+    "exportHar": "__MISSING__:Export .har",
+    "recordSession": "__MISSING__:REC",
+    "stopSession": "__MISSING__:Stop",
+    "liveBadge": "__MISSING__:live",
+    "offlineBadge": "__MISSING__:offline",
+    "noRequests": "__MISSING__:No requests captured yet.",
+    "noRequestsDesc": "__MISSING__:Make sure AgentBridge is running or enable another capture mode.",
+    "selectRequest": "__MISSING__:Select a request to inspect it.",
+    "tabConversation": "__MISSING__:Conversation",
+    "tabHeaders": "__MISSING__:Headers",
+    "tabRequest": "__MISSING__:Request",
+    "tabResponse": "__MISSING__:Response",
+    "tabTiming": "__MISSING__:Timing",
+    "tabLlm": "__MISSING__:LLM",
+    "tabStats": "__MISSING__:Stats",
+    "requestHeaders": "__MISSING__:Request Headers",
+    "responseHeaders": "__MISSING__:Response Headers",
+    "rawEvents": "__MISSING__:Raw events",
+    "mergedView": "__MISSING__:Merged view",
+    "noBody": "__MISSING__:No body.",
+    "streaming": "__MISSING__:streaming…",
+    "manageHosts": "__MISSING__:Manage hosts",
+    "copySnippet": "__MISSING__:Copy proxy snippet",
+    "addHost": "__MISSING__:Add",
+    "hostPlaceholder": "__MISSING__:api.openai.com",
+    "noHostsYet": "__MISSING__:No custom hosts added yet.",
+    "noSessionsYet": "__MISSING__:No sessions yet",
+    "allTraffic": "__MISSING__:All traffic (no session)",
+    "sessionsDropdown": "__MISSING__:Sessions",
+    "annotationPlaceholder": "__MISSING__:Add a note…",
+    "contextFingerprint": "__MISSING__:Context fingerprint",
+    "llmProvider": "__MISSING__:Detected provider",
+    "llmApiKind": "__MISSING__:API kind",
+    "llmModel": "__MISSING__:Model",
+    "llmMessages": "__MISSING__:Messages",
+    "llmStream": "__MISSING__:Stream",
+    "llmMappedTo": "__MISSING__:Mapped to",
+    "llmCostEstimate": "__MISSING__:Cost estimate",
+    "systemProxyExitWarning": "__MISSING__:System-wide proxy still active — leave page anyway?",
+    "customHostsTitle": "__MISSING__:Custom Hosts",
+    "loading": "__MISSING__:Loading…",
+    "copied": "__MISSING__:Copied!",
+    "copy": "__MISSING__:Copy",
+    "httpProxyTitle": "__MISSING__:HTTP Proxy Snippet — port {port}",
+    "notRecording": "__MISSING__:Not recording",
+    "anyStatus": "__MISSING__:Any status",
+    "liveOnly": "__MISSING__:Live",
+    "viewingRecordedSession": "__MISSING__:Viewing recorded session",
+    "backToLive": "__MISSING__:Back to live",
+    "untitledSession": "__MISSING__:Untitled session",
+    "contextHistory": "__MISSING__:Context History",
+    "modelResponse": "__MISSING__:Model Response",
+    "conversationNoMessages": "__MISSING__:No messages found in this request.",
+    "conversationNotAvailable": "__MISSING__:Conversation data not available. This may not be an LLM request or the body could not be parsed.",
+    "loadingCharts": "__MISSING__:Loading charts…",
+    "statsErrors": "__MISSING__:Errors",
+    "statsLatency": "__MISSING__:Latency (last 50 requests)",
+    "statsNoData": "__MISSING__:No requests yet. Start a session recording to capture data for stats.",
+    "statsStatusDistribution": "__MISSING__:Status distribution",
+    "statsSuccessful": "__MISSING__:Successful",
+    "statsTotalRequests": "__MISSING__:Total requests",
+    "timingProxyOverhead": "__MISSING__:Proxy overhead",
+    "timingUpstreamResponse": "__MISSING__:Upstream response",
+    "timingNoData": "__MISSING__:No timing data available.",
+    "timingTotalLatency": "__MISSING__:Total latency",
+    "timingTimestamp": "__MISSING__:Timestamp",
+    "timingMethod": "__MISSING__:Method",
+    "timingStatus": "__MISSING__:Status",
+    "timingRequestSize": "__MISSING__:Request size",
+    "timingResponseSize": "__MISSING__:Response size",
+    "pausedNewBadge": "__MISSING__:{count} new",
+    "clearContextFilter": "__MISSING__:clear"
+  },
+  "cliCommon": {
+    "concept": {
+      "code": {
+        "title": "__MISSING__:CLI Code",
+        "phrase": "__MISSING__:Code tools you point at OmniRoute",
+        "flow": "__MISSING__:You → CLI Code → OmniRoute → Provider",
+        "seeOther": "__MISSING__:See →"
+      },
+      "agent": {
+        "title": "__MISSING__:CLI Agents",
+        "phrase": "__MISSING__:Broad-purpose autonomous CLI agents you point at OmniRoute",
+        "flow": "__MISSING__:You → CLI Agent → OmniRoute → Provider",
+        "seeOther": "__MISSING__:See →"
+      },
+      "acp": {
+        "title": "__MISSING__:ACP Agents",
+        "phrase": "__MISSING__:CLIs that OmniRoute spawns as execution backend (reverse flow)",
+        "flow": "__MISSING__:Client → OmniRoute → spawn CLI (stdio/ACP) → response",
+        "seeOther": "__MISSING__:See →"
+      }
+    },
+    "comparison": {
+      "title": "__MISSING__:Understand the 3 CLI types in OmniRoute",
+      "thisPage": "__MISSING__:This page",
+      "open": "__MISSING__:Open →",
+      "code": {
+        "title": "__MISSING__:Code tool",
+        "desc": "__MISSING__:Points to Omni",
+        "flow": "__MISSING__:you → CLI → Omni → provider",
+        "examples": "__MISSING__:e.g.: claude, codex"
+      },
+      "agent": {
+        "title": "__MISSING__:Broad autonomous agent",
+        "desc": "__MISSING__:Points to Omni",
+        "flow": "__MISSING__:you → agent → Omni",
+        "examples": "__MISSING__:e.g.: hermes, goose"
+      },
+      "acp": {
+        "title": "__MISSING__:CLI used as backend by Omni",
+        "desc": "__MISSING__:Reverse execution",
+        "flow": "__MISSING__:Omni → spawn CLI → resp",
+        "examples": "__MISSING__:e.g.: claude, codex (ACP)"
+      }
+    },
+    "card": {
+      "detected": "__MISSING__:Detected",
+      "notDetected": "__MISSING__:Not detected",
+      "configured": "__MISSING__:Configured",
+      "notConfigured": "__MISSING__:Not configured",
+      "configure": "__MISSING__:Configure →",
+      "howToInstall": "__MISSING__:How to install →",
+      "manualConfig": "__MISSING__:Manual config",
+      "installGuide": "__MISSING__:Install guide",
+      "endpointLabel": "__MISSING__:Endpoint",
+      "baseUrlFull": "__MISSING__:Full Base URL",
+      "baseUrlPartial": "__MISSING__:Partial Base URL",
+      "refreshDetection": "__MISSING__:Refresh detection",
+      "alsoAcp": "__MISSING__:also ACP",
+      "connectProviderHint": "__MISSING__:Connect a provider in Providers"
+    },
+    "detail": {
+      "back": "__MISSING__:Back",
+      "apply": "__MISSING__:Save",
+      "reset": "__MISSING__:Clear",
+      "manualConfig": "__MISSING__:Manual configuration",
+      "vendor": "__MISSING__:Vendor",
+      "category": "__MISSING__:Type",
+      "detectionStatus": "__MISSING__:Detection",
+      "configStatus": "__MISSING__:Configuration",
+      "baseUrlLabel": "__MISSING__:Base URL",
+      "apiKeyLabel": "__MISSING__:API Key",
+      "modelMappingLabel": "__MISSING__:Model mapping",
+      "noActiveProviders": "__MISSING__:No active providers.",
+      "noActiveProvidersDesc": "__MISSING__:Go to Providers to connect at least 1 provider before configuring the CLI.",
+      "openProviders": "__MISSING__:Open Providers →"
+    }
+  },
+  "cliCode": {
+    "pageTitle": "__MISSING__:CLI Code's",
+    "pageSubtitle": "__MISSING__:Code tools pointing to OmniRoute",
+    "searchPlaceholder": "__MISSING__:Search CLI…",
+    "filterDetectionLabel": "__MISSING__:Detection",
+    "filterBaseUrlLabel": "__MISSING__:Base URL",
+    "detectionAll": "__MISSING__:All",
+    "detectionInstalled": "__MISSING__:Installed",
+    "detectionNotFound": "__MISSING__:Not found",
+    "baseUrlAll": "__MISSING__:All",
+    "baseUrlFull": "__MISSING__:Full",
+    "baseUrlPartial": "__MISSING__:Partial"
+  },
+  "cliAgents": {
+    "pageTitle": "__MISSING__:CLI Agents",
+    "pageSubtitle": "__MISSING__:Broad-purpose autonomous CLI agents",
+    "refreshDetection": "__MISSING__:Refresh detection",
+    "searchPlaceholder": "__MISSING__:Search agent…",
+    "detectionFilterLabel": "__MISSING__:Detection",
+    "detectionAll": "__MISSING__:All",
+    "detectionInstalled": "__MISSING__:Installed",
+    "detectionNotInstalled": "__MISSING__:Not installed",
+    "visibleCount": "__MISSING__:{count} visible",
+    "emptyState": "__MISSING__:No CLI agents found with the current filters."
+  },
+  "acpAgents": {
+    "pageTitle": "__MISSING__:ACP Agents",
+    "pageSubtitle": "__MISSING__:CLIs that OmniRoute spawns as execution backend",
+    "scanning": "__MISSING__:Detecting agents…",
+    "refresh": "__MISSING__:Refresh",
+    "setupGuideTitle": "__MISSING__:Setup guide",
+    "setupGuideDetectCliTitle": "__MISSING__:Detect CLI",
+    "setupGuideDetectCliDesc": "__MISSING__:Agents are identified by running the --version command in PATH.",
+    "setupGuideCustomAgentTitle": "__MISSING__:Add custom agent",
+    "setupGuideCustomAgentDesc": "__MISSING__:Fill in the form below to register a custom CLI agent.",
+    "setupGuideCommandMissingTitle": "__MISSING__:Command not found",
+    "setupGuideCommandMissingDesc": "__MISSING__:Check that the binary is in PATH.",
+    "fingerprintSettingsHint": "__MISSING__:Configure routing and fingerprints in",
+    "settingsRoutingLink": "__MISSING__:Settings → Routing",
+    "installed": "__MISSING__:Installed",
+    "notFound": "__MISSING__:Not found",
+    "builtIn": "__MISSING__:Built-in",
+    "custom": "__MISSING__:Custom",
+    "agentUseCaseHint": "__MISSING__:Available for spawn via ACP.",
+    "remove": "__MISSING__:Remove",
+    "addCustomAgent": "__MISSING__:Add custom agent",
+    "addCustomAgentDesc": "__MISSING__:Register a custom CLI agent to be spawned via ACP.",
+    "addAgent": "__MISSING__:Add agent",
+    "agentName": "__MISSING__:Name",
+    "agentNamePlaceholder": "__MISSING__:e.g.: My Agent",
+    "binaryName": "__MISSING__:Binary",
+    "binaryNamePlaceholder": "__MISSING__:e.g.: myagent",
+    "versionCommand": "__MISSING__:Version command",
+    "versionCommandPlaceholder": "__MISSING__:e.g.: myagent --version",
+    "spawnArgs": "__MISSING__:Spawn arguments",
+    "spawnArgsPlaceholder": "__MISSING__:e.g.: --quiet, --json",
+    "cliCodeRedirectCta": "__MISSING__:Open CLI Code"
+  },
+  "agentSkills": {
+    "pageTitle": "__MISSING__:Agent Skills",
+    "pageSubtitle": "__MISSING__:Teach your agent to operate OmniRoute — 22 API areas + 20 CLI families",
+    "conceptCard": {
+      "agent": {
+        "title": "__MISSING__:Agent Skills — Outbound",
+        "description": "__MISSING__:Agent Skills are machine-readable SKILL.md documents that external AI agents (Claude Code, Cursor, Copilot…) fetch from GitHub to learn how to operate OmniRoute via REST or CLI. They are read by the agent, not executed by OmniRoute.",
+        "crossLinkLabel": "__MISSING__:Understand the difference →"
+      },
+      "omni": {
+        "title": "__MISSING__:Omni Skills — Inbound",
+        "description": "__MISSING__:Omni Skills are sandbox tools that OmniRoute injects into the model's context on every request. They are executed by OmniRoute, not read by the agent.",
+        "crossLinkLabel": "__MISSING__:Understand the difference →"
+      },
+      "comparison": {
+        "colAgent": "__MISSING__:Agent Skills",
+        "colOmni": "__MISSING__:Omni Skills",
+        "whatIs": {
+          "label": "__MISSING__:What it is",
+          "agent": "__MISSING__:Machine-readable SKILL.md that teaches an external agent to operate OmniRoute",
+          "omni": "__MISSING__:Executable tools that OmniRoute injects as tools into LLM requests"
+        },
+        "direction": {
+          "label": "__MISSING__:Direction",
+          "agent": "__MISSING__:Outbound — external agent learns to control OmniRoute",
+          "omni": "__MISSING__:Inbound — OmniRoute gives tools to models passing through it"
+        },
+        "executor": {
+          "label": "__MISSING__:Executor",
+          "agent": "__MISSING__:External agent (reads markdown → acts via API/CLI)",
+          "omni": "__MISSING__:OmniRoute itself (intercepts tool_calls, Docker sandbox)"
+        },
+        "storage": {
+          "label": "__MISSING__:Storage",
+          "agent": "__MISSING__:Dynamic catalog (/api/agent-skills) → SKILL.md on GitHub",
+          "omni": "__MISSING__:SQLite (SkillsMP / skills.sh / local)"
+        },
+        "tagline": {
+          "label": "__MISSING__:Tagline",
+          "agent": "__MISSING__:Teach your agent to use OmniRoute",
+          "omni": "__MISSING__:Give executable tools to OmniRoute models"
+        }
+      }
+    },
+    "filters": {
+      "category": "__MISSING__:Category",
+      "area": "__MISSING__:Area",
+      "searchPlaceholder": "__MISSING__:Search skills…"
+    },
+    "categoryApi": "__MISSING__:API",
+    "categoryCli": "__MISSING__:CLI",
+    "categoryConfig": "__MISSING__:Config",
+    "filterAll": "__MISSING__:All",
+    "coverageLabel": "__MISSING__:Coverage",
+    "mcpUrl": "__MISSING__:MCP URL",
+    "a2aLink": "__MISSING__:A2A",
+    "copyUrl": "__MISSING__:Copy URL",
+    "viewOnGithub": "__MISSING__:View on GitHub",
+    "previewLoading": "__MISSING__:Loading skill documentation…",
+    "previewError": "__MISSING__:Failed to load skill documentation.",
+    "previewEmpty": "__MISSING__:Select a skill to preview its documentation.",
+    "generateButton": "__MISSING__:Generate missing skills",
+    "coverageBar": {
+      "complete": "__MISSING__:Complete",
+      "partial": "__MISSING__:Partial"
+    },
+    "noSkillsFound": "__MISSING__:No skills found matching your filters.",
+    "regenerateConfirm": "__MISSING__:This will regenerate all missing SKILL.md files. Continue?",
+    "regenerateRunning": "__MISSING__:Regenerating skills…",
+    "regenerateSuccess": "__MISSING__:Skills regenerated successfully.",
+    "regenerateError": "__MISSING__:Failed to regenerate skills."
+  },
+  "freeProviderRankingsPage": {
+    "title": "__MISSING__:Free Provider Rankings",
+    "subtitle": "__MISSING__:Best free providers ranked by model ELO scores from Arena AI leaderboards",
+    "loading": "__MISSING__:Loading rankings...",
+    "errorLoading": "__MISSING__:Failed to load rankings",
+    "emptyState": "__MISSING__:No rankings available yet. Arena ELO data syncs on startup (daily) — check back shortly, or trigger a manual sync. Disable Arena ELO Sync in Feature Flags or set ARENA_ELO_SYNC_ENABLED=false to opt out.",
+    "bestModel": "__MISSING__:Best",
+    "allCategories": "__MISSING__:All Categories",
+    "categoryDefault": "__MISSING__:Default",
+    "categoryCoding": "__MISSING__:Coding",
+    "categoryReview": "__MISSING__:Review",
+    "categoryDocumentation": "__MISSING__:Documentation",
+    "categoryDebugging": "__MISSING__:Debugging",
+    "colRank": "__MISSING__:Rank",
+    "colProvider": "__MISSING__:Provider",
+    "colTopModel": "__MISSING__:Top Model",
+    "colScore": "__MISSING__:Score",
+    "colAvgScore": "__MISSING__:Avg Score",
+    "colModels": "__MISSING__:Models",
+    "colType": "__MISSING__:Type"
   }
 }
diff --git a/src/i18n/messages/sw.json b/src/i18n/messages/sw.json
index 00acd2411a..33848e6d30 100644
--- a/src/i18n/messages/sw.json
+++ b/src/i18n/messages/sw.json
@@ -3002,7 +3002,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
diff --git a/src/i18n/messages/ta.json b/src/i18n/messages/ta.json
index e6bed4b692..f53df2e3e8 100644
--- a/src/i18n/messages/ta.json
+++ b/src/i18n/messages/ta.json
@@ -3002,7 +3002,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
diff --git a/src/i18n/messages/te.json b/src/i18n/messages/te.json
index ee8e024ad0..a63e5289d0 100644
--- a/src/i18n/messages/te.json
+++ b/src/i18n/messages/te.json
@@ -3002,7 +3002,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
diff --git a/src/i18n/messages/th.json b/src/i18n/messages/th.json
index fa94375af9..080bb543c9 100644
--- a/src/i18n/messages/th.json
+++ b/src/i18n/messages/th.json
@@ -3002,7 +3002,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
diff --git a/src/i18n/messages/tr.json b/src/i18n/messages/tr.json
index dde378eae3..bc8585b0ad 100644
--- a/src/i18n/messages/tr.json
+++ b/src/i18n/messages/tr.json
@@ -3002,7 +3002,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Uç Nokta Proxy",
diff --git a/src/i18n/messages/uk-UA.json b/src/i18n/messages/uk-UA.json
index 37009a0c67..635d8bfd28 100644
--- a/src/i18n/messages/uk-UA.json
+++ b/src/i18n/messages/uk-UA.json
@@ -2999,7 +2999,10 @@
     "tierAlwaysProtected": "Завжди захищені",
     "tierPublic": "Публічні",
     "hideInternal": "Приховати внутрішні",
-    "showInternal": "Показати внутрішні"
+    "showInternal": "Показати внутрішні",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
diff --git a/src/i18n/messages/ur.json b/src/i18n/messages/ur.json
index 7d51f3dcee..55897a3938 100644
--- a/src/i18n/messages/ur.json
+++ b/src/i18n/messages/ur.json
@@ -3002,7 +3002,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
diff --git a/src/i18n/messages/vi.json b/src/i18n/messages/vi.json
index ca8aa5d923..448757df58 100644
--- a/src/i18n/messages/vi.json
+++ b/src/i18n/messages/vi.json
@@ -3002,7 +3002,10 @@
     "tierAlwaysProtected": "__MISSING__:Always Protected",
     "tierPublic": "__MISSING__:Public",
     "hideInternal": "__MISSING__:Hide Internal",
-    "showInternal": "__MISSING__:Show Internal"
+    "showInternal": "__MISSING__:Show Internal",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
   },
   "endpoints": {
     "tabProxy": "Endpoint Proxy",
diff --git a/src/i18n/messages/zh-CN.json b/src/i18n/messages/zh-CN.json
index 9871778a9a..393e959fb7 100644
--- a/src/i18n/messages/zh-CN.json
+++ b/src/i18n/messages/zh-CN.json
@@ -3081,6 +3081,9 @@
     "tierPublic": "公开",
     "hideInternal": "隐藏内部端点",
     "showInternal": "显示内部端点",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak...",
     "vscodeAliasTitle": "VS Code 令牌别名",
     "vscodeAliasDescriptionReady": "使用 /api/v1/vscode/TOKEN/... 接口的可粘贴兼容性 URL。",
     "vscodeAliasDescriptionError": "由于当前会话无法加载 CLI 密钥，正在显示占位符 URL。",
diff --git a/src/instrumentation-node.ts b/src/instrumentation-node.ts
index 32debc0f35..30f79f8f59 100755
--- a/src/instrumentation-node.ts
+++ b/src/instrumentation-node.ts
@@ -276,6 +276,18 @@ export async function registerNodejs(): Promise<void> {
       console.warn("[STARTUP] Auto-refresh daemon failed to start (non-fatal):", msg);
     }
 
+    // Proactive connection-cooldown recovery (#8): re-validate connections whose
+    // transient `rate_limited_until` window has elapsed OUTSIDE the request hot
+    // path, so the first request after a cooldown does not pay the probe latency.
+    // Lazy/self-recovery still happens in getProviderCredentials; this front-runs it.
+    try {
+      const { initConnectionRecoveryScheduler } = await import("@/lib/quota/connectionRecovery");
+      initConnectionRecoveryScheduler();
+    } catch (err: unknown) {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.warn("[STARTUP] Connection recovery scheduler failed to start (non-fatal):", msg);
+    }
+
     try {
       // Arena ELO sync: model intelligence from the Arena AI leaderboard, powering the
       // Free Provider Rankings page. On by default; configurable from Dashboard Feature Flags.
diff --git a/src/lib/api/comboErrorResponse.ts b/src/lib/api/comboErrorResponse.ts
new file mode 100644
index 0000000000..11436ca0ba
--- /dev/null
+++ b/src/lib/api/comboErrorResponse.ts
@@ -0,0 +1,80 @@
+/**
+ * Combo API error helper (T-22.b).
+ *
+ * Standardizes the 400/404/409 response shape for `/api/combos/*` routes.
+ * Every failure surfaces a stable machine-readable `code` token (from
+ * `src/shared/constants/errorCodes.ts`), a human-readable `message`, an
+ * optional `details` payload, and the current `requestId` for log
+ * correlation. The prior shape returned `{ error: <string|object> }` with
+ * no `code` field, which forced clients to string-match English error
+ * messages. See `plans/2026-06-23-omniroute-v3.8.34-deep-audit.md` (Bug #3).
+ *
+ * Usage:
+ *   return comboErrorResponse("COMBO_002", 400, { issues: validation.issues });
+ *   return comboErrorResponse("COMBO_005", 400, { reason: "cycle-detected" });
+ *
+ * The response is a plain `Response` (not `NextResponse.json`) so it can
+ * be used from both Next.js route handlers and server-side callers. The
+ * `x-request-id` header is also attached for downstream log correlation.
+ */
+
+import { ERROR_CODES } from "@/shared/constants/errorCodes";
+import {
+  attachRequestIdToResponse,
+  getRequestId,
+} from "@/shared/utils/requestId";
+
+export type ComboErrorCode =
+  | "COMBO_001" // request body is not valid JSON
+  | "COMBO_002" // zod schema failure
+  | "COMBO_003" // composite tier config invalid
+  | "COMBO_004" // name collision
+  | "COMBO_005" // DAG cycle / depth overflow
+  | "COMBO_006" // managed by Quota Share (409)
+  | "COMBO_007" // not found (404)
+  | "VALID_001" // generic invalid body
+  | "VALID_002" // missing required field
+  | "INTERNAL_001"; // fallback
+
+export interface ComboErrorBody {
+  error: {
+    code: ComboErrorCode;
+    message: string;
+    category: string;
+    details?: unknown;
+    requestId?: string;
+  };
+}
+
+export function buildComboErrorBody(
+  code: ComboErrorCode,
+  details?: unknown
+): ComboErrorBody {
+  const def = ERROR_CODES[code] ?? ERROR_CODES.INTERNAL_001;
+  const requestId = getRequestId();
+  return {
+    error: {
+      code: def.code as ComboErrorCode,
+      message: def.message,
+      category: def.category,
+      ...(details !== undefined ? { details } : {}),
+      ...(requestId ? { requestId } : {}),
+    },
+  };
+}
+
+export function comboErrorResponse(
+  code: ComboErrorCode,
+  status?: number,
+  details?: unknown,
+  request?: Request
+): Response {
+  const def = ERROR_CODES[code] ?? ERROR_CODES.INTERNAL_001;
+  const httpStatus = status ?? def.httpStatus;
+  const body = buildComboErrorBody(code, details);
+  const response = Response.json(body, { status: httpStatus });
+  // Attach x-request-id header for downstream consumers. If a request is
+  // passed, prefer to derive its id (works outside withRequestId scope);
+  // otherwise the response body already carries requestId when available.
+  return request ? attachRequestIdToResponse(request, response) : response;
+}
diff --git a/src/lib/copilot/tools.ts b/src/lib/copilot/tools.ts
index 4f60a8b872..2ebf72e2da 100644
--- a/src/lib/copilot/tools.ts
+++ b/src/lib/copilot/tools.ts
@@ -5,7 +5,11 @@
  * query the codebase via CodeGraph, and execute CLI commands for full control.
  */
 
-import { execSync } from "node:child_process";
+import { execFile, execSync } from "node:child_process";
+import { promisify } from "node:util";
+import { sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
+
+const execFileAsync = promisify(execFile);
 import { createCombo, getCombos, updateCombo } from "@/lib/db/combos";
 import { getProviderConnections } from "@/lib/db/providers";
 import { createApiKey, revokeApiKey, getApiKeys } from "@/lib/db/apiKeys";
@@ -381,15 +385,20 @@ export const COPILOT_TOOLS: CopilotTool[] = [
       if (!cliPath) return "omniroute CLI not found in PATH. Install OmniRoute first.";
 
       try {
-        const output = execSync(`omniroute ${cmd}`, {
+        const trimmedCmd = cmd.trim();
+        if (!trimmedCmd) return "Please provide a command to execute.";
+        const argv = (trimmedCmd.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || []).map((arg) =>
+          arg.replace(/^["']|["']$/g, "")
+        );
+        const { stdout } = await execFileAsync(cliPath, argv, {
           encoding: "utf-8",
           timeout: 30000,
           maxBuffer: 1024 * 1024,
         });
-        return `\`\`\`\n${output.trim()}\n\`\`\``;
+        return `\`\`\`\n${stdout.trim()}\n\`\`\``;
       } catch (err: unknown) {
         const e = err as { stderr?: string; stdout?: string; message?: string };
-        return `Error executing CLI command:\n${e.stderr || e.stdout || e.message || "Unknown error"}`;
+        return `Error executing CLI command:\n${sanitizeErrorMessage(e.stderr || e.stdout || e.message || "Unknown error")}`;
       }
     },
   },
diff --git a/src/lib/db/apiKeys.ts b/src/lib/db/apiKeys.ts
index 810ca53300..7d76f99296 100644
--- a/src/lib/db/apiKeys.ts
+++ b/src/lib/db/apiKeys.ts
@@ -17,6 +17,34 @@ import {
 import { setNoLog } from "../compliance/noLog";
 import { resolveModelAlias } from "@omniroute/open-sse/services/modelDeprecation.ts";
 import { getSyncedAvailableModelsByConnection, getCustomModels, getModelIsHidden } from "./models";
+import {
+  CLAUDE_CODE_PROVIDER_PREFIXES,
+  preferClaudeCodeForUnprefixedClaudeModels,
+  stripExtendedContextSuffix,
+  isPotentialUnprefixedClaudeCodeModel,
+  addModelCandidate,
+  modelPatternMatches,
+  hasClaudeCodeWildcardPermission,
+  matchesWildcardPattern,
+} from "./apiKeys/modelPermissions";
+import {
+  parseAllowedModels,
+  parseAllowedCombos,
+  parseNoLog,
+  parseAutoResolve,
+  parseDisableNonPublicModels,
+  parseAllowUsageCommand,
+  parseIsActive,
+  parseAccessSchedule,
+  parseRateLimits,
+  parseAllowedConnections,
+  parseAllowedQuotas,
+  parseStringList,
+  parseNullableTimestamp,
+  parseIsBanned,
+  parseStreamDefaultMode,
+} from "./apiKeys/rowParsers";
+import type { AccessSchedule, RateLimitRule } from "./apiKeys/types";
 
 // ──────────────── Performance Optimizations ────────────────
 
@@ -30,18 +58,8 @@ interface CacheEntry<TValue> {
   value: TValue;
 }
 
-export interface RateLimitRule {
-  limit: number;
-  window: number;
-}
-
-export interface AccessSchedule {
-  enabled: boolean;
-  from: string;
-  until: string;
-  days: number[];
-  tz: string;
-}
+// Re-exported for the historical public surface (moved to ./apiKeys/types).
+export type { AccessSchedule, RateLimitRule } from "./apiKeys/types";
 
 interface ApiKeyMetadata {
   id: string;
@@ -171,8 +189,6 @@ const _lastUsedUpdateCache = new Map<string, number>();
 const CACHE_TTL = 60 * 1000; // 1 minute TTL
 const LAST_USED_UPDATE_TTL = 5 * 60 * 1000;
 const MAX_CACHE_SIZE = 1000;
-const CLAUDE_CODE_PROVIDER_PREFIXES = new Set(["cc", "claude"]);
-const CLAUDE_CODE_SHORT_ALIASES = new Set(["sonnet", "opus", "haiku", "fable"]);
 
 // Wildcard scope matching is now handled by `matchesWildcardPattern`
 // (deterministic, no RegExp from dynamic strings).
@@ -269,39 +285,6 @@ function evictIfNeeded<TKey, TValue>(cache: Map<TKey, TValue>) {
   }
 }
 
-function isTruthyEnvFlag(value: string | undefined): boolean {
-  return typeof value === "string" && /^(1|true|yes|on)$/i.test(value.trim());
-}
-
-async function preferClaudeCodeForUnprefixedClaudeModels(): Promise<boolean> {
-  try {
-    const { getCachedSettings } = await import("./readCache");
-    const settings = await getCachedSettings();
-    if (typeof settings.preferClaudeCodeForUnprefixedClaudeModels === "boolean") {
-      return settings.preferClaudeCodeForUnprefixedClaudeModels;
-    }
-  } catch {
-    // Standalone DB usage may not have the settings cache ready.
-  }
-  return isTruthyEnvFlag(process.env.OMNIROUTE_PREFER_CLAUDE_CODE_FOR_UNPREFIXED_CLAUDE_MODELS);
-}
-
-function stripExtendedContextSuffix(modelId: string): string {
-  return modelId.endsWith("[1m]") ? modelId.slice(0, -4) : modelId;
-}
-
-function isPotentialUnprefixedClaudeCodeModel(modelId: string): boolean {
-  const clean = stripExtendedContextSuffix(modelId.trim());
-  return /^claude-/i.test(clean) || CLAUDE_CODE_SHORT_ALIASES.has(clean.toLowerCase());
-}
-
-function addModelCandidate(candidates: Set<string>, modelId: string): void {
-  const clean = modelId.trim();
-  if (!clean) return;
-  candidates.add(clean);
-  candidates.add(stripExtendedContextSuffix(clean));
-}
-
 async function getModelPermissionCandidates(modelId: string): Promise<string[]> {
   const candidates = new Set<string>();
   addModelCandidate(candidates, modelId);
@@ -332,34 +315,6 @@ async function getModelPermissionCandidates(modelId: string): Promise<string[]>
   return Array.from(candidates);
 }
 
-function modelPatternMatches(pattern: string, candidates: string[]): boolean {
-  for (const candidate of candidates) {
-    if (pattern === candidate) return true;
-    if (pattern.endsWith("/*")) {
-      const prefix = pattern.slice(0, -2);
-      if (candidate.startsWith(prefix + "/") || candidate.startsWith(prefix)) {
-        return true;
-      }
-    }
-    if (pattern.includes("*") && matchesWildcardPattern(pattern, candidate)) {
-      return true;
-    }
-  }
-  return false;
-}
-
-function hasClaudeCodeWildcardPermission(
-  allowedModels: string[] | undefined,
-  candidates: string[]
-): boolean {
-  if (!allowedModels || allowedModels.length === 0) return false;
-  return allowedModels.some(
-    (pattern) =>
-      (pattern === "cc/*" || pattern === "claude/*") &&
-      candidates.some((candidate) => modelPatternMatches(pattern, [candidate]))
-  );
-}
-
 async function getPublishedModelLookupTarget(
   modelId: string
 ): Promise<{ providerId: string; modelId: string } | null> {
@@ -387,60 +342,6 @@ async function getPublishedModelLookupTarget(
   return null;
 }
 
-/**
- * Match an API-key wildcard scope pattern against a model id without
- * compiling a RegExp from string concatenation (avoid ReDoS exposure on
- * operator-supplied patterns and silence the Semgrep `js/regex-injection`
- * advisory for `new RegExp(<dynamic>)`).
- *
- * Supported pattern syntax (only what real scopes use):
- *   - literal segments
- *   - `*` matches any run of characters, but does NOT cross `/`
- *
- * Walks the pattern token-by-token: each `*` consumes the longest possible
- * run within the current path segment, then the next literal anchor must
- * appear before the segment boundary. Worst-case complexity is O(n*m)
- * where n = pattern length, m = candidate length — there is no nested
- * backtracking that could explode adversarially.
- */
-function matchesWildcardPattern(pattern: string, candidate: string): boolean {
-  const pSegs = pattern.split("/");
-  const cSegs = candidate.split("/");
-  if (pSegs.length !== cSegs.length) return false;
-  for (let i = 0; i < pSegs.length; i++) {
-    if (!segmentMatchesWildcard(pSegs[i], cSegs[i])) return false;
-  }
-  return true;
-}
-
-function segmentMatchesWildcard(pattern: string, segment: string): boolean {
-  if (pattern === segment) return true;
-  if (!pattern.includes("*")) return false;
-  const parts = pattern.split("*");
-  // Anchor first literal to the start.
-  let cursor = 0;
-  const first = parts[0];
-  if (first) {
-    if (!segment.startsWith(first)) return false;
-    cursor = first.length;
-  }
-  // Anchor last literal to the end.
-  const last = parts[parts.length - 1];
-  const endLimit = segment.length - last.length;
-  if (last) {
-    if (!segment.endsWith(last)) return false;
-  }
-  // Each middle literal must appear in order between cursor and endLimit.
-  for (let i = 1; i < parts.length - 1; i++) {
-    const piece = parts[i];
-    if (!piece) continue;
-    const idx = segment.indexOf(piece, cursor);
-    if (idx === -1 || idx + piece.length > endLimit) return false;
-    cursor = idx + piece.length;
-  }
-  return cursor <= endLimit;
-}
-
 function ensureApiKeyColumn(
   db: ApiKeysDbLike,
   columnNames: Set<string>,
@@ -584,156 +485,6 @@ export async function getApiKeyById(id: string) {
   return camelRow;
 }
 
-/**
- * Helper function to safely parse allowed_models JSON
- */
-function parseAllowedModels(value: unknown): string[] {
-  if (!value || typeof value !== "string" || value.trim() === "") {
-    return [];
-  }
-  try {
-    const parsed = JSON.parse(value);
-    return Array.isArray(parsed)
-      ? parsed.filter((entry): entry is string => typeof entry === "string")
-      : [];
-  } catch {
-    return [];
-  }
-}
-
-function parseAllowedCombos(value: unknown): string[] {
-  return parseStringList(value);
-}
-
-function parseNoLog(value: unknown): boolean {
-  return value === true || value === 1 || value === "1";
-}
-
-function parseAutoResolve(value: unknown): boolean {
-  return value === true || value === 1 || value === "1";
-}
-
-function parseDisableNonPublicModels(value: unknown): boolean {
-  return value === true || value === 1 || value === "1";
-}
-
-function parseAllowUsageCommand(value: unknown): boolean {
-  return value === true || value === 1 || value === "1";
-}
-
-function parseIsActive(value: unknown): boolean {
-  // DEFAULT 1 — active unless explicitly set to 0
-  if (value === 0 || value === "0" || value === false) return false;
-  return true;
-}
-
-function parseAccessSchedule(value: unknown): AccessSchedule | null {
-  if (!value || typeof value !== "string" || value.trim() === "") return null;
-  try {
-    const parsed: unknown = JSON.parse(value);
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-    const obj = parsed as Record<string, unknown>;
-    if (
-      typeof obj["enabled"] !== "boolean" ||
-      typeof obj["from"] !== "string" ||
-      typeof obj["until"] !== "string" ||
-      !Array.isArray(obj["days"]) ||
-      typeof obj["tz"] !== "string"
-    ) {
-      return null;
-    }
-    const days = (obj["days"] as unknown[]).filter(
-      (d): d is number => typeof d === "number" && Number.isInteger(d) && d >= 0 && d <= 6
-    );
-    return {
-      enabled: obj["enabled"],
-      from: obj["from"],
-      until: obj["until"],
-      days,
-      tz: obj["tz"],
-    };
-  } catch {
-    return null;
-  }
-}
-
-function parseRateLimits(value: unknown): RateLimitRule[] | null {
-  if (!value || typeof value !== "string" || value.trim() === "") return null;
-  try {
-    const parsed = JSON.parse(value);
-    if (!Array.isArray(parsed)) return null;
-    return parsed.filter(
-      (rule: RateLimitRule) =>
-        typeof rule === "object" &&
-        rule !== null &&
-        typeof rule.limit === "number" &&
-        typeof rule.window === "number"
-    ) as RateLimitRule[];
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Helper function to safely parse allowed_connections JSON
- */
-function parseAllowedConnections(value: unknown): string[] {
-  if (!value || typeof value !== "string" || value.trim() === "") {
-    return [];
-  }
-  try {
-    const parsed = JSON.parse(value);
-    return Array.isArray(parsed)
-      ? parsed.filter((entry): entry is string => typeof entry === "string")
-      : [];
-  } catch {
-    return [];
-  }
-}
-
-/**
- * Helper function to safely parse allowed_quotas JSON
- */
-function parseAllowedQuotas(value: unknown): string[] {
-  if (!value || typeof value !== "string" || value.trim() === "") {
-    return [];
-  }
-  try {
-    const parsed = JSON.parse(value);
-    return Array.isArray(parsed)
-      ? parsed.filter((entry): entry is string => typeof entry === "string")
-      : [];
-  } catch {
-    return [];
-  }
-}
-
-function parseStringList(value: unknown): string[] {
-  if (!value || typeof value !== "string" || value.trim() === "") return [];
-  try {
-    const parsed = JSON.parse(value);
-    return Array.isArray(parsed)
-      ? parsed.filter((entry): entry is string => typeof entry === "string")
-      : [];
-  } catch {
-    return [];
-  }
-}
-
-function parseNullableTimestamp(value: unknown): string | null {
-  if (typeof value !== "string") return null;
-  const trimmed = value.trim();
-  return trimmed === "" ? null : trimmed;
-}
-
-function parseIsBanned(value: unknown): boolean {
-  return value === 1 || value === "1" || value === true;
-}
-
-function parseStreamDefaultMode(value: unknown): "legacy" | "json" {
-  return value === "json" ? "json" : "legacy";
-}
-
 async function hashKey(key: string): Promise<string> {
   if (!key || typeof key !== "string") return "";
   // CodeQL: This is intentionally SHA-256, NOT password hashing. API keys are
diff --git a/src/lib/db/apiKeys/modelPermissions.ts b/src/lib/db/apiKeys/modelPermissions.ts
new file mode 100644
index 0000000000..336c81af43
--- /dev/null
+++ b/src/lib/db/apiKeys/modelPermissions.ts
@@ -0,0 +1,122 @@
+// API-key model-permission matching: Claude-Code alias/prefix resolution + wildcard/glob pattern
+// matching used to decide whether a model is permitted for a key. Pure logic (no DB) extracted from
+// db/apiKeys.ts (god-file decomposition); behavior is byte-identical to the original inline defs.
+
+export const CLAUDE_CODE_PROVIDER_PREFIXES = new Set(["cc", "claude"]);
+
+export const CLAUDE_CODE_SHORT_ALIASES = new Set(["sonnet", "opus", "haiku", "fable"]);
+
+export function isTruthyEnvFlag(value: string | undefined): boolean {
+  return typeof value === "string" && /^(1|true|yes|on)$/i.test(value.trim());
+}
+
+export async function preferClaudeCodeForUnprefixedClaudeModels(): Promise<boolean> {
+  try {
+    const { getCachedSettings } = await import("../readCache");
+    const settings = await getCachedSettings();
+    if (typeof settings.preferClaudeCodeForUnprefixedClaudeModels === "boolean") {
+      return settings.preferClaudeCodeForUnprefixedClaudeModels;
+    }
+  } catch {
+    // Standalone DB usage may not have the settings cache ready.
+  }
+  return isTruthyEnvFlag(process.env.OMNIROUTE_PREFER_CLAUDE_CODE_FOR_UNPREFIXED_CLAUDE_MODELS);
+}
+
+export function stripExtendedContextSuffix(modelId: string): string {
+  return modelId.endsWith("[1m]") ? modelId.slice(0, -4) : modelId;
+}
+
+export function isPotentialUnprefixedClaudeCodeModel(modelId: string): boolean {
+  const clean = stripExtendedContextSuffix(modelId.trim());
+  return /^claude-/i.test(clean) || CLAUDE_CODE_SHORT_ALIASES.has(clean.toLowerCase());
+}
+
+export function addModelCandidate(candidates: Set<string>, modelId: string): void {
+  const clean = modelId.trim();
+  if (!clean) return;
+  candidates.add(clean);
+  candidates.add(stripExtendedContextSuffix(clean));
+}
+
+export function modelPatternMatches(pattern: string, candidates: string[]): boolean {
+  for (const candidate of candidates) {
+    if (pattern === candidate) return true;
+    if (pattern.endsWith("/*")) {
+      const prefix = pattern.slice(0, -2);
+      if (candidate.startsWith(prefix + "/") || candidate.startsWith(prefix)) {
+        return true;
+      }
+    }
+    if (pattern.includes("*") && matchesWildcardPattern(pattern, candidate)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+export function hasClaudeCodeWildcardPermission(
+  allowedModels: string[] | undefined,
+  candidates: string[]
+): boolean {
+  if (!allowedModels || allowedModels.length === 0) return false;
+  return allowedModels.some(
+    (pattern) =>
+      (pattern === "cc/*" || pattern === "claude/*") &&
+      candidates.some((candidate) => modelPatternMatches(pattern, [candidate]))
+  );
+}
+
+/**
+ * Match an API-key wildcard scope pattern against a model id without
+ * compiling a RegExp from string concatenation (avoid ReDoS exposure on
+ * operator-supplied patterns and silence the Semgrep `js/regex-injection`
+ * advisory for `new RegExp(<dynamic>)`).
+ *
+ * Supported pattern syntax (only what real scopes use):
+ *   - literal segments
+ *   - `*` matches any run of characters, but does NOT cross `/`
+ *
+ * Walks the pattern token-by-token: each `*` consumes the longest possible
+ * run within the current path segment, then the next literal anchor must
+ * appear before the segment boundary. Worst-case complexity is O(n*m)
+ * where n = pattern length, m = candidate length — there is no nested
+ * backtracking that could explode adversarially.
+ */
+export function matchesWildcardPattern(pattern: string, candidate: string): boolean {
+  const pSegs = pattern.split("/");
+  const cSegs = candidate.split("/");
+  if (pSegs.length !== cSegs.length) return false;
+  for (let i = 0; i < pSegs.length; i++) {
+    if (!segmentMatchesWildcard(pSegs[i], cSegs[i])) return false;
+  }
+  return true;
+}
+
+export function segmentMatchesWildcard(pattern: string, segment: string): boolean {
+  if (pattern === segment) return true;
+  if (!pattern.includes("*")) return false;
+  const parts = pattern.split("*");
+  // Anchor first literal to the start.
+  let cursor = 0;
+  const first = parts[0];
+  if (first) {
+    if (!segment.startsWith(first)) return false;
+    cursor = first.length;
+  }
+  // Anchor last literal to the end.
+  const last = parts[parts.length - 1];
+  const endLimit = segment.length - last.length;
+  if (last) {
+    if (!segment.endsWith(last)) return false;
+  }
+  // Each middle literal must appear in order between cursor and endLimit.
+  for (let i = 1; i < parts.length - 1; i++) {
+    const piece = parts[i];
+    if (!piece) continue;
+    const idx = segment.indexOf(piece, cursor);
+    if (idx === -1 || idx + piece.length > endLimit) return false;
+    cursor = idx + piece.length;
+  }
+  return cursor <= endLimit;
+}
diff --git a/src/lib/db/apiKeys/rowParsers.ts b/src/lib/db/apiKeys/rowParsers.ts
new file mode 100644
index 0000000000..d087563b7e
--- /dev/null
+++ b/src/lib/db/apiKeys/rowParsers.ts
@@ -0,0 +1,161 @@
+/**
+ * db/apiKeys/rowParsers.ts — pure column parsers for persisted api_keys rows.
+ *
+ * Extracted verbatim from db/apiKeys.ts (god-file decomposition): the family of
+ * functions that coerce raw SQLite column values (JSON strings, 0/1 flags, nullable
+ * timestamps) into the typed shapes the host hydrates rows with. Pure — no DB handle,
+ * no caches, no side effects — so they live as a co-located leaf. Behavior-preserving
+ * move; apiKeys.ts imports them back for getApiKeys/getApiKeyById/getApiKeyMetadata.
+ */
+
+import type { AccessSchedule, RateLimitRule } from "./types";
+
+/**
+ * Helper function to safely parse allowed_models JSON
+ */
+export function parseAllowedModels(value: unknown): string[] {
+  if (!value || typeof value !== "string" || value.trim() === "") {
+    return [];
+  }
+  try {
+    const parsed = JSON.parse(value);
+    return Array.isArray(parsed)
+      ? parsed.filter((entry): entry is string => typeof entry === "string")
+      : [];
+  } catch {
+    return [];
+  }
+}
+
+export function parseAllowedCombos(value: unknown): string[] {
+  return parseStringList(value);
+}
+
+export function parseNoLog(value: unknown): boolean {
+  return value === true || value === 1 || value === "1";
+}
+
+export function parseAutoResolve(value: unknown): boolean {
+  return value === true || value === 1 || value === "1";
+}
+
+export function parseDisableNonPublicModels(value: unknown): boolean {
+  return value === true || value === 1 || value === "1";
+}
+
+export function parseAllowUsageCommand(value: unknown): boolean {
+  return value === true || value === 1 || value === "1";
+}
+
+export function parseIsActive(value: unknown): boolean {
+  // DEFAULT 1 — active unless explicitly set to 0
+  if (value === 0 || value === "0" || value === false) return false;
+  return true;
+}
+
+export function parseAccessSchedule(value: unknown): AccessSchedule | null {
+  if (!value || typeof value !== "string" || value.trim() === "") return null;
+  try {
+    const parsed: unknown = JSON.parse(value);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+    const obj = parsed as Record<string, unknown>;
+    if (
+      typeof obj["enabled"] !== "boolean" ||
+      typeof obj["from"] !== "string" ||
+      typeof obj["until"] !== "string" ||
+      !Array.isArray(obj["days"]) ||
+      typeof obj["tz"] !== "string"
+    ) {
+      return null;
+    }
+    const days = (obj["days"] as unknown[]).filter(
+      (d): d is number => typeof d === "number" && Number.isInteger(d) && d >= 0 && d <= 6
+    );
+    return {
+      enabled: obj["enabled"],
+      from: obj["from"],
+      until: obj["until"],
+      days,
+      tz: obj["tz"],
+    };
+  } catch {
+    return null;
+  }
+}
+
+export function parseRateLimits(value: unknown): RateLimitRule[] | null {
+  if (!value || typeof value !== "string" || value.trim() === "") return null;
+  try {
+    const parsed = JSON.parse(value);
+    if (!Array.isArray(parsed)) return null;
+    return parsed.filter(
+      (rule: RateLimitRule) =>
+        typeof rule === "object" &&
+        rule !== null &&
+        typeof rule.limit === "number" &&
+        typeof rule.window === "number"
+    ) as RateLimitRule[];
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Helper function to safely parse allowed_connections JSON
+ */
+export function parseAllowedConnections(value: unknown): string[] {
+  if (!value || typeof value !== "string" || value.trim() === "") {
+    return [];
+  }
+  try {
+    const parsed = JSON.parse(value);
+    return Array.isArray(parsed)
+      ? parsed.filter((entry): entry is string => typeof entry === "string")
+      : [];
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Helper function to safely parse allowed_quotas JSON
+ */
+export function parseAllowedQuotas(value: unknown): string[] {
+  if (!value || typeof value !== "string" || value.trim() === "") {
+    return [];
+  }
+  try {
+    const parsed = JSON.parse(value);
+    return Array.isArray(parsed)
+      ? parsed.filter((entry): entry is string => typeof entry === "string")
+      : [];
+  } catch {
+    return [];
+  }
+}
+
+export function parseStringList(value: unknown): string[] {
+  if (!value || typeof value !== "string" || value.trim() === "") return [];
+  try {
+    const parsed = JSON.parse(value);
+    return Array.isArray(parsed)
+      ? parsed.filter((entry): entry is string => typeof entry === "string")
+      : [];
+  } catch {
+    return [];
+  }
+}
+
+export function parseNullableTimestamp(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed === "" ? null : trimmed;
+}
+
+export function parseIsBanned(value: unknown): boolean {
+  return value === 1 || value === "1" || value === true;
+}
+
+export function parseStreamDefaultMode(value: unknown): "legacy" | "json" {
+  return value === "json" ? "json" : "legacy";
+}
diff --git a/src/lib/db/apiKeys/types.ts b/src/lib/db/apiKeys/types.ts
new file mode 100644
index 0000000000..edcda074c6
--- /dev/null
+++ b/src/lib/db/apiKeys/types.ts
@@ -0,0 +1,21 @@
+/**
+ * db/apiKeys/types.ts — shared API-key value types.
+ *
+ * Extracted from db/apiKeys.ts (god-file decomposition): the persisted-row shapes
+ * that both the host module and the row-parser leaf need. Kept as a neutral leaf so
+ * apiKeys.ts and apiKeys/rowParsers.ts can import them without a cycle. apiKeys.ts
+ * re-exports both interfaces to preserve its historical public surface.
+ */
+
+export interface RateLimitRule {
+  limit: number;
+  window: number;
+}
+
+export interface AccessSchedule {
+  enabled: boolean;
+  from: string;
+  until: string;
+  days: number[];
+  tz: string;
+}
diff --git a/src/lib/db/caseMapping.ts b/src/lib/db/caseMapping.ts
new file mode 100644
index 0000000000..007a3d3d72
--- /dev/null
+++ b/src/lib/db/caseMapping.ts
@@ -0,0 +1,80 @@
+/**
+ * db/caseMapping.ts — pure snake_case ↔ camelCase column mapping.
+ *
+ * Extracted from db/core.ts (god-file decomposition): the column-name conversion
+ * helpers that translate raw SQLite rows (snake_case columns, 0/1 booleans, `_json`
+ * TEXT columns) into the camelCase shapes the domain modules consume. Pure — no DB
+ * handle, no module state — so they live as a co-located leaf that every db/ module
+ * (and core.ts itself) imports. core.ts re-exports all five so existing call sites that
+ * pull these helpers off the core module keep working unchanged.
+ */
+
+type JsonRecord = Record<string, unknown>;
+
+export function toSnakeCase(str: string): string {
+  return str.replace(/([A-Z])/g, "_$1").toLowerCase();
+}
+
+export function toCamelCase(str: string): string {
+  return str.replace(/_([a-z])/g, (_: string, c: string) => c.toUpperCase());
+}
+
+export function objToSnake(obj: unknown): unknown {
+  if (!obj || typeof obj !== "object") return obj;
+  const result: JsonRecord = {};
+  for (const [k, v] of Object.entries(obj as JsonRecord)) {
+    result[toSnakeCase(k)] = v;
+  }
+  return result;
+}
+
+export function rowToCamel(row: unknown): JsonRecord | null {
+  if (!row) return null;
+  const result: JsonRecord = {};
+  for (const [k, v] of Object.entries(row as JsonRecord)) {
+    const camelKey = toCamelCase(k);
+    if (
+      camelKey === "isActive" ||
+      camelKey === "rateLimitProtection" ||
+      camelKey === "proxyEnabled" ||
+      camelKey === "perKeyProxyEnabled"
+    ) {
+      result[camelKey] = v === 1 || v === true;
+    } else if (camelKey === "providerSpecificData" && typeof v === "string") {
+      try {
+        result[camelKey] = JSON.parse(v);
+      } catch {
+        result[camelKey] = v;
+      }
+    } else if (camelKey.endsWith("Json")) {
+      // Convention: any column with a `_json` suffix is JSON-encoded TEXT.
+      // Surface the parsed object under the friendlier name (key minus the
+      // "Json" suffix) — e.g. quotaWindowThresholdsJson → quotaWindowThresholds.
+      // A NULL/absent column normalizes to `baseKey: null` (not the suffixed
+      // key) so read and write paths expose a consistent shape.
+      const baseKey = camelKey.slice(0, -"Json".length);
+      if (typeof v === "string") {
+        try {
+          result[baseKey] = JSON.parse(v);
+        } catch {
+          result[baseKey] = null;
+        }
+      } else {
+        result[baseKey] = v == null ? null : v;
+      }
+    } else {
+      result[camelKey] = v;
+    }
+  }
+  return result;
+}
+
+export function cleanNulls(obj: unknown): JsonRecord {
+  const result: JsonRecord = {};
+  for (const [k, v] of Object.entries((obj as JsonRecord) || {})) {
+    if (v !== null && v !== undefined) {
+      result[k] = v;
+    }
+  }
+  return result;
+}
diff --git a/src/lib/db/core.ts b/src/lib/db/core.ts
index 5ef6816157..99a04cda7f 100644
--- a/src/lib/db/core.ts
+++ b/src/lib/db/core.ts
@@ -18,6 +18,15 @@ import { runMigrations } from "./migrationRunner";
 import { runDbHealthCheck } from "./healthCheck";
 import { resetAllDbModuleState } from "./stateReset";
 import { parseStoredPayload } from "../logPayloads";
+import { DEFAULT_DATABASE_SETTINGS, type DatabaseSettings } from "@/types/databaseSettings";
+import {
+  applyDatabaseOptimizationSettingsForDb,
+  applyStoredDatabaseOptimizationSettings,
+  getAutoVacuumModeForDb,
+  setAutoVacuumForDb,
+  setCacheSizeForDb,
+  setPageSizeForDb,
+} from "./optimizationSettings";
 import {
   buildArtifactRelativePath,
   writeCallArtifact,
@@ -25,10 +34,22 @@ import {
 } from "../usage/callLogArtifacts";
 import { migrateLegacyEncryptedString } from "./encryption";
 import { invalidateDbCache } from "./readCache";
+import { rowToCamel } from "./caseMapping";
+// Re-exported so existing call sites that pull these helpers off the core module keep working.
+export { toSnakeCase, toCamelCase, objToSnake, rowToCamel, cleanNulls } from "./caseMapping";
+import {
+  ensureProviderConnectionsColumns,
+  ensureUsageHistoryColumns,
+  ensureCallLogsColumns,
+  hasTable,
+  quoteIdentifier,
+  getTableColumns,
+} from "./schemaColumns";
 
 type SqliteDatabase = SqliteAdapter;
 type JsonRecord = Record<string, unknown>;
 type CheckpointMode = "PASSIVE" | "FULL" | "RESTART" | "TRUNCATE";
+type DatabaseOptimizationSettings = DatabaseSettings["optimization"];
 type PreservedTableSnapshot = {
   table: string;
   rowCount: number;
@@ -434,76 +455,6 @@ const SCHEMA_SQL = `
   CREATE INDEX IF NOT EXISTS idx_quota_snapshots_created_at ON quota_snapshots(created_at);
 `;
 
-// ──────────────── Column Mapping ────────────────
-
-export function toSnakeCase(str: string): string {
-  return str.replace(/([A-Z])/g, "_$1").toLowerCase();
-}
-
-export function toCamelCase(str: string): string {
-  return str.replace(/_([a-z])/g, (_: string, c: string) => c.toUpperCase());
-}
-
-export function objToSnake(obj: unknown): unknown {
-  if (!obj || typeof obj !== "object") return obj;
-  const result: JsonRecord = {};
-  for (const [k, v] of Object.entries(obj as JsonRecord)) {
-    result[toSnakeCase(k)] = v;
-  }
-  return result;
-}
-
-export function rowToCamel(row: unknown): JsonRecord | null {
-  if (!row) return null;
-  const result: JsonRecord = {};
-  for (const [k, v] of Object.entries(row as JsonRecord)) {
-    const camelKey = toCamelCase(k);
-    if (
-      camelKey === "isActive" ||
-      camelKey === "rateLimitProtection" ||
-      camelKey === "proxyEnabled" ||
-      camelKey === "perKeyProxyEnabled"
-    ) {
-      result[camelKey] = v === 1 || v === true;
-    } else if (camelKey === "providerSpecificData" && typeof v === "string") {
-      try {
-        result[camelKey] = JSON.parse(v);
-      } catch {
-        result[camelKey] = v;
-      }
-    } else if (camelKey.endsWith("Json")) {
-      // Convention: any column with a `_json` suffix is JSON-encoded TEXT.
-      // Surface the parsed object under the friendlier name (key minus the
-      // "Json" suffix) — e.g. quotaWindowThresholdsJson → quotaWindowThresholds.
-      // A NULL/absent column normalizes to `baseKey: null` (not the suffixed
-      // key) so read and write paths expose a consistent shape.
-      const baseKey = camelKey.slice(0, -"Json".length);
-      if (typeof v === "string") {
-        try {
-          result[baseKey] = JSON.parse(v);
-        } catch {
-          result[baseKey] = null;
-        }
-      } else {
-        result[baseKey] = v == null ? null : v;
-      }
-    } else {
-      result[camelKey] = v;
-    }
-  }
-  return result;
-}
-
-export function cleanNulls(obj: unknown): JsonRecord {
-  const result: JsonRecord = {};
-  for (const [k, v] of Object.entries((obj as JsonRecord) || {})) {
-    if (v !== null && v !== undefined) {
-      result[k] = v;
-    }
-  }
-  return result;
-}
-
 // ──────────────── Singleton DB Instance ────────────────
 // Use globalThis to survive Next.js dev HMR module re-evaluation.
 // Module-level `let` resets on every webpack recompile, causing connection leaks.
@@ -530,210 +481,6 @@ function checkpointDb(db: SqliteDatabase, mode: CheckpointMode = "TRUNCATE"): bo
   return true;
 }
 
-function ensureProviderConnectionsColumns(db: SqliteDatabase) {
-  try {
-    const columns = db.prepare("PRAGMA table_info(provider_connections)").all() as Array<{
-      name?: string;
-    }>;
-    const columnNames = new Set(columns.map((column) => String(column.name ?? "")));
-    if (!columnNames.has("rate_limit_protection")) {
-      db.exec(
-        "ALTER TABLE provider_connections ADD COLUMN rate_limit_protection INTEGER DEFAULT 0"
-      );
-      console.log("[DB] Added provider_connections.rate_limit_protection column");
-    }
-    if (!columnNames.has("last_used_at")) {
-      db.exec("ALTER TABLE provider_connections ADD COLUMN last_used_at TEXT");
-      console.log("[DB] Added provider_connections.last_used_at column");
-    }
-    if (!columnNames.has("group")) {
-      db.exec('ALTER TABLE provider_connections ADD COLUMN "group" TEXT');
-      console.log('[DB] Added provider_connections."group" column');
-    }
-    if (!columnNames.has("max_concurrent")) {
-      db.exec("ALTER TABLE provider_connections ADD COLUMN max_concurrent INTEGER");
-      console.log("[DB] Added provider_connections.max_concurrent column");
-    }
-    if (!columnNames.has("proxy_enabled")) {
-      db.exec(
-        "ALTER TABLE provider_connections ADD COLUMN proxy_enabled INTEGER NOT NULL DEFAULT 1"
-      );
-      console.log("[DB] Added provider_connections.proxy_enabled column");
-    }
-    if (!columnNames.has("per_key_proxy_enabled")) {
-      db.exec(
-        "ALTER TABLE provider_connections ADD COLUMN per_key_proxy_enabled INTEGER NOT NULL DEFAULT 0"
-      );
-      console.log("[DB] Added provider_connections.per_key_proxy_enabled column");
-    }
-    if (!columnNames.has("quota_window_thresholds_json")) {
-      db.exec("ALTER TABLE provider_connections ADD COLUMN quota_window_thresholds_json TEXT");
-      console.log("[DB] Added provider_connections.quota_window_thresholds_json column");
-    }
-    if (!columnNames.has("rate_limit_overrides_json")) {
-      db.exec("ALTER TABLE provider_connections ADD COLUMN rate_limit_overrides_json TEXT");
-      console.log("[DB] Added provider_connections.rate_limit_overrides_json column");
-    }
-    db.exec(
-      "CREATE INDEX IF NOT EXISTS idx_pc_max_concurrent ON provider_connections(provider, max_concurrent)"
-    );
-  } catch (error: unknown) {
-    const message = error instanceof Error ? error.message : String(error);
-    console.warn("[DB] Failed to verify provider_connections schema:", message);
-  }
-}
-
-function ensureUsageHistoryColumns(db: SqliteDatabase) {
-  try {
-    const columns = db.prepare("PRAGMA table_info(usage_history)").all() as Array<{
-      name?: string;
-    }>;
-    const columnNames = new Set(columns.map((column) => String(column.name ?? "")));
-
-    if (!columnNames.has("success")) {
-      db.exec("ALTER TABLE usage_history ADD COLUMN success INTEGER DEFAULT 1");
-      console.log("[DB] Added usage_history.success column");
-    }
-    if (!columnNames.has("latency_ms")) {
-      db.exec("ALTER TABLE usage_history ADD COLUMN latency_ms INTEGER DEFAULT 0");
-      console.log("[DB] Added usage_history.latency_ms column");
-    }
-    if (!columnNames.has("ttft_ms")) {
-      db.exec("ALTER TABLE usage_history ADD COLUMN ttft_ms INTEGER DEFAULT 0");
-      console.log("[DB] Added usage_history.ttft_ms column");
-    }
-    if (!columnNames.has("error_code")) {
-      db.exec("ALTER TABLE usage_history ADD COLUMN error_code TEXT");
-      console.log("[DB] Added usage_history.error_code column");
-    }
-    if (!columnNames.has("service_tier")) {
-      db.exec("ALTER TABLE usage_history ADD COLUMN service_tier TEXT DEFAULT 'standard'");
-      console.log("[DB] Added usage_history.service_tier column");
-    }
-    db.exec("CREATE INDEX IF NOT EXISTS idx_uh_service_tier ON usage_history(service_tier)");
-    if (!columnNames.has("combo_strategy")) {
-      db.exec("ALTER TABLE usage_history ADD COLUMN combo_strategy TEXT DEFAULT 'direct'");
-      console.log("[DB] Added usage_history.combo_strategy column");
-    }
-    db.exec("CREATE INDEX IF NOT EXISTS idx_uh_combo_strategy ON usage_history(combo_strategy)");
-  } catch (error: unknown) {
-    const message = error instanceof Error ? error.message : String(error);
-    console.warn("[DB] Failed to verify usage_history schema:", message);
-  }
-}
-
-function ensureCallLogsColumns(db: SqliteDatabase) {
-  try {
-    const columns = db.prepare("PRAGMA table_info(call_logs)").all() as Array<{
-      name?: string;
-    }>;
-    const columnNames = new Set(columns.map((column) => String(column.name ?? "")));
-
-    if (!columnNames.has("artifact_relpath")) {
-      db.exec("ALTER TABLE call_logs ADD COLUMN artifact_relpath TEXT");
-      console.log("[DB] Added call_logs.artifact_relpath column");
-    }
-    if (!columnNames.has("has_pipeline_details")) {
-      db.exec("ALTER TABLE call_logs ADD COLUMN has_pipeline_details INTEGER DEFAULT 0");
-      console.log("[DB] Added call_logs.has_pipeline_details column");
-    }
-    if (!columnNames.has("requested_model")) {
-      db.exec("ALTER TABLE call_logs ADD COLUMN requested_model TEXT DEFAULT NULL");
-      console.log("[DB] Added call_logs.requested_model column");
-    }
-    if (!columnNames.has("request_type")) {
-      db.exec("ALTER TABLE call_logs ADD COLUMN request_type TEXT DEFAULT NULL");
-      console.log("[DB] Added call_logs.request_type column");
-    }
-    if (!columnNames.has("tokens_cache_read")) {
-      db.exec("ALTER TABLE call_logs ADD COLUMN tokens_cache_read INTEGER DEFAULT NULL");
-      console.log("[DB] Added call_logs.tokens_cache_read column");
-    }
-    if (!columnNames.has("tokens_cache_creation")) {
-      db.exec("ALTER TABLE call_logs ADD COLUMN tokens_cache_creation INTEGER DEFAULT NULL");
-      console.log("[DB] Added call_logs.tokens_cache_creation column");
-    }
-    if (!columnNames.has("tokens_reasoning")) {
-      db.exec("ALTER TABLE call_logs ADD COLUMN tokens_reasoning INTEGER DEFAULT NULL");
-      console.log("[DB] Added call_logs.tokens_reasoning column");
-    }
-    if (!columnNames.has("cache_source")) {
-      db.exec("ALTER TABLE call_logs ADD COLUMN cache_source TEXT DEFAULT 'upstream'");
-      console.log("[DB] Added call_logs.cache_source column");
-    }
-    if (!columnNames.has("combo_step_id")) {
-      db.exec("ALTER TABLE call_logs ADD COLUMN combo_step_id TEXT DEFAULT NULL");
-      console.log("[DB] Added call_logs.combo_step_id column");
-    }
-    if (!columnNames.has("combo_execution_key")) {
-      db.exec("ALTER TABLE call_logs ADD COLUMN combo_execution_key TEXT DEFAULT NULL");
-      console.log("[DB] Added call_logs.combo_execution_key column");
-    }
-    if (!columnNames.has("error_summary")) {
-      db.exec("ALTER TABLE call_logs ADD COLUMN error_summary TEXT DEFAULT NULL");
-      console.log("[DB] Added call_logs.error_summary column");
-    }
-    if (!columnNames.has("detail_state")) {
-      db.exec("ALTER TABLE call_logs ADD COLUMN detail_state TEXT DEFAULT 'none'");
-      console.log("[DB] Added call_logs.detail_state column");
-    }
-    if (!columnNames.has("artifact_size_bytes")) {
-      db.exec("ALTER TABLE call_logs ADD COLUMN artifact_size_bytes INTEGER DEFAULT NULL");
-      console.log("[DB] Added call_logs.artifact_size_bytes column");
-    }
-    if (!columnNames.has("artifact_sha256")) {
-      db.exec("ALTER TABLE call_logs ADD COLUMN artifact_sha256 TEXT DEFAULT NULL");
-      console.log("[DB] Added call_logs.artifact_sha256 column");
-    }
-    if (!columnNames.has("has_request_body")) {
-      db.exec("ALTER TABLE call_logs ADD COLUMN has_request_body INTEGER DEFAULT 0");
-      console.log("[DB] Added call_logs.has_request_body column");
-    }
-    if (!columnNames.has("has_response_body")) {
-      db.exec("ALTER TABLE call_logs ADD COLUMN has_response_body INTEGER DEFAULT 0");
-      console.log("[DB] Added call_logs.has_response_body column");
-    }
-    if (!columnNames.has("request_summary")) {
-      db.exec("ALTER TABLE call_logs ADD COLUMN request_summary TEXT DEFAULT NULL");
-      console.log("[DB] Added call_logs.request_summary column");
-    }
-
-    db.exec(
-      "CREATE INDEX IF NOT EXISTS idx_call_logs_requested_model ON call_logs(requested_model)"
-    );
-    db.exec("CREATE INDEX IF NOT EXISTS idx_call_logs_request_type ON call_logs(request_type)");
-    db.exec(
-      "CREATE INDEX IF NOT EXISTS idx_cl_combo_target ON call_logs(combo_name, combo_execution_key, timestamp)"
-    );
-  } catch (error: unknown) {
-    const message = error instanceof Error ? error.message : String(error);
-    console.warn("[DB] Failed to verify call_logs schema:", message);
-  }
-}
-
-function hasColumn(db: SqliteDatabase, tableName: string, columnName: string): boolean {
-  const rows = db.prepare(`PRAGMA table_info(${tableName})`).all() as Array<{ name?: string }>;
-  return rows.some((row) => row.name === columnName);
-}
-
-function hasTable(db: SqliteDatabase, tableName: string): boolean {
-  return Boolean(
-    db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?").get(tableName)
-  );
-}
-
-function quoteIdentifier(identifier: string): string {
-  return `"${identifier.replace(/"/g, '""')}"`;
-}
-
-function getTableColumns(db: SqliteDatabase, tableName: string): string[] {
-  return (
-    db.prepare(`PRAGMA table_info(${quoteIdentifier(tableName)})`).all() as Array<{ name?: string }>
-  )
-    .map((column) => String(column.name ?? ""))
-    .filter((column) => column.length > 0);
-}
-
 function summarizePreservedTables(tables: PreservedTableSnapshot[]): string {
   if (tables.length === 0) return "none";
   return tables.map((table) => `${table.table}(${table.rowCount})`).join(", ");
@@ -1340,7 +1087,7 @@ export function getDbInstance(): SqliteDatabase {
   // contended op can no longer freeze the loop past the host watchdog's 6s liveness probe.
   db.pragma("busy_timeout = 2000");
   db.pragma("synchronous = NORMAL");
-  db.pragma("cache_size = -2048");
+  db.pragma(`cache_size = -${DEFAULT_DATABASE_SETTINGS.optimization.cacheSize}`);
   db.exec(SCHEMA_SQL);
   ensureProviderConnectionsColumns(db);
   ensureUsageHistoryColumns(db);
@@ -1361,6 +1108,8 @@ export function getDbInstance(): SqliteDatabase {
 
   runMigrations(db, { isNewDb });
 
+  applyStoredDatabaseOptimizationSettings(db);
+
   offloadLegacyCallLogDetails(db);
 
   // Auto-migrate from db.json if exists
@@ -1731,44 +1480,16 @@ function migrateFromJson(db: SqliteDatabase, jsonPath: string) {
 
 // ──────────────── Auto-Vacuum Management ────────────────
 
+export function applyDatabaseOptimizationSettings(settings: DatabaseOptimizationSettings): void {
+  applyDatabaseOptimizationSettingsForDb(getDbInstance(), settings, { applyPersistent: true });
+}
+
 export function setAutoVacuum(mode: "NONE" | "FULL" | "INCREMENTAL"): void {
-  const db = getDbInstance();
-
-  const currentMode = db.pragma("auto_vacuum", { simple: true }) as number;
-  const modeMap: Record<string, number> = {
-    NONE: 0,
-    FULL: 1,
-    INCREMENTAL: 2,
-  };
-
-  const targetMode = modeMap[mode];
-
-  if (currentMode === targetMode) {
-    console.log(`[DB] auto_vacuum already set to ${mode}`);
-    return;
-  }
-
-  console.log(`[DB] Changing auto_vacuum from ${currentMode} to ${mode} (${targetMode})`);
-
-  db.pragma(`auto_vacuum = ${targetMode}`);
-
-  db.exec("VACUUM");
-
-  const newMode = db.pragma("auto_vacuum", { simple: true }) as number;
-  console.log(`[DB] auto_vacuum changed to ${newMode}`);
+  setAutoVacuumForDb(getDbInstance(), mode);
 }
 
 export function getAutoVacuumMode(): "NONE" | "FULL" | "INCREMENTAL" {
-  const db = getDbInstance();
-  const mode = db.pragma("auto_vacuum", { simple: true }) as number;
-
-  const modeMap: Record<number, "NONE" | "FULL" | "INCREMENTAL"> = {
-    0: "NONE",
-    1: "FULL",
-    2: "INCREMENTAL",
-  };
-
-  return modeMap[mode] || "NONE";
+  return getAutoVacuumModeForDb(getDbInstance());
 }
 
 export function runManualVacuum(): { success: boolean; duration: number; error?: string } {
@@ -1790,35 +1511,9 @@ export function runManualVacuum(): { success: boolean; duration: number; error?:
 }
 
 export function setPageSize(pageSize: number): void {
-  const db = getDbInstance();
-  const currentPageSize = db.pragma("page_size", { simple: true }) as number;
-
-  if (currentPageSize === pageSize) {
-    console.log(`[DB] page_size already set to ${pageSize}`);
-    return;
-  }
-
-  console.log(`[DB] Changing page_size from ${currentPageSize} to ${pageSize}`);
-  db.pragma(`page_size = ${pageSize}`);
-  db.exec("VACUUM");
-
-  const newPageSize = db.pragma("page_size", { simple: true }) as number;
-  console.log(`[DB] page_size changed to ${newPageSize}`);
+  setPageSizeForDb(getDbInstance(), pageSize);
 }
 
 export function setCacheSize(cacheSizeKb: number): void {
-  const db = getDbInstance();
-  const currentCacheSize = db.pragma("cache_size", { simple: true }) as number;
-  const targetCacheSize = -cacheSizeKb;
-
-  if (currentCacheSize === targetCacheSize) {
-    console.log(`[DB] cache_size already set to ${cacheSizeKb}KB`);
-    return;
-  }
-
-  console.log(`[DB] Changing cache_size from ${Math.abs(currentCacheSize)}KB to ${cacheSizeKb}KB`);
-  db.pragma(`cache_size = ${targetCacheSize}`);
-
-  const newCacheSize = db.pragma("cache_size", { simple: true }) as number;
-  console.log(`[DB] cache_size changed to ${Math.abs(newCacheSize)}KB`);
+  setCacheSizeForDb(getDbInstance(), cacheSizeKb);
 }
diff --git a/src/lib/db/databaseSettings.ts b/src/lib/db/databaseSettings.ts
index 567ffcf5ba..fa63534b18 100644
--- a/src/lib/db/databaseSettings.ts
+++ b/src/lib/db/databaseSettings.ts
@@ -3,7 +3,7 @@ import fs from "node:fs";
 import { DEFAULT_DATABASE_SETTINGS, type DatabaseSettings } from "@/types/databaseSettings";
 
 import { backupDbFile } from "./backup";
-import { DATA_DIR, SQLITE_FILE, getDbInstance } from "./core";
+import { DATA_DIR, SQLITE_FILE, applyDatabaseOptimizationSettings, getDbInstance } from "./core";
 import { invalidateDbCache } from "./readCache";
 import { getDatabaseStats } from "./stats";
 import { getState as getVacuumSchedulerState, refreshVacuumScheduler } from "./vacuumScheduler";
@@ -95,6 +95,15 @@ function toBooleanSetting(value: unknown): boolean | null {
   return null;
 }
 
+function normalizeOptimizationSettings(settings: UserDatabaseSettings) {
+  const fallback = DEFAULT_DATABASE_SETTINGS.optimization.cacheSize;
+  const numericCacheSize = Number(settings.optimization.cacheSize);
+  settings.optimization.cacheSize =
+    Number.isFinite(numericCacheSize) && numericCacheSize > 0
+      ? Math.min(1000000, Math.floor(numericCacheSize))
+      : fallback;
+}
+
 function readNamespace(namespace: string): Record<string, unknown> {
   const db = getDbInstance();
   const rows = db
@@ -220,6 +229,7 @@ export function getUserDatabaseSettings(): UserDatabaseSettings {
   mergeTopLevelSections(settings, mainSettings);
   mergeDatabaseSettingsNamespace(settings, readNamespace(DATABASE_SETTINGS_NAMESPACE));
   mergeRuntimeLogSettings(settings, mainSettings);
+  normalizeOptimizationSettings(settings);
 
   return settings;
 }
@@ -259,6 +269,7 @@ export function updateDatabaseSettings(
       mergeSectionObject(nextSettings, section, updates[section]);
     }
   }
+  normalizeOptimizationSettings(nextSettings);
 
   const db = getDbInstance();
   const insert = db.prepare(
@@ -289,7 +300,10 @@ export function updateDatabaseSettings(
 
   backupDbFile("pre-write");
   invalidateDbCache("settings");
-  if (optimizationUpdated) refreshVacuumScheduler();
+  if (optimizationUpdated) {
+    applyDatabaseOptimizationSettings(nextSettings.optimization);
+    refreshVacuumScheduler();
+  }
 
   return nextSettings;
 }
diff --git a/src/lib/db/freeProxies.ts b/src/lib/db/freeProxies.ts
index 3ea7fd46db..57593c98ef 100644
--- a/src/lib/db/freeProxies.ts
+++ b/src/lib/db/freeProxies.ts
@@ -270,6 +270,35 @@ export async function clearFreeProxiesBySource(source: FreeProxySourceId): Promi
   return result.changes;
 }
 
+// #4878: the displayed "last sync" used to be derived from MAX(last_validated),
+// which only advances when a provider returns at least one new/updated proxy. A
+// sync that returns zero rows (or whose providers all fail) left the timestamp
+// frozen, so "Sync All" appeared to do nothing. We persist an explicit sync
+// timestamp in the generic key_value store and prefer it in the stats.
+const FREE_PROXY_SYNC_NAMESPACE = "free_proxies";
+const FREE_PROXY_SYNC_KEY = "last_sync_at";
+
+/**
+ * Persist the moment a free-proxy sync completed. Returns the stored ISO string
+ * so the route can echo it back. `at` is overridable for deterministic tests.
+ */
+export async function recordFreeProxySync(at?: string): Promise<string> {
+  const db = getDbInstance();
+  const ts = at ?? new Date().toISOString();
+  db.prepare(
+    "INSERT OR REPLACE INTO key_value (namespace, key, value) VALUES (?, ?, ?)"
+  ).run(FREE_PROXY_SYNC_NAMESPACE, FREE_PROXY_SYNC_KEY, ts);
+  backupDbFile("pre-write");
+  return ts;
+}
+
+function getRecordedFreeProxySync(db: ReturnType<typeof getDbInstance>): string | null {
+  const row = db
+    .prepare("SELECT value FROM key_value WHERE namespace = ? AND key = ?")
+    .get(FREE_PROXY_SYNC_NAMESPACE, FREE_PROXY_SYNC_KEY) as { value?: string } | undefined;
+  return row?.value != null ? String(row.value) : null;
+}
+
 export async function getFreeProxyStats(): Promise<FreeProxyStats> {
   const db = getDbInstance();
   const totals = db
@@ -288,11 +317,16 @@ export async function getFreeProxyStats(): Promise<FreeProxyStats> {
     )
     .all() as DbRow[];
 
+  // Prefer the explicitly recorded sync timestamp (#4878); fall back to the
+  // newest last_validated only when no sync has ever been recorded.
+  const recordedSyncAt = getRecordedFreeProxySync(db);
+  const derivedSyncAt = totals.last_sync_at != null ? String(totals.last_sync_at) : null;
+
   return {
     total: Number(totals.total) || 0,
     inPool: Number(totals.in_pool_count) || 0,
     avgQuality: totals.avg_quality != null ? Math.round(Number(totals.avg_quality)) : null,
     bySource: bySource.map((r) => ({ source: String(r.source), count: Number(r.count) })),
-    lastSyncAt: totals.last_sync_at != null ? String(totals.last_sync_at) : null,
+    lastSyncAt: recordedSyncAt ?? derivedSyncAt,
   };
 }
diff --git a/src/lib/db/migrations/046_database_settings.sql b/src/lib/db/migrations/046_database_settings.sql
index 87df12d241..57fd15c903 100644
--- a/src/lib/db/migrations/046_database_settings.sql
+++ b/src/lib/db/migrations/046_database_settings.sql
@@ -40,5 +40,5 @@ INSERT OR IGNORE INTO key_value (namespace, key, value) VALUES ('databaseSetting
 INSERT OR IGNORE INTO key_value (namespace, key, value) VALUES ('databaseSettings', 'autoVacuumMode', '"INCREMENTAL"');
 INSERT OR IGNORE INTO key_value (namespace, key, value) VALUES ('databaseSettings', 'scheduledVacuum', '"weekly"');
 INSERT OR IGNORE INTO key_value (namespace, key, value) VALUES ('databaseSettings', 'pageSize', '4096');
-INSERT OR IGNORE INTO key_value (namespace, key, value) VALUES ('databaseSettings', 'cacheSize', '10000');
+INSERT OR IGNORE INTO key_value (namespace, key, value) VALUES ('databaseSettings', 'cacheSize', '16384');
 INSERT OR IGNORE INTO key_value (namespace, key, value) VALUES ('databaseSettings', 'mmapSize', '268435456');
diff --git a/src/lib/db/migrations/104_normalize_database_cache_size.sql b/src/lib/db/migrations/104_normalize_database_cache_size.sql
new file mode 100644
index 0000000000..2c24afe8d0
--- /dev/null
+++ b/src/lib/db/migrations/104_normalize_database_cache_size.sql
@@ -0,0 +1,10 @@
+-- 104_normalize_database_cache_size.sql
+-- Normalize the old SQLite cache-size default to the new UI contract:
+-- databaseSettings.optimization.cacheSize is a positive KiB value, e.g. 16384.
+-- Only legacy defaults are rewritten; custom positive values are preserved.
+
+UPDATE key_value
+SET value = '16384'
+WHERE namespace = 'databaseSettings'
+  AND key IN ('cacheSize', 'optimization.cacheSize')
+  AND TRIM(value) IN ('-2000', '"-2000"', '10000', '"10000"');
diff --git a/src/lib/db/migrations/105_usage_history_endpoint.sql b/src/lib/db/migrations/105_usage_history_endpoint.sql
new file mode 100644
index 0000000000..55a459b138
--- /dev/null
+++ b/src/lib/db/migrations/105_usage_history_endpoint.sql
@@ -0,0 +1,6 @@
+-- Migration 105: Add endpoint column to usage_history
+-- Tracks the API endpoint path (e.g. /v1/chat/completions, /v1/messages, /v1/responses)
+-- so usage analytics can break down activity per endpoint dimension.
+-- Backward compatible: existing rows default to NULL; aggregation queries fold NULL into 'unknown'.
+ALTER TABLE usage_history ADD COLUMN endpoint TEXT;
+CREATE INDEX IF NOT EXISTS idx_uh_endpoint ON usage_history(endpoint);
diff --git a/src/lib/db/migrations/106_quota_allocation_model_caps.sql b/src/lib/db/migrations/106_quota_allocation_model_caps.sql
new file mode 100644
index 0000000000..6a96a04f8b
--- /dev/null
+++ b/src/lib/db/migrations/106_quota_allocation_model_caps.sql
@@ -0,0 +1,32 @@
+-- Migration 106: quota_allocation_model_caps
+--
+-- Adds per-(pool, api_key, model) budget caps so a single API key cannot drain
+-- the shared quota pool by hammering one model (Group B hardening, Fase 3 #7).
+--
+-- Schema design:
+--   pool_id    — references quota_pools.id (no FK cascade; orphan cleanup is
+--                app-layer responsibility to avoid 3-table chain fragility in SQLite)
+--   api_key_id — the API key being capped (same as in quota_allocations)
+--   model      — exact model identifier string (e.g. "kimi-k2", "gpt-4o")
+--   cap_value  — maximum allowed consumption in the given unit per hourly window
+--   cap_unit   — one of 'percent','requests','tokens','usd' (matches QuotaUnit enum)
+--
+-- cap_value CHECK > 0: zero/negative caps are rejected at DB level.
+-- The enforce layer additionally skips values ≤ Number.EPSILON (placeholder seeds).
+--
+-- Primary key: (pool_id, api_key_id, model) — one cap row per triple.
+-- Idempotent: safe to run more than once.
+--
+-- Part of: Group B — Quota Sharing Engine, Fase 3 #7.
+
+CREATE TABLE IF NOT EXISTS quota_allocation_model_caps (
+  pool_id    TEXT NOT NULL,
+  api_key_id TEXT NOT NULL,
+  model      TEXT NOT NULL,
+  cap_value  REAL NOT NULL CHECK (cap_value > 0),
+  cap_unit   TEXT NOT NULL CHECK (cap_unit IN ('percent','requests','tokens','usd')),
+  PRIMARY KEY (pool_id, api_key_id, model)
+);
+
+CREATE INDEX IF NOT EXISTS idx_qamc_pool_key
+  ON quota_allocation_model_caps(pool_id, api_key_id);
diff --git a/src/lib/db/migrations/107_quota_combos_quota_share_strategy.sql b/src/lib/db/migrations/107_quota_combos_quota_share_strategy.sql
new file mode 100644
index 0000000000..3f16eb0deb
--- /dev/null
+++ b/src/lib/db/migrations/107_quota_combos_quota_share_strategy.sql
@@ -0,0 +1,25 @@
+-- Migration 107: activate the dedicated quota-share strategy on existing qtSd/ combos
+--
+-- Fase 3 #9 introduced a dedicated "quota-share" routing strategy and changed
+-- syncQuotaCombos() to mint the auto-generated qtSd/ combos with it (replacing the
+-- previous "fill-first"). syncQuotaCombos only re-runs when a pool/connection is
+-- created or edited, so combos minted BEFORE the #9 deploy keep their old
+-- "fill-first" strategy and never exercise the new DRR + P2C + per-model gating
+-- engine. This migration aligns those pre-existing combos with the new default.
+--
+-- Scope is deliberately narrow:
+--   - name LIKE 'qtSd/%'              → only the auto-minted, hidden quota-share combos
+--   - strategy = 'fill-first'         → only the stale ones (leaves anything already
+--                                       on quota-share / a user-chosen strategy untouched)
+-- A user's own combo can never match 'qtSd/%' (that prefix is reserved for the
+-- quota-share engine), so no human-authored routing choice is overwritten.
+--
+-- Idempotent: re-running is a no-op once every qtSd/ combo is on quota-share.
+--
+-- Part of: Group B — Quota Sharing Engine, Fase 3 #9 (activation follow-up).
+
+UPDATE combos
+SET data = json_set(data, '$.strategy', 'quota-share'),
+    updated_at = datetime('now')
+WHERE name LIKE 'qtSd/%'
+  AND json_extract(data, '$.strategy') = 'fill-first';
diff --git a/src/lib/db/optimizationSettings.ts b/src/lib/db/optimizationSettings.ts
new file mode 100644
index 0000000000..636313c406
--- /dev/null
+++ b/src/lib/db/optimizationSettings.ts
@@ -0,0 +1,284 @@
+import { DEFAULT_DATABASE_SETTINGS, type DatabaseSettings } from "@/types/databaseSettings";
+
+import type { SqliteAdapter } from "./adapters/types";
+
+type SqliteDatabase = SqliteAdapter;
+type DatabaseOptimizationSettings = DatabaseSettings["optimization"];
+type AutoVacuumMode = DatabaseOptimizationSettings["autoVacuumMode"];
+
+const AUTO_VACUUM_MODE_TO_PRAGMA: Record<AutoVacuumMode, number> = {
+  NONE: 0,
+  FULL: 1,
+  INCREMENTAL: 2,
+};
+
+const PRAGMA_TO_AUTO_VACUUM_MODE: Record<number, AutoVacuumMode> = {
+  0: "NONE",
+  1: "FULL",
+  2: "INCREMENTAL",
+};
+
+function parseKeyValueJson(raw: string | null | undefined): unknown {
+  if (raw === null || raw === undefined) return undefined;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return raw;
+  }
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function normalizeAutoVacuumMode(value: unknown, fallback: AutoVacuumMode): AutoVacuumMode {
+  return typeof value === "string" && value in AUTO_VACUUM_MODE_TO_PRAGMA
+    ? (value as AutoVacuumMode)
+    : fallback;
+}
+
+function normalizePageSizeBytes(value: unknown, fallback: number): number {
+  const numeric = Number(value);
+  if (!Number.isFinite(numeric)) return fallback;
+  const pageSize = Math.floor(numeric);
+  if (pageSize < 512 || pageSize > 65536 || pageSize % 512 !== 0) return fallback;
+  return pageSize;
+}
+
+function normalizeVacuumHour(value: unknown, fallback: number): number {
+  const numeric = Number(value);
+  if (!Number.isFinite(numeric)) return fallback;
+  return Math.min(23, Math.max(0, Math.floor(numeric)));
+}
+
+function normalizeStoredCacheSizeKb(value: unknown, fallback: number): number {
+  const numeric = Number(value);
+  if (!Number.isFinite(numeric)) return fallback;
+  const cacheSizeKb = Math.floor(numeric);
+  if (cacheSizeKb < 1 || cacheSizeKb > 1000000) return fallback;
+  return cacheSizeKb;
+}
+
+function requireCacheSizeKb(value: number): number {
+  if (!Number.isInteger(value) || value < 1 || value > 1000000) {
+    throw new Error("cache_size must be a positive KiB value between 1 and 1000000");
+  }
+  return value;
+}
+
+function mergeOptimizationSettings(
+  target: DatabaseOptimizationSettings,
+  value: unknown
+): DatabaseOptimizationSettings {
+  if (!isRecord(value)) return target;
+  return {
+    ...target,
+    autoVacuumMode: normalizeAutoVacuumMode(value.autoVacuumMode, target.autoVacuumMode),
+    scheduledVacuum:
+      typeof value.scheduledVacuum === "string" &&
+      ["never", "daily", "weekly", "monthly"].includes(value.scheduledVacuum)
+        ? (value.scheduledVacuum as DatabaseOptimizationSettings["scheduledVacuum"])
+        : target.scheduledVacuum,
+    vacuumHour: normalizeVacuumHour(value.vacuumHour, target.vacuumHour),
+    pageSize: normalizePageSizeBytes(value.pageSize, target.pageSize),
+    cacheSize: normalizeStoredCacheSizeKb(value.cacheSize, target.cacheSize),
+    optimizeOnStartup:
+      typeof value.optimizeOnStartup === "boolean"
+        ? value.optimizeOnStartup
+        : target.optimizeOnStartup,
+  };
+}
+
+function readDatabaseOptimizationSettings(db: SqliteDatabase): DatabaseOptimizationSettings {
+  let settings: DatabaseOptimizationSettings = { ...DEFAULT_DATABASE_SETTINGS.optimization };
+
+  try {
+    const rows = db
+      .prepare("SELECT namespace, key, value FROM key_value WHERE namespace IN (?, ?)")
+      .all("settings", "databaseSettings") as Array<{
+      namespace: string;
+      key: string;
+      value: string | null;
+    }>;
+    const byNamespace: Record<string, Record<string, unknown>> = {
+      settings: {},
+      databaseSettings: {},
+    };
+    for (const row of rows) {
+      byNamespace[row.namespace] ??= {};
+      byNamespace[row.namespace][row.key] = parseKeyValueJson(row.value);
+    }
+
+    const mainSettings = byNamespace.settings ?? {};
+    const databaseSettingsValue = mainSettings.databaseSettings;
+    if (isRecord(databaseSettingsValue)) {
+      settings = mergeOptimizationSettings(settings, databaseSettingsValue.optimization);
+    }
+    settings = mergeOptimizationSettings(settings, mainSettings.optimization);
+
+    const databaseSettings = byNamespace.databaseSettings ?? {};
+    const optimizeOnStartup =
+      databaseSettings["optimization.optimizeOnStartup"] ?? databaseSettings.optimizeOnStartup;
+    settings = mergeOptimizationSettings(settings, databaseSettings.optimization);
+    settings = {
+      ...settings,
+      autoVacuumMode: normalizeAutoVacuumMode(
+        databaseSettings["optimization.autoVacuumMode"] ?? databaseSettings.autoVacuumMode,
+        settings.autoVacuumMode
+      ),
+      pageSize: normalizePageSizeBytes(
+        databaseSettings["optimization.pageSize"] ?? databaseSettings.pageSize,
+        settings.pageSize
+      ),
+      cacheSize: normalizeStoredCacheSizeKb(
+        databaseSettings["optimization.cacheSize"] ?? databaseSettings.cacheSize,
+        settings.cacheSize
+      ),
+      optimizeOnStartup:
+        typeof optimizeOnStartup === "boolean" ? optimizeOnStartup : settings.optimizeOnStartup,
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.warn(`[DB] Failed to read database optimization settings; using defaults: ${message}`);
+  }
+
+  return settings;
+}
+
+export function setCacheSizeForDb(db: SqliteDatabase, cacheSizeKb: number): void {
+  const normalizedCacheSizeKb = requireCacheSizeKb(cacheSizeKb);
+  const currentCacheSize = db.pragma("cache_size", { simple: true }) as number;
+  const targetCacheSize = -normalizedCacheSizeKb;
+
+  if (currentCacheSize === targetCacheSize) {
+    console.log(`[DB] cache_size already set to ${normalizedCacheSizeKb}KB`);
+    return;
+  }
+
+  console.log(
+    `[DB] Changing cache_size from ${Math.abs(currentCacheSize)}KB to ${normalizedCacheSizeKb}KB`
+  );
+  db.pragma(`cache_size = ${targetCacheSize}`);
+
+  const newCacheSize = db.pragma("cache_size", { simple: true }) as number;
+  if (newCacheSize !== targetCacheSize) {
+    throw new Error(
+      `cache_size change did not take effect (expected ${targetCacheSize}, got ${newCacheSize})`
+    );
+  }
+  console.log(`[DB] cache_size changed to ${Math.abs(newCacheSize)}KB`);
+}
+
+function applyPersistentOptimizationPragmas(
+  db: SqliteDatabase,
+  settings: DatabaseOptimizationSettings
+): void {
+  const targetAutoVacuum = AUTO_VACUUM_MODE_TO_PRAGMA[settings.autoVacuumMode];
+  const targetPageSize = normalizePageSizeBytes(
+    settings.pageSize,
+    DEFAULT_DATABASE_SETTINGS.optimization.pageSize
+  );
+  const currentAutoVacuum = db.pragma("auto_vacuum", { simple: true }) as number;
+  const currentPageSize = db.pragma("page_size", { simple: true }) as number;
+
+  if (currentAutoVacuum === targetAutoVacuum && currentPageSize === targetPageSize) return;
+
+  const originalJournalMode = String(
+    db.pragma("journal_mode", { simple: true }) ?? ""
+  ).toUpperCase();
+  const shouldRestoreWal = originalJournalMode === "WAL";
+
+  console.log(
+    `[DB] Applying persistent optimization settings ` +
+      `(auto_vacuum ${currentAutoVacuum}->${targetAutoVacuum}, ` +
+      `page_size ${currentPageSize}->${targetPageSize})`
+  );
+
+  try {
+    if (shouldRestoreWal) db.pragma("journal_mode = DELETE");
+    db.pragma(`auto_vacuum = ${targetAutoVacuum}`);
+    db.pragma(`page_size = ${targetPageSize}`);
+    db.exec("VACUUM");
+  } finally {
+    if (shouldRestoreWal) {
+      try {
+        db.pragma("journal_mode = WAL");
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        console.warn(`[DB] Failed to restore WAL mode after optimization settings: ${message}`);
+      }
+    }
+  }
+
+  const newAutoVacuum = db.pragma("auto_vacuum", { simple: true }) as number;
+  const newPageSize = db.pragma("page_size", { simple: true }) as number;
+  if (newAutoVacuum !== targetAutoVacuum || newPageSize !== targetPageSize) {
+    throw new Error(
+      `database optimization settings did not take effect ` +
+        `(auto_vacuum expected ${targetAutoVacuum}, got ${newAutoVacuum}; ` +
+        `page_size expected ${targetPageSize}, got ${newPageSize})`
+    );
+  }
+}
+
+export function applyDatabaseOptimizationSettingsForDb(
+  db: SqliteDatabase,
+  settings: DatabaseOptimizationSettings,
+  options: { applyPersistent: boolean }
+): void {
+  if (options.applyPersistent) applyPersistentOptimizationPragmas(db, settings);
+  setCacheSizeForDb(
+    db,
+    normalizeStoredCacheSizeKb(settings.cacheSize, DEFAULT_DATABASE_SETTINGS.optimization.cacheSize)
+  );
+}
+
+export function applyStoredDatabaseOptimizationSettings(db: SqliteDatabase): void {
+  const settings = readDatabaseOptimizationSettings(db);
+  // Startup can happen concurrently in test workers and clustered hosts. Only
+  // restore connection-local settings here; page_size/auto_vacuum require VACUUM
+  // and are applied synchronously when the Storage settings are saved.
+  applyDatabaseOptimizationSettingsForDb(db, settings, {
+    applyPersistent: false,
+  });
+}
+
+export function setAutoVacuumForDb(db: SqliteDatabase, mode: AutoVacuumMode): void {
+  const currentMode = db.pragma("auto_vacuum", { simple: true }) as number;
+  const targetMode = AUTO_VACUUM_MODE_TO_PRAGMA[mode];
+
+  if (currentMode === targetMode) {
+    console.log(`[DB] auto_vacuum already set to ${mode}`);
+    return;
+  }
+
+  applyPersistentOptimizationPragmas(db, {
+    ...DEFAULT_DATABASE_SETTINGS.optimization,
+    autoVacuumMode: mode,
+    pageSize: db.pragma("page_size", { simple: true }) as number,
+  });
+}
+
+export function getAutoVacuumModeForDb(db: SqliteDatabase): AutoVacuumMode {
+  const mode = db.pragma("auto_vacuum", { simple: true }) as number;
+  return PRAGMA_TO_AUTO_VACUUM_MODE[mode] || "NONE";
+}
+
+export function setPageSizeForDb(db: SqliteDatabase, pageSize: number): void {
+  const currentPageSize = db.pragma("page_size", { simple: true }) as number;
+  const targetPageSize = normalizePageSizeBytes(
+    pageSize,
+    DEFAULT_DATABASE_SETTINGS.optimization.pageSize
+  );
+
+  if (currentPageSize === targetPageSize) {
+    console.log(`[DB] page_size already set to ${targetPageSize}`);
+    return;
+  }
+
+  applyPersistentOptimizationPragmas(db, {
+    ...DEFAULT_DATABASE_SETTINGS.optimization,
+    autoVacuumMode: getAutoVacuumModeForDb(db),
+    pageSize: targetPageSize,
+  });
+}
diff --git a/src/lib/db/proxies.ts b/src/lib/db/proxies.ts
index 4b758555ab..43bd7d914e 100755
--- a/src/lib/db/proxies.ts
+++ b/src/lib/db/proxies.ts
@@ -1,5 +1,8 @@
-// Convention: when type === "vercel", the `notes` column stores JSON { relayAuth: "<token>" }
-// used by proxyFetch.ts to route requests through the Vercel edge relay instead of an undici ProxyAgent.
+// Convention: when type is a relay (vercel | deno | cloudflare), the `notes` column stores JSON
+// { relayAuth: "<token>" } used by proxyFetch.ts to route requests through the relay edge function
+// (Vercel Edge, Deno Deploy, or Cloudflare Workers) instead of an undici ProxyAgent. All relay
+// types share the exact same x-relay-target / x-relay-path / x-relay-auth header spec; only the
+// deployment surface differs.
 import { randomUUID } from "crypto";
 import { getDbInstance } from "./core";
 import { backupDbFile } from "./backup";
@@ -119,6 +122,15 @@ function mapAssignmentRow(row: unknown): ProxyAssignmentRecord {
   };
 }
 
+// Edge-relay proxy types. Mirrors RELAY_TYPES in open-sse/utils/proxyDispatcher.
+// Duplicated here (not imported) to keep src/lib/db/ free of open-sse runtime
+// imports; if a third relay backend lands, update BOTH sets.
+const RELAY_PROXY_TYPES = new Set(["vercel", "deno", "cloudflare"]);
+
+function isRelayProxyType(type: unknown): boolean {
+  return typeof type === "string" && RELAY_PROXY_TYPES.has(type);
+}
+
 function extractRelayAuth(notes: unknown): string | undefined {
   if (typeof notes !== "string") return undefined;
   try {
@@ -141,7 +153,7 @@ function extractRelayAuth(notes: unknown): string | undefined {
 
 function toRegistryProxyResolution(row: unknown, level: ProxyScope, levelId: string | null) {
   const record = toRecord(row);
-  const relayAuth = record.type === "vercel" ? extractRelayAuth(record.notes) : undefined;
+  const relayAuth = isRelayProxyType(record.type) ? extractRelayAuth(record.notes) : undefined;
   return {
     proxy: {
       type: record.type,
@@ -383,7 +395,7 @@ function coerceProxyPayload(value: unknown, fallbackName: string): ProxyPayload
 
 export function redactProxySecrets(proxy: ProxyRegistryRecord): ProxyRegistryRecord {
   let redactedNotes = proxy.notes;
-  if (proxy.type === "vercel" && proxy.notes) {
+  if (isRelayProxyType(proxy.type) && proxy.notes) {
     try {
       const parsed = JSON.parse(proxy.notes);
       if (parsed && typeof parsed === "object") {
@@ -719,7 +731,7 @@ export async function resolveProxyForConnectionFromRegistry(connectionId: string
       .get(connectionId);
     if (accountAssignment) {
       const record = toRecord(accountAssignment);
-      const relayAuth = record.type === "vercel" ? extractRelayAuth(record.notes) : undefined;
+      const relayAuth = isRelayProxyType(record.type) ? extractRelayAuth(record.notes) : undefined;
       return {
         proxy: {
           type: record.type,
@@ -748,7 +760,7 @@ export async function resolveProxyForConnectionFromRegistry(connectionId: string
         .get(connection.provider);
       if (providerAssignment) {
         const record = toRecord(providerAssignment);
-        const relayAuth = record.type === "vercel" ? extractRelayAuth(record.notes) : undefined;
+        const relayAuth = isRelayProxyType(record.type) ? extractRelayAuth(record.notes) : undefined;
         return {
           proxy: {
             type: record.type,
@@ -773,7 +785,7 @@ export async function resolveProxyForConnectionFromRegistry(connectionId: string
       .get();
     if (globalAssignment) {
       const record = toRecord(globalAssignment);
-      const relayAuth = record.type === "vercel" ? extractRelayAuth(record.notes) : undefined;
+      const relayAuth = isRelayProxyType(record.type) ? extractRelayAuth(record.notes) : undefined;
       return {
         proxy: {
           type: record.type,
diff --git a/src/lib/db/quotaModelCaps.ts b/src/lib/db/quotaModelCaps.ts
new file mode 100644
index 0000000000..86306122d2
--- /dev/null
+++ b/src/lib/db/quotaModelCaps.ts
@@ -0,0 +1,128 @@
+/**
+ * db/quotaModelCaps.ts — CRUD for quota_allocation_model_caps table.
+ *
+ * Per-(pool_id, api_key_id, model) budget caps for the Quota Share Engine.
+ * Closes the "one key drains the pool on a single model" attack (Fase 3 #7).
+ *
+ * cap_unit aligns with QuotaUnit: "requests" | "tokens" | "usd" | "percent".
+ * cap_value of ≤ Number.EPSILON is treated as a placeholder by the enforce
+ * layer (not enforced), consistent with the planRegistry EPSILON convention.
+ *
+ * All SQL goes through prepared statements — never raw string interpolation
+ * (Hard Rule #5).
+ */
+
+import { getDbInstance } from "./core";
+
+// ---------------------------------------------------------------------------
+// Types
+// ---------------------------------------------------------------------------
+
+type QuotaUnit = "percent" | "requests" | "tokens" | "usd";
+
+export interface ModelCap {
+  poolId: string;
+  apiKeyId: string;
+  model: string;
+  capValue: number;
+  capUnit: QuotaUnit;
+}
+
+interface ModelCapRow {
+  pool_id: string;
+  api_key_id: string;
+  model: string;
+  cap_value: number;
+  cap_unit: string;
+}
+
+// ---------------------------------------------------------------------------
+// Internal helpers
+// ---------------------------------------------------------------------------
+
+interface StatementLike<TRow = unknown> {
+  all: (...params: unknown[]) => TRow[];
+  get: (...params: unknown[]) => TRow | undefined;
+  run: (...params: unknown[]) => { changes: number };
+}
+
+interface DbLike {
+  prepare: <TRow = unknown>(sql: string) => StatementLike<TRow>;
+}
+
+function rowToModelCap(row: ModelCapRow): ModelCap {
+  return {
+    poolId: row.pool_id,
+    apiKeyId: row.api_key_id,
+    model: row.model,
+    capValue: row.cap_value,
+    capUnit: row.cap_unit as QuotaUnit,
+  };
+}
+
+function getDb(): DbLike {
+  return getDbInstance() as unknown as DbLike;
+}
+
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+
+/**
+ * Retrieve the cap for a specific (pool, key, model) triple.
+ * Returns null if no cap is configured.
+ */
+export function getModelCap(poolId: string, apiKeyId: string, model: string): ModelCap | null {
+  const row = getDb()
+    .prepare<ModelCapRow>(
+      `SELECT pool_id, api_key_id, model, cap_value, cap_unit
+       FROM quota_allocation_model_caps
+       WHERE pool_id = ? AND api_key_id = ? AND model = ?`
+    )
+    .get(poolId, apiKeyId, model);
+  return row ? rowToModelCap(row) : null;
+}
+
+/**
+ * List all model caps for a given (pool, key) pair.
+ */
+export function listModelCaps(poolId: string, apiKeyId: string): ModelCap[] {
+  const rows = getDb()
+    .prepare<ModelCapRow>(
+      `SELECT pool_id, api_key_id, model, cap_value, cap_unit
+       FROM quota_allocation_model_caps
+       WHERE pool_id = ? AND api_key_id = ?`
+    )
+    .all(poolId, apiKeyId);
+  return rows.map(rowToModelCap);
+}
+
+/**
+ * Insert or replace a model cap.
+ * cap_value must be > 0 (enforced by DB CHECK constraint).
+ */
+export function setModelCap(cap: ModelCap): void {
+  getDb()
+    .prepare(
+      `INSERT INTO quota_allocation_model_caps
+         (pool_id, api_key_id, model, cap_value, cap_unit)
+       VALUES (?, ?, ?, ?, ?)
+       ON CONFLICT(pool_id, api_key_id, model) DO UPDATE SET
+         cap_value = excluded.cap_value,
+         cap_unit  = excluded.cap_unit`
+    )
+    .run(cap.poolId, cap.apiKeyId, cap.model, cap.capValue, cap.capUnit);
+}
+
+/**
+ * Remove the cap for a specific (pool, key, model) triple.
+ * No-op if it does not exist.
+ */
+export function deleteModelCap(poolId: string, apiKeyId: string, model: string): void {
+  getDb()
+    .prepare(
+      `DELETE FROM quota_allocation_model_caps
+       WHERE pool_id = ? AND api_key_id = ? AND model = ?`
+    )
+    .run(poolId, apiKeyId, model);
+}
diff --git a/src/lib/db/quotaPools.ts b/src/lib/db/quotaPools.ts
index 14b9032e3a..93cf86264d 100644
--- a/src/lib/db/quotaPools.ts
+++ b/src/lib/db/quotaPools.ts
@@ -144,11 +144,25 @@ interface AllocationRow {
   policy: string;
 }
 
+const VALID_POLICIES: ReadonlySet<string> = new Set<Policy>(["hard", "soft", "burst"]);
+
+/**
+ * Fail-safe policy normalization at the DB read boundary. A column value outside
+ * `hard | soft | burst` (corrupted/legacy row, or a value inserted while the
+ * table CHECK constraint was bypassed) is coerced to the most restrictive
+ * policy, `hard`, instead of being trusted via a raw `as Policy` cast. This
+ * prevents an unknown policy from reaching the fair-share engine, where it would
+ * otherwise be a silent fail-OPEN (issue #10).
+ */
+function normalizePolicy(value: string): Policy {
+  return VALID_POLICIES.has(value) ? (value as Policy) : "hard";
+}
+
 function rowToAllocation(row: AllocationRow): PoolAllocation {
   const alloc: PoolAllocation = {
     apiKeyId: row.api_key_id,
     weight: row.weight,
-    policy: row.policy as Policy,
+    policy: normalizePolicy(row.policy),
   };
   if (row.cap_value != null) alloc.capValue = row.cap_value;
   if (row.cap_unit != null) alloc.capUnit = row.cap_unit as QuotaUnit;
diff --git a/src/lib/db/schemaColumns.ts b/src/lib/db/schemaColumns.ts
new file mode 100644
index 0000000000..ccc55d77ed
--- /dev/null
+++ b/src/lib/db/schemaColumns.ts
@@ -0,0 +1,217 @@
+/**
+ * db/schemaColumns.ts — idempotent schema-column reconciliation + table introspection.
+ *
+ * Extracted from db/core.ts (god-file decomposition): the helpers that bring older SQLite
+ * files up to the current column set (ALTER TABLE … ADD COLUMN, guarded by PRAGMA
+ * table_info) plus the small introspection utilities they build on. Each takes the db
+ * handle explicitly — no module state — so they live as a co-located leaf that core.ts
+ * calls during getDbInstance() bootstrap. Behavior-preserving move.
+ */
+
+import type { SqliteAdapter } from "./adapters/types";
+
+type SqliteDatabase = SqliteAdapter;
+
+export function ensureProviderConnectionsColumns(db: SqliteDatabase) {
+  try {
+    const columns = db.prepare("PRAGMA table_info(provider_connections)").all() as Array<{
+      name?: string;
+    }>;
+    const columnNames = new Set(columns.map((column) => String(column.name ?? "")));
+    if (!columnNames.has("rate_limit_protection")) {
+      db.exec(
+        "ALTER TABLE provider_connections ADD COLUMN rate_limit_protection INTEGER DEFAULT 0"
+      );
+      console.log("[DB] Added provider_connections.rate_limit_protection column");
+    }
+    if (!columnNames.has("last_used_at")) {
+      db.exec("ALTER TABLE provider_connections ADD COLUMN last_used_at TEXT");
+      console.log("[DB] Added provider_connections.last_used_at column");
+    }
+    if (!columnNames.has("group")) {
+      db.exec('ALTER TABLE provider_connections ADD COLUMN "group" TEXT');
+      console.log('[DB] Added provider_connections."group" column');
+    }
+    if (!columnNames.has("max_concurrent")) {
+      db.exec("ALTER TABLE provider_connections ADD COLUMN max_concurrent INTEGER");
+      console.log("[DB] Added provider_connections.max_concurrent column");
+    }
+    if (!columnNames.has("proxy_enabled")) {
+      db.exec(
+        "ALTER TABLE provider_connections ADD COLUMN proxy_enabled INTEGER NOT NULL DEFAULT 1"
+      );
+      console.log("[DB] Added provider_connections.proxy_enabled column");
+    }
+    if (!columnNames.has("per_key_proxy_enabled")) {
+      db.exec(
+        "ALTER TABLE provider_connections ADD COLUMN per_key_proxy_enabled INTEGER NOT NULL DEFAULT 0"
+      );
+      console.log("[DB] Added provider_connections.per_key_proxy_enabled column");
+    }
+    if (!columnNames.has("quota_window_thresholds_json")) {
+      db.exec("ALTER TABLE provider_connections ADD COLUMN quota_window_thresholds_json TEXT");
+      console.log("[DB] Added provider_connections.quota_window_thresholds_json column");
+    }
+    if (!columnNames.has("rate_limit_overrides_json")) {
+      db.exec("ALTER TABLE provider_connections ADD COLUMN rate_limit_overrides_json TEXT");
+      console.log("[DB] Added provider_connections.rate_limit_overrides_json column");
+    }
+    db.exec(
+      "CREATE INDEX IF NOT EXISTS idx_pc_max_concurrent ON provider_connections(provider, max_concurrent)"
+    );
+  } catch (error: unknown) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.warn("[DB] Failed to verify provider_connections schema:", message);
+  }
+}
+
+export function ensureUsageHistoryColumns(db: SqliteDatabase) {
+  try {
+    const columns = db.prepare("PRAGMA table_info(usage_history)").all() as Array<{
+      name?: string;
+    }>;
+    const columnNames = new Set(columns.map((column) => String(column.name ?? "")));
+
+    if (!columnNames.has("success")) {
+      db.exec("ALTER TABLE usage_history ADD COLUMN success INTEGER DEFAULT 1");
+      console.log("[DB] Added usage_history.success column");
+    }
+    if (!columnNames.has("latency_ms")) {
+      db.exec("ALTER TABLE usage_history ADD COLUMN latency_ms INTEGER DEFAULT 0");
+      console.log("[DB] Added usage_history.latency_ms column");
+    }
+    if (!columnNames.has("ttft_ms")) {
+      db.exec("ALTER TABLE usage_history ADD COLUMN ttft_ms INTEGER DEFAULT 0");
+      console.log("[DB] Added usage_history.ttft_ms column");
+    }
+    if (!columnNames.has("error_code")) {
+      db.exec("ALTER TABLE usage_history ADD COLUMN error_code TEXT");
+      console.log("[DB] Added usage_history.error_code column");
+    }
+    if (!columnNames.has("service_tier")) {
+      db.exec("ALTER TABLE usage_history ADD COLUMN service_tier TEXT DEFAULT 'standard'");
+      console.log("[DB] Added usage_history.service_tier column");
+    }
+    db.exec("CREATE INDEX IF NOT EXISTS idx_uh_service_tier ON usage_history(service_tier)");
+    if (!columnNames.has("combo_strategy")) {
+      db.exec("ALTER TABLE usage_history ADD COLUMN combo_strategy TEXT DEFAULT 'direct'");
+      console.log("[DB] Added usage_history.combo_strategy column");
+    }
+    db.exec("CREATE INDEX IF NOT EXISTS idx_uh_combo_strategy ON usage_history(combo_strategy)");
+  } catch (error: unknown) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.warn("[DB] Failed to verify usage_history schema:", message);
+  }
+}
+
+export function ensureCallLogsColumns(db: SqliteDatabase) {
+  try {
+    const columns = db.prepare("PRAGMA table_info(call_logs)").all() as Array<{
+      name?: string;
+    }>;
+    const columnNames = new Set(columns.map((column) => String(column.name ?? "")));
+
+    if (!columnNames.has("artifact_relpath")) {
+      db.exec("ALTER TABLE call_logs ADD COLUMN artifact_relpath TEXT");
+      console.log("[DB] Added call_logs.artifact_relpath column");
+    }
+    if (!columnNames.has("has_pipeline_details")) {
+      db.exec("ALTER TABLE call_logs ADD COLUMN has_pipeline_details INTEGER DEFAULT 0");
+      console.log("[DB] Added call_logs.has_pipeline_details column");
+    }
+    if (!columnNames.has("requested_model")) {
+      db.exec("ALTER TABLE call_logs ADD COLUMN requested_model TEXT DEFAULT NULL");
+      console.log("[DB] Added call_logs.requested_model column");
+    }
+    if (!columnNames.has("request_type")) {
+      db.exec("ALTER TABLE call_logs ADD COLUMN request_type TEXT DEFAULT NULL");
+      console.log("[DB] Added call_logs.request_type column");
+    }
+    if (!columnNames.has("tokens_cache_read")) {
+      db.exec("ALTER TABLE call_logs ADD COLUMN tokens_cache_read INTEGER DEFAULT NULL");
+      console.log("[DB] Added call_logs.tokens_cache_read column");
+    }
+    if (!columnNames.has("tokens_cache_creation")) {
+      db.exec("ALTER TABLE call_logs ADD COLUMN tokens_cache_creation INTEGER DEFAULT NULL");
+      console.log("[DB] Added call_logs.tokens_cache_creation column");
+    }
+    if (!columnNames.has("tokens_reasoning")) {
+      db.exec("ALTER TABLE call_logs ADD COLUMN tokens_reasoning INTEGER DEFAULT NULL");
+      console.log("[DB] Added call_logs.tokens_reasoning column");
+    }
+    if (!columnNames.has("cache_source")) {
+      db.exec("ALTER TABLE call_logs ADD COLUMN cache_source TEXT DEFAULT 'upstream'");
+      console.log("[DB] Added call_logs.cache_source column");
+    }
+    if (!columnNames.has("combo_step_id")) {
+      db.exec("ALTER TABLE call_logs ADD COLUMN combo_step_id TEXT DEFAULT NULL");
+      console.log("[DB] Added call_logs.combo_step_id column");
+    }
+    if (!columnNames.has("combo_execution_key")) {
+      db.exec("ALTER TABLE call_logs ADD COLUMN combo_execution_key TEXT DEFAULT NULL");
+      console.log("[DB] Added call_logs.combo_execution_key column");
+    }
+    if (!columnNames.has("error_summary")) {
+      db.exec("ALTER TABLE call_logs ADD COLUMN error_summary TEXT DEFAULT NULL");
+      console.log("[DB] Added call_logs.error_summary column");
+    }
+    if (!columnNames.has("detail_state")) {
+      db.exec("ALTER TABLE call_logs ADD COLUMN detail_state TEXT DEFAULT 'none'");
+      console.log("[DB] Added call_logs.detail_state column");
+    }
+    if (!columnNames.has("artifact_size_bytes")) {
+      db.exec("ALTER TABLE call_logs ADD COLUMN artifact_size_bytes INTEGER DEFAULT NULL");
+      console.log("[DB] Added call_logs.artifact_size_bytes column");
+    }
+    if (!columnNames.has("artifact_sha256")) {
+      db.exec("ALTER TABLE call_logs ADD COLUMN artifact_sha256 TEXT DEFAULT NULL");
+      console.log("[DB] Added call_logs.artifact_sha256 column");
+    }
+    if (!columnNames.has("has_request_body")) {
+      db.exec("ALTER TABLE call_logs ADD COLUMN has_request_body INTEGER DEFAULT 0");
+      console.log("[DB] Added call_logs.has_request_body column");
+    }
+    if (!columnNames.has("has_response_body")) {
+      db.exec("ALTER TABLE call_logs ADD COLUMN has_response_body INTEGER DEFAULT 0");
+      console.log("[DB] Added call_logs.has_response_body column");
+    }
+    if (!columnNames.has("request_summary")) {
+      db.exec("ALTER TABLE call_logs ADD COLUMN request_summary TEXT DEFAULT NULL");
+      console.log("[DB] Added call_logs.request_summary column");
+    }
+
+    db.exec(
+      "CREATE INDEX IF NOT EXISTS idx_call_logs_requested_model ON call_logs(requested_model)"
+    );
+    db.exec("CREATE INDEX IF NOT EXISTS idx_call_logs_request_type ON call_logs(request_type)");
+    db.exec(
+      "CREATE INDEX IF NOT EXISTS idx_cl_combo_target ON call_logs(combo_name, combo_execution_key, timestamp)"
+    );
+  } catch (error: unknown) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.warn("[DB] Failed to verify call_logs schema:", message);
+  }
+}
+
+export function hasColumn(db: SqliteDatabase, tableName: string, columnName: string): boolean {
+  const rows = db.prepare(`PRAGMA table_info(${tableName})`).all() as Array<{ name?: string }>;
+  return rows.some((row) => row.name === columnName);
+}
+
+export function hasTable(db: SqliteDatabase, tableName: string): boolean {
+  return Boolean(
+    db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?").get(tableName)
+  );
+}
+
+export function quoteIdentifier(identifier: string): string {
+  return `"${identifier.replace(/"/g, '""')}"`;
+}
+
+export function getTableColumns(db: SqliteDatabase, tableName: string): string[] {
+  return (
+    db.prepare(`PRAGMA table_info(${quoteIdentifier(tableName)})`).all() as Array<{ name?: string }>
+  )
+    .map((column) => String(column.name ?? ""))
+    .filter((column) => column.length > 0);
+}
diff --git a/src/lib/db/settings.ts b/src/lib/db/settings.ts
index 9791a0d22a..f6b207b775 100644
--- a/src/lib/db/settings.ts
+++ b/src/lib/db/settings.ts
@@ -147,6 +147,8 @@ export async function getSettings() {
     customBannedSignals: [],
     proxyEnabled: true,
     perKeyProxyEnabled: false,
+    customSystemPromptEnabled: false,
+    customSystemPrompt: "",
   };
   for (const row of rows) {
     const record = toRecord(row);
diff --git a/src/lib/db/usageAnalytics.ts b/src/lib/db/usageAnalytics.ts
index 2d73c1d92f..1bdf859648 100644
--- a/src/lib/db/usageAnalytics.ts
+++ b/src/lib/db/usageAnalytics.ts
@@ -821,6 +821,79 @@ export function getPresetCostModelRows(
     .all(params) as PresetCostModelRow[];
 }
 
+// ---------------------------------------------------------------------------
+// Endpoint dimension — ported from decolua/9router#152 (thanks @toanalien).
+// Reads directly from usage_history (raw rows) so the unified CTE stays
+// untouched; matches the pattern used by getAutoRoutingVariantBreakdown.
+// ---------------------------------------------------------------------------
+
+export interface EndpointUsageRow {
+  endpoint: string;
+  provider: string;
+  model: string;
+  requests: number;
+  promptTokens: number;
+  completionTokens: number;
+  cacheReadTokens: number;
+  cacheCreationTokens: number;
+  reasoningTokens: number;
+  totalTokens: number;
+  avgLatencyMs: number;
+  successfulRequests: number;
+  lastUsed: string;
+}
+
+export interface EndpointUsageParams {
+  sinceIso?: string | null;
+  untilIso?: string | null;
+}
+
+/**
+ * Per-endpoint × provider × model usage aggregates from `usage_history`.
+ * NULL endpoints fold into the 'unknown' bucket so legacy rows stay visible.
+ *
+ * Inspired by decolua/9router#152 (byEndpoint aggregation), reshaped for the
+ * OmniRoute SQLite schema + analytics conventions.
+ */
+export function getEndpointUsageRows(params: EndpointUsageParams = {}): EndpointUsageRow[] {
+  const db = getDbInstance();
+  const conditions: string[] = [];
+  const bind: Record<string, unknown> = {};
+  if (params.sinceIso) {
+    conditions.push("timestamp >= @since");
+    bind.since = params.sinceIso;
+  }
+  if (params.untilIso) {
+    conditions.push("timestamp <= @until");
+    bind.until = params.untilIso;
+  }
+  const whereSql = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+  return db
+    .prepare(
+      `
+      SELECT
+        COALESCE(NULLIF(endpoint, ''), 'unknown') as endpoint,
+        LOWER(COALESCE(provider, 'unknown')) as provider,
+        LOWER(COALESCE(model, 'unknown')) as model,
+        COUNT(*) as requests,
+        COALESCE(SUM(tokens_input), 0) as promptTokens,
+        COALESCE(SUM(tokens_output), 0) as completionTokens,
+        COALESCE(SUM(tokens_cache_read), 0) as cacheReadTokens,
+        COALESCE(SUM(tokens_cache_creation), 0) as cacheCreationTokens,
+        COALESCE(SUM(tokens_reasoning), 0) as reasoningTokens,
+        COALESCE(SUM(tokens_input + tokens_output), 0) as totalTokens,
+        COALESCE(AVG(latency_ms), 0) as avgLatencyMs,
+        COALESCE(SUM(CASE WHEN success = 1 THEN 1 ELSE 0 END), 0) as successfulRequests,
+        COALESCE(MAX(timestamp), '') as lastUsed
+      FROM usage_history
+      ${whereSql}
+      GROUP BY endpoint, LOWER(COALESCE(provider, 'unknown')), LOWER(COALESCE(model, 'unknown'))
+      ORDER BY requests DESC
+    `
+    )
+    .all(bind) as EndpointUsageRow[];
+}
+
 // ---------------------------------------------------------------------------
 // Export-JSON backup — /api/settings/export-json
 // ---------------------------------------------------------------------------
diff --git a/src/lib/display/useProviderNodeMap.ts b/src/lib/display/useProviderNodeMap.ts
new file mode 100644
index 0000000000..df152509f4
--- /dev/null
+++ b/src/lib/display/useProviderNodeMap.ts
@@ -0,0 +1,68 @@
+/**
+ * Shared resolver for custom provider display names.
+ *
+ * Provides:
+ *   - `resolveProviderName(id, nodeMap)` — pure function for tests and SSR
+ *   - `useProviderNodeMap()` — React hook that fetches /api/provider-nodes once
+ *     and returns a Map<id, {name?, prefix?}>
+ *
+ * Usage in components:
+ *   const nodeMap = useProviderNodeMap();
+ *   const label = resolveProviderName(providerId, nodeMap);
+ *
+ * @module lib/display/useProviderNodeMap
+ */
+
+"use client";
+
+import { useEffect, useState } from "react";
+import { getProviderDisplayName, type ProviderNodeLike } from "./names";
+
+export type ProviderNodeEntry = { name?: string | null; prefix?: string | null };
+
+/**
+ * Pure resolver — usable in tests without React.
+ *
+ * Delegates to the canonical `getProviderDisplayName` helper, supplying the
+ * node entry from the map as the second argument so custom names take priority.
+ */
+export function resolveProviderName(
+  id: string | null | undefined,
+  nodeMap: Map<string, ProviderNodeEntry> | null | undefined
+): string {
+  const node = id ? (nodeMap?.get(id) ?? null) : null;
+  return getProviderDisplayName(id, node as ProviderNodeLike | null);
+}
+
+/**
+ * Fetches /api/provider-nodes once per mount and returns a stable Map.
+ * Returns an empty Map while loading or on error — callers degrade gracefully
+ * because `resolveProviderName` falls back to the de-UUIDed id.
+ */
+export function useProviderNodeMap(): Map<string, ProviderNodeEntry> {
+  const [nodeMap, setNodeMap] = useState<Map<string, ProviderNodeEntry>>(new Map());
+
+  useEffect(() => {
+    let cancelled = false;
+    fetch("/api/provider-nodes")
+      .then((r) => (r.ok ? r.json() : null))
+      .then((data) => {
+        if (cancelled || !data?.nodes) return;
+        const map = new Map<string, ProviderNodeEntry>();
+        for (const node of data.nodes) {
+          if (typeof node.id === "string") {
+            map.set(node.id, { name: node.name ?? null, prefix: node.prefix ?? null });
+          }
+        }
+        setNodeMap(map);
+      })
+      .catch(() => {
+        // Silently degrade — custom providers will show de-UUIDed fallback label
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, []);
+
+  return nodeMap;
+}
diff --git a/src/lib/localDb.ts b/src/lib/localDb.ts
index 0979fa4138..68b1245590 100755
--- a/src/lib/localDb.ts
+++ b/src/lib/localDb.ts
@@ -533,6 +533,7 @@ export {
   deleteFreeProxy,
   clearFreeProxiesBySource,
   getFreeProxyStats,
+  recordFreeProxySync,
 } from "./db/freeProxies";
 
 export type { FreeProxyRecord, FreeProxyStats } from "./db/freeProxies";
@@ -574,6 +575,13 @@ export {
   upsertAllocations,
   listAllocationsForApiKey,
 } from "./db/quotaPools";
+// Quota per-(key, model) caps — Group B Fase 3 #7
+export {
+  getModelCap,
+  listModelCaps,
+  setModelCap,
+  deleteModelCap,
+} from "./db/quotaModelCaps";
 
 export {
   // Quota Groups (B2)
diff --git a/src/lib/oauth/constants/oauth.ts b/src/lib/oauth/constants/oauth.ts
index f415963fa6..d7dbc941c0 100644
--- a/src/lib/oauth/constants/oauth.ts
+++ b/src/lib/oauth/constants/oauth.ts
@@ -131,6 +131,19 @@ export const QODER_CONFIG = {
   },
 };
 
+// CodeBuddy CN (Tencent — copilot.tencent.com) OAuth Configuration
+// (Custom Device-Auth Flow: POST stateUrl → open authUrl → GET pollUrl?state=).
+// No client_id/secret — the upstream CLI ships none.
+export const CODEBUDDY_CN_CONFIG = {
+  baseUrl: "https://copilot.tencent.com",
+  stateUrl: "https://copilot.tencent.com/v2/plugin/auth/state",
+  tokenUrl: "https://copilot.tencent.com/v2/plugin/auth/token",
+  refreshUrl: "https://copilot.tencent.com/v2/plugin/auth/token/refresh",
+  userAgent: "CLI/2.63.2 CodeBuddy/2.63.2",
+  platform: "CLI",
+  pollInterval: 5000,
+};
+
 // Kimi Coding OAuth Configuration (Device Code Flow)
 export const KIMI_CODING_CONFIG = {
   clientId: resolvePublicCred("kimi_id", "KIMI_CODING_OAUTH_CLIENT_ID"),
@@ -262,6 +275,22 @@ export const GITLAB_DUO_CONFIG = {
   codeChallengeMethod: "S256",
 };
 
+// AWS region allowlist — prevents SSRF via region injection into upstream URLs
+// (GHSA-6mwv-4mrm-5p3m). Region values flow user-supplied through the kiro OAuth
+// import surfaces (request body, providerSpecificData) and are interpolated into
+// URLs like `https://oidc.${region}.amazonaws.com/...`. Without this guard, a
+// region like "127.0.0.1" or "evil.com" would redirect the proxy's outbound
+// fetch to an attacker-controlled host. Canonical AWS region shape only:
+// two letters, dash, one-or-more letters, dash, one-or-two digits.
+export const AWS_REGION_PATTERN = /^[a-z]{2}-[a-z]+-\d{1,2}$/;
+
+export function assertValidAwsRegion(region: string): string {
+  if (typeof region !== "string" || !AWS_REGION_PATTERN.test(region)) {
+    throw new Error("Invalid region");
+  }
+  return region;
+}
+
 // Kiro OAuth Configuration
 // Supports multiple auth methods:
 // 1. AWS Builder ID (Device Code Flow)
@@ -440,4 +469,5 @@ export const PROVIDERS = {
   WINDSURF: "windsurf",
   DEVIN_CLI: "devin-cli",
   TRAE: "trae",
+  CODEBUDDY_CN: "codebuddy-cn",
 };
diff --git a/src/lib/oauth/providers/codebuddy-cn.ts b/src/lib/oauth/providers/codebuddy-cn.ts
new file mode 100644
index 0000000000..3a4fa93544
--- /dev/null
+++ b/src/lib/oauth/providers/codebuddy-cn.ts
@@ -0,0 +1,123 @@
+import { CODEBUDDY_CN_CONFIG } from "../constants/oauth";
+
+/**
+ * CodeBuddy CN (Tencent — copilot.tencent.com) — custom device-auth flow.
+ *
+ *   1. POST stateUrl → { code: 0, data: { state, authUrl } }
+ *   2. Open authUrl in the browser
+ *   3. GET tokenUrl?state=<state> until { code: 0, data.accessToken } (11217 = pending)
+ *
+ * Mirrors the official CodeBuddy CLI's distinguishing detail: poll is GET with
+ * the state as a query param, NOT POST/body.
+ */
+type CodeBuddyConfig = typeof CODEBUDDY_CN_CONFIG;
+
+interface CodeBuddyDeviceCodeResponse {
+  device_code: string;
+  user_code: string;
+  verification_uri: string;
+  verification_uri_complete: string;
+  expires_in: number;
+  interval: number;
+}
+
+interface CodeBuddyTokens {
+  access_token: string;
+  refresh_token: string;
+  token_type: string;
+  expires_in?: number;
+}
+
+interface CodeBuddyPollResult {
+  ok: boolean;
+  data: Record<string, unknown> | CodeBuddyTokens;
+}
+
+export const codebuddyCn = {
+  config: CODEBUDDY_CN_CONFIG,
+  flowType: "device_code" as const,
+
+  requestDeviceCode: async (config: CodeBuddyConfig): Promise<CodeBuddyDeviceCodeResponse> => {
+    const response = await fetch(config.stateUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json",
+        "User-Agent": config.userAgent,
+        "X-Requested-With": "XMLHttpRequest",
+        "X-Domain": "copilot.tencent.com",
+        "X-No-Authorization": "true",
+        "X-No-User-Id": "true",
+        "X-Product": "SaaS",
+      },
+      body: JSON.stringify({ platform: config.platform }),
+    });
+
+    if (!response.ok) {
+      const err = await response.text();
+      throw new Error(`CodeBuddy state request failed (${response.status})`);
+    }
+
+    const json = (await response.json()) as { code?: number; data?: any; msg?: string };
+    if (json.code !== 0 || !json.data?.state) {
+      throw new Error(`CodeBuddy state error: ${json.msg || "no state in response"}`);
+    }
+
+    const state = String(json.data.state);
+    const authUrl = String(json.data.authUrl || json.data.url || "");
+    return {
+      device_code: state,
+      user_code: state,
+      verification_uri: authUrl,
+      verification_uri_complete: authUrl,
+      expires_in: 600,
+      interval: Math.max(1, Math.floor((config.pollInterval || 5000) / 1000)),
+    };
+  },
+
+  pollToken: async (config: CodeBuddyConfig, deviceCode: string): Promise<CodeBuddyPollResult> => {
+    // GET with state as a query param (not POST/body) — matches the official CLI's
+    // /v2/plugin/auth/token?state=... endpoint shape.
+    const response = await fetch(
+      `${config.tokenUrl}?state=${encodeURIComponent(deviceCode)}`,
+      {
+        method: "GET",
+        headers: {
+          Accept: "application/json",
+          "User-Agent": config.userAgent,
+          "X-Requested-With": "XMLHttpRequest",
+          "X-Domain": "copilot.tencent.com",
+          "X-No-Authorization": "true",
+          "X-No-User-Id": "true",
+          "X-No-Enterprise-Id": "true",
+          "X-No-Department-Info": "true",
+          "X-Product": "SaaS",
+        },
+      }
+    );
+    if (!response.ok) return { ok: false, data: { error: "request_failed" } };
+    const data = (await response.json()) as { code?: number; data?: any; msg?: string };
+    // code 11217 = pending (RetryFetchToken), code 0 = success
+    if (data.code === 0 && data.data?.accessToken) {
+      return {
+        ok: true,
+        data: {
+          access_token: data.data.accessToken,
+          refresh_token: data.data.refreshToken || "",
+          token_type: data.data.tokenType || "Bearer",
+          expires_in: data.data.expiresIn,
+        },
+      };
+    }
+    return { ok: false, data: { code: data.code, msg: data.msg } };
+  },
+
+  mapTokens: (tokens: CodeBuddyTokens) => ({
+    accessToken: tokens.access_token,
+    refreshToken: tokens.refresh_token,
+    expiresIn: tokens.expires_in || 86400,
+    providerSpecificData: {},
+  }),
+};
+
+export default codebuddyCn;
diff --git a/src/lib/oauth/providers/index.ts b/src/lib/oauth/providers/index.ts
index 208fbbacdb..b98d7b28df 100644
--- a/src/lib/oauth/providers/index.ts
+++ b/src/lib/oauth/providers/index.ts
@@ -26,6 +26,7 @@ import { trae } from "./trae";
 import { kilocode } from "./kilocode";
 import { cline } from "./cline";
 import { windsurf } from "./windsurf";
+import { codebuddyCn } from "./codebuddy-cn";
 
 export const PROVIDERS = {
   claude,
@@ -47,6 +48,7 @@ export const PROVIDERS = {
   windsurf,
   // devin-cli shares the same token format as windsurf (WINDSURF_API_KEY / devin auth login)
   "devin-cli": windsurf,
+  "codebuddy-cn": codebuddyCn,
 };
 
 export default PROVIDERS;
diff --git a/src/lib/oauth/providers/kiro.ts b/src/lib/oauth/providers/kiro.ts
index 63d9965114..2efb7fc609 100644
--- a/src/lib/oauth/providers/kiro.ts
+++ b/src/lib/oauth/providers/kiro.ts
@@ -1,11 +1,16 @@
-import { KIRO_CONFIG } from "../constants/oauth";
+import { KIRO_CONFIG, AWS_REGION_PATTERN, assertValidAwsRegion } from "../constants/oauth";
 
 export const kiro = {
   config: KIRO_CONFIG,
   flowType: "device_code",
   requestDeviceCode: async (config) => {
     const regionMatch = String(config.tokenUrl || "").match(/oidc\.([a-z0-9-]+)\.amazonaws\.com/i);
-    const resolvedRegion = regionMatch?.[1] || "us-east-1";
+    const candidateRegion = regionMatch?.[1] || "us-east-1";
+    // Region is sourced from KIRO_CONFIG.tokenUrl (trusted constant) but defensively
+    // re-validate before letting it influence later fetches (GHSA-6mwv-4mrm-5p3m).
+    const resolvedRegion = AWS_REGION_PATTERN.test(candidateRegion)
+      ? candidateRegion
+      : "us-east-1";
     const registerPayload: {
       clientName: string;
       clientType: string;
@@ -77,6 +82,7 @@ export const kiro = {
   },
   pollToken: async (config, deviceCode, codeVerifier, extraData) => {
     const tokenRegion = String(extraData?._region || "us-east-1").toLowerCase();
+    assertValidAwsRegion(tokenRegion);
     const tokenUrl = `https://oidc.${tokenRegion}.amazonaws.com/token`;
 
     const response = await fetch(tokenUrl, {
@@ -132,6 +138,9 @@ export const kiro = {
     const accessToken = tokenData?.access_token;
     if (!accessToken) return null;
     const region = String(tokenData?._region || "us-east-1").toLowerCase();
+    // Defensive: tokenData._region came from upstream JSON or extraData
+    // and is interpolated into the runtime host below (GHSA-6mwv-4mrm-5p3m).
+    if (!AWS_REGION_PATTERN.test(region)) return null;
     const runtimeHost =
       region === "us-east-1"
         ? "https://codewhisperer.us-east-1.amazonaws.com"
diff --git a/src/lib/oauth/services/kiro.ts b/src/lib/oauth/services/kiro.ts
index e3ca235de3..b1357533f3 100644
--- a/src/lib/oauth/services/kiro.ts
+++ b/src/lib/oauth/services/kiro.ts
@@ -1,4 +1,4 @@
-import { KIRO_CONFIG } from "../constants/oauth";
+import { KIRO_CONFIG, assertValidAwsRegion } from "../constants/oauth";
 
 /**
  * Kiro OAuth Service
@@ -17,6 +17,7 @@ export class KiroService {
    * Returns clientId and clientSecret for device code flow
    */
   async registerClient(region: string = "us-east-1") {
+    assertValidAwsRegion(region);
     const endpoint = `https://oidc.${region}.amazonaws.com/client/register`;
 
     const response = await fetch(endpoint, {
@@ -55,6 +56,7 @@ export class KiroService {
     startUrl: string,
     region: string = "us-east-1"
   ) {
+    assertValidAwsRegion(region);
     const endpoint = `https://oidc.${region}.amazonaws.com/device_authorization`;
 
     const response = await fetch(endpoint, {
@@ -94,6 +96,7 @@ export class KiroService {
     deviceCode: string,
     region: string = "us-east-1"
   ) {
+    assertValidAwsRegion(region);
     const endpoint = `https://oidc.${region}.amazonaws.com/token`;
 
     const response = await fetch(endpoint, {
@@ -189,6 +192,7 @@ export class KiroService {
     // but a Kiro-social refresh token the OIDC client can't refresh — use the social path (#2467).
     if (clientId && clientSecret && authMethod !== "imported") {
       const resolvedRegion = region || "us-east-1";
+      assertValidAwsRegion(resolvedRegion);
       const endpoint = `https://oidc.${resolvedRegion}.amazonaws.com/token`;
 
       const response = await fetch(endpoint, {
@@ -288,6 +292,7 @@ export class KiroService {
    * If registerClient() also fails, the import falls back to the shared social-auth refresh path.
    */
   async validateImportToken(refreshToken: string, region: string = "us-east-1") {
+    assertValidAwsRegion(region);
     // Validate token format
     if (!refreshToken.startsWith("aorAAAAAG")) {
       throw new Error("Invalid token format. Token should start with aorAAAAAG...");
diff --git a/src/lib/providers/validation.ts b/src/lib/providers/validation.ts
index 2578bc911e..eaf6062478 100644
--- a/src/lib/providers/validation.ts
+++ b/src/lib/providers/validation.ts
@@ -1,18 +1,6 @@
-import { randomUUID } from "node:crypto";
 import { getEmbeddingProvider } from "@omniroute/open-sse/config/embeddingRegistry.ts";
 import { getRerankProvider } from "@omniroute/open-sse/config/rerankRegistry.ts";
 import { getRegistryEntry } from "@omniroute/open-sse/config/providerRegistry.ts";
-import { selectProxyForValidation } from "@omniroute/open-sse/services/proxyAutoSelector.ts";
-import {
-  buildClaudeCodeCompatibleHeaders,
-  buildClaudeCodeCompatibleValidationPayload,
-  CLAUDE_CODE_COMPATIBLE_DEFAULT_CHAT_PATH,
-  CLAUDE_CODE_COMPATIBLE_DEFAULT_MODELS_PATH,
-  joinClaudeCodeCompatibleUrl,
-  joinBaseUrlAndPath,
-  stripClaudeCodeCompatibleEndpointSuffix,
-  stripAnthropicMessagesSuffix,
-} from "@omniroute/open-sse/services/claudeCodeCompatible.ts";
 import {
   isClaudeCodeCompatibleProvider,
   isAnthropicCompatibleProvider,
@@ -24,3919 +12,104 @@ import {
 } from "@/shared/constants/providers";
 import {
   SAFE_OUTBOUND_FETCH_PRESETS,
-  SafeOutboundFetchError,
-  getSafeOutboundFetchErrorStatus,
   safeOutboundFetch,
 } from "@/shared/network/safeOutboundFetch";
-import { getProviderOutboundGuard, isPrivateHost } from "@/shared/network/outboundUrlGuard";
-import {
-  buildGrokCookieHeader,
-  buildQwenCookieHeader,
-  extractCookieValue,
-  extractQwenToken,
-  normalizeSessionCookieHeader,
-} from "@/lib/providers/webCookieAuth";
-import { buildJulesApiUrl } from "@/lib/cloudAgent/julesApi.ts";
+import { getProviderOutboundGuard } from "@/shared/network/outboundUrlGuard";
 import { resolveNvidiaValidationModel } from "@/lib/providers/nvidiaValidationModel";
-import { getGigachatAccessToken } from "@omniroute/open-sse/services/gigachatAuth.ts";
 import { validateQoderCliPat } from "@omniroute/open-sse/services/qoderCli.ts";
-import {
-  AZURE_AI_DEFAULT_BASE_URL,
-  buildAzureAiChatUrl,
-  buildAzureAiModelsUrl,
-} from "@omniroute/open-sse/config/azureAi.ts";
-import {
-  discoverBedrockNativeModels,
-  isBedrockNativeApiError,
-  isBedrockNativeAuthError,
-} from "@omniroute/open-sse/services/bedrock.ts";
-import {
-  DATAROBOT_DEFAULT_BASE_URL,
-  buildDataRobotCatalogUrl,
-  buildDataRobotChatUrl,
-  isDataRobotDeploymentUrl,
-} from "@omniroute/open-sse/config/datarobot.ts";
-import {
-  OCI_DEFAULT_BASE_URL,
-  buildOciChatUrl,
-  buildOciModelsUrl,
-} from "@omniroute/open-sse/config/oci.ts";
-import {
-  SAP_DEFAULT_BASE_URL,
-  buildSapChatUrl,
-  buildSapModelsUrl,
-  getSapResourceGroup,
-  isSapDeploymentUrl,
-} from "@omniroute/open-sse/config/sap.ts";
-import {
-  WATSONX_DEFAULT_BASE_URL,
-  buildWatsonxChatUrl,
-  buildWatsonxModelsUrl,
-} from "@omniroute/open-sse/config/watsonx.ts";
-import {
-  buildRunwayApiUrl,
-  buildRunwayHeaders,
-  normalizeRunwayBaseUrl,
-} from "@omniroute/open-sse/config/runway.ts";
-import {
-  buildMaritalkChatUrl,
-  buildMaritalkModelsUrl,
-} from "@omniroute/open-sse/config/maritalk.ts";
-import { signAwsRequest } from "@omniroute/open-sse/utils/awsSigV4.ts";
 import { validateImageProviderApiKey } from "@/lib/providers/imageValidation";
 
-const OPENAI_LIKE_FORMATS = new Set(["openai", "openai-responses"]);
-const GEMINI_LIKE_FORMATS = new Set(["gemini", "gemini-cli"]);
+import {
+  OPENAI_LIKE_FORMATS,
+  GEMINI_LIKE_FORMATS,
+  normalizeBaseUrl,
+  addModelsSuffix,
+  resolveBaseUrl,
+} from "./validation/urlHelpers";
+import {
+  STANDARD_USER_AGENT,
+  directHttpsRequest,
+  buildBearerHeaders,
+} from "./validation/headers";
+import {
+  validationRead,
+  validationWrite,
+  toValidationErrorResult,
+} from "./validation/transport";
+import {
+  validateDeepSeekWebProvider,
+  validateQwenWebProvider,
+  validateGrokWebProvider,
+  validateChatGptWebProvider,
+  validatePerplexityWebProvider,
+  validateBlackboxWebProvider,
+} from "./validation/webProvidersA";
+import {
+  validateMuseSparkWebProvider,
+  validateAdaptaWebProvider,
+  validateClaudeWebProvider,
+  validateGeminiWebProvider,
+  validateCopilotWebProvider,
+  validateT3WebProvider,
+  validateJulesProvider,
+  validateInnerAiProvider,
+} from "./validation/webProvidersB";
+import {
+  validateHerokuProvider,
+  validateDatabricksProvider,
+  validateDataRobotProvider,
+  validateSnowflakeProvider,
+  validateGigachatProvider,
+  validateAzureOpenAIProvider,
+  validateAzureAiProvider,
+  validateWatsonxProvider,
+  validateOciProvider,
+  validateSapProvider,
+} from "./validation/cloudProviders";
+import {
+  validateDeepgramProvider,
+  validateAssemblyAIProvider,
+  validateElevenLabsProvider,
+  validateInworldProvider,
+  validateKieProvider,
+  validateAwsPollyProvider,
+  validateBailianCodingPlanProvider,
+  validateRekaProvider,
+  validateMaritalkProvider,
+  validateNlpCloudProvider,
+  validateRunwayProvider,
+  validateNousResearchProvider,
+  validatePoeProvider,
+} from "./validation/audioMiscProviders";
+import {
+  validateSearchProvider,
+  SEARCH_VALIDATOR_CONFIGS,
+} from "./validation/searchProviders";
+import {
+  validateClarifaiProvider,
+  validateEmbeddingApiProvider,
+  validateRerankApiProvider,
+} from "./validation/embeddingProviders";
+import {
+  validateBedrockProvider,
+  validateOpenAILikeProvider,
+  validateCommandCodeProvider,
+  validateGeminiLikeProvider,
+  validateOpenAICompatibleProvider,
+} from "./validation/openaiFormat";
+import {
+  validateAnthropicLikeProvider,
+  validateAnthropicCompatibleProvider,
+  validateClaudeCodeCompatibleProvider,
+} from "./validation/anthropicFormat";
+// validateCommandCodeProvider + validateClaudeCodeCompatibleProvider have external importers
+// (provider-nodes/validate route + tests) — re-export to preserve the historical public surface.
+export { validateCommandCodeProvider, validateClaudeCodeCompatibleProvider };
+
+// isRetryableProxyTarget + isSecurityBlockError now live in ./validation/transport. Re-export them
+// here to preserve the historical public surface (tests + route handlers import them via this module).
+export { isRetryableProxyTarget, isSecurityBlockError } from "./validation/transport";
 
-function normalizeBaseUrl(baseUrl: string) {
-  // Guard against a non-string baseUrl reaching .trim() / .replace() — see #2463
-  // where NVIDIA NIM validation surfaced as `e.startsWith is not a function`
-  // after the bundler renamed `baseUrl` to `e`. Any malformed providerSpecificData
-  // (e.g. saved as object from a UI bug) would otherwise crash mid-validation.
-  const value = typeof baseUrl === "string" ? baseUrl : "";
-  return value.trim().replace(/\/$/, "");
-}
-
-function normalizeAzureOpenAIBaseUrl(baseUrl: string) {
-  return normalizeBaseUrl(baseUrl)
-    .replace(/\/openai$/i, "")
-    .replace(/\/openai\/deployments\/[^/]+\/chat\/completions.*$/i, "");
-}
-
-function normalizeAnthropicBaseUrl(baseUrl: string) {
-  return stripAnthropicMessagesSuffix(baseUrl || "");
-}
-
-function normalizeClaudeCodeCompatibleBaseUrl(baseUrl: string) {
-  return stripClaudeCodeCompatibleEndpointSuffix(baseUrl || "");
-}
-
-function addModelsSuffix(baseUrl: string) {
-  const normalized = normalizeBaseUrl(baseUrl);
-  if (!normalized) return "";
-
-  const suffixes = ["/chat/completions", "/responses", "/chat", "/messages"];
-  if (normalized.endsWith("/models")) {
-    return normalized;
-  }
-  for (const suffix of suffixes) {
-    if (normalized.endsWith(suffix)) {
-      return `${normalized.slice(0, -suffix.length)}/models`;
-    }
-  }
-
-  return `${normalized}/models`;
-}
-
-function resolveBaseUrl(entry: any, providerSpecificData: any = {}) {
-  if (providerSpecificData?.baseUrl) return normalizeBaseUrl(providerSpecificData.baseUrl);
-  if (entry?.baseUrl) return normalizeBaseUrl(entry.baseUrl);
-  return "";
-}
-
-function resolveChatUrl(provider: string, baseUrl: string, providerSpecificData: any = {}) {
-  const normalized = normalizeBaseUrl(baseUrl);
-  if (!normalized) return "";
-
-  if (isOpenAICompatibleProvider(provider)) {
-    if (providerSpecificData?.chatPath) {
-      return `${normalized}${providerSpecificData.chatPath}`;
-    }
-    if (providerSpecificData?.apiType === "responses") {
-      return `${normalized}/responses`;
-    }
-    return `${normalized}/chat/completions`;
-  }
-
-  if (
-    normalized.endsWith("/chat/completions") ||
-    normalized.endsWith("/responses") ||
-    normalized.endsWith("/chat")
-  ) {
-    return normalized;
-  }
-
-  if (normalized.endsWith("/v1")) {
-    return `${normalized}/chat/completions`;
-  }
-
-  return normalized;
-}
-
-function normalizeHerokuChatUrl(baseUrl: string) {
-  const normalized = normalizeBaseUrl(baseUrl);
-  if (!normalized) return "";
-  return normalized.endsWith("/v1/chat/completions")
-    ? normalized
-    : `${normalized}/v1/chat/completions`;
-}
-
-function normalizeDatabricksChatUrl(baseUrl: string) {
-  const normalized = normalizeBaseUrl(baseUrl);
-  if (!normalized) return "";
-  return normalized.endsWith("/chat/completions") ? normalized : `${normalized}/chat/completions`;
-}
-
-function normalizeSnowflakeChatUrl(baseUrl: string) {
-  const normalized = normalizeBaseUrl(baseUrl)
-    .replace(/\/cortex\/inference:complete$/, "")
-    .replace(/\/api\/v2$/, "");
-  if (!normalized) return "";
-  return `${normalized}/api/v2/cortex/inference:complete`;
-}
-
-function normalizeGigachatChatUrl(baseUrl: string) {
-  const normalized = normalizeBaseUrl(baseUrl).replace(/\/chat\/completions$/, "");
-  if (!normalized) return "";
-  return `${normalized}/chat/completions`;
-}
-
-// Standardized desktop Chrome UA for web-cookie/no-auth session probes (minimizes anti-bot detection).
-const STANDARD_USER_AGENT =
-  "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36";
-
-function getCustomUserAgent(providerSpecificData: any = {}) {
-  if (typeof providerSpecificData?.customUserAgent !== "string") return null;
-  const customUserAgent = providerSpecificData.customUserAgent.trim();
-  return customUserAgent || null;
-}
-
-function applyCustomUserAgent(headers: Record<string, string>, providerSpecificData: any = {}) {
-  const customUserAgent = getCustomUserAgent(providerSpecificData);
-  if (!customUserAgent) return headers;
-  headers["User-Agent"] = customUserAgent;
-  if ("user-agent" in headers) {
-    headers["user-agent"] = customUserAgent;
-  }
-  return headers;
-}
-
-function withCustomUserAgent(init: RequestInit, providerSpecificData: any = {}) {
-  return {
-    ...init,
-    headers: applyCustomUserAgent(
-      { ...((init.headers as Record<string, string> | undefined) || {}) },
-      providerSpecificData
-    ),
-  };
-}
-
-/**
- * Direct HTTPS request utility that bypasses the global patched fetch.
- * Used for provider validation where the patched fetch has compatibility issues.
- * Uses safeOutboundFetch with bypassProxyPatch to use native Node.js fetch directly.
- */
-function directHttpsRequest(
-  url: string,
-  options: { method?: string; headers?: Record<string, string>; body?: string },
-  timeoutMs: number
-): Promise<{ status: number; ok: boolean; text: () => Promise<string> }> {
-  return safeOutboundFetch(url, {
-    method: options.method || "GET",
-    headers: (options.headers || {}) as Record<string, string>,
-    body: options.body,
-    timeoutMs,
-    bypassProxyPatch: true,
-    allowRedirect: true,
-    guard: "none",
-    retry: false,
-  }).then(async (response) => ({
-    status: response.status,
-    ok: response.ok,
-    text: async () => await response.text(),
-  }));
-}
-
-function buildBearerHeaders(apiKey: string, providerSpecificData: any = {}) {
-  const headers: Record<string, string> = {
-    "Content-Type": "application/json",
-  };
-  if (apiKey) {
-    headers.Authorization = `Bearer ${apiKey}`;
-  }
-  return applyCustomUserAgent(headers, providerSpecificData);
-}
-
-function buildRekaHeaders(apiKey: string, providerSpecificData: any = {}) {
-  const headers: Record<string, string> = {
-    "Content-Type": "application/json",
-  };
-
-  if (apiKey) {
-    headers.Authorization = `Bearer ${apiKey}`;
-    headers["X-Api-Key"] = apiKey;
-  }
-
-  return applyCustomUserAgent(headers, providerSpecificData);
-}
-
-function buildClarifaiHeaders(apiKey: string, providerSpecificData: any = {}) {
-  const headers: Record<string, string> = {
-    "Content-Type": "application/json",
-  };
-
-  if (apiKey) {
-    headers.Authorization = `Key ${apiKey}`;
-  }
-
-  return applyCustomUserAgent(headers, providerSpecificData);
-}
-
-function buildKeyHeaders(apiKey: string, providerSpecificData: any = {}) {
-  const headers: Record<string, string> = {
-    "Content-Type": "application/json",
-  };
-
-  if (apiKey) {
-    headers.Authorization = `Key ${apiKey}`;
-  }
-
-  return applyCustomUserAgent(headers, providerSpecificData);
-}
-
-function buildTokenHeaders(apiKey: string, providerSpecificData: any = {}) {
-  const headers: Record<string, string> = {
-    "Content-Type": "application/json",
-  };
-
-  if (apiKey) {
-    headers.Authorization = `Token ${apiKey}`;
-  }
-
-  return applyCustomUserAgent(headers, providerSpecificData);
-}
-
-/**
- * Wrapped fetch call that auto-retries with a proxy when the direct connection
- * fails.  This happens transparently so individual validators don't need to
- * think about proxy fallback.
- */
-async function fetchWithProxyFallback(
-  url: string,
-  init: RequestInit,
-  presets: typeof SAFE_OUTBOUND_FETCH_PRESETS.validationRead,
-  isLocal: boolean
-): Promise<Response> {
-  try {
-    return await safeOutboundFetch(url, {
-      ...presets,
-      guard: isLocal ? "none" : getProviderOutboundGuard(),
-      ...init,
-    });
-  } catch (err: unknown) {
-    // Only attempt proxy fallback for retryable errors (network / timeout)
-    // and only when the target is not a local / LAN address.
-    const fetchErr = err as SafeOutboundFetchError;
-    const isNetworkIssue = fetchErr?.code === "NETWORK_ERROR" || fetchErr?.code === "TIMEOUT";
-    const isRetryable = fetchErr?.isRetryable !== false;
-    const isValidTarget = !isLocal && isRetryableProxyTarget(url);
-
-    if (isLocal || !isNetworkIssue || !isRetryable) throw err;
-    if (!isValidTarget) throw err;
-
-    const proxyUrl = await selectProxyForValidation(url);
-    if (!proxyUrl) throw err;
-
-    return safeOutboundFetch(url, {
-      ...presets,
-      guard: isLocal ? "none" : getProviderOutboundGuard(),
-      ...init,
-      proxyConfig: proxyUrl,
-    });
-  }
-}
-
-export function isRetryableProxyTarget(url: string): boolean {
-  try {
-    const hostname = new URL(url).hostname.toLowerCase();
-    // Never proxy-fallback to a private/link-local/metadata host. Delegates to
-    // the canonical SSRF guard (covers 169.254, 0.0.0.0, 172.16/12, CGNAT,
-    // IPv6 fc/fd/fe80, .internal — gaps the previous inline check missed).
-    return !isPrivateHost(hostname);
-  } catch {
-    return false;
-  }
-}
-
-async function validationRead(url: string, init: RequestInit, isLocal: boolean = false) {
-  return fetchWithProxyFallback(url, init, SAFE_OUTBOUND_FETCH_PRESETS.validationRead, isLocal);
-}
-
-async function validationWrite(url: string, init: RequestInit, isLocal: boolean = false) {
-  return fetchWithProxyFallback(url, init, SAFE_OUTBOUND_FETCH_PRESETS.validationWrite, isLocal);
-}
-
-// A validation failure should only be flagged `securityBlocked` (which the route
-// surfaces as a `provider.validation.ssrf_blocked` audit event + a security warning in
-// the UI) when it is a GENUINE SSRF/guard block — not for every outbound-guard 503.
-// A blocked redirect (REDIRECT_BLOCKED) to a PUBLIC host is benign: the redirect was
-// never followed, so no SSRF occurred. Web-cookie providers like qwen-web answer their
-// probe with a 307 to a public host, which used to be mislabeled as an SSRF block
-// (#3288 / #3758). Only treat a blocked redirect as a security event when its target is
-// a private/internal host.
-export function isSecurityBlockError(error: unknown): boolean {
-  if (!(error instanceof SafeOutboundFetchError)) return false;
-  if (error.code === "URL_GUARD_BLOCKED" || error.code === "INVALID_URL") return true;
-  if (error.code === "REDIRECT_BLOCKED") {
-    if (!error.location) return false;
-    try {
-      return isPrivateHost(new URL(error.location, error.url).hostname);
-    } catch {
-      return false;
-    }
-  }
-  return false;
-}
-
-function toValidationErrorResult(error: unknown) {
-  const message = error instanceof Error ? error.message : String(error || "Validation failed");
-  const statusCode = getSafeOutboundFetchErrorStatus(error);
-
-  return {
-    valid: false,
-    error: message || "Validation failed",
-    unsupported: false as const,
-    ...(statusCode ? { statusCode } : {}),
-    ...(error instanceof SafeOutboundFetchError && error.code === "TIMEOUT"
-      ? { timeout: true }
-      : {}),
-    ...(isSecurityBlockError(error) ? { securityBlocked: true } : {}),
-  };
-}
-
-async function validateBedrockProvider({ apiKey, providerSpecificData = {} }: any) {
-  if (!apiKey) {
-    return { valid: false, error: "Provider and API key required" };
-  }
-
-  try {
-    const discovery = await discoverBedrockNativeModels({
-      apiKey,
-      providerSpecificData,
-      fetcher: (url, init) => validationRead(url, init),
-    });
-    return {
-      valid: true,
-      error: null,
-      method: "bedrock_native_models",
-      warning: discovery.warnings[0] || null,
-    };
-  } catch (error: any) {
-    if (isBedrockNativeAuthError(error)) {
-      return { valid: false, error: "Invalid API key" };
-    }
-    if (isBedrockNativeApiError(error)) {
-      if (error.status === 429) {
-        return {
-          valid: true,
-          error: null,
-          warning: "Bedrock accepted the key but model discovery is rate limited",
-          method: "bedrock_native_models",
-        };
-      }
-      if (typeof error.status === "number" && error.status >= 500) {
-        return { valid: false, error: `Provider unavailable (${error.status})` };
-      }
-      if (typeof error.status === "number") {
-        return { valid: false, error: `Bedrock validation failed: ${error.status}` };
-      }
-    }
-    return toValidationErrorResult(error);
-  }
-}
-
-async function validateOpenAILikeProvider({
-  provider = "openai",
-  apiKey,
-  baseUrl,
-  headers = {},
-  modelId = "gpt-3.5-turbo",
-  providerSpecificData,
-  modelsUrl = "",
-  isLocal = false,
-}: any) {
-  try {
-    // Guard against a non-string modelsUrl reaching .trim()/.startsWith() — a malformed
-    // providerSpecificData / registry value would otherwise throw a TypeError mid-validation
-    // ("trim is not a function" / "startsWith is not a function"). See #2463 class.
-    const customModelsUrl = (typeof modelsUrl === "string" ? modelsUrl.trim() : "") || "";
-    const endpointUrl = customModelsUrl
-      ? customModelsUrl.startsWith("http")
-        ? customModelsUrl
-        : `${baseUrl.replace(/\/+$/, "")}/${customModelsUrl.replace(/^\/+/, "")}`
-      : // addModelsSuffix strips a trailing /chat/completions before appending /models,
-        // so an OpenAI-style baseUrl validates against /v1/models, not /v1/chat/completions/models.
-        addModelsSuffix(baseUrl);
-
-    const requestUrl =
-      typeof providerSpecificData?.modelsUrl === "string" &&
-      providerSpecificData.modelsUrl.trim() !== ""
-        ? providerSpecificData.modelsUrl.trim()
-        : endpointUrl;
-
-    const response = await validationRead(
-      requestUrl,
-      {
-        headers: {
-          ...headers,
-          ...(apiKey ? { Authorization: `Bearer ${apiKey}` } : {}),
-        },
-      },
-      isLocal
-    );
-
-    if (response.ok) {
-      return { valid: true, error: null };
-    }
-
-    if (response.status === 401) {
-      return { valid: false, error: "Invalid API key" };
-    }
-
-    // #2929: A 403 on the models endpoint is not always a bad key. Some providers
-    // (e.g. Fireworks Fire Pass `fpk_*` keys) return "...not authorized for this
-    // route." on /models while still serving chat. Fall through to the chat probe
-    // for such route-restriction 403s instead of declaring the key invalid.
-    if (response.status === 403) {
-      const forbiddenBody = await response.text().catch(() => "");
-      if (!/not authorized for this route/i.test(forbiddenBody)) {
-        return { valid: false, error: "Invalid API key" };
-      }
-    }
-
-    const chatUrl = resolveChatUrl(provider, baseUrl, providerSpecificData);
-    if (!chatUrl) {
-      return { valid: false, error: `Validation failed: ${response.status}` };
-    }
-
-    const testModelId = (providerSpecificData as any)?.validationModelId || modelId;
-
-    const testBody = {
-      model: testModelId,
-      messages: [{ role: "user", content: "test" }],
-      max_tokens: 1,
-    };
-
-    const chatRes = await validationWrite(
-      chatUrl,
-      {
-        method: "POST",
-        headers: {
-          ...headers,
-          ...(apiKey ? { Authorization: `Bearer ${apiKey}` } : {}),
-        },
-        body: JSON.stringify(testBody),
-      },
-      isLocal
-    );
-
-    if (chatRes.ok) {
-      return { valid: true, error: null };
-    }
-
-    if (chatRes.status === 401 || chatRes.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-
-    if (chatRes.status === 404 || chatRes.status === 405) {
-      return { valid: false, error: "Provider validation endpoint not supported" };
-    }
-
-    if (chatRes.status >= 500) {
-      return { valid: false, error: `Provider unavailable (${chatRes.status})` };
-    }
-
-    return { valid: true, error: null };
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-}
-
-async function validateDirectChatProvider({
-  url,
-  headers,
-  body,
-  providerSpecificData = {},
-  isLocal = false,
-}: any) {
-  try {
-    const response = await validationWrite(
-      url,
-      {
-        method: "POST",
-        headers: applyCustomUserAgent(headers, providerSpecificData),
-        body: JSON.stringify(body),
-      },
-      isLocal
-    );
-
-    if (response.status === 401 || response.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-
-    if (
-      response.ok ||
-      response.status === 400 ||
-      response.status === 422 ||
-      response.status === 429
-    ) {
-      return { valid: true, error: null };
-    }
-
-    if (response.status >= 500) {
-      return { valid: false, error: `Provider unavailable (${response.status})` };
-    }
-
-    return { valid: false, error: `Validation failed: ${response.status}` };
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-}
-
-export async function validateCommandCodeProvider({ apiKey, providerSpecificData = {} }: any) {
-  const entry = getRegistryEntry("command-code");
-  const baseUrl = normalizeBaseUrl(entry?.baseUrl || "https://api.commandcode.ai");
-  const chatPath = entry?.chatPath || "/alpha/generate";
-  const url = `${baseUrl}${chatPath.startsWith("/") ? chatPath : `/${chatPath}`}`;
-  const validationModelId =
-    providerSpecificData?.validationModelId ||
-    entry?.models?.find((model) => model.id === "deepseek/deepseek-v4-flash")?.id ||
-    "deepseek/deepseek-v4-flash";
-  const { COMMAND_CODE_VERSION } = await import("@omniroute/open-sse/executors/commandCode.ts");
-
-  return validateDirectChatProvider({
-    url,
-    providerSpecificData,
-    headers: {
-      "Content-Type": "application/json",
-      Authorization: `Bearer ${apiKey}`,
-      "x-command-code-version": COMMAND_CODE_VERSION,
-      "x-cli-environment": "external",
-      "x-project-slug": "pi-cc",
-      "x-taste-learning": "false",
-      "x-co-flag": "false",
-      "x-session-id": randomUUID(),
-    },
-    body: {
-      config: {
-        workingDir: "/workspace",
-        date: new Date().toISOString().slice(0, 10),
-        environment: "external",
-        structure: [],
-        isGitRepo: false,
-        currentBranch: "",
-        mainBranch: "",
-        gitStatus: "",
-        recentCommits: [],
-      },
-      memory: "",
-      taste: "",
-      skills: "",
-      permissionMode: "standard",
-      params: {
-        model: validationModelId,
-        messages: [{ role: "user", content: "test" }],
-        tools: [],
-        system: "",
-        max_tokens: 1,
-        stream: true,
-      },
-    },
-  });
-}
-
-async function validateClarifaiProvider({ apiKey, providerSpecificData = {} }: any) {
-  const baseUrl =
-    normalizeBaseUrl(providerSpecificData.baseUrl) || "https://api.clarifai.com/v2/ext/openai/v1";
-  const modelsUrl = addModelsSuffix(baseUrl);
-
-  try {
-    const modelsRes = await validationRead(modelsUrl, {
-      method: "GET",
-      headers: buildClarifaiHeaders(apiKey, providerSpecificData),
-    });
-
-    if (modelsRes.ok) {
-      return { valid: true, error: null, method: "clarifai_models" };
-    }
-
-    if (modelsRes.status === 401 || modelsRes.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-
-    const chatUrl = resolveChatUrl("clarifai", baseUrl, providerSpecificData);
-    const chatRes = await validationWrite(chatUrl, {
-      method: "POST",
-      headers: buildClarifaiHeaders(apiKey, providerSpecificData),
-      body: JSON.stringify({
-        model:
-          providerSpecificData?.validationModelId || "openai/chat-completion/models/gpt-oss-120b",
-        messages: [{ role: "user", content: "test" }],
-        max_tokens: 1,
-      }),
-    });
-
-    if (chatRes.ok || chatRes.status === 400 || chatRes.status === 422 || chatRes.status === 429) {
-      return { valid: true, error: null, method: "clarifai_chat_probe" };
-    }
-
-    if (chatRes.status === 401 || chatRes.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-
-    if (chatRes.status === 404 || chatRes.status === 405) {
-      return { valid: false, error: "Provider validation endpoint not supported" };
-    }
-
-    if (chatRes.status >= 500) {
-      return { valid: false, error: `Provider unavailable (${chatRes.status})` };
-    }
-
-    return { valid: true, error: null, method: "clarifai_chat_probe" };
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-}
-
-async function validateEmbeddingApiProvider({
-  apiKey,
-  providerSpecificData = {},
-  url,
-  modelId,
-}: any) {
-  if (!url) {
-    return { valid: false, error: "Missing embedding endpoint" };
-  }
-
-  try {
-    const response = await validationWrite(url, {
-      method: "POST",
-      headers: buildBearerHeaders(apiKey, providerSpecificData),
-      body: JSON.stringify({
-        model: providerSpecificData?.validationModelId || modelId,
-        input: ["test"],
-      }),
-    });
-
-    if (response.status === 401 || response.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-
-    if (
-      response.ok ||
-      response.status === 400 ||
-      response.status === 422 ||
-      response.status === 429
-    ) {
-      return { valid: true, error: null };
-    }
-
-    if (response.status >= 500) {
-      return { valid: false, error: `Provider unavailable (${response.status})` };
-    }
-
-    return { valid: false, error: `Validation failed: ${response.status}` };
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-}
-
-async function validateRerankApiProvider({ apiKey, providerSpecificData = {}, url, modelId }: any) {
-  if (!url) {
-    return { valid: false, error: "Missing rerank endpoint" };
-  }
-
-  try {
-    const response = await validationWrite(url, {
-      method: "POST",
-      headers: buildBearerHeaders(apiKey, providerSpecificData),
-      body: JSON.stringify({
-        model: providerSpecificData?.validationModelId || modelId,
-        query: "test",
-        documents: ["test"],
-        top_n: 1,
-        return_documents: false,
-      }),
-    });
-
-    if (response.status === 401 || response.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-
-    if (
-      response.ok ||
-      response.status === 400 ||
-      response.status === 422 ||
-      response.status === 429
-    ) {
-      return { valid: true, error: null };
-    }
-
-    if (response.status >= 500) {
-      return { valid: false, error: `Provider unavailable (${response.status})` };
-    }
-
-    return { valid: false, error: `Validation failed: ${response.status}` };
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-}
-
-async function validateAnthropicLikeProvider({
-  apiKey,
-  baseUrl,
-  modelId = "claude-3-5-sonnet-20240620",
-  headers = {},
-  providerSpecificData = {},
-  isLocal = false,
-}: any) {
-  try {
-    if (!baseUrl) {
-      return { valid: false, error: "Missing base URL" };
-    }
-
-    if (typeof apiKey === "string" && apiKey.startsWith("sk-ant-oat")) {
-      return validateClaudeOAuthInline({ apiKey, modelId, providerSpecificData });
-    }
-
-    const probeUrl =
-      typeof providerSpecificData?.modelsUrl === "string" &&
-      providerSpecificData.modelsUrl.trim() !== ""
-        ? providerSpecificData.modelsUrl.trim()
-        : `${baseUrl}/models`;
-
-    // Best-effort /models probe. It must not fail validation: canonical Claude
-    // base URLs can already include a path/query (…/messages?beta=true).
-    try {
-      await validationRead(
-        probeUrl,
-        {
-          headers: {
-            "anthropic-version": "2023-06-01",
-            ...headers,
-          },
-        },
-        isLocal
-      );
-    } catch {
-      // ignore probe failures
-    }
-
-    const requestUrl =
-      typeof providerSpecificData?.modelsUrl === "string" &&
-      providerSpecificData.modelsUrl.trim() !== ""
-        ? providerSpecificData.modelsUrl.trim()
-        : "";
-
-    if (requestUrl) {
-      const response = await validationRead(
-        requestUrl,
-        {
-          headers: {
-            "anthropic-version": "2023-06-01",
-            ...headers,
-          },
-        },
-        isLocal
-      );
-
-      if (response.status === 401 || response.status === 403) {
-        return { valid: false, error: "Invalid API key" };
-      }
-    }
-
-    const requestHeaders = applyCustomUserAgent(
-      {
-        "Content-Type": "application/json",
-        ...headers,
-      },
-      providerSpecificData
-    );
-
-    if (!requestHeaders["x-api-key"] && !requestHeaders["X-API-Key"]) {
-      requestHeaders["x-api-key"] = apiKey;
-    }
-
-    if (!requestHeaders["anthropic-version"] && !requestHeaders["Anthropic-Version"]) {
-      requestHeaders["anthropic-version"] = "2023-06-01";
-    }
-
-    const testModelId =
-      providerSpecificData?.validationModelId || modelId || "claude-3-5-sonnet-20241022";
-
-    const chatResponse = await validationWrite(
-      baseUrl,
-      {
-        method: "POST",
-        headers: requestHeaders,
-        body: JSON.stringify({
-          model: testModelId,
-          max_tokens: 1,
-          messages: [{ role: "user", content: "test" }],
-        }),
-      },
-      isLocal
-    );
-
-    if (chatResponse.status === 401 || chatResponse.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-
-    return { valid: true, error: null };
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-}
-
-async function validateClaudeOAuthInline({
-  apiKey,
-  modelId,
-  providerSpecificData = {},
-}: {
-  apiKey: string;
-  modelId: string | null | undefined;
-  providerSpecificData?: Record<string, unknown>;
-}) {
-  const testModelId =
-    providerSpecificData?.validationModelId || modelId || "claude-haiku-4-5-20251001";
-
-  try {
-    const { getExecutor } = await import("@omniroute/open-sse/executors/index.ts");
-    const { response } = await getExecutor("claude").execute({
-      model: testModelId,
-      body: {
-        model: testModelId,
-        max_tokens: 1,
-        messages: [{ role: "user", content: "test" }],
-      },
-      stream: false,
-      credentials: { accessToken: apiKey, providerSpecificData },
-    });
-
-    if (response.status === 401 || response.status === 403) {
-      return { valid: false, error: "Invalid OAuth token" };
-    }
-    if (response.status >= 500) {
-      return { valid: false, error: `Provider unavailable (${response.status})` };
-    }
-    return { valid: true, error: null };
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-}
-
-async function validateGeminiLikeProvider({
-  apiKey,
-  baseUrl,
-  providerSpecificData = {},
-  authType = "query",
-  isLocal = false,
-}: any) {
-  try {
-    if (!baseUrl) {
-      return { valid: false, error: "Missing base URL" };
-    }
-
-    const normalizedAuthType = String(authType || "query").toLowerCase();
-    // Strip a trailing /models before appending — the default Gemini registry baseUrl is
-    // `.../v1beta/models` (for the chat urlBuilder), so naively appending /models produced
-    // `.../v1beta/models/models` → upstream 404 on connection validation (#2545).
-    const baseForModels = String(baseUrl)
-      .replace(/\/models\/?$/, "")
-      .replace(/\/$/, "");
-    const requestUrl =
-      typeof providerSpecificData?.modelsUrl === "string" &&
-      providerSpecificData.modelsUrl.trim() !== ""
-        ? providerSpecificData.modelsUrl.trim()
-        : `${baseForModels}/models`;
-
-    // Use the correct auth header based on provider config:
-    // - gemini / gemini-cli (API key): x-goog-api-key
-    // - gemini-cli (OAuth): Bearer token
-    const headers: Record<string, string> = {};
-    let urlWithKey = requestUrl;
-
-    if (typeof apiKey === "string" && apiKey.startsWith("ya29.")) {
-      // A Google OAuth access token (ya29.*) must use Bearer auth even when the
-      // connection is configured as an API-key provider — gemini-cli OAuth stores the
-      // access token in the apiKey field. Checked first so authType "apikey"/"header"
-      // doesn't shadow it with x-goog-api-key.
-      headers["Authorization"] = `Bearer ${apiKey}`;
-    } else if (normalizedAuthType === "header" || normalizedAuthType === "apikey") {
-      headers["x-goog-api-key"] = apiKey;
-    } else if (normalizedAuthType === "oauth" || normalizedAuthType === "bearer") {
-      headers["Authorization"] = `Bearer ${apiKey}`;
-    } else if (normalizedAuthType === "query") {
-      urlWithKey = `${requestUrl}?key=${encodeURIComponent(apiKey)}`;
-    }
-
-    applyCustomUserAgent(headers, providerSpecificData);
-
-    const response = await validationRead(
-      urlWithKey,
-      {
-        headers,
-      },
-      isLocal
-    );
-
-    if (response.ok) {
-      return { valid: true, error: null };
-    }
-
-    if (response.status === 429) {
-      return { valid: true, error: null };
-    }
-
-    if (response.status === 400 || response.status === 401 || response.status === 403) {
-      const isAuthError = (body: any) => {
-        const message = (body?.error?.message || "").toLowerCase();
-        const reason = body?.error?.details?.[0]?.reason || "";
-        const status = body?.error?.status || "";
-        const authPatterns = [
-          "api key not valid",
-          "api key expired",
-          "api key invalid",
-          "API_KEY_INVALID",
-          "API_KEY_EXPIRED",
-          "PERMISSION_DENIED",
-          "UNAUTHENTICATED",
-        ];
-        return authPatterns.some(
-          (p) => message.includes(p.toLowerCase()) || reason === p || status === p
-        );
-      };
-
-      try {
-        const body = await response.json();
-        if (isAuthError(body)) {
-          return { valid: false, error: "Invalid API key" };
-        }
-        if (response.status === 401 || response.status === 403) {
-          return { valid: false, error: "Invalid API key" };
-        }
-      } catch {
-        if (response.status === 401 || response.status === 403) {
-          return { valid: false, error: "Invalid API key" };
-        }
-        return { valid: false, error: "Invalid API key" };
-      }
-    }
-
-    return { valid: false, error: `Validation failed: ${response.status}` };
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-}
-
-// ── Specialty providers (non-standard APIs) ──
-
-async function validateDeepgramProvider({ apiKey, providerSpecificData = {} }: any) {
-  try {
-    const response = await validationRead("https://api.deepgram.com/v1/auth/token", {
-      method: "GET",
-      headers: applyCustomUserAgent({ Authorization: `Token ${apiKey}` }, providerSpecificData),
-    });
-    if (response.ok) return { valid: true, error: null };
-    if (response.status === 401 || response.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-    return { valid: false, error: `Validation failed: ${response.status}` };
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-}
-
-async function validateAssemblyAIProvider({ apiKey, providerSpecificData = {} }: any) {
-  try {
-    const response = await validationRead("https://api.assemblyai.com/v2/transcript?limit=1", {
-      method: "GET",
-      headers: applyCustomUserAgent(
-        {
-          Authorization: apiKey,
-          "Content-Type": "application/json",
-        },
-        providerSpecificData
-      ),
-    });
-    if (response.ok) return { valid: true, error: null };
-    if (response.status === 401 || response.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-    return { valid: false, error: `Validation failed: ${response.status}` };
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-}
-
-async function validateElevenLabsProvider({ apiKey, providerSpecificData = {} }: any) {
-  try {
-    // Lightweight auth check endpoint
-    const response = await validationRead("https://api.elevenlabs.io/v1/voices", {
-      method: "GET",
-      headers: applyCustomUserAgent(
-        {
-          "xi-api-key": apiKey,
-          "Content-Type": "application/json",
-        },
-        providerSpecificData
-      ),
-    });
-
-    if (response.ok) return { valid: true, error: null };
-    if (response.status === 401 || response.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-
-    return { valid: false, error: `Validation failed: ${response.status}` };
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-}
-
-async function validateInworldProvider({ apiKey, providerSpecificData = {} }: any) {
-  try {
-    // Inworld TTS lacks a simple key-introspection endpoint.
-    // Send a minimal synth request and treat non-auth 4xx as auth-pass.
-    const response = await validationWrite("https://api.inworld.ai/tts/v1/voice", {
-      method: "POST",
-      headers: applyCustomUserAgent(
-        {
-          Authorization: `Basic ${apiKey}`,
-          "Content-Type": "application/json",
-        },
-        providerSpecificData
-      ),
-      body: JSON.stringify({
-        text: "test",
-        modelId: "inworld-tts-1.5-mini",
-        audioConfig: { audioEncoding: "MP3" },
-      }),
-    });
-
-    if (response.status === 401 || response.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-
-    // Any other response indicates auth is accepted (payload/model may still be wrong)
-    return { valid: true, error: null };
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-}
-
-async function validateKieProvider({ apiKey, providerSpecificData = {} }: any) {
-  try {
-    // Use credit check endpoint as requested by user based on Kie.ai docs.
-    const response = await validationRead("https://api.kie.ai/api/v1/chat/credit", {
-      method: "GET",
-      headers: applyCustomUserAgent(
-        {
-          Authorization: `Bearer ${apiKey}`,
-          "Content-Type": "application/json",
-        },
-        providerSpecificData
-      ),
-    });
-
-    if (response.ok) {
-      return { valid: true, error: null };
-    }
-
-    if (response.status === 401 || response.status === 403) {
-      return { valid: false, error: "Invalid Kie.ai API key" };
-    }
-
-    // Fallback: if credits endpoint is 404/not supported, try minimal chat probe.
-    const chatRes = await validationWrite("https://api.kie.ai/api/v1/chat/completions", {
-      method: "POST",
-      headers: buildBearerHeaders(apiKey, providerSpecificData),
-      body: JSON.stringify({
-        model: providerSpecificData.validationModelId || "gpt-4o-mini",
-        messages: [{ role: "user", content: "test" }],
-        max_tokens: 1,
-      }),
-    });
-
-    if (
-      chatRes.ok ||
-      (chatRes.status >= 400 &&
-        chatRes.status < 500 &&
-        chatRes.status !== 401 &&
-        chatRes.status !== 403)
-    ) {
-      return { valid: true, error: null };
-    }
-
-    return { valid: false, error: `Validation failed: ${chatRes.status}` };
-  } catch (error: unknown) {
-    return toValidationErrorResult(error);
-  }
-}
-
-function getAwsProviderString(value: unknown): string | null {
-  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
-}
-
-function getAwsPollyRegion(providerSpecificData: any = {}) {
-  return (
-    getAwsProviderString(providerSpecificData.region) ||
-    getAwsProviderString(providerSpecificData.awsRegion) ||
-    process.env.AWS_REGION ||
-    process.env.AWS_DEFAULT_REGION ||
-    "us-east-1"
-  );
-}
-
-function getAwsPollyBaseUrl(providerSpecificData: any = {}, region: string) {
-  return (
-    getAwsProviderString(providerSpecificData.baseUrl) || `https://polly.${region}.amazonaws.com`
-  ).replace(/\/+$/, "");
-}
-
-async function validateAwsPollyProvider({ apiKey, providerSpecificData = {} }: any) {
-  const accessKeyId =
-    getAwsProviderString(providerSpecificData.accessKeyId) ||
-    getAwsProviderString(providerSpecificData.awsAccessKeyId);
-  const secretAccessKey = getAwsProviderString(apiKey);
-
-  if (!accessKeyId) {
-    return { valid: false, error: "Missing AWS accessKeyId" };
-  }
-  if (!secretAccessKey) {
-    return { valid: false, error: "Missing AWS Secret Access Key" };
-  }
-
-  const region = getAwsPollyRegion(providerSpecificData);
-  const baseUrl = getAwsPollyBaseUrl(providerSpecificData, region).replace(/\/v1\/voices$/i, "");
-  const url = `${baseUrl}/v1/voices?Engine=standard`;
-
-  try {
-    const signedHeaders = signAwsRequest({
-      method: "GET",
-      url,
-      region,
-      service: "polly",
-      credentials: {
-        accessKeyId,
-        secretAccessKey,
-        sessionToken:
-          getAwsProviderString(providerSpecificData.sessionToken) ||
-          getAwsProviderString(providerSpecificData.awsSessionToken),
-      },
-    });
-
-    const response = await validationRead(url, {
-      method: "GET",
-      headers: applyCustomUserAgent(signedHeaders, providerSpecificData),
-    });
-
-    if (response.ok) return { valid: true, error: null };
-    if (response.status === 401 || response.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-    return { valid: false, error: `Validation failed: ${response.status}` };
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-}
-
-async function validateBailianCodingPlanProvider({ apiKey, providerSpecificData = {} }: any) {
-  try {
-    const rawBaseUrl =
-      normalizeBaseUrl(providerSpecificData.baseUrl) ||
-      "https://coding-intl.dashscope.aliyuncs.com/apps/anthropic/v1";
-    const baseUrl = rawBaseUrl.endsWith("/messages")
-      ? rawBaseUrl.slice(0, -"/messages".length)
-      : rawBaseUrl;
-    // bailian-coding-plan uses DashScope Anthropic-compatible messages endpoint
-    // It does NOT expose /v1/models — use messages probe directly
-    const messagesUrl = `${baseUrl}/messages`;
-
-    const response = await validationWrite(messagesUrl, {
-      method: "POST",
-      headers: applyCustomUserAgent(
-        {
-          "Content-Type": "application/json",
-          "x-api-key": apiKey,
-          "anthropic-version": "2023-06-01",
-        },
-        providerSpecificData
-      ),
-      body: JSON.stringify({
-        model: "qwen3-coder-plus",
-        max_tokens: 1,
-        messages: [{ role: "user", content: "test" }],
-      }),
-    });
-
-    // 401/403 => invalid key
-    if (response.status === 401 || response.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-
-    // Non-auth 4xx (e.g., 400 bad request) means auth passed but request was malformed
-    if (response.status >= 400 && response.status < 500) {
-      return { valid: true, error: null };
-    }
-
-    if (response.ok) {
-      return { valid: true, error: null };
-    }
-
-    return { valid: false, error: `Validation failed: ${response.status}` };
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-}
-
-async function validateHerokuProvider({ apiKey, providerSpecificData = {} }: any) {
-  const baseUrl = normalizeBaseUrl(providerSpecificData.baseUrl);
-  if (!baseUrl) {
-    return { valid: false, error: "Missing base URL" };
-  }
-
-  return validateDirectChatProvider({
-    url: normalizeHerokuChatUrl(baseUrl),
-    headers: buildBearerHeaders(apiKey, providerSpecificData),
-    body: {
-      model: providerSpecificData.validationModelId || "claude-4-sonnet",
-      messages: [{ role: "user", content: "test" }],
-      max_tokens: 1,
-    },
-    providerSpecificData,
-  });
-}
-
-async function validateDatabricksProvider({ apiKey, providerSpecificData = {} }: any) {
-  const baseUrl = normalizeBaseUrl(providerSpecificData.baseUrl);
-  if (!baseUrl) {
-    return { valid: false, error: "Missing base URL" };
-  }
-
-  return validateDirectChatProvider({
-    url: normalizeDatabricksChatUrl(baseUrl),
-    headers: buildBearerHeaders(apiKey, providerSpecificData),
-    body: {
-      model: providerSpecificData.validationModelId || "databricks-meta-llama-3-3-70b-instruct",
-      messages: [{ role: "user", content: "test" }],
-      max_tokens: 1,
-    },
-    providerSpecificData,
-  });
-}
-
-async function validateDataRobotProvider({ apiKey, providerSpecificData = {} }: any) {
-  const configuredBaseUrl =
-    normalizeBaseUrl(providerSpecificData.baseUrl) || DATAROBOT_DEFAULT_BASE_URL;
-
-  if (isDataRobotDeploymentUrl(configuredBaseUrl)) {
-    return validateDirectChatProvider({
-      url: buildDataRobotChatUrl(configuredBaseUrl),
-      headers: buildBearerHeaders(apiKey, providerSpecificData),
-      body: {
-        model: providerSpecificData.validationModelId || "datarobot-deployed-llm",
-        messages: [{ role: "user", content: "test" }],
-        max_tokens: 1,
-      },
-      providerSpecificData,
-    });
-  }
-
-  const catalogUrl = buildDataRobotCatalogUrl(configuredBaseUrl);
-  if (!catalogUrl) {
-    return { valid: false, error: "Invalid DataRobot base URL" };
-  }
-
-  try {
-    const response = await validationRead(catalogUrl, {
-      method: "GET",
-      headers: buildBearerHeaders(apiKey, providerSpecificData),
-    });
-
-    if (response.ok) {
-      return { valid: true, error: null, method: "gateway_catalog" };
-    }
-
-    if (response.status === 401 || response.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-
-    if (response.status === 429) {
-      return {
-        valid: true,
-        error: null,
-        method: "gateway_catalog",
-        warning: "Rate limited, but credentials are valid",
-      };
-    }
-
-    if (response.status >= 400 && response.status < 500) {
-      return { valid: true, error: null, method: "gateway_catalog" };
-    }
-
-    return { valid: false, error: `Validation failed: ${response.status}` };
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-}
-
-async function validateSnowflakeProvider({ apiKey, providerSpecificData = {} }: any) {
-  const baseUrl = normalizeBaseUrl(providerSpecificData.baseUrl);
-  if (!baseUrl) {
-    return { valid: false, error: "Missing base URL" };
-  }
-
-  const usesProgrammaticAccessToken = typeof apiKey === "string" && apiKey.startsWith("pat/");
-  return validateDirectChatProvider({
-    url: normalizeSnowflakeChatUrl(baseUrl),
-    headers: {
-      "Content-Type": "application/json",
-      Authorization: `Bearer ${usesProgrammaticAccessToken ? apiKey.slice(4) : apiKey}`,
-      "X-Snowflake-Authorization-Token-Type": usesProgrammaticAccessToken
-        ? "PROGRAMMATIC_ACCESS_TOKEN"
-        : "KEYPAIR_JWT",
-    },
-    body: {
-      model: providerSpecificData.validationModelId || "llama3.3-70b",
-      messages: [{ role: "user", content: "test" }],
-      max_tokens: 1,
-    },
-    providerSpecificData,
-  });
-}
-
-async function validateGigachatProvider({ apiKey, providerSpecificData = {} }: any) {
-  const baseUrl =
-    normalizeBaseUrl(providerSpecificData.baseUrl) || "https://gigachat.devices.sberbank.ru/api/v1";
-
-  let token;
-  try {
-    token = await getGigachatAccessToken({ credentials: apiKey });
-  } catch (error: any) {
-    if (String(error?.message || "").match(/\b(401|403)\b/)) {
-      return { valid: false, error: "Invalid API key" };
-    }
-    return toValidationErrorResult(error);
-  }
-
-  return validateDirectChatProvider({
-    url: normalizeGigachatChatUrl(baseUrl),
-    headers: {
-      "Content-Type": "application/json",
-      Authorization: `Bearer ${token.accessToken}`,
-      Accept: "application/json",
-    },
-    body: {
-      model: providerSpecificData.validationModelId || "GigaChat-2-Pro",
-      messages: [{ role: "user", content: "test" }],
-      max_tokens: 1,
-    },
-    providerSpecificData,
-  });
-}
-
-async function validateAzureOpenAIProvider({ apiKey, providerSpecificData = {} }: any) {
-  const rawBaseUrl = normalizeBaseUrl(providerSpecificData.baseUrl);
-  if (!rawBaseUrl) {
-    return { valid: false, error: "Missing base URL" };
-  }
-
-  const baseUrl = normalizeAzureOpenAIBaseUrl(rawBaseUrl);
-  const apiVersion =
-    typeof providerSpecificData.validationApiVersion === "string" &&
-    providerSpecificData.validationApiVersion.trim()
-      ? providerSpecificData.validationApiVersion.trim()
-      : "2024-12-01-preview";
-  const headers = applyCustomUserAgent(
-    {
-      "Content-Type": "application/json",
-      "api-key": apiKey,
-    },
-    providerSpecificData
-  );
-  const encodedVersion = encodeURIComponent(apiVersion);
-
-  for (const probeUrl of [
-    `${baseUrl}/openai/deployments?api-version=${encodedVersion}`,
-    `${baseUrl}/openai/models?api-version=${encodedVersion}`,
-  ]) {
-    try {
-      const response = await validationRead(probeUrl, { method: "GET", headers });
-      if (response.ok) {
-        return { valid: true, error: null, method: "azure_probe" };
-      }
-      if (response.status === 401 || response.status === 403) {
-        return { valid: false, error: "Invalid API key" };
-      }
-      if (response.status === 400 || response.status === 404 || response.status === 405) {
-        continue;
-      }
-      if (response.status === 429) {
-        return {
-          valid: true,
-          error: null,
-          method: "azure_probe",
-          warning: "Rate limited, but credentials are valid",
-        };
-      }
-      if (response.status >= 500) {
-        return { valid: false, error: `Provider unavailable (${response.status})` };
-      }
-    } catch (error) {
-      return toValidationErrorResult(error);
-    }
-  }
-
-  const deploymentId =
-    typeof providerSpecificData.validationModelId === "string"
-      ? providerSpecificData.validationModelId.trim()
-      : "";
-
-  if (!deploymentId) {
-    return {
-      valid: true,
-      error: null,
-      warning:
-        "Azure key accepted, but no deployment name was provided for a chat probe. Set Model ID to validate a specific deployment.",
-    };
-  }
-
-  const chatUrl = `${baseUrl}/openai/deployments/${encodeURIComponent(deploymentId)}/chat/completions?api-version=${encodedVersion}`;
-  const response = await validationWrite(chatUrl, {
-    method: "POST",
-    headers,
-    body: JSON.stringify({
-      model: deploymentId,
-      messages: [{ role: "user", content: "test" }],
-      max_tokens: 1,
-    }),
-  });
-
-  if (
-    response.ok ||
-    response.status === 400 ||
-    response.status === 422 ||
-    response.status === 429
-  ) {
-    return { valid: true, error: null, method: "chat_probe" };
-  }
-  if (response.status === 401 || response.status === 403) {
-    return { valid: false, error: "Invalid API key" };
-  }
-  if (response.status === 404) {
-    return {
-      valid: true,
-      error: null,
-      method: "chat_probe",
-      warning: "Azure credentials are valid, but the requested deployment was not found.",
-    };
-  }
-  if (response.status >= 500) {
-    return { valid: false, error: `Provider unavailable (${response.status})` };
-  }
-  return { valid: false, error: `Validation failed: ${response.status}` };
-}
-
-async function validateAzureAiProvider({ apiKey, providerSpecificData = {} }: any) {
-  const rawBaseUrl = normalizeBaseUrl(providerSpecificData.baseUrl) || AZURE_AI_DEFAULT_BASE_URL;
-  const modelsUrl = buildAzureAiModelsUrl(rawBaseUrl);
-  const headers = applyCustomUserAgent(
-    {
-      "Content-Type": "application/json",
-      "api-key": apiKey,
-    },
-    providerSpecificData
-  );
-
-  try {
-    const response = await validationRead(modelsUrl, {
-      method: "GET",
-      headers,
-    });
-
-    if (response.ok) {
-      return { valid: true, error: null, method: "azure_ai_models" };
-    }
-
-    if (response.status === 401 || response.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-
-    if (response.status === 429) {
-      return {
-        valid: true,
-        error: null,
-        method: "azure_ai_models",
-        warning: "Rate limited, but credentials are valid",
-      };
-    }
-  } catch {
-    // Fall through to chat probe when /models is unavailable.
-  }
-
-  const validationModelId =
-    typeof providerSpecificData.validationModelId === "string"
-      ? providerSpecificData.validationModelId.trim()
-      : "";
-
-  if (!validationModelId) {
-    return {
-      valid: false,
-      error: "Endpoint /models unavailable. Provide a Model ID to validate via /chat/completions.",
-    };
-  }
-
-  const chatUrl = buildAzureAiChatUrl(
-    rawBaseUrl,
-    providerSpecificData.apiType === "responses" ? "responses" : "chat"
-  );
-  const chatBody =
-    providerSpecificData.apiType === "responses"
-      ? {
-          model: validationModelId,
-          input: "test",
-          max_output_tokens: 1,
-        }
-      : {
-          model: validationModelId,
-          messages: [{ role: "user", content: "test" }],
-          max_tokens: 1,
-        };
-
-  try {
-    const response = await validationWrite(chatUrl, {
-      method: "POST",
-      headers,
-      body: JSON.stringify(chatBody),
-    });
-
-    if (
-      response.ok ||
-      response.status === 400 ||
-      response.status === 404 ||
-      response.status === 422 ||
-      response.status === 429
-    ) {
-      return { valid: true, error: null, method: "azure_ai_chat_probe" };
-    }
-
-    if (response.status === 401 || response.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-
-    if (response.status >= 500) {
-      return { valid: false, error: `Provider unavailable (${response.status})` };
-    }
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-
-  return { valid: false, error: "Connection failed while testing Azure AI Foundry" };
-}
-
-async function validateWatsonxProvider({ apiKey, providerSpecificData = {} }: any) {
-  const rawBaseUrl = normalizeBaseUrl(providerSpecificData.baseUrl) || WATSONX_DEFAULT_BASE_URL;
-  const headers = applyCustomUserAgent(
-    {
-      "Content-Type": "application/json",
-      Authorization: `Bearer ${apiKey}`,
-    },
-    providerSpecificData
-  );
-
-  try {
-    const response = await validationRead(buildWatsonxModelsUrl(rawBaseUrl), {
-      method: "GET",
-      headers,
-    });
-
-    if (response.ok) {
-      return { valid: true, error: null, method: "watsonx_models" };
-    }
-
-    if (response.status === 401 || response.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-
-    if (response.status === 429) {
-      return {
-        valid: true,
-        error: null,
-        method: "watsonx_models",
-        warning: "Rate limited, but credentials are valid",
-      };
-    }
-  } catch {
-    // Fall through to chat probe when /models is unavailable.
-  }
-
-  const validationModelId =
-    typeof providerSpecificData.validationModelId === "string" &&
-    providerSpecificData.validationModelId.trim()
-      ? providerSpecificData.validationModelId.trim()
-      : "ibm/granite-3-3-8b-instruct";
-
-  try {
-    const response = await validationWrite(buildWatsonxChatUrl(rawBaseUrl), {
-      method: "POST",
-      headers,
-      body: JSON.stringify({
-        model: validationModelId,
-        messages: [{ role: "user", content: "test" }],
-        max_tokens: 1,
-      }),
-    });
-
-    if (
-      response.ok ||
-      response.status === 400 ||
-      response.status === 404 ||
-      response.status === 422 ||
-      response.status === 429
-    ) {
-      return {
-        valid: true,
-        error: null,
-        method: "watsonx_chat_probe",
-        ...(response.status === 404
-          ? { warning: "watsonx credentials are valid, but the requested model is not enabled." }
-          : {}),
-      };
-    }
-
-    if (response.status === 401 || response.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-
-    if (response.status >= 500) {
-      return { valid: false, error: `Provider unavailable (${response.status})` };
-    }
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-
-  return { valid: false, error: "Connection failed while testing watsonx.ai" };
-}
-
-async function validateOciProvider({ apiKey, providerSpecificData = {} }: any) {
-  const rawBaseUrl = normalizeBaseUrl(providerSpecificData.baseUrl) || OCI_DEFAULT_BASE_URL;
-  const projectId =
-    typeof providerSpecificData.projectId === "string" && providerSpecificData.projectId.trim()
-      ? providerSpecificData.projectId.trim()
-      : typeof providerSpecificData.project === "string" && providerSpecificData.project.trim()
-        ? providerSpecificData.project.trim()
-        : "";
-  const headers = applyCustomUserAgent(
-    {
-      "Content-Type": "application/json",
-      Authorization: `Bearer ${apiKey}`,
-      ...(projectId ? { "OpenAI-Project": projectId } : {}),
-    },
-    providerSpecificData
-  );
-
-  try {
-    const response = await validationRead(buildOciModelsUrl(rawBaseUrl), {
-      method: "GET",
-      headers,
-    });
-
-    if (response.ok) {
-      return { valid: true, error: null, method: "oci_models" };
-    }
-
-    if (response.status === 401 || response.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-
-    if (response.status === 429) {
-      return {
-        valid: true,
-        error: null,
-        method: "oci_models",
-        warning: "Rate limited, but credentials are valid",
-      };
-    }
-  } catch {
-    // Fall through to chat/responses probe when /models is unavailable.
-  }
-
-  const validationModelId =
-    typeof providerSpecificData.validationModelId === "string" &&
-    providerSpecificData.validationModelId.trim()
-      ? providerSpecificData.validationModelId.trim()
-      : "openai.gpt-oss-20b";
-  const apiType = providerSpecificData.apiType === "responses" ? "responses" : "chat";
-  const body =
-    apiType === "responses"
-      ? {
-          model: validationModelId,
-          input: "test",
-          max_output_tokens: 1,
-        }
-      : {
-          model: validationModelId,
-          messages: [{ role: "user", content: "test" }],
-          max_tokens: 1,
-        };
-
-  try {
-    const response = await validationWrite(buildOciChatUrl(rawBaseUrl, apiType), {
-      method: "POST",
-      headers,
-      body: JSON.stringify(body),
-    });
-
-    if (
-      response.ok ||
-      response.status === 400 ||
-      response.status === 404 ||
-      response.status === 422 ||
-      response.status === 429
-    ) {
-      return {
-        valid: true,
-        error: null,
-        method: apiType === "responses" ? "oci_responses_probe" : "oci_chat_probe",
-        ...(response.status === 404
-          ? { warning: "OCI credentials are valid, but the requested model was not found." }
-          : {}),
-      };
-    }
-
-    if (response.status === 401 || response.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-
-    if (response.status >= 500) {
-      return { valid: false, error: `Provider unavailable (${response.status})` };
-    }
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-
-  return { valid: false, error: "Connection failed while testing OCI Generative AI" };
-}
-
-async function validateSapProvider({ apiKey, providerSpecificData = {} }: any) {
-  const rawBaseUrl = normalizeBaseUrl(providerSpecificData.baseUrl) || SAP_DEFAULT_BASE_URL;
-  const resourceGroup = getSapResourceGroup(providerSpecificData);
-  const headers = applyCustomUserAgent(
-    {
-      "Content-Type": "application/json",
-      Authorization: `Bearer ${apiKey}`,
-      "AI-Resource-Group": resourceGroup,
-    },
-    providerSpecificData
-  );
-
-  try {
-    const response = await validationRead(buildSapModelsUrl(rawBaseUrl), {
-      method: "GET",
-      headers,
-    });
-
-    if (response.ok) {
-      return { valid: true, error: null, method: "sap_models" };
-    }
-
-    if (response.status === 401 || response.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-
-    if (response.status === 429) {
-      return {
-        valid: true,
-        error: null,
-        method: "sap_models",
-        warning: "Rate limited, but credentials are valid",
-      };
-    }
-  } catch {
-    // Fall through to deployment probe when the discovery API is unavailable.
-  }
-
-  const canProbeChat =
-    isSapDeploymentUrl(rawBaseUrl) || /\/chat\/completions$/i.test(normalizeBaseUrl(rawBaseUrl));
-  if (!canProbeChat) {
-    return {
-      valid: false,
-      error:
-        "SAP validation needs either a reachable AI_API_URL or a deployment URL in providerSpecificData.baseUrl",
-    };
-  }
-
-  const validationModelId =
-    typeof providerSpecificData.validationModelId === "string" &&
-    providerSpecificData.validationModelId.trim()
-      ? providerSpecificData.validationModelId.trim()
-      : "gpt-4o";
-
-  try {
-    const response = await validationWrite(buildSapChatUrl(rawBaseUrl), {
-      method: "POST",
-      headers,
-      body: JSON.stringify({
-        model: validationModelId,
-        messages: [{ role: "user", content: "test" }],
-        max_tokens: 1,
-      }),
-    });
-
-    if (
-      response.ok ||
-      response.status === 400 ||
-      response.status === 404 ||
-      response.status === 422 ||
-      response.status === 429
-    ) {
-      return {
-        valid: true,
-        error: null,
-        method: "sap_chat_probe",
-        ...(response.status === 404
-          ? { warning: "SAP credentials are valid, but the deployment URL or model was not found." }
-          : {}),
-      };
-    }
-
-    if (response.status === 401 || response.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-
-    if (response.status >= 500) {
-      return { valid: false, error: `Provider unavailable (${response.status})` };
-    }
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-
-  return { valid: false, error: "Connection failed while testing SAP Generative AI Hub" };
-}
-
-async function validateRekaProvider({ apiKey, providerSpecificData = {} }: any) {
-  const baseUrl = normalizeBaseUrl(providerSpecificData.baseUrl) || "https://api.reka.ai/v1";
-  const headers = buildRekaHeaders(apiKey, providerSpecificData);
-
-  try {
-    const response = await validationRead(`${baseUrl}/models`, {
-      method: "GET",
-      headers,
-    });
-
-    if (response.ok) {
-      return { valid: true, error: null, method: "reka_models" };
-    }
-
-    if (response.status === 401 || response.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-
-    if (response.status === 429) {
-      return {
-        valid: true,
-        error: null,
-        method: "reka_models",
-        warning: "Rate limited, but credentials are valid",
-      };
-    }
-  } catch {
-    // Fall through to the chat probe when /models is unavailable.
-  }
-
-  try {
-    const response = await validationWrite(`${baseUrl}/chat/completions`, {
-      method: "POST",
-      headers,
-      body: JSON.stringify({
-        model: providerSpecificData.validationModelId || "reka-flash-3",
-        messages: [{ role: "user", content: "test" }],
-        max_tokens: 1,
-      }),
-    });
-
-    if (
-      response.ok ||
-      response.status === 400 ||
-      response.status === 422 ||
-      response.status === 429
-    ) {
-      return { valid: true, error: null, method: "reka_chat_probe" };
-    }
-
-    if (response.status === 401 || response.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-
-    if (response.status >= 500) {
-      return { valid: false, error: `Provider unavailable (${response.status})` };
-    }
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-
-  return { valid: false, error: "Connection failed while testing Reka" };
-}
-
-async function validateMaritalkProvider({ apiKey, providerSpecificData = {} }: any) {
-  const entry = getRegistryEntry("maritalk");
-  const baseUrl = normalizeBaseUrl(providerSpecificData.baseUrl || entry?.baseUrl);
-  const headers = buildKeyHeaders(apiKey, providerSpecificData);
-
-  try {
-    const modelsRes = await validationRead(buildMaritalkModelsUrl(baseUrl), {
-      method: "GET",
-      headers,
-    });
-
-    if (modelsRes.ok) {
-      return { valid: true, error: null, method: "maritalk_models" };
-    }
-
-    if (modelsRes.status === 401 || modelsRes.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-
-    if (modelsRes.status === 429) {
-      return {
-        valid: true,
-        error: null,
-        method: "maritalk_models",
-        warning: "Rate limited, but credentials are valid",
-      };
-    }
-
-    if (modelsRes.status >= 500) {
-      return { valid: false, error: `Provider unavailable (${modelsRes.status})` };
-    }
-  } catch {
-    // Fall through to the chat probe when /models cannot be reached.
-  }
-
-  const modelId =
-    typeof providerSpecificData?.validationModelId === "string" &&
-    providerSpecificData.validationModelId.trim()
-      ? providerSpecificData.validationModelId.trim()
-      : entry?.models?.[0]?.id || "sabia-4";
-
-  return validateDirectChatProvider({
-    url: buildMaritalkChatUrl(baseUrl),
-    headers,
-    body: {
-      model: modelId,
-      messages: [{ role: "user", content: "test" }],
-      max_tokens: 1,
-    },
-    providerSpecificData,
-  });
-}
-
-async function validateNlpCloudProvider({ apiKey, providerSpecificData = {} }: any) {
-  const rawBaseUrl = normalizeBaseUrl(providerSpecificData.baseUrl) || "https://api.nlpcloud.io/v1";
-  const baseUrl = rawBaseUrl.endsWith("/gpu") ? rawBaseUrl : `${rawBaseUrl.replace(/\/$/, "")}/gpu`;
-  const modelId =
-    typeof providerSpecificData.validationModelId === "string" &&
-    providerSpecificData.validationModelId.trim()
-      ? providerSpecificData.validationModelId.trim()
-      : "chatdolphin";
-  const headers = buildTokenHeaders(apiKey, providerSpecificData);
-
-  try {
-    const response = await validationWrite(`${baseUrl}/${modelId}/chatbot`, {
-      method: "POST",
-      headers,
-      body: JSON.stringify({
-        input: "test",
-        context: "You are a concise assistant.",
-        history: [],
-      }),
-    });
-
-    if (
-      response.ok ||
-      response.status === 400 ||
-      response.status === 422 ||
-      response.status === 429
-    ) {
-      return {
-        valid: true,
-        error: null,
-        method: "nlpcloud_chatbot",
-        ...(response.status === 429 ? { warning: "Rate limited, but credentials are valid" } : {}),
-      };
-    }
-
-    if (response.status === 401 || response.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-
-    if (response.status >= 500) {
-      return { valid: false, error: `Provider unavailable (${response.status})` };
-    }
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-
-  return { valid: false, error: "Connection failed while testing NLP Cloud" };
-}
-
-async function validateRunwayProvider({ apiKey, providerSpecificData = {} }: any) {
-  const baseUrl = normalizeRunwayBaseUrl(providerSpecificData.baseUrl);
-
-  try {
-    const response = await validationRead(buildRunwayApiUrl("/organization", baseUrl), {
-      method: "GET",
-      headers: buildRunwayHeaders(apiKey),
-    });
-
-    if (response.ok) {
-      return { valid: true, error: null, method: "runway_organization" };
-    }
-
-    if (response.status === 401 || response.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-
-    if (response.status === 429) {
-      return {
-        valid: true,
-        error: null,
-        method: "runway_organization",
-        warning: "Rate limited, but credentials are valid",
-      };
-    }
-
-    if (response.status >= 500) {
-      return { valid: false, error: `Provider unavailable (${response.status})` };
-    }
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-
-  return { valid: false, error: "Connection failed while testing Runway" };
-}
-
-async function validateNousResearchProvider({ apiKey, providerSpecificData = {} }: any) {
-  const baseUrl =
-    normalizeBaseUrl(providerSpecificData.baseUrl) || "https://inference-api.nousresearch.com/v1";
-  const chatUrl = `${baseUrl}/chat/completions`;
-  const modelId =
-    typeof providerSpecificData.validationModelId === "string" &&
-    providerSpecificData.validationModelId.trim()
-      ? providerSpecificData.validationModelId.trim()
-      : "Hermes-4-70B";
-
-  try {
-    const response = await validationWrite(chatUrl, {
-      method: "POST",
-      headers: buildBearerHeaders(apiKey, providerSpecificData),
-      body: JSON.stringify({
-        model: modelId,
-        messages: [{ role: "user", content: "test" }],
-        max_tokens: 1,
-      }),
-    });
-
-    if (response.ok) {
-      return { valid: true, error: null, method: "nous_chat_completions" };
-    }
-
-    if (response.status === 401 || response.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-
-    if (response.status === 429) {
-      return {
-        valid: true,
-        error: null,
-        method: "nous_chat_completions",
-        warning: "Rate limited, but credentials are valid",
-      };
-    }
-
-    if (response.status === 402) {
-      return { valid: false, error: "Payment required or API key missing" };
-    }
-
-    if (response.status >= 500) {
-      return { valid: false, error: `Provider unavailable (${response.status})` };
-    }
-
-    // #3881: any other non-auth 4xx (e.g. 400 model-not-found, 404, 422) means the
-    // credentials were accepted — only the probe model/request shape was rejected.
-    // Treat as valid (mirrors the longcat/nvidia validators) so a model rename upstream
-    // can't make a working key read as "invalid".
-    if (response.status >= 400 && response.status < 500) {
-      return {
-        valid: true,
-        error: null,
-        method: "nous_chat_completions",
-        warning: `Credentials valid (probe returned ${response.status})`,
-      };
-    }
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-
-  return { valid: false, error: "Connection failed while testing Nous Research" };
-}
-
-async function validatePoeProvider({ apiKey, providerSpecificData = {} }: any) {
-  const baseUrl = normalizeBaseUrl(providerSpecificData.baseUrl) || "https://api.poe.com/v1";
-  const balanceUrl = new URL("/usage/current_balance", baseUrl).toString();
-
-  try {
-    const response = await validationRead(balanceUrl, {
-      method: "GET",
-      headers: buildBearerHeaders(apiKey, providerSpecificData),
-    });
-
-    if (response.ok) {
-      return { valid: true, error: null, method: "poe_current_balance" };
-    }
-
-    if (response.status === 401 || response.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-
-    if (response.status === 429) {
-      return {
-        valid: true,
-        error: null,
-        method: "poe_current_balance",
-        warning: "Rate limited, but credentials are valid",
-      };
-    }
-
-    if (response.status >= 500) {
-      return { valid: false, error: `Provider unavailable (${response.status})` };
-    }
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-
-  return { valid: false, error: "Connection failed while testing Poe" };
-}
-
-async function validateOpenAICompatibleProvider({ apiKey, providerSpecificData = {} }: any) {
-  const baseUrl = normalizeBaseUrl(providerSpecificData.baseUrl);
-  if (!baseUrl) {
-    return { valid: false, error: "No base URL configured for OpenAI compatible provider" };
-  }
-
-  const validationModelId =
-    typeof providerSpecificData?.validationModelId === "string"
-      ? providerSpecificData.validationModelId.trim()
-      : "";
-
-  // Step 1: Try GET /models
-  let modelsReachable = false;
-  try {
-    const modelsRes = await validationRead(`${baseUrl}/models`, {
-      method: "GET",
-      headers: buildBearerHeaders(apiKey, providerSpecificData),
-    });
-
-    modelsReachable = true;
-
-    if (modelsRes.ok) {
-      return { valid: true, error: null, method: "models_endpoint" };
-    }
-
-    if (modelsRes.status === 401 || modelsRes.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-
-    // Endpoint responded and auth seems valid, but quota is exhausted/rate-limited.
-    if (modelsRes.status === 429) {
-      return {
-        valid: true,
-        error: null,
-        method: "models_endpoint",
-        warning: "Rate limited, but credentials are valid",
-      };
-    }
-  } catch {
-    // /models fetch failed (network error, etc.) — fall through to chat test
-  }
-
-  // T25: if /models cannot be used and no custom model was provided, return a
-  // clear actionable message instead of a generic connection error.
-  if (!validationModelId) {
-    return {
-      valid: false,
-      error: "Endpoint /models unavailable. Provide a Model ID to validate via /chat/completions.",
-    };
-  }
-
-  // Step 2: Fallback — try a minimal chat completion request
-  // Many providers don't expose /models but accept chat completions fine
-  const apiType = providerSpecificData.apiType || "chat";
-  const chatSuffix = apiType === "responses" ? "/responses" : "/chat/completions";
-  const chatUrl = `${baseUrl}${chatSuffix}`;
-  const testModelId = validationModelId;
-
-  try {
-    const chatRes = await validationWrite(chatUrl, {
-      method: "POST",
-      headers: buildBearerHeaders(apiKey, providerSpecificData),
-      body: JSON.stringify({
-        model: testModelId,
-        messages: [{ role: "user", content: "test" }],
-        max_tokens: 1,
-      }),
-    });
-
-    if (chatRes.ok) {
-      return { valid: true, error: null, method: "chat_completions" };
-    }
-
-    if (chatRes.status === 401 || chatRes.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-
-    if (chatRes.status === 429) {
-      return {
-        valid: true,
-        error: null,
-        method: "chat_completions",
-        warning: "Rate limited, but credentials are valid",
-      };
-    }
-
-    // If /models was reachable but returned non-auth error, and chat succeeds
-    // auth-wise, this still confirms credentials are valid.
-    if (chatRes.status === 400) {
-      return {
-        valid: true,
-        error: null,
-        method: "inference_available",
-        warning: "Model ID may be invalid, but credentials are valid",
-      };
-    }
-
-    // 4xx other than auth (e.g. 400 bad model, 422) usually means auth passed
-    if (chatRes.status >= 400 && chatRes.status < 500) {
-      return {
-        valid: true,
-        error: null,
-        method: "inference_available",
-      };
-    }
-
-    if (chatRes.status >= 500) {
-      return { valid: false, error: `Provider unavailable (${chatRes.status})` };
-    }
-  } catch {
-    // Chat test also failed — fall through to simple connectivity check
-  }
-
-  // Step 3: Final fallback — simple connectivity check
-  // For local providers (Ollama, LM Studio, etc.) that may not respond to
-  // standard OpenAI endpoints but are still reachable
-  if (!modelsReachable) {
-    return { valid: false, error: "Connection failed while testing /chat/completions" };
-  }
-
-  try {
-    const pingRes = await validationRead(baseUrl, {
-      method: "GET",
-      headers: buildBearerHeaders(apiKey, providerSpecificData),
-    });
-
-    // If the server responds at all (even with an error page), it's reachable
-    if (pingRes.status < 500) {
-      return { valid: true, error: null };
-    }
-
-    return { valid: false, error: `Provider unavailable (${pingRes.status})` };
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-}
-
-async function validateAnthropicCompatibleProvider({
-  apiKey,
-  providerSpecificData = {},
-  isLocal = false,
-}: any) {
-  let baseUrl = normalizeAnthropicBaseUrl(providerSpecificData.baseUrl);
-  if (!baseUrl) {
-    return { valid: false, error: "No base URL configured for Anthropic compatible provider" };
-  }
-
-  const headers = applyCustomUserAgent(
-    {
-      "Content-Type": "application/json",
-      "x-api-key": apiKey,
-      "anthropic-version": "2023-06-01",
-      Authorization: `Bearer ${apiKey}`,
-    },
-    providerSpecificData
-  );
-
-  // Step 1: Try GET /models
-  try {
-    const modelsRes = await validationRead(
-      joinBaseUrlAndPath(baseUrl, providerSpecificData?.modelsPath || "/models"),
-      {
-        method: "GET",
-        headers,
-      },
-      isLocal
-    );
-
-    if (modelsRes.ok) {
-      return { valid: true, error: null };
-    }
-
-    if (modelsRes.status === 401 || modelsRes.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-  } catch {
-    // /models fetch failed — fall through to messages test
-  }
-
-  // Step 2: Fallback — try a minimal messages request
-  const testModelId = providerSpecificData?.validationModelId || "claude-3-5-sonnet-20241022";
-  try {
-    const messagesRes = await validationWrite(
-      joinBaseUrlAndPath(baseUrl, providerSpecificData?.chatPath || "/messages"),
-      {
-        method: "POST",
-        headers,
-        body: JSON.stringify({
-          model: testModelId,
-          max_tokens: 1,
-          messages: [{ role: "user", content: "test" }],
-        }),
-      },
-      isLocal
-    );
-
-    if (messagesRes.status === 401 || messagesRes.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-
-    // Any other response (200, 400, 422, etc.) means auth passed
-    return { valid: true, error: null };
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-}
-
-export async function validateClaudeCodeCompatibleProvider({
-  apiKey,
-  providerSpecificData = {},
-}: any) {
-  const baseUrl = normalizeClaudeCodeCompatibleBaseUrl(providerSpecificData.baseUrl);
-  if (!baseUrl) {
-    return { valid: false, error: "No base URL configured for CC Compatible provider" };
-  }
-
-  const modelsPath = providerSpecificData?.modelsPath || CLAUDE_CODE_COMPATIBLE_DEFAULT_MODELS_PATH;
-  const chatPath = providerSpecificData?.chatPath || CLAUDE_CODE_COMPATIBLE_DEFAULT_CHAT_PATH;
-  const defaultHeaders = applyCustomUserAgent(
-    buildClaudeCodeCompatibleHeaders(apiKey, false),
-    providerSpecificData
-  );
-
-  try {
-    const modelsRes = await validationRead(joinClaudeCodeCompatibleUrl(baseUrl, modelsPath), {
-      method: "GET",
-      headers: defaultHeaders,
-    });
-
-    if (modelsRes.ok) {
-      return { valid: true, error: null, method: "models_endpoint" };
-    }
-
-    if (modelsRes.status === 401 || modelsRes.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-  } catch {
-    // Fall through to bridge request validation.
-  }
-
-  const payload = buildClaudeCodeCompatibleValidationPayload(
-    providerSpecificData?.validationModelId || "claude-sonnet-4-6"
-  );
-  const sessionId = JSON.parse(payload.metadata.user_id as string).session_id;
-
-  try {
-    const messagesRes = await validationWrite(joinClaudeCodeCompatibleUrl(baseUrl, chatPath), {
-      method: "POST",
-      headers: applyCustomUserAgent(
-        buildClaudeCodeCompatibleHeaders(apiKey, true, sessionId),
-        providerSpecificData
-      ),
-      body: JSON.stringify(payload),
-    });
-
-    if (messagesRes.status === 401 || messagesRes.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-
-    if (messagesRes.status === 429) {
-      return {
-        valid: true,
-        error: null,
-        method: "cc_bridge_request",
-        warning: "Rate limited, but credentials are valid",
-      };
-    }
-
-    if (messagesRes.status >= 400 && messagesRes.status < 500) {
-      return {
-        valid: true,
-        error: null,
-        method: "cc_bridge_request",
-        warning: "Bridge request reached upstream, but the model or payload was rejected",
-      };
-    }
-
-    return {
-      valid: messagesRes.ok,
-      error: messagesRes.ok ? null : `Validation failed: ${messagesRes.status}`,
-      method: "cc_bridge_request",
-    };
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-}
-
-// ── Search provider validators (factored) ──
-
-async function validateGenericProvider(
-  baseUrl: string,
-  apiKey: string,
-  providerSpecificData: any = {},
-  provider: string,
-  isLocal: boolean = false
-) {
-  const config = SEARCH_VALIDATOR_CONFIGS[provider];
-  if (!config) {
-    return { valid: false, error: "Validator not found", unsupported: true };
-  }
-  const { url, init } = config(apiKey, providerSpecificData);
-  return validateSearchProvider(url, init, providerSpecificData, isLocal);
-}
-
-async function validateSearchProvider(
-  url: string,
-  init: RequestInit,
-  providerSpecificData: any = {},
-  isLocal: boolean = false
-): Promise<{ valid: boolean; error: string | null; unsupported: false }> {
-  try {
-    const response = await safeOutboundFetch(url, {
-      ...SAFE_OUTBOUND_FETCH_PRESETS.validationWrite,
-      guard: isLocal ? "none" : getProviderOutboundGuard(),
-      ...withCustomUserAgent(init, providerSpecificData),
-    });
-    if (response.ok) return { valid: true, error: null, unsupported: false };
-    if (response.status === 401 || response.status === 403) {
-      return { valid: false, error: "Invalid API key", unsupported: false };
-    }
-    // For provider setup we only need to confirm authentication passed.
-    // Search providers may return non-auth statuses for exhausted credits,
-    // rate limiting, or request-shape quirks while still accepting the key.
-    if (response.status < 500) {
-      return { valid: true, error: null, unsupported: false };
-    }
-    return { valid: false, error: `Validation failed: ${response.status}`, unsupported: false };
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-}
-
-const SEARCH_VALIDATOR_CONFIGS: Record<
-  string,
-  (apiKey: string, providerSpecificData?: any) => { url: string; init: RequestInit }
-> = {
-  "serper-search": (apiKey) => ({
-    url: "https://google.serper.dev/search",
-    init: {
-      method: "POST",
-      headers: { "Content-Type": "application/json", "X-API-Key": apiKey },
-      body: JSON.stringify({ q: "test", num: 1 }),
-    },
-  }),
-  "brave-search": (apiKey) => ({
-    url: "https://api.search.brave.com/res/v1/web/search?q=test&count=1",
-    init: {
-      method: "GET",
-      headers: { Accept: "application/json", "X-Subscription-Token": apiKey },
-    },
-  }),
-  "perplexity-search": (apiKey) => ({
-    url: "https://api.perplexity.ai/search",
-    init: {
-      method: "POST",
-      headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
-      body: JSON.stringify({ query: "test", max_results: 1 }),
-    },
-  }),
-  "exa-search": (apiKey) => ({
-    url: "https://api.exa.ai/search",
-    init: {
-      method: "POST",
-      headers: { "Content-Type": "application/json", "x-api-key": apiKey },
-      body: JSON.stringify({ query: "test", numResults: 1 }),
-    },
-  }),
-  "tavily-search": (apiKey) => ({
-    url: "https://api.tavily.com/search",
-    init: {
-      method: "POST",
-      headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
-      body: JSON.stringify({ query: "test", max_results: 1 }),
-    },
-  }),
-  "google-pse-search": (apiKey, providerSpecificData = {}) => {
-    const cx = providerSpecificData?.cx;
-    if (!cx || typeof cx !== "string") {
-      throw new Error("Programmable Search Engine ID (cx) is required");
-    }
-    return {
-      url: `https://www.googleapis.com/customsearch/v1?key=${encodeURIComponent(apiKey)}&cx=${encodeURIComponent(
-        cx
-      )}&q=test&num=1`,
-      init: {
-        method: "GET",
-        headers: { Accept: "application/json" },
-      },
-    };
-  },
-  "linkup-search": (apiKey) => ({
-    url: "https://api.linkup.so/v1/search",
-    init: {
-      method: "POST",
-      headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
-      body: JSON.stringify({
-        q: "test",
-        depth: "standard",
-        outputType: "searchResults",
-        maxResults: 1,
-      }),
-    },
-  }),
-  "searchapi-search": (apiKey) => ({
-    url: `https://www.searchapi.io/api/v1/search?engine=google&q=test&api_key=${encodeURIComponent(
-      apiKey
-    )}`,
-    init: {
-      method: "GET",
-      headers: { Accept: "application/json" },
-    },
-  }),
-  "youcom-search": (apiKey) => ({
-    url: "https://ydc-index.io/v1/search?query=test&count=1",
-    init: {
-      method: "GET",
-      headers: { Accept: "application/json", "X-API-Key": apiKey },
-    },
-  }),
-  "searxng-search": (apiKey, providerSpecificData = {}) => {
-    const baseUrl =
-      typeof providerSpecificData?.baseUrl === "string" && providerSpecificData.baseUrl.trim()
-        ? providerSpecificData.baseUrl.trim().replace(/\/+$/, "")
-        : "http://localhost:8888/search";
-    const searchUrl = baseUrl.endsWith("/search") ? baseUrl : `${baseUrl}/search`;
-    const headers: Record<string, string> = { Accept: "application/json" };
-    if (apiKey) {
-      headers["Authorization"] = `Bearer ${apiKey}`;
-    }
-    return {
-      url: `${searchUrl}?q=test&format=json`,
-      init: {
-        method: "GET",
-        headers,
-      },
-    };
-  },
-  "ollama-search": (apiKey) => ({
-    url: "https://ollama.com/api/web_search",
-    init: {
-      method: "POST",
-      headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
-      body: JSON.stringify({ query: "test", max_results: 1 }),
-    },
-  }),
-  "zai-search": (apiKey, providerSpecificData = {}) => {
-    const baseUrl =
-      typeof providerSpecificData?.baseUrl === "string" && providerSpecificData.baseUrl.trim()
-        ? providerSpecificData.baseUrl.trim().replace(/\/+$/, "")
-        : "https://api.z.ai/api/mcp/web_search_prime/mcp";
-    return {
-      url: baseUrl,
-      init: {
-        method: "POST",
-        headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
-        body: JSON.stringify({
-          jsonrpc: "2.0",
-          method: "tools/call",
-          params: { name: "web_search_prime", arguments: { search_query: "test" } },
-          id: 1,
-        }),
-      },
-    };
-  },
-  // ── Web-fetch providers (#4401) ──
-  // firecrawl / jina-reader were added as webFetch-kind providers in #2645 with their
-  // own executors but no validator, so the dashboard "Validate" step returned
-  // "Provider validation not supported" and accounts could not be added through the UI.
-  // Probe each provider's real fetch endpoint with the same Bearer auth the executor
-  // uses; validateSearchProvider maps 200/<500 → valid, 401/403 → invalid key,
-  // >=500 → failure (a credit-exhausted / rate-limited key still validates).
-  firecrawl: (apiKey) => ({
-    url: "https://api.firecrawl.dev/v1/scrape",
-    init: {
-      method: "POST",
-      headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
-      body: JSON.stringify({ url: "https://example.com", formats: ["markdown"] }),
-    },
-  }),
-  "jina-reader": (apiKey) => ({
-    url: "https://r.jina.ai/https://example.com",
-    init: {
-      method: "GET",
-      headers: { Authorization: `Bearer ${apiKey}` },
-    },
-  }),
-};
-
-// See open-sse/executors/muse-spark-web.ts for the rationale: Meta migrated
-// from the "Abra" mutation (doc_id 078dfdff…, type RewriteOptionsInput now
-// missing from schema) to the "Ecto" subscription. POST graphql still
-// streams the response; only the persisted-query identifier and operation
-// shape changed.
-const META_AI_SEND_MESSAGE_DOC_ID = "29ae946c82d1f301196c6ca2226400b5";
-const META_AI_FRIENDLY_NAME = "useEctoSendMessageSubscription";
-const META_AI_REQUEST_ANALYTICS_TAGS = "graphservice";
-const META_AI_ASBD_ID = "129477";
-const META_AI_USER_AGENT =
-  "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36";
-const META_AI_BASE62_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
-
-function encodeMetaAiBase62(value: bigint, padLength: number): string {
-  let remaining = value;
-  let encoded = "";
-
-  while (remaining > 0n) {
-    encoded = META_AI_BASE62_ALPHABET[Number(remaining % 62n)] + encoded;
-    remaining /= 62n;
-  }
-
-  return encoded.padStart(padLength, "0");
-}
-
-function decodeMetaAiBase62(value: string): bigint {
-  let decoded = 0n;
-  for (const char of value) {
-    const index = META_AI_BASE62_ALPHABET.indexOf(char);
-    if (index < 0) {
-      throw new Error(`Invalid Meta AI base62 character: ${char}`);
-    }
-    decoded = decoded * 62n + BigInt(index);
-  }
-  return decoded;
-}
-
-function randomMetaAiBigInt(byteLength: number): bigint {
-  const bytes = new Uint8Array(byteLength);
-  crypto.getRandomValues(bytes);
-  let result = 0n;
-  for (const byte of bytes) {
-    result = (result << 8n) | BigInt(byte);
-  }
-  return result;
-}
-
-function generateMetaAiConversationId(): string {
-  const timestamp = BigInt(Date.now()) & ((1n << 44n) - 1n);
-  const random = randomMetaAiBigInt(8) & ((1n << 64n) - 1n);
-  return `c.${encodeMetaAiBase62((timestamp << 64n) | random, 19)}`;
-}
-
-function generateMetaAiEventId(conversationId: string): string | null {
-  if (!conversationId.startsWith("c.")) {
-    return null;
-  }
-
-  try {
-    const packedConversation = decodeMetaAiBase62(conversationId.slice(2));
-    const conversationRandom = packedConversation & ((1n << 64n) - 1n);
-    const timestamp = BigInt(Date.now()) & ((1n << 44n) - 1n);
-    const eventRandom = randomMetaAiBigInt(4) & ((1n << 32n) - 1n);
-    return `e.${encodeMetaAiBase62((timestamp << (64n + 32n)) | (conversationRandom << 32n) | eventRandom, 25)}`;
-  } catch {
-    return null;
-  }
-}
-
-function generateMetaAiNumericMessageId(): string {
-  return (
-    BigInt(Date.now()) * 1000n +
-    BigInt(Math.floor(Math.random() * 1000)) +
-    (randomMetaAiBigInt(2) & 0xfffn)
-  ).toString();
-}
-
-function buildMetaAiValidationBody() {
-  const conversationId = generateMetaAiConversationId();
-  return {
-    doc_id: META_AI_SEND_MESSAGE_DOC_ID,
-    variables: {
-      assistantMessageId: crypto.randomUUID(),
-      attachments: null,
-      clientLatitude: null,
-      clientLongitude: null,
-      clientTimezone:
-        typeof Intl !== "undefined" ? Intl.DateTimeFormat().resolvedOptions().timeZone : "UTC",
-      clippyIp: null,
-      content: "test",
-      conversationId,
-      conversationStarterId: null,
-      currentBranchPath: "0",
-      developerOverridesForMessage: null,
-      devicePixelRatio: 1,
-      entryPoint: "KADABRA__CHAT__UNIFIED_INPUT_BAR",
-      imagineOperationRequest: null,
-      isNewConversation: true,
-      mentions: null,
-      mode: "mode_fast",
-      promptEditType: null,
-      promptSessionId: crypto.randomUUID(),
-      promptType: null,
-      qplJoinId: null,
-      requestedToolCall: null,
-      // See muse-spark-web executor: RewriteOptionsInput was removed from
-      // Meta's schema; sending `rewriteOptions` (even null) breaks the
-      // persisted-query validation. Omit the field.
-      turnId: crypto.randomUUID(),
-      userAgent: META_AI_USER_AGENT,
-      userEventId: generateMetaAiEventId(conversationId),
-      userLocale: "en_US",
-      userMessageId: crypto.randomUUID(),
-      userUniqueMessageId: generateMetaAiNumericMessageId(),
-    },
-  };
-}
-
-async function validateDeepSeekWebProvider({ apiKey }: any) {
-  if (!apiKey) {
-    return {
-      valid: false,
-      error:
-        "Missing userToken — paste the value from DevTools → Application → Local Storage → chat.deepseek.com → userToken",
-    };
-  }
-  let token = apiKey;
-  try {
-    const parsed = JSON.parse(token);
-    if (typeof parsed?.value === "string") token = parsed.value;
-  } catch {
-    // not JSON, use as-is
-  }
-
-  try {
-    const resp = await fetch("https://chat.deepseek.com/api/v0/users/current", {
-      headers: {
-        Authorization: `Bearer ${token}`,
-        Accept: "*/*",
-        Origin: "https://chat.deepseek.com",
-        Referer: "https://chat.deepseek.com/",
-        "User-Agent":
-          "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36",
-        "X-App-Version": "20241129.1",
-        "X-Client-Platform": "web",
-      },
-    });
-    if (resp.status === 401 || resp.status === 403) {
-      return {
-        valid: false,
-        error: "userToken is invalid or expired — get a fresh one from localStorage",
-      };
-    }
-    if (!resp.ok) {
-      return { valid: false, error: `DeepSeek returned HTTP ${resp.status}` };
-    }
-    const json = await resp.json();
-    const bizData = json?.data?.biz_data || json?.biz_data;
-    if (!bizData?.token) {
-      return {
-        valid: false,
-        error: `DeepSeek did not return an access token: ${json?.msg || "unknown error"}`,
-      };
-    }
-    return { valid: true, error: null };
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-}
-
-// qwen-web has no `modelsUrl` in its registry entry, so the generic OpenAI-compatible
-// validator derived a probe URL of `https://chat.qwen.ai/api/v2/models` (via
-// addModelsSuffix) — a non-existent path that answers with a 307 redirect, which the
-// outbound guard blocked and the route then mislabeled as an SSRF block (#3288/#3758).
-// This specialty validator probes the real session-validity endpoint instead
-// (`GET /api/v2/user`, the same one Chat2API uses), mirroring the executor's anti-bot
-// headers + cookie-jar replay. It uses plain fetch (like the other web-cookie
-// validators) so it never hits the addModelsSuffix/redirect path.
-async function validateQwenWebProvider({ apiKey }: any) {
-  const rawCred = String(apiKey ?? "").trim();
-  if (!rawCred) {
-    return {
-      valid: false,
-      error:
-        "Missing Qwen session — paste the full chat.qwen.ai Cookie header (must include token, cna and ssxmod_itna)",
-    };
-  }
-
-  const token = extractQwenToken(rawCred);
-  const cookieHeader = buildQwenCookieHeader(rawCred);
-  if (!token && !cookieHeader) {
-    return {
-      valid: false,
-      error: "Could not find a Qwen token/cookie in the pasted value",
-    };
-  }
-
-  try {
-    const headers: Record<string, string> = {
-      Accept: "*/*",
-      "User-Agent":
-        "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
-      Origin: "https://chat.qwen.ai",
-      Referer: "https://chat.qwen.ai/",
-      source: "web",
-      "bx-v": "2.5.36",
-    };
-    if (token) headers["Authorization"] = `Bearer ${token}`;
-    if (cookieHeader) headers["Cookie"] = cookieHeader;
-
-    const resp = await fetch("https://chat.qwen.ai/api/v2/user", { headers });
-    const contentType = resp.headers.get("content-type") || "";
-
-    if (resp.status === 401 || resp.status === 403) {
-      return {
-        valid: false,
-        error:
-          "Qwen session is invalid or expired — re-login at https://chat.qwen.ai and paste a fresh full Cookie header",
-      };
-    }
-    // Alibaba's WAF / retired-v1 gateway answers with an HTML challenge page (or 504)
-    // instead of JSON. A bearer token alone is no longer enough for the v2 endpoint.
-    if (contentType.includes("text/html") || resp.status === 504) {
-      return {
-        valid: false,
-        error:
-          "Qwen blocked the request with its anti-bot WAF. Re-login at https://chat.qwen.ai and paste a fresh full Cookie header (must include cna, ssxmod_itna and token) — a bearer token alone is not accepted.",
-      };
-    }
-    if (!resp.ok) {
-      return { valid: false, error: `Qwen returned HTTP ${resp.status}` };
-    }
-
-    // Parse JSON response and verify we have a real user object
-    // Qwen returns HTTP 200 even for invalid tokens, so we must check the body
-    try {
-      const data = await resp.json();
-      const user = data?.user || data?.data?.user;
-
-      if (!user) {
-        return {
-          valid: false,
-          error:
-            "Qwen session token is invalid or expired — re-login at https://chat.qwen.ai and paste a fresh full Cookie header",
-        };
-      }
-    } catch (parseError) {
-      return {
-        valid: false,
-        error: "Qwen returned invalid JSON response",
-      };
-    }
-
-    return { valid: true, error: null };
-  } catch (error) {
-    return toValidationErrorResult(error);
-  }
-}
-
-/**
- * Heuristic for a Grok 403 that is an anti-bot / IP-reputation block rather than
- * a genuine upstream API error (issue #3474).
- *
- * Returns true when the body reads like an anti-bot rejection — Grok's literal
- * "Request rejected by anti-bot rules." text, or a bare/non-structured forbidden
- * body that carries no parseable upstream `error.message`. Returns false for a
- * structured upstream API error (e.g. `{"error":{"message":"Model is not found"}}`),
- * which must keep surfacing its body to the user/maintainer.
- *
- * Callers should run `isCloudflareChallenge()` first; this covers the non-HTML
- * anti-bot cases that Cloudflare-challenge detection does not.
- */
-function isGrokAntiBotBlock(body: string | null | undefined): boolean {
-  const text = (body || "").trim();
-  if (!text) return true; // empty 403 body — pre-auth block, treat as anti-bot
-  if (/anti-bot|forbidden|access denied|blocked|rate.?limit/i.test(text)) return true;
-  // A structured upstream API error has a parseable JSON `error.message`; if one
-  // is present this is a real upstream error, not an anti-bot block.
-  try {
-    const parsed = JSON.parse(text);
-    if (parsed && typeof parsed?.error?.message === "string") return false;
-  } catch {
-    // Non-JSON 403 body with no recognizable structure → treat as anti-bot block.
-    return true;
-  }
-  return false;
-}
-
-async function validateGrokWebProvider({ apiKey, providerSpecificData = {} }: any) {
-  try {
-    const token = extractCookieValue(apiKey, "sso");
-    if (!token) {
-      return {
-        valid: false,
-        error: "Missing sso cookie — paste the value (or the full grok.com cookie line)",
-      };
-    }
-
-    // Use the TLS-impersonating client — Cloudflare on grok.com pins
-    // cf_clearance to JA3/JA4 + HTTP/2 SETTINGS, so plain Node fetch always
-    // gets "Request rejected by anti-bot rules." regardless of cookies (#3180).
-    const { tlsFetchGrok, TlsClientUnavailableError, isCloudflareChallenge } =
-      await import("@omniroute/open-sse/services/grokTlsClient.ts");
-
-    // Generate the same Cloudflare-bypass headers the GrokWebExecutor uses.
-    const randomHex = (n: number) => {
-      const a = new Uint8Array(n);
-      crypto.getRandomValues(a);
-      return Array.from(a, (b) => b.toString(16).padStart(2, "0")).join("");
-    };
-    const statsigMsg = `e:TypeError: Cannot read properties of null (reading 'children')`;
-    const traceId = randomHex(16);
-    const spanId = randomHex(8);
-
-    let response;
-    try {
-      response = await tlsFetchGrok("https://grok.com/rest/app-chat/conversations/new", {
-        method: "POST",
-        headers: applyCustomUserAgent(
-          {
-            Accept: "*/*",
-            "Accept-Encoding": "gzip, deflate, br, zstd",
-            "Accept-Language": "en-US,en;q=0.9",
-            Baggage:
-              "sentry-environment=production,sentry-release=d6add6fb0460641fd482d767a335ef72b9b6abb8,sentry-public_key=b311e0f2690c81f25e2c4cf6d4f7ce1c",
-            "Cache-Control": "no-cache",
-            "Content-Type": "application/json",
-            Cookie: buildGrokCookieHeader(apiKey),
-            Origin: "https://grok.com",
-            Pragma: "no-cache",
-            Referer: "https://grok.com/",
-            "Sec-Ch-Ua": '"Google Chrome";v="147", "Chromium";v="147", "Not(A:Brand";v="24"',
-            "Sec-Ch-Ua-Mobile": "?0",
-            "Sec-Ch-Ua-Platform": '"macOS"',
-            "Sec-Fetch-Dest": "empty",
-            "Sec-Fetch-Mode": "cors",
-            "Sec-Fetch-Site": "same-origin",
-            "User-Agent":
-              "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36",
-            "x-statsig-id": btoa(statsigMsg),
-            "x-xai-request-id": crypto.randomUUID(),
-            traceparent: `00-${traceId}-${spanId}-00`,
-          },
-          providerSpecificData
-        ),
-        body: JSON.stringify({
-          temporary: true,
-          modeId: "fast",
-          message: "test",
-          fileAttachments: [],
-          imageAttachments: [],
-          disableSearch: true,
-          enableImageGeneration: false,
-          returnImageBytes: false,
-          returnRawGrokInXaiRequest: false,
-          enableImageStreaming: false,
-          imageGenerationCount: 0,
-          forceConcise: true,
-          toolOverrides: {},
-          enableSideBySide: false,
-          sendFinalMetadata: false,
-          isReasoning: false,
-          disableTextFollowUps: true,
-          disableMemory: true,
-          forceSideBySide: false,
-          isAsyncChat: false,
-          disableSelfHarmShortCircuit: false,
-        }),
-        timeoutMs: 15_000,
-      });
-    } catch (err: any) {
-      if (err instanceof TlsClientUnavailableError) {
-        return {
-          valid: false,
-          error: `TLS impersonation client unavailable: ${err.message}`,
-        };
-      }
-      throw err;
-    }
-
-    let errorDetail = "";
-    try {
-      errorDetail = (response.text || "").slice(0, 240);
-    } catch {}
-
-    // Detect Cloudflare challenge pages even with a 200 status from tls-client-node
-    if (isCloudflareChallenge(errorDetail)) {
-      return {
-        valid: false,
-        error: "Grok validation blocked by Cloudflare anti-bot. Try a residential IP or proxy.",
-      };
-    }
-
-    if (response.status >= 200 && response.status < 300) {
-      return { valid: true, error: null };
-    }
-
-    if (response.status === 401) {
-      return {
-        valid: false,
-        error: "Invalid SSO cookie — re-paste from grok.com DevTools → Cookies → sso",
-      };
-    }
-
-    if (response.status === 403) {
-      // Grok uses 403 for auth failures, entitlement issues, geo blocks,
-      // anti-bot/IP-reputation rejections, and resource errors. Classify before
-      // messaging — a misleading "invalid cookie" verdict on an IP-reputation
-      // block (issue #3474) sends users chasing a cookie that is actually fine.
-      //
-      // 1. Auth-shaped → the cookie/session is the problem; re-paste it.
-      if (/invalid-credentials|unauthenticated|unauthorized/i.test(errorDetail)) {
-        return {
-          valid: false,
-          error: "Invalid SSO cookie — re-paste from grok.com DevTools → Cookies → sso",
-        };
-      }
-      // 2. Anti-bot / Cloudflare / IP-reputation block → the cookie is likely
-      //    fine; the request was rejected before auth was even evaluated. This is
-      //    not code-fixable: the datacenter/VPS IP is flagged. A Cloudflare
-      //    challenge body, Grok's "anti-bot rules" rejection, or a bare/non-JSON
-      //    forbidden body (no structured upstream `error.message`) all map here.
-      if (isCloudflareChallenge(errorDetail) || isGrokAntiBotBlock(errorDetail)) {
-        return {
-          valid: false,
-          error:
-            "Grok returned 403 (anti-bot/Cloudflare block). Your sso cookie is likely fine — " +
-            "this is an IP-reputation block on the request, not an auth failure. Retry from a " +
-            "residential IP or configure a proxy for grok-web.",
-        };
-      }
-      // 3. Structured upstream error (e.g. probe model renamed) → surface the body
-      //    so the user/maintainer sees the real cause instead of a wrong verdict.
-      return {
-        valid: false,
-        error: `Grok rejected validation (403)${errorDetail ? `: ${errorDetail.slice(0, 160)}` : ""}`,
-      };
-    }
-
-    if (response.status === 429) {
-      return { valid: false, error: "Grok rate limited during validation (429)" };
-    }
-
-    if (response.status >= 500) {
-      return { valid: false, error: `Grok unavailable (${response.status})` };
-    }
-
-    return {
-      valid: false,
-      error: `Grok validation failed (${response.status})${errorDetail ? `: ${errorDetail}` : ""}`,
-    };
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-}
-
-async function validateChatGptWebProvider({ apiKey, providerSpecificData = {} }: any) {
-  try {
-    // Accept bare value, unchunked cookie, chunked (.0/.1) cookies, or full
-    // "Cookie: ..." DevTools line. Pass through verbatim once recognised.
-    let cookieHeader = String(apiKey || "").trim();
-    if (/^cookie\s*:\s*/i.test(cookieHeader)) {
-      cookieHeader = cookieHeader.replace(/^cookie\s*:\s*/i, "");
-    }
-    if (!/__Secure-next-auth\.session-token(?:\.\d+)?\s*=/.test(cookieHeader)) {
-      cookieHeader = `__Secure-next-auth.session-token=${cookieHeader}`;
-    }
-
-    // Use the TLS-impersonating client — Cloudflare on chatgpt.com pins
-    // cf_clearance to JA3/JA4 + HTTP/2 SETTINGS, so plain Node fetch always
-    // gets cf-mitigated: challenge regardless of cookies.
-    const { tlsFetchChatGpt, TlsClientUnavailableError } =
-      await import("@omniroute/open-sse/services/chatgptTlsClient.ts");
-
-    let response;
-    try {
-      response = await tlsFetchChatGpt("https://chatgpt.com/api/auth/session", {
-        method: "GET",
-        headers: applyCustomUserAgent(
-          {
-            Accept: "application/json",
-            "Accept-Language": "en-US,en;q=0.9",
-            "Cache-Control": "no-cache",
-            Cookie: cookieHeader,
-            Origin: "https://chatgpt.com",
-            Pragma: "no-cache",
-            Referer: "https://chatgpt.com/",
-            "Sec-Fetch-Dest": "empty",
-            "Sec-Fetch-Mode": "cors",
-            "Sec-Fetch-Site": "same-origin",
-            "User-Agent":
-              "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:148.0) Gecko/20100101 Firefox/148.0",
-          },
-          providerSpecificData
-        ),
-        timeoutMs: 30_000,
-      });
-    } catch (err: any) {
-      if (err instanceof TlsClientUnavailableError) {
-        return {
-          valid: false,
-          error: `${err.message} (chatgpt-web requires this — without it, Cloudflare blocks every request)`,
-        };
-      }
-      throw err;
-    }
-
-    const contentType = response.headers.get("content-type") || "";
-    const cfRay = response.headers.get("cf-ray");
-    const cfMitigated = response.headers.get("cf-mitigated");
-
-    if (response.status === 401 || response.status === 403) {
-      const bodyText = response.text || "";
-      if (cfMitigated || /just a moment|cloudflare|cf-chl|attention required/i.test(bodyText)) {
-        return {
-          valid: false,
-          error:
-            "Cloudflare blocked the validator — open chatgpt.com in your browser, then copy the FULL Cookie line from DevTools (Network → request → Cookie) including cf_clearance, __cf_bm, _cfuvid, and the session-token chunks.",
-        };
-      }
-      return {
-        valid: false,
-        error:
-          "Invalid ChatGPT session cookie — re-paste __Secure-next-auth.session-token from chatgpt.com DevTools → Cookies",
-      };
-    }
-
-    if (response.status >= 500) {
-      return { valid: false, error: `ChatGPT unavailable (${response.status})` };
-    }
-
-    if (response.status >= 400) {
-      return { valid: false, error: `Validation failed: ${response.status}` };
-    }
-
-    if (!contentType.includes("json")) {
-      return {
-        valid: false,
-        error: `ChatGPT returned non-JSON (${contentType || "no content-type"}${cfRay ? `, cf-ray=${cfRay}` : ""}) — paste the FULL Cookie line including cf_clearance, __cf_bm, _cfuvid alongside the session-token chunks.`,
-      };
-    }
-
-    let data: any = {};
-    try {
-      data = JSON.parse(response.text || "{}");
-    } catch {
-      return {
-        valid: false,
-        error:
-          "ChatGPT session response was not JSON — paste the FULL Cookie line including cf_clearance and __cf_bm.",
-      };
-    }
-    if (!data?.accessToken) {
-      return {
-        valid: false,
-        error: "ChatGPT session expired — log into chatgpt.com and copy a fresh cookie",
-      };
-    }
-    return { valid: true, error: null };
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-}
-
-async function validatePerplexityWebProvider({ apiKey, providerSpecificData = {} }: any) {
-  try {
-    let sessionToken = apiKey;
-    let bearerToken: string | null = null;
-
-    if (sessionToken.startsWith("__Secure-next-auth.session-token=")) {
-      sessionToken = sessionToken.slice("__Secure-next-auth.session-token=".length);
-    } else if (/^bearer\s+/i.test(sessionToken)) {
-      bearerToken = sessionToken.replace(/^bearer\s+/i, "").trim();
-      sessionToken = "";
-    }
-
-    const timezone =
-      typeof Intl !== "undefined" ? Intl.DateTimeFormat().resolvedOptions().timeZone : "UTC";
-    const headers = applyCustomUserAgent(
-      {
-        "Content-Type": "application/json",
-        Accept: "text/event-stream",
-        Origin: "https://www.perplexity.ai",
-        Referer: "https://www.perplexity.ai/",
-        // Firefox 148 — must match the firefox_148 TLS profile of perplexityTlsClient (issue #2459).
-        "User-Agent":
-          "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:148.0) Gecko/20100101 Firefox/148.0",
-        "X-App-ApiClient": "default",
-        "X-App-ApiVersion": "client-1.11.0",
-        ...(bearerToken
-          ? { Authorization: `Bearer ${bearerToken}` }
-          : sessionToken
-            ? { Cookie: `__Secure-next-auth.session-token=${sessionToken}` }
-            : {}),
-      },
-      providerSpecificData
-    );
-
-    // Perplexity is behind Cloudflare Enterprise which pins JA3/JA4 to a real
-    // browser handshake — plain fetch is challenged with a 403 page from
-    // VPS/datacenter IPs even with a valid cookie. Use the Firefox-fingerprinted
-    // TLS client so the validator's verdict reflects the cookie, not the IP (issue #2459).
-    const { tlsFetchPerplexity, isCloudflareChallenge, TlsClientUnavailableError } =
-      await import("@omniroute/open-sse/services/perplexityTlsClient.ts");
-
-    let response: { status: number; text: string | null };
-    try {
-      response = await tlsFetchPerplexity("https://www.perplexity.ai/rest/sse/perplexity_ask", {
-        method: "POST",
-        headers,
-        body: JSON.stringify({
-          query_str: "test",
-          params: {
-            query_str: "test",
-            search_focus: "internet",
-            mode: "concise",
-            model_preference: "default",
-            sources: ["web"],
-            attachments: [],
-            frontend_uuid: crypto.randomUUID(),
-            frontend_context_uuid: crypto.randomUUID(),
-            version: "client-1.11.0",
-            language: "en-US",
-            timezone,
-            search_recency_filter: null,
-            is_incognito: true,
-            use_schematized_api: true,
-            last_backend_uuid: null,
-          },
-        }),
-        timeoutMs: 30_000,
-      });
-    } catch (err) {
-      if (err instanceof TlsClientUnavailableError) {
-        return {
-          valid: false,
-          error: `${err.message} perplexity-web requires it — without it Cloudflare blocks every request.`,
-        };
-      }
-      throw err;
-    }
-
-    if (response.status === 401 || response.status === 403) {
-      if (isCloudflareChallenge(response.text)) {
-        return {
-          valid: false,
-          error:
-            "Cloudflare is blocking connections from this server's IP (TLS fingerprint rejected). " +
-            "The session cookie may still be valid — install tls-client-node's native binary or route " +
-            "perplexity-web through a residential proxy.",
-        };
-      }
-      return {
-        valid: false,
-        error:
-          "Invalid Perplexity session cookie — re-paste __Secure-next-auth.session-token from perplexity.ai",
-      };
-    }
-
-    if (response.status === 200 || (response.status >= 400 && response.status < 500)) {
-      return { valid: true, error: null };
-    }
-
-    if (response.status >= 500) {
-      return { valid: false, error: `Perplexity unavailable (${response.status})` };
-    }
-
-    return { valid: false, error: `Validation failed: ${response.status}` };
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-}
-
-async function validateBlackboxWebProvider({ apiKey, providerSpecificData = {} }: any) {
-  try {
-    const cookieHeader = normalizeSessionCookieHeader(apiKey, "next-auth.session-token");
-    const sessionHeaders = applyCustomUserAgent(
-      {
-        Accept: "application/json",
-        Cookie: cookieHeader,
-        Origin: "https://app.blackbox.ai",
-        Referer: "https://app.blackbox.ai/",
-        "User-Agent":
-          "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/147.0.0.0",
-      },
-      providerSpecificData
-    );
-
-    const sessionResponse = await validationRead("https://app.blackbox.ai/api/auth/session", {
-      method: "GET",
-      headers: sessionHeaders,
-    });
-
-    const sessionText = await sessionResponse.text();
-    const sessionPayload = sessionText ? JSON.parse(sessionText) : null;
-    const userEmail = sessionPayload?.user?.email;
-
-    if (!sessionResponse.ok || !userEmail) {
-      return {
-        valid: false,
-        error:
-          "Invalid Blackbox session cookie — re-paste __Secure-authjs.session-token from app.blackbox.ai",
-      };
-    }
-
-    const subscriptionHeaders = applyCustomUserAgent(
-      {
-        "Content-Type": "application/json",
-        Accept: "application/json",
-        Cookie: cookieHeader,
-        Origin: "https://app.blackbox.ai",
-        Referer: "https://app.blackbox.ai/",
-        "User-Agent":
-          "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/147.0.0.0",
-      },
-      providerSpecificData
-    );
-
-    const subscriptionResponse = await validationWrite(
-      "https://app.blackbox.ai/api/check-subscription",
-      {
-        method: "POST",
-        headers: subscriptionHeaders,
-        body: JSON.stringify({ email: userEmail }),
-      }
-    );
-
-    const subscriptionText = await subscriptionResponse.text();
-    const subscriptionPayload = subscriptionText ? JSON.parse(subscriptionText) : null;
-    const explicitActive =
-      subscriptionPayload?.hasActiveSubscription === true ||
-      subscriptionPayload?.isTrialSubscription === true ||
-      subscriptionPayload?.status === "PREMIUM";
-    const explicitInactive =
-      subscriptionPayload?.hasActiveSubscription === false ||
-      subscriptionPayload?.status === "FREE";
-    const requiresAuthentication =
-      subscriptionPayload?.requiresAuthentication === true ||
-      /login is required/i.test(subscriptionText || "");
-
-    if (subscriptionResponse.status === 401 || subscriptionResponse.status === 403) {
-      return {
-        valid: false,
-        error:
-          "Invalid Blackbox session cookie — re-paste __Secure-authjs.session-token from app.blackbox.ai",
-      };
-    }
-
-    if (requiresAuthentication) {
-      return {
-        valid: false,
-        error:
-          "Blackbox session expired — re-paste __Secure-authjs.session-token from app.blackbox.ai",
-      };
-    }
-
-    if (subscriptionResponse.ok && explicitActive) {
-      return { valid: true, error: null };
-    }
-
-    if (
-      (subscriptionResponse.ok && explicitInactive) ||
-      subscriptionPayload?.previouslySubscribed
-    ) {
-      return {
-        valid: false,
-        error:
-          "Blackbox account authenticated, but no active paid subscription was detected for premium web models.",
-      };
-    }
-
-    if (subscriptionResponse.ok) {
-      return { valid: true, error: null };
-    }
-
-    if (subscriptionResponse.status >= 500) {
-      return { valid: false, error: `Blackbox unavailable (${subscriptionResponse.status})` };
-    }
-
-    return { valid: false, error: `Validation failed: ${subscriptionResponse.status}` };
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-}
-
-async function validateMuseSparkWebProvider({ apiKey, providerSpecificData = {} }: any) {
-  try {
-    const cookieHeader = normalizeSessionCookieHeader(apiKey, "ecto_1_sess");
-    const response = await validationWrite("https://www.meta.ai/api/graphql", {
-      method: "POST",
-      headers: applyCustomUserAgent(
-        {
-          "Content-Type": "application/json",
-          Accept: "text/event-stream",
-          "Accept-Language": "en-US,en;q=0.9",
-          Cookie: cookieHeader,
-          Origin: "https://www.meta.ai",
-          Referer: "https://www.meta.ai/",
-          "Sec-Fetch-Dest": "empty",
-          "Sec-Fetch-Mode": "cors",
-          "Sec-Fetch-Site": "same-origin",
-          "User-Agent": META_AI_USER_AGENT,
-          "X-ASBD-ID": META_AI_ASBD_ID,
-          "X-FB-Friendly-Name": META_AI_FRIENDLY_NAME,
-          "X-FB-Request-Analytics-Tags": META_AI_REQUEST_ANALYTICS_TAGS,
-        },
-        providerSpecificData
-      ),
-      body: JSON.stringify(buildMetaAiValidationBody()),
-    });
-
-    const responseText = await response.text();
-    if (response.status === 401 || response.status === 403) {
-      return {
-        valid: false,
-        error: "Invalid Meta AI session cookie — re-paste abra_sess from meta.ai",
-      };
-    }
-
-    if (/authentication required to send messages|login is required|sign in/i.test(responseText)) {
-      return {
-        valid: false,
-        error: "Invalid Meta AI session cookie — re-paste abra_sess from meta.ai",
-      };
-    }
-
-    if (
-      response.status === 429 ||
-      /limit exceeded|rate limit|too many requests/i.test(responseText)
-    ) {
-      return { valid: true, error: null };
-    }
-
-    if (response.ok) {
-      return { valid: true, error: null };
-    }
-
-    if (response.status >= 500) {
-      return { valid: false, error: `Meta AI unavailable (${response.status})` };
-    }
-
-    return { valid: false, error: `Validation failed: ${response.status}` };
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-}
-
-async function validateAdaptaWebProvider({ apiKey, providerSpecificData = {} }: any) {
-  try {
-    const raw = typeof apiKey === "string" ? apiKey.trim() : "";
-    if (!raw)
-      return { valid: false, error: "Paste your __client cookie from .clerk.agent.adapta.one" };
-    const eqIdx = raw.indexOf("=");
-    const clientJwt = eqIdx > 0 && !raw.startsWith("eyJ") ? raw.slice(eqIdx + 1).trim() : raw;
-
-    const response = await validationRead("https://clerk.agent.adapta.one/v1/client", {
-      headers: applyCustomUserAgent(
-        {
-          Cookie: `__client=${clientJwt}`,
-          "User-Agent":
-            "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
-          Origin: "https://agent.adapta.one",
-        },
-        providerSpecificData
-      ),
-    });
-
-    if (response.status === 401 || response.status === 403) {
-      return {
-        valid: false,
-        error: "Invalid or expired __client cookie — re-paste from .clerk.agent.adapta.one",
-      };
-    }
-
-    if (!response.ok) {
-      return { valid: false, error: `Adapta Clerk returned HTTP ${response.status}` };
-    }
-
-    const body = await response.json().catch(() => null);
-    const sessions: Array<{ id: string; status: string }> = body?.response?.sessions ?? [];
-    const hasActive = sessions.some((s) => s.status === "active");
-    if (!hasActive) {
-      return {
-        valid: false,
-        error: "No active Adapta session — your __client cookie may be expired",
-      };
-    }
-
-    return { valid: true, error: null };
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-}
-
-async function validateClaudeWebProvider({ apiKey, providerSpecificData = {} }: any) {
-  try {
-    const cookieHeader = normalizeSessionCookieHeader(String(apiKey || ""), "sessionKey");
-    if (!cookieHeader) {
-      return { valid: false, error: "Paste your sessionKey cookie from claude.ai" };
-    }
-
-    const { tlsFetchClaude, TlsClientUnavailableError } =
-      await import("@omniroute/open-sse/services/claudeTlsClient.ts");
-
-    let response: { status: number; text: string | null };
-    try {
-      response = await tlsFetchClaude("https://claude.ai/api/organizations", {
-        method: "GET",
-        headers: applyCustomUserAgent(
-          {
-            Accept: "application/json",
-            "Accept-Language": "en-US,en;q=0.9",
-            "Cache-Control": "no-cache",
-            Cookie: cookieHeader,
-            Origin: "https://claude.ai",
-            Pragma: "no-cache",
-            Referer: "https://claude.ai/new",
-            "Sec-Fetch-Dest": "empty",
-            "Sec-Fetch-Mode": "cors",
-            "Sec-Fetch-Site": "same-origin",
-            "User-Agent":
-              "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
-            "anthropic-client-platform": "web_claude_ai",
-          },
-          providerSpecificData
-        ),
-        timeoutMs: 30_000,
-      });
-    } catch (err: any) {
-      if (err instanceof TlsClientUnavailableError) {
-        return {
-          valid: false,
-          error: `${err.message} (claude-web requires this — without it, Cloudflare blocks every request)`,
-        };
-      }
-      throw err;
-    }
-
-    if (response.status === 200) {
-      return { valid: true, error: null };
-    }
-
-    if (response.status === 401 || response.status === 403) {
-      return {
-        valid: false,
-        error:
-          "Invalid or expired session cookie — re-paste sessionKey from claude.ai DevTools → Cookies",
-      };
-    }
-
-    if (response.status === 429) {
-      return { valid: true, error: null };
-    }
-
-    if (response.status >= 500) {
-      return { valid: false, error: `Claude.ai unavailable (${response.status})` };
-    }
-
-    return { valid: false, error: `Claude.ai validation failed (${response.status})` };
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-}
-
-// ── Gemini Web cookie validator ──
-async function validateGeminiWebProvider({ apiKey, providerSpecificData = {} }: any) {
-  try {
-    const raw = String(apiKey || "").trim();
-    if (!raw) {
-      return { valid: false, error: "Paste your __Secure-1PSID cookie from gemini.google.com" };
-    }
-
-    // Accept full cookie blob or bare value
-    let cookieHeader = raw;
-    if (!raw.includes("=")) {
-      cookieHeader = `__Secure-1PSID=${raw}`;
-    }
-
-    const response = await validationRead("https://gemini.google.com/app", {
-      headers: applyCustomUserAgent(
-        {
-          Accept: "text/html,application/xhtml+xml",
-          Cookie: cookieHeader,
-          Origin: "https://gemini.google.com",
-          Referer: "https://gemini.google.com/",
-        },
-        providerSpecificData
-      ),
-    });
-
-    if (response.status === 401 || response.status === 403) {
-      return {
-        valid: false,
-        error:
-          "Invalid or expired __Secure-1PSID cookie — re-paste from gemini.google.com DevTools → Cookies",
-      };
-    }
-
-    // 200/302 = valid, anything < 500 that isn't auth failure is acceptable
-    if (response.status < 500) {
-      return { valid: true, error: null };
-    }
-
-    return { valid: false, error: `Gemini validation failed (${response.status})` };
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-}
-
-// ── Copilot Web token validator ──
-async function validateCopilotWebProvider({ apiKey, providerSpecificData = {} }: any) {
-  try {
-    const raw = String(apiKey || "").trim();
-    if (!raw) {
-      return {
-        valid: false,
-        error: "Paste your access_token from copilot.microsoft.com DevTools → Cookies",
-      };
-    }
-
-    // Extract token — may be bare JWT, cookie string with access_token=, or Bearer prefix
-    const { extractAccessToken } = await import("@omniroute/open-sse/executors/copilot-web.ts");
-    const token = extractAccessToken(raw);
-    if (!token) {
-      return { valid: false, error: "Could not extract access_token from input" };
-    }
-
-    // Probe Copilot's conversation API to verify token
-    const response = await validationWrite(
-      "https://copilot.microsoft.com/c/api/conversations?language=en",
-      {
-        method: "GET",
-        headers: applyCustomUserAgent(
-          {
-            Accept: "application/json",
-            Authorization: `Bearer ${token}`,
-            Origin: "https://copilot.microsoft.com",
-            Referer: "https://copilot.microsoft.com/",
-          },
-          providerSpecificData
-        ),
-      }
-    );
-
-    if (response.status === 401 || response.status === 403) {
-      return {
-        valid: false,
-        error:
-          "Invalid or expired access_token — re-paste from copilot.microsoft.com DevTools → Cookies",
-      };
-    }
-
-    if (response.status >= 500) {
-      return { valid: false, error: `Copilot unavailable (${response.status})` };
-    }
-
-    // 200, 400, 404 etc. all indicate the token was accepted
-    return { valid: true, error: null };
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-}
-
-// ── t3.chat Web cookie validator ──
-async function validateT3WebProvider({ apiKey, providerSpecificData = {} }: any) {
-  try {
-    const raw = String(apiKey || "").trim();
-    if (!raw) {
-      return {
-        valid: false,
-        error: "Paste your Cookie header and convex-session-id from t3.chat",
-      };
-    }
-
-    // The cookie field may contain "cookies=<Cookie header>\nconvexSessionId=<id>"
-    // or just the Cookie header value. Try to parse.
-    let cookieHeader = raw;
-    let convexSessionId = "";
-
-    if (raw.includes("convexSessionId") || raw.includes("convex-session-id")) {
-      // Structured format: "cookies=...; convexSessionId=..."
-      const parts = raw.split(/[,;\n]/).map((s: string) => s.trim());
-      const cookieParts: string[] = [];
-      for (const part of parts) {
-        if (part.startsWith("convexSessionId=") || part.startsWith("convex-session-id=")) {
-          convexSessionId = part.split("=").slice(1).join("=");
-        } else if (part.startsWith("cookies=")) {
-          cookieParts.push(part.slice("cookies=".length));
-        } else if (part.includes("=")) {
-          cookieParts.push(part);
-        }
-      }
-      if (cookieParts.length) cookieHeader = cookieParts.join("; ");
-    }
-
-    // Build final cookie with convex-session-id if found
-    const finalCookie = convexSessionId
-      ? `${cookieHeader}; convex-session-id=${convexSessionId}`
-      : cookieHeader;
-
-    const response = await validationRead("https://t3.chat", {
-      headers: applyCustomUserAgent(
-        {
-          Accept: "text/html",
-          Cookie: finalCookie,
-        },
-        providerSpecificData
-      ),
-    });
-
-    // t3.chat returns 200/302/404 for valid sessions, 5xx for down
-    if (response.status >= 500) {
-      return { valid: false, error: `t3.chat unavailable (${response.status})` };
-    }
-
-    return { valid: true, error: null };
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-}
-
-/** Jules API — GET /v1alpha/sources with X-Goog-Api-Key (see developers.google.com/jules/api). */
-async function validateJulesProvider({ apiKey }: { apiKey: string }) {
-  try {
-    const response = await validationWrite(buildJulesApiUrl("/sources"), {
-      method: "GET",
-      headers: {
-        "X-Goog-Api-Key": apiKey,
-      },
-    });
-
-    if (response.status === 401 || response.status === 403) {
-      return { valid: false, error: "Invalid API key" };
-    }
-
-    if (response.ok) {
-      return { valid: true, error: null };
-    }
-
-    const errorText = await response.text().catch(() => "");
-    return {
-      valid: false,
-      error: errorText.trim() || `Jules API returned ${response.status}`,
-    };
-  } catch (error: unknown) {
-    return toValidationErrorResult(error);
-  }
-}
-
-async function validateInnerAiProvider({ apiKey, providerSpecificData = {} }: any) {
-  try {
-    const raw = typeof apiKey === "string" ? apiKey.trim() : "";
-    if (!raw) {
-      return {
-        valid: false,
-        error: "Paste your token cookie and email — format: eyJ... user@example.com",
-      };
-    }
-
-    // Parse token and optional email (format: "TOKEN EMAIL")
-    const eqIdx = raw.indexOf("=");
-    const stripped = eqIdx > 0 && !raw.startsWith("eyJ") ? raw.slice(eqIdx + 1).trim() : raw;
-    const lastSpace = stripped.lastIndexOf(" ");
-    let token = stripped;
-    let credEmail = "";
-    if (lastSpace > 0) {
-      const possibleEmail = stripped.slice(lastSpace + 1).trim();
-      if (possibleEmail.includes("@")) {
-        token = stripped.slice(0, lastSpace).trim();
-        credEmail = possibleEmail;
-      }
-    }
-
-    if (!credEmail) {
-      return {
-        valid: false,
-        error:
-          "Email is required — paste token followed by a space and your email: eyJ... user@example.com",
-      };
-    }
-
-    // Validate JWT structure (3 parts separated by dots)
-    const parts = token.split(".");
-    if (parts.length < 3) {
-      return {
-        valid: false,
-        error:
-          "Invalid token format — paste only the token cookie value from .innerai.com (starts with eyJ…)",
-      };
-    }
-
-    // Decode payload and check expiry
-    const b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
-    let payload: Record<string, unknown> = {};
-    try {
-      payload = JSON.parse(Buffer.from(b64, "base64").toString("utf8"));
-    } catch {
-      return { valid: false, error: "Could not parse Inner.ai token — re-paste from DevTools" };
-    }
-
-    if (typeof payload.exp === "number" && payload.exp * 1000 < Date.now()) {
-      return {
-        valid: false,
-        error:
-          "Inner.ai token has expired — re-login at app.innerai.com and re-paste the token cookie",
-      };
-    }
-
-    // Verify the token carries at least one known Inner.ai identity field
-    const hasIdentity =
-      payload.device_id ??
-      payload.deviceId ??
-      payload["device-id"] ??
-      payload.did ??
-      payload.user_id ??
-      payload.userId ??
-      payload.sub;
-    if (!hasIdentity) {
-      return {
-        valid: false,
-        error:
-          "Token does not look like an Inner.ai session token — re-paste from DevTools → Cookies → .innerai.com",
-      };
-    }
-
-    return { valid: true, error: null };
-  } catch (error: any) {
-    return toValidationErrorResult(error);
-  }
-}
 /**
  * Validates web-cookie providers by performing a ping request to check if the session is still valid.
  * Returns SESSION_EXPIRED error code if the upstream returns 401/403.
diff --git a/src/lib/providers/validation/anthropicFormat.ts b/src/lib/providers/validation/anthropicFormat.ts
new file mode 100644
index 0000000000..66a213b2d2
--- /dev/null
+++ b/src/lib/providers/validation/anthropicFormat.ts
@@ -0,0 +1,319 @@
+// Anthropic/Claude-format provider key validators (anthropic-like, claude-oauth-inline, anthropic-compatible, claude-code-compatible).
+// Extracted from validation.ts (god-file decomposition) — top-level functions; behavior is
+// byte-identical to the original inline defs.
+import {
+  buildClaudeCodeCompatibleHeaders,
+  buildClaudeCodeCompatibleValidationPayload,
+  CLAUDE_CODE_COMPATIBLE_DEFAULT_CHAT_PATH,
+  CLAUDE_CODE_COMPATIBLE_DEFAULT_MODELS_PATH,
+  joinClaudeCodeCompatibleUrl,
+  joinBaseUrlAndPath,
+} from "@omniroute/open-sse/services/claudeCodeCompatible.ts";
+import {
+  normalizeAnthropicBaseUrl,
+  normalizeClaudeCodeCompatibleBaseUrl,
+} from "./urlHelpers";
+import { applyCustomUserAgent } from "./headers";
+import {
+  toValidationErrorResult,
+  validationRead,
+  validationWrite,
+} from "./transport";
+
+export async function validateAnthropicLikeProvider({
+  apiKey,
+  baseUrl,
+  modelId = "claude-3-5-sonnet-20240620",
+  headers = {},
+  providerSpecificData = {},
+  isLocal = false,
+}: any) {
+  try {
+    if (!baseUrl) {
+      return { valid: false, error: "Missing base URL" };
+    }
+
+    if (typeof apiKey === "string" && apiKey.startsWith("sk-ant-oat")) {
+      return validateClaudeOAuthInline({ apiKey, modelId, providerSpecificData });
+    }
+
+    const probeUrl =
+      typeof providerSpecificData?.modelsUrl === "string" &&
+      providerSpecificData.modelsUrl.trim() !== ""
+        ? providerSpecificData.modelsUrl.trim()
+        : `${baseUrl}/models`;
+
+    // Best-effort /models probe. It must not fail validation: canonical Claude
+    // base URLs can already include a path/query (…/messages?beta=true).
+    try {
+      await validationRead(
+        probeUrl,
+        {
+          headers: {
+            "anthropic-version": "2023-06-01",
+            ...headers,
+          },
+        },
+        isLocal
+      );
+    } catch {
+      // ignore probe failures
+    }
+
+    const requestUrl =
+      typeof providerSpecificData?.modelsUrl === "string" &&
+      providerSpecificData.modelsUrl.trim() !== ""
+        ? providerSpecificData.modelsUrl.trim()
+        : "";
+
+    if (requestUrl) {
+      const response = await validationRead(
+        requestUrl,
+        {
+          headers: {
+            "anthropic-version": "2023-06-01",
+            ...headers,
+          },
+        },
+        isLocal
+      );
+
+      if (response.status === 401 || response.status === 403) {
+        return { valid: false, error: "Invalid API key" };
+      }
+    }
+
+    const requestHeaders = applyCustomUserAgent(
+      {
+        "Content-Type": "application/json",
+        ...headers,
+      },
+      providerSpecificData
+    );
+
+    if (!requestHeaders["x-api-key"] && !requestHeaders["X-API-Key"]) {
+      requestHeaders["x-api-key"] = apiKey;
+    }
+
+    if (!requestHeaders["anthropic-version"] && !requestHeaders["Anthropic-Version"]) {
+      requestHeaders["anthropic-version"] = "2023-06-01";
+    }
+
+    const testModelId =
+      providerSpecificData?.validationModelId || modelId || "claude-3-5-sonnet-20241022";
+
+    const chatResponse = await validationWrite(
+      baseUrl,
+      {
+        method: "POST",
+        headers: requestHeaders,
+        body: JSON.stringify({
+          model: testModelId,
+          max_tokens: 1,
+          messages: [{ role: "user", content: "test" }],
+        }),
+      },
+      isLocal
+    );
+
+    if (chatResponse.status === 401 || chatResponse.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    return { valid: true, error: null };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
+
+
+export async function validateClaudeOAuthInline({
+  apiKey,
+  modelId,
+  providerSpecificData = {},
+}: {
+  apiKey: string;
+  modelId: string | null | undefined;
+  providerSpecificData?: Record<string, unknown>;
+}) {
+  const testModelId =
+    providerSpecificData?.validationModelId || modelId || "claude-haiku-4-5-20251001";
+
+  try {
+    const { getExecutor } = await import("@omniroute/open-sse/executors/index.ts");
+    const { response } = await getExecutor("claude").execute({
+      model: testModelId,
+      body: {
+        model: testModelId,
+        max_tokens: 1,
+        messages: [{ role: "user", content: "test" }],
+      },
+      stream: false,
+      credentials: { accessToken: apiKey, providerSpecificData },
+    });
+
+    if (response.status === 401 || response.status === 403) {
+      return { valid: false, error: "Invalid OAuth token" };
+    }
+    if (response.status >= 500) {
+      return { valid: false, error: `Provider unavailable (${response.status})` };
+    }
+    return { valid: true, error: null };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
+
+
+export async function validateAnthropicCompatibleProvider({
+  apiKey,
+  providerSpecificData = {},
+  isLocal = false,
+}: any) {
+  let baseUrl = normalizeAnthropicBaseUrl(providerSpecificData.baseUrl);
+  if (!baseUrl) {
+    return { valid: false, error: "No base URL configured for Anthropic compatible provider" };
+  }
+
+  const headers = applyCustomUserAgent(
+    {
+      "Content-Type": "application/json",
+      "x-api-key": apiKey,
+      "anthropic-version": "2023-06-01",
+      Authorization: `Bearer ${apiKey}`,
+    },
+    providerSpecificData
+  );
+
+  // Step 1: Best-effort GET /models probe. /models is NOT part of the Anthropic API spec
+  // and many compatible proxies either 404, 401, or 403 on /models even with a valid key —
+  // so a 401/403 here must NOT mark the credentials invalid. Only a 2xx is a positive
+  // signal that the proxy DOES implement /models AND the key was accepted; everything else
+  // (including auth-shaped statuses) falls through to the authoritative POST /v1/messages
+  // probe below. Ported from decolua/9router 584cf66a.
+  try {
+    const modelsRes = await validationRead(
+      joinBaseUrlAndPath(baseUrl, providerSpecificData?.modelsPath || "/models"),
+      {
+        method: "GET",
+        headers,
+      },
+      isLocal
+    );
+
+    if (modelsRes.ok) {
+      return { valid: true, error: null };
+    }
+  } catch {
+    // /models fetch failed — fall through to messages test
+  }
+
+  // Step 2: Authoritative probe — POST /v1/messages with max_tokens=1.
+  const testModelId = providerSpecificData?.validationModelId || "claude-3-5-sonnet-20241022";
+  try {
+    const messagesRes = await validationWrite(
+      joinBaseUrlAndPath(baseUrl, providerSpecificData?.chatPath || "/messages"),
+      {
+        method: "POST",
+        headers,
+        body: JSON.stringify({
+          model: testModelId,
+          max_tokens: 1,
+          messages: [{ role: "user", content: "test" }],
+        }),
+      },
+      isLocal
+    );
+
+    if (messagesRes.status === 401 || messagesRes.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    // Any other response (200, 400, 422, etc.) means auth passed
+    return { valid: true, error: null };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
+
+
+export async function validateClaudeCodeCompatibleProvider({
+  apiKey,
+  providerSpecificData = {},
+}: any) {
+  const baseUrl = normalizeClaudeCodeCompatibleBaseUrl(providerSpecificData.baseUrl);
+  if (!baseUrl) {
+    return { valid: false, error: "No base URL configured for CC Compatible provider" };
+  }
+
+  const modelsPath = providerSpecificData?.modelsPath || CLAUDE_CODE_COMPATIBLE_DEFAULT_MODELS_PATH;
+  const chatPath = providerSpecificData?.chatPath || CLAUDE_CODE_COMPATIBLE_DEFAULT_CHAT_PATH;
+  const defaultHeaders = applyCustomUserAgent(
+    buildClaudeCodeCompatibleHeaders(apiKey, false),
+    providerSpecificData
+  );
+
+  try {
+    const modelsRes = await validationRead(joinClaudeCodeCompatibleUrl(baseUrl, modelsPath), {
+      method: "GET",
+      headers: defaultHeaders,
+    });
+
+    if (modelsRes.ok) {
+      return { valid: true, error: null, method: "models_endpoint" };
+    }
+
+    if (modelsRes.status === 401 || modelsRes.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+  } catch {
+    // Fall through to bridge request validation.
+  }
+
+  const payload = buildClaudeCodeCompatibleValidationPayload(
+    providerSpecificData?.validationModelId || "claude-sonnet-4-6"
+  );
+  const sessionId = JSON.parse(payload.metadata.user_id as string).session_id;
+
+  try {
+    const messagesRes = await validationWrite(joinClaudeCodeCompatibleUrl(baseUrl, chatPath), {
+      method: "POST",
+      headers: applyCustomUserAgent(
+        buildClaudeCodeCompatibleHeaders(apiKey, true, sessionId),
+        providerSpecificData
+      ),
+      body: JSON.stringify(payload),
+    });
+
+    if (messagesRes.status === 401 || messagesRes.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    if (messagesRes.status === 429) {
+      return {
+        valid: true,
+        error: null,
+        method: "cc_bridge_request",
+        warning: "Rate limited, but credentials are valid",
+      };
+    }
+
+    if (messagesRes.status >= 400 && messagesRes.status < 500) {
+      return {
+        valid: true,
+        error: null,
+        method: "cc_bridge_request",
+        warning: "Bridge request reached upstream, but the model or payload was rejected",
+      };
+    }
+
+    return {
+      valid: messagesRes.ok,
+      error: messagesRes.ok ? null : `Validation failed: ${messagesRes.status}`,
+      method: "cc_bridge_request",
+    };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
+
diff --git a/src/lib/providers/validation/audioMiscProviders.ts b/src/lib/providers/validation/audioMiscProviders.ts
new file mode 100644
index 0000000000..2672fce0c1
--- /dev/null
+++ b/src/lib/providers/validation/audioMiscProviders.ts
@@ -0,0 +1,582 @@
+// Audio/speech + miscellaneous API-key provider validators: deepgram, assemblyai, elevenlabs,
+// inworld, kie, aws-polly, bailian-coding-plan, reka, maritalk, nlpcloud, runwayml, nous-research,
+// poe. Extracted from validation.ts (god-file decomposition) — top-level functions with no
+// dispatcher-state captures; behavior is byte-identical to the original inline defs.
+import { getRegistryEntry } from "@omniroute/open-sse/config/providerRegistry.ts";
+import { normalizeBaseUrl } from "./urlHelpers";
+import {
+  applyCustomUserAgent,
+  buildBearerHeaders,
+  buildKeyHeaders,
+  buildRekaHeaders,
+  buildTokenHeaders,
+} from "./headers";
+import { toValidationErrorResult, validationRead, validationWrite } from "./transport";
+import { validateDirectChatProvider } from "./directChatProbe";
+import { buildRunwayApiUrl, buildRunwayHeaders, normalizeRunwayBaseUrl } from "@omniroute/open-sse/config/runway.ts";
+import { buildMaritalkChatUrl, buildMaritalkModelsUrl } from "@omniroute/open-sse/config/maritalk.ts";
+import { signAwsRequest } from "@omniroute/open-sse/utils/awsSigV4.ts";
+
+export async function validateDeepgramProvider({ apiKey, providerSpecificData = {} }: any) {
+  try {
+    const response = await validationRead("https://api.deepgram.com/v1/auth/token", {
+      method: "GET",
+      headers: applyCustomUserAgent({ Authorization: `Token ${apiKey}` }, providerSpecificData),
+    });
+    if (response.ok) return { valid: true, error: null };
+    if (response.status === 401 || response.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+    return { valid: false, error: `Validation failed: ${response.status}` };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
+
+export async function validateAssemblyAIProvider({ apiKey, providerSpecificData = {} }: any) {
+  try {
+    const response = await validationRead("https://api.assemblyai.com/v2/transcript?limit=1", {
+      method: "GET",
+      headers: applyCustomUserAgent(
+        {
+          Authorization: apiKey,
+          "Content-Type": "application/json",
+        },
+        providerSpecificData
+      ),
+    });
+    if (response.ok) return { valid: true, error: null };
+    if (response.status === 401 || response.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+    return { valid: false, error: `Validation failed: ${response.status}` };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
+
+export async function validateElevenLabsProvider({ apiKey, providerSpecificData = {} }: any) {
+  try {
+    // Lightweight auth check endpoint
+    const response = await validationRead("https://api.elevenlabs.io/v1/voices", {
+      method: "GET",
+      headers: applyCustomUserAgent(
+        {
+          "xi-api-key": apiKey,
+          "Content-Type": "application/json",
+        },
+        providerSpecificData
+      ),
+    });
+
+    if (response.ok) return { valid: true, error: null };
+    if (response.status === 401 || response.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    return { valid: false, error: `Validation failed: ${response.status}` };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
+
+export async function validateInworldProvider({ apiKey, providerSpecificData = {} }: any) {
+  try {
+    // Inworld TTS lacks a simple key-introspection endpoint.
+    // Send a minimal synth request and treat non-auth 4xx as auth-pass.
+    const response = await validationWrite("https://api.inworld.ai/tts/v1/voice", {
+      method: "POST",
+      headers: applyCustomUserAgent(
+        {
+          Authorization: `Basic ${apiKey}`,
+          "Content-Type": "application/json",
+        },
+        providerSpecificData
+      ),
+      body: JSON.stringify({
+        text: "test",
+        modelId: "inworld-tts-1.5-mini",
+        audioConfig: { audioEncoding: "MP3" },
+      }),
+    });
+
+    if (response.status === 401 || response.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    // Any other response indicates auth is accepted (payload/model may still be wrong)
+    return { valid: true, error: null };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
+
+export async function validateKieProvider({ apiKey, providerSpecificData = {} }: any) {
+  try {
+    // Use credit check endpoint as requested by user based on Kie.ai docs.
+    const response = await validationRead("https://api.kie.ai/api/v1/chat/credit", {
+      method: "GET",
+      headers: applyCustomUserAgent(
+        {
+          Authorization: `Bearer ${apiKey}`,
+          "Content-Type": "application/json",
+        },
+        providerSpecificData
+      ),
+    });
+
+    if (response.ok) {
+      return { valid: true, error: null };
+    }
+
+    if (response.status === 401 || response.status === 403) {
+      return { valid: false, error: "Invalid Kie.ai API key" };
+    }
+
+    // Fallback: if credits endpoint is 404/not supported, try minimal chat probe.
+    const chatRes = await validationWrite("https://api.kie.ai/api/v1/chat/completions", {
+      method: "POST",
+      headers: buildBearerHeaders(apiKey, providerSpecificData),
+      body: JSON.stringify({
+        model: providerSpecificData.validationModelId || "gpt-4o-mini",
+        messages: [{ role: "user", content: "test" }],
+        max_tokens: 1,
+      }),
+    });
+
+    if (
+      chatRes.ok ||
+      (chatRes.status >= 400 &&
+        chatRes.status < 500 &&
+        chatRes.status !== 401 &&
+        chatRes.status !== 403)
+    ) {
+      return { valid: true, error: null };
+    }
+
+    return { valid: false, error: `Validation failed: ${chatRes.status}` };
+  } catch (error: unknown) {
+    return toValidationErrorResult(error);
+  }
+}
+
+export function getAwsProviderString(value: unknown): string | null {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+
+export function getAwsPollyRegion(providerSpecificData: any = {}) {
+  return (
+    getAwsProviderString(providerSpecificData.region) ||
+    getAwsProviderString(providerSpecificData.awsRegion) ||
+    process.env.AWS_REGION ||
+    process.env.AWS_DEFAULT_REGION ||
+    "us-east-1"
+  );
+}
+
+export function getAwsPollyBaseUrl(providerSpecificData: any = {}, region: string) {
+  return (
+    getAwsProviderString(providerSpecificData.baseUrl) || `https://polly.${region}.amazonaws.com`
+  ).replace(/\/+$/, "");
+}
+
+export async function validateAwsPollyProvider({ apiKey, providerSpecificData = {} }: any) {
+  const accessKeyId =
+    getAwsProviderString(providerSpecificData.accessKeyId) ||
+    getAwsProviderString(providerSpecificData.awsAccessKeyId);
+  const secretAccessKey = getAwsProviderString(apiKey);
+
+  if (!accessKeyId) {
+    return { valid: false, error: "Missing AWS accessKeyId" };
+  }
+  if (!secretAccessKey) {
+    return { valid: false, error: "Missing AWS Secret Access Key" };
+  }
+
+  const region = getAwsPollyRegion(providerSpecificData);
+  const baseUrl = getAwsPollyBaseUrl(providerSpecificData, region).replace(/\/v1\/voices$/i, "");
+  const url = `${baseUrl}/v1/voices?Engine=standard`;
+
+  try {
+    const signedHeaders = signAwsRequest({
+      method: "GET",
+      url,
+      region,
+      service: "polly",
+      credentials: {
+        accessKeyId,
+        secretAccessKey,
+        sessionToken:
+          getAwsProviderString(providerSpecificData.sessionToken) ||
+          getAwsProviderString(providerSpecificData.awsSessionToken),
+      },
+    });
+
+    const response = await validationRead(url, {
+      method: "GET",
+      headers: applyCustomUserAgent(signedHeaders, providerSpecificData),
+    });
+
+    if (response.ok) return { valid: true, error: null };
+    if (response.status === 401 || response.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+    return { valid: false, error: `Validation failed: ${response.status}` };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
+
+export async function validateBailianCodingPlanProvider({ apiKey, providerSpecificData = {} }: any) {
+  try {
+    const rawBaseUrl =
+      normalizeBaseUrl(providerSpecificData.baseUrl) ||
+      "https://coding-intl.dashscope.aliyuncs.com/apps/anthropic/v1";
+    const baseUrl = rawBaseUrl.endsWith("/messages")
+      ? rawBaseUrl.slice(0, -"/messages".length)
+      : rawBaseUrl;
+    // bailian-coding-plan uses DashScope Anthropic-compatible messages endpoint
+    // It does NOT expose /v1/models — use messages probe directly
+    const messagesUrl = `${baseUrl}/messages`;
+
+    const response = await validationWrite(messagesUrl, {
+      method: "POST",
+      headers: applyCustomUserAgent(
+        {
+          "Content-Type": "application/json",
+          "x-api-key": apiKey,
+          "anthropic-version": "2023-06-01",
+        },
+        providerSpecificData
+      ),
+      body: JSON.stringify({
+        model: "qwen3-coder-plus",
+        max_tokens: 1,
+        messages: [{ role: "user", content: "test" }],
+      }),
+    });
+
+    // 401/403 => invalid key
+    if (response.status === 401 || response.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    // Non-auth 4xx (e.g., 400 bad request) means auth passed but request was malformed
+    if (response.status >= 400 && response.status < 500) {
+      return { valid: true, error: null };
+    }
+
+    if (response.ok) {
+      return { valid: true, error: null };
+    }
+
+    return { valid: false, error: `Validation failed: ${response.status}` };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
+
+export async function validateRekaProvider({ apiKey, providerSpecificData = {} }: any) {
+  const baseUrl = normalizeBaseUrl(providerSpecificData.baseUrl) || "https://api.reka.ai/v1";
+  const headers = buildRekaHeaders(apiKey, providerSpecificData);
+
+  try {
+    const response = await validationRead(`${baseUrl}/models`, {
+      method: "GET",
+      headers,
+    });
+
+    if (response.ok) {
+      return { valid: true, error: null, method: "reka_models" };
+    }
+
+    if (response.status === 401 || response.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    if (response.status === 429) {
+      return {
+        valid: true,
+        error: null,
+        method: "reka_models",
+        warning: "Rate limited, but credentials are valid",
+      };
+    }
+  } catch {
+    // Fall through to the chat probe when /models is unavailable.
+  }
+
+  try {
+    const response = await validationWrite(`${baseUrl}/chat/completions`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({
+        model: providerSpecificData.validationModelId || "reka-flash-3",
+        messages: [{ role: "user", content: "test" }],
+        max_tokens: 1,
+      }),
+    });
+
+    if (
+      response.ok ||
+      response.status === 400 ||
+      response.status === 422 ||
+      response.status === 429
+    ) {
+      return { valid: true, error: null, method: "reka_chat_probe" };
+    }
+
+    if (response.status === 401 || response.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    if (response.status >= 500) {
+      return { valid: false, error: `Provider unavailable (${response.status})` };
+    }
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+
+  return { valid: false, error: "Connection failed while testing Reka" };
+}
+
+export async function validateMaritalkProvider({ apiKey, providerSpecificData = {} }: any) {
+  const entry = getRegistryEntry("maritalk");
+  const baseUrl = normalizeBaseUrl(providerSpecificData.baseUrl || entry?.baseUrl);
+  const headers = buildKeyHeaders(apiKey, providerSpecificData);
+
+  try {
+    const modelsRes = await validationRead(buildMaritalkModelsUrl(baseUrl), {
+      method: "GET",
+      headers,
+    });
+
+    if (modelsRes.ok) {
+      return { valid: true, error: null, method: "maritalk_models" };
+    }
+
+    if (modelsRes.status === 401 || modelsRes.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    if (modelsRes.status === 429) {
+      return {
+        valid: true,
+        error: null,
+        method: "maritalk_models",
+        warning: "Rate limited, but credentials are valid",
+      };
+    }
+
+    if (modelsRes.status >= 500) {
+      return { valid: false, error: `Provider unavailable (${modelsRes.status})` };
+    }
+  } catch {
+    // Fall through to the chat probe when /models cannot be reached.
+  }
+
+  const modelId =
+    typeof providerSpecificData?.validationModelId === "string" &&
+    providerSpecificData.validationModelId.trim()
+      ? providerSpecificData.validationModelId.trim()
+      : entry?.models?.[0]?.id || "sabia-4";
+
+  return validateDirectChatProvider({
+    url: buildMaritalkChatUrl(baseUrl),
+    headers,
+    body: {
+      model: modelId,
+      messages: [{ role: "user", content: "test" }],
+      max_tokens: 1,
+    },
+    providerSpecificData,
+  });
+}
+
+export async function validateNlpCloudProvider({ apiKey, providerSpecificData = {} }: any) {
+  const rawBaseUrl = normalizeBaseUrl(providerSpecificData.baseUrl) || "https://api.nlpcloud.io/v1";
+  const baseUrl = rawBaseUrl.endsWith("/gpu") ? rawBaseUrl : `${rawBaseUrl.replace(/\/$/, "")}/gpu`;
+  const modelId =
+    typeof providerSpecificData.validationModelId === "string" &&
+    providerSpecificData.validationModelId.trim()
+      ? providerSpecificData.validationModelId.trim()
+      : "chatdolphin";
+  const headers = buildTokenHeaders(apiKey, providerSpecificData);
+
+  try {
+    const response = await validationWrite(`${baseUrl}/${modelId}/chatbot`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({
+        input: "test",
+        context: "You are a concise assistant.",
+        history: [],
+      }),
+    });
+
+    if (
+      response.ok ||
+      response.status === 400 ||
+      response.status === 422 ||
+      response.status === 429
+    ) {
+      return {
+        valid: true,
+        error: null,
+        method: "nlpcloud_chatbot",
+        ...(response.status === 429 ? { warning: "Rate limited, but credentials are valid" } : {}),
+      };
+    }
+
+    if (response.status === 401 || response.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    if (response.status >= 500) {
+      return { valid: false, error: `Provider unavailable (${response.status})` };
+    }
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+
+  return { valid: false, error: "Connection failed while testing NLP Cloud" };
+}
+
+export async function validateRunwayProvider({ apiKey, providerSpecificData = {} }: any) {
+  const baseUrl = normalizeRunwayBaseUrl(providerSpecificData.baseUrl);
+
+  try {
+    const response = await validationRead(buildRunwayApiUrl("/organization", baseUrl), {
+      method: "GET",
+      headers: buildRunwayHeaders(apiKey),
+    });
+
+    if (response.ok) {
+      return { valid: true, error: null, method: "runway_organization" };
+    }
+
+    if (response.status === 401 || response.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    if (response.status === 429) {
+      return {
+        valid: true,
+        error: null,
+        method: "runway_organization",
+        warning: "Rate limited, but credentials are valid",
+      };
+    }
+
+    if (response.status >= 500) {
+      return { valid: false, error: `Provider unavailable (${response.status})` };
+    }
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+
+  return { valid: false, error: "Connection failed while testing Runway" };
+}
+
+export async function validateNousResearchProvider({ apiKey, providerSpecificData = {} }: any) {
+  const baseUrl =
+    normalizeBaseUrl(providerSpecificData.baseUrl) || "https://inference-api.nousresearch.com/v1";
+  const chatUrl = `${baseUrl}/chat/completions`;
+  const modelId =
+    typeof providerSpecificData.validationModelId === "string" &&
+    providerSpecificData.validationModelId.trim()
+      ? providerSpecificData.validationModelId.trim()
+      : "Hermes-4-70B";
+
+  try {
+    const response = await validationWrite(chatUrl, {
+      method: "POST",
+      headers: buildBearerHeaders(apiKey, providerSpecificData),
+      body: JSON.stringify({
+        model: modelId,
+        messages: [{ role: "user", content: "test" }],
+        max_tokens: 1,
+      }),
+    });
+
+    if (response.ok) {
+      return { valid: true, error: null, method: "nous_chat_completions" };
+    }
+
+    if (response.status === 401 || response.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    if (response.status === 429) {
+      return {
+        valid: true,
+        error: null,
+        method: "nous_chat_completions",
+        warning: "Rate limited, but credentials are valid",
+      };
+    }
+
+    if (response.status === 402) {
+      return { valid: false, error: "Payment required or API key missing" };
+    }
+
+    if (response.status >= 500) {
+      return { valid: false, error: `Provider unavailable (${response.status})` };
+    }
+
+    // #3881: any other non-auth 4xx (e.g. 400 model-not-found, 404, 422) means the
+    // credentials were accepted — only the probe model/request shape was rejected.
+    // Treat as valid (mirrors the longcat/nvidia validators) so a model rename upstream
+    // can't make a working key read as "invalid".
+    if (response.status >= 400 && response.status < 500) {
+      return {
+        valid: true,
+        error: null,
+        method: "nous_chat_completions",
+        warning: `Credentials valid (probe returned ${response.status})`,
+      };
+    }
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+
+  return { valid: false, error: "Connection failed while testing Nous Research" };
+}
+
+export async function validatePoeProvider({ apiKey, providerSpecificData = {} }: any) {
+  const baseUrl = normalizeBaseUrl(providerSpecificData.baseUrl) || "https://api.poe.com/v1";
+  const balanceUrl = new URL("/usage/current_balance", baseUrl).toString();
+
+  try {
+    const response = await validationRead(balanceUrl, {
+      method: "GET",
+      headers: buildBearerHeaders(apiKey, providerSpecificData),
+    });
+
+    if (response.ok) {
+      return { valid: true, error: null, method: "poe_current_balance" };
+    }
+
+    if (response.status === 401 || response.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    if (response.status === 429) {
+      return {
+        valid: true,
+        error: null,
+        method: "poe_current_balance",
+        warning: "Rate limited, but credentials are valid",
+      };
+    }
+
+    if (response.status >= 500) {
+      return { valid: false, error: `Provider unavailable (${response.status})` };
+    }
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+
+  return { valid: false, error: "Connection failed while testing Poe" };
+}
+
diff --git a/src/lib/providers/validation/cloudProviders.ts b/src/lib/providers/validation/cloudProviders.ts
new file mode 100644
index 0000000000..0000d8cfba
--- /dev/null
+++ b/src/lib/providers/validation/cloudProviders.ts
@@ -0,0 +1,669 @@
+// Enterprise-cloud provider key validators: heroku, databricks, datarobot, snowflake, gigachat,
+// azure-openai, azure-ai, watsonx, oci, sap. Extracted from validation.ts (god-file decomposition) —
+// top-level functions with no dispatcher-state captures; behavior is byte-identical to the inline defs.
+import {
+  normalizeBaseUrl,
+  normalizeAzureOpenAIBaseUrl,
+  normalizeHerokuChatUrl,
+  normalizeDatabricksChatUrl,
+  normalizeSnowflakeChatUrl,
+  normalizeGigachatChatUrl,
+} from "./urlHelpers";
+import { applyCustomUserAgent, buildBearerHeaders } from "./headers";
+import { toValidationErrorResult, validationRead, validationWrite } from "./transport";
+import { validateDirectChatProvider } from "./directChatProbe";
+import { getGigachatAccessToken } from "@omniroute/open-sse/services/gigachatAuth.ts";
+import {
+  AZURE_AI_DEFAULT_BASE_URL,
+  buildAzureAiChatUrl,
+  buildAzureAiModelsUrl,
+} from "@omniroute/open-sse/config/azureAi.ts";
+import {
+  DATAROBOT_DEFAULT_BASE_URL,
+  buildDataRobotCatalogUrl,
+  buildDataRobotChatUrl,
+  isDataRobotDeploymentUrl,
+} from "@omniroute/open-sse/config/datarobot.ts";
+import {
+  OCI_DEFAULT_BASE_URL,
+  buildOciChatUrl,
+  buildOciModelsUrl,
+} from "@omniroute/open-sse/config/oci.ts";
+import {
+  SAP_DEFAULT_BASE_URL,
+  buildSapChatUrl,
+  buildSapModelsUrl,
+  getSapResourceGroup,
+  isSapDeploymentUrl,
+} from "@omniroute/open-sse/config/sap.ts";
+import {
+  WATSONX_DEFAULT_BASE_URL,
+  buildWatsonxChatUrl,
+  buildWatsonxModelsUrl,
+} from "@omniroute/open-sse/config/watsonx.ts";
+
+export async function validateHerokuProvider({ apiKey, providerSpecificData = {} }: any) {
+  const baseUrl = normalizeBaseUrl(providerSpecificData.baseUrl);
+  if (!baseUrl) {
+    return { valid: false, error: "Missing base URL" };
+  }
+
+  return validateDirectChatProvider({
+    url: normalizeHerokuChatUrl(baseUrl),
+    headers: buildBearerHeaders(apiKey, providerSpecificData),
+    body: {
+      model: providerSpecificData.validationModelId || "claude-4-sonnet",
+      messages: [{ role: "user", content: "test" }],
+      max_tokens: 1,
+    },
+    providerSpecificData,
+  });
+}
+
+export async function validateDatabricksProvider({ apiKey, providerSpecificData = {} }: any) {
+  const baseUrl = normalizeBaseUrl(providerSpecificData.baseUrl);
+  if (!baseUrl) {
+    return { valid: false, error: "Missing base URL" };
+  }
+
+  return validateDirectChatProvider({
+    url: normalizeDatabricksChatUrl(baseUrl),
+    headers: buildBearerHeaders(apiKey, providerSpecificData),
+    body: {
+      model: providerSpecificData.validationModelId || "databricks-meta-llama-3-3-70b-instruct",
+      messages: [{ role: "user", content: "test" }],
+      max_tokens: 1,
+    },
+    providerSpecificData,
+  });
+}
+
+export async function validateDataRobotProvider({ apiKey, providerSpecificData = {} }: any) {
+  const configuredBaseUrl =
+    normalizeBaseUrl(providerSpecificData.baseUrl) || DATAROBOT_DEFAULT_BASE_URL;
+
+  if (isDataRobotDeploymentUrl(configuredBaseUrl)) {
+    return validateDirectChatProvider({
+      url: buildDataRobotChatUrl(configuredBaseUrl),
+      headers: buildBearerHeaders(apiKey, providerSpecificData),
+      body: {
+        model: providerSpecificData.validationModelId || "datarobot-deployed-llm",
+        messages: [{ role: "user", content: "test" }],
+        max_tokens: 1,
+      },
+      providerSpecificData,
+    });
+  }
+
+  const catalogUrl = buildDataRobotCatalogUrl(configuredBaseUrl);
+  if (!catalogUrl) {
+    return { valid: false, error: "Invalid DataRobot base URL" };
+  }
+
+  try {
+    const response = await validationRead(catalogUrl, {
+      method: "GET",
+      headers: buildBearerHeaders(apiKey, providerSpecificData),
+    });
+
+    if (response.ok) {
+      return { valid: true, error: null, method: "gateway_catalog" };
+    }
+
+    if (response.status === 401 || response.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    if (response.status === 429) {
+      return {
+        valid: true,
+        error: null,
+        method: "gateway_catalog",
+        warning: "Rate limited, but credentials are valid",
+      };
+    }
+
+    if (response.status >= 400 && response.status < 500) {
+      return { valid: true, error: null, method: "gateway_catalog" };
+    }
+
+    return { valid: false, error: `Validation failed: ${response.status}` };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
+
+export async function validateSnowflakeProvider({ apiKey, providerSpecificData = {} }: any) {
+  const baseUrl = normalizeBaseUrl(providerSpecificData.baseUrl);
+  if (!baseUrl) {
+    return { valid: false, error: "Missing base URL" };
+  }
+
+  const usesProgrammaticAccessToken = typeof apiKey === "string" && apiKey.startsWith("pat/");
+  return validateDirectChatProvider({
+    url: normalizeSnowflakeChatUrl(baseUrl),
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${usesProgrammaticAccessToken ? apiKey.slice(4) : apiKey}`,
+      "X-Snowflake-Authorization-Token-Type": usesProgrammaticAccessToken
+        ? "PROGRAMMATIC_ACCESS_TOKEN"
+        : "KEYPAIR_JWT",
+    },
+    body: {
+      model: providerSpecificData.validationModelId || "llama3.3-70b",
+      messages: [{ role: "user", content: "test" }],
+      max_tokens: 1,
+    },
+    providerSpecificData,
+  });
+}
+
+export async function validateGigachatProvider({ apiKey, providerSpecificData = {} }: any) {
+  const baseUrl =
+    normalizeBaseUrl(providerSpecificData.baseUrl) || "https://gigachat.devices.sberbank.ru/api/v1";
+
+  let token;
+  try {
+    token = await getGigachatAccessToken({ credentials: apiKey });
+  } catch (error: any) {
+    if (String(error?.message || "").match(/\b(401|403)\b/)) {
+      return { valid: false, error: "Invalid API key" };
+    }
+    return toValidationErrorResult(error);
+  }
+
+  return validateDirectChatProvider({
+    url: normalizeGigachatChatUrl(baseUrl),
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${token.accessToken}`,
+      Accept: "application/json",
+    },
+    body: {
+      model: providerSpecificData.validationModelId || "GigaChat-2-Pro",
+      messages: [{ role: "user", content: "test" }],
+      max_tokens: 1,
+    },
+    providerSpecificData,
+  });
+}
+
+export async function validateAzureOpenAIProvider({ apiKey, providerSpecificData = {} }: any) {
+  const rawBaseUrl = normalizeBaseUrl(providerSpecificData.baseUrl);
+  if (!rawBaseUrl) {
+    return { valid: false, error: "Missing base URL" };
+  }
+
+  const baseUrl = normalizeAzureOpenAIBaseUrl(rawBaseUrl);
+  const apiVersion =
+    typeof providerSpecificData.validationApiVersion === "string" &&
+    providerSpecificData.validationApiVersion.trim()
+      ? providerSpecificData.validationApiVersion.trim()
+      : "2024-12-01-preview";
+  const headers = applyCustomUserAgent(
+    {
+      "Content-Type": "application/json",
+      "api-key": apiKey,
+    },
+    providerSpecificData
+  );
+  const encodedVersion = encodeURIComponent(apiVersion);
+
+  for (const probeUrl of [
+    `${baseUrl}/openai/deployments?api-version=${encodedVersion}`,
+    `${baseUrl}/openai/models?api-version=${encodedVersion}`,
+  ]) {
+    try {
+      const response = await validationRead(probeUrl, { method: "GET", headers });
+      if (response.ok) {
+        return { valid: true, error: null, method: "azure_probe" };
+      }
+      if (response.status === 401 || response.status === 403) {
+        return { valid: false, error: "Invalid API key" };
+      }
+      if (response.status === 400 || response.status === 404 || response.status === 405) {
+        continue;
+      }
+      if (response.status === 429) {
+        return {
+          valid: true,
+          error: null,
+          method: "azure_probe",
+          warning: "Rate limited, but credentials are valid",
+        };
+      }
+      if (response.status >= 500) {
+        return { valid: false, error: `Provider unavailable (${response.status})` };
+      }
+    } catch (error) {
+      return toValidationErrorResult(error);
+    }
+  }
+
+  const deploymentId =
+    typeof providerSpecificData.validationModelId === "string"
+      ? providerSpecificData.validationModelId.trim()
+      : "";
+
+  if (!deploymentId) {
+    return {
+      valid: true,
+      error: null,
+      warning:
+        "Azure key accepted, but no deployment name was provided for a chat probe. Set Model ID to validate a specific deployment.",
+    };
+  }
+
+  const chatUrl = `${baseUrl}/openai/deployments/${encodeURIComponent(deploymentId)}/chat/completions?api-version=${encodedVersion}`;
+  const response = await validationWrite(chatUrl, {
+    method: "POST",
+    headers,
+    body: JSON.stringify({
+      model: deploymentId,
+      messages: [{ role: "user", content: "test" }],
+      max_tokens: 1,
+    }),
+  });
+
+  if (
+    response.ok ||
+    response.status === 400 ||
+    response.status === 422 ||
+    response.status === 429
+  ) {
+    return { valid: true, error: null, method: "chat_probe" };
+  }
+  if (response.status === 401 || response.status === 403) {
+    return { valid: false, error: "Invalid API key" };
+  }
+  if (response.status === 404) {
+    return {
+      valid: true,
+      error: null,
+      method: "chat_probe",
+      warning: "Azure credentials are valid, but the requested deployment was not found.",
+    };
+  }
+  if (response.status >= 500) {
+    return { valid: false, error: `Provider unavailable (${response.status})` };
+  }
+  return { valid: false, error: `Validation failed: ${response.status}` };
+}
+
+export async function validateAzureAiProvider({ apiKey, providerSpecificData = {} }: any) {
+  const rawBaseUrl = normalizeBaseUrl(providerSpecificData.baseUrl) || AZURE_AI_DEFAULT_BASE_URL;
+  const modelsUrl = buildAzureAiModelsUrl(rawBaseUrl);
+  const headers = applyCustomUserAgent(
+    {
+      "Content-Type": "application/json",
+      "api-key": apiKey,
+    },
+    providerSpecificData
+  );
+
+  try {
+    const response = await validationRead(modelsUrl, {
+      method: "GET",
+      headers,
+    });
+
+    if (response.ok) {
+      return { valid: true, error: null, method: "azure_ai_models" };
+    }
+
+    if (response.status === 401 || response.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    if (response.status === 429) {
+      return {
+        valid: true,
+        error: null,
+        method: "azure_ai_models",
+        warning: "Rate limited, but credentials are valid",
+      };
+    }
+  } catch {
+    // Fall through to chat probe when /models is unavailable.
+  }
+
+  const validationModelId =
+    typeof providerSpecificData.validationModelId === "string"
+      ? providerSpecificData.validationModelId.trim()
+      : "";
+
+  if (!validationModelId) {
+    return {
+      valid: false,
+      error: "Endpoint /models unavailable. Provide a Model ID to validate via /chat/completions.",
+    };
+  }
+
+  const chatUrl = buildAzureAiChatUrl(
+    rawBaseUrl,
+    providerSpecificData.apiType === "responses" ? "responses" : "chat"
+  );
+  const chatBody =
+    providerSpecificData.apiType === "responses"
+      ? {
+          model: validationModelId,
+          input: "test",
+          max_output_tokens: 1,
+        }
+      : {
+          model: validationModelId,
+          messages: [{ role: "user", content: "test" }],
+          max_tokens: 1,
+        };
+
+  try {
+    const response = await validationWrite(chatUrl, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(chatBody),
+    });
+
+    if (
+      response.ok ||
+      response.status === 400 ||
+      response.status === 404 ||
+      response.status === 422 ||
+      response.status === 429
+    ) {
+      return { valid: true, error: null, method: "azure_ai_chat_probe" };
+    }
+
+    if (response.status === 401 || response.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    if (response.status >= 500) {
+      return { valid: false, error: `Provider unavailable (${response.status})` };
+    }
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+
+  return { valid: false, error: "Connection failed while testing Azure AI Foundry" };
+}
+
+export async function validateWatsonxProvider({ apiKey, providerSpecificData = {} }: any) {
+  const rawBaseUrl = normalizeBaseUrl(providerSpecificData.baseUrl) || WATSONX_DEFAULT_BASE_URL;
+  const headers = applyCustomUserAgent(
+    {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${apiKey}`,
+    },
+    providerSpecificData
+  );
+
+  try {
+    const response = await validationRead(buildWatsonxModelsUrl(rawBaseUrl), {
+      method: "GET",
+      headers,
+    });
+
+    if (response.ok) {
+      return { valid: true, error: null, method: "watsonx_models" };
+    }
+
+    if (response.status === 401 || response.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    if (response.status === 429) {
+      return {
+        valid: true,
+        error: null,
+        method: "watsonx_models",
+        warning: "Rate limited, but credentials are valid",
+      };
+    }
+  } catch {
+    // Fall through to chat probe when /models is unavailable.
+  }
+
+  const validationModelId =
+    typeof providerSpecificData.validationModelId === "string" &&
+    providerSpecificData.validationModelId.trim()
+      ? providerSpecificData.validationModelId.trim()
+      : "ibm/granite-3-3-8b-instruct";
+
+  try {
+    const response = await validationWrite(buildWatsonxChatUrl(rawBaseUrl), {
+      method: "POST",
+      headers,
+      body: JSON.stringify({
+        model: validationModelId,
+        messages: [{ role: "user", content: "test" }],
+        max_tokens: 1,
+      }),
+    });
+
+    if (
+      response.ok ||
+      response.status === 400 ||
+      response.status === 404 ||
+      response.status === 422 ||
+      response.status === 429
+    ) {
+      return {
+        valid: true,
+        error: null,
+        method: "watsonx_chat_probe",
+        ...(response.status === 404
+          ? { warning: "watsonx credentials are valid, but the requested model is not enabled." }
+          : {}),
+      };
+    }
+
+    if (response.status === 401 || response.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    if (response.status >= 500) {
+      return { valid: false, error: `Provider unavailable (${response.status})` };
+    }
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+
+  return { valid: false, error: "Connection failed while testing watsonx.ai" };
+}
+
+export async function validateOciProvider({ apiKey, providerSpecificData = {} }: any) {
+  const rawBaseUrl = normalizeBaseUrl(providerSpecificData.baseUrl) || OCI_DEFAULT_BASE_URL;
+  const projectId =
+    typeof providerSpecificData.projectId === "string" && providerSpecificData.projectId.trim()
+      ? providerSpecificData.projectId.trim()
+      : typeof providerSpecificData.project === "string" && providerSpecificData.project.trim()
+        ? providerSpecificData.project.trim()
+        : "";
+  const headers = applyCustomUserAgent(
+    {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${apiKey}`,
+      ...(projectId ? { "OpenAI-Project": projectId } : {}),
+    },
+    providerSpecificData
+  );
+
+  try {
+    const response = await validationRead(buildOciModelsUrl(rawBaseUrl), {
+      method: "GET",
+      headers,
+    });
+
+    if (response.ok) {
+      return { valid: true, error: null, method: "oci_models" };
+    }
+
+    if (response.status === 401 || response.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    if (response.status === 429) {
+      return {
+        valid: true,
+        error: null,
+        method: "oci_models",
+        warning: "Rate limited, but credentials are valid",
+      };
+    }
+  } catch {
+    // Fall through to chat/responses probe when /models is unavailable.
+  }
+
+  const validationModelId =
+    typeof providerSpecificData.validationModelId === "string" &&
+    providerSpecificData.validationModelId.trim()
+      ? providerSpecificData.validationModelId.trim()
+      : "openai.gpt-oss-20b";
+  const apiType = providerSpecificData.apiType === "responses" ? "responses" : "chat";
+  const body =
+    apiType === "responses"
+      ? {
+          model: validationModelId,
+          input: "test",
+          max_output_tokens: 1,
+        }
+      : {
+          model: validationModelId,
+          messages: [{ role: "user", content: "test" }],
+          max_tokens: 1,
+        };
+
+  try {
+    const response = await validationWrite(buildOciChatUrl(rawBaseUrl, apiType), {
+      method: "POST",
+      headers,
+      body: JSON.stringify(body),
+    });
+
+    if (
+      response.ok ||
+      response.status === 400 ||
+      response.status === 404 ||
+      response.status === 422 ||
+      response.status === 429
+    ) {
+      return {
+        valid: true,
+        error: null,
+        method: apiType === "responses" ? "oci_responses_probe" : "oci_chat_probe",
+        ...(response.status === 404
+          ? { warning: "OCI credentials are valid, but the requested model was not found." }
+          : {}),
+      };
+    }
+
+    if (response.status === 401 || response.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    if (response.status >= 500) {
+      return { valid: false, error: `Provider unavailable (${response.status})` };
+    }
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+
+  return { valid: false, error: "Connection failed while testing OCI Generative AI" };
+}
+
+export async function validateSapProvider({ apiKey, providerSpecificData = {} }: any) {
+  const rawBaseUrl = normalizeBaseUrl(providerSpecificData.baseUrl) || SAP_DEFAULT_BASE_URL;
+  const resourceGroup = getSapResourceGroup(providerSpecificData);
+  const headers = applyCustomUserAgent(
+    {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${apiKey}`,
+      "AI-Resource-Group": resourceGroup,
+    },
+    providerSpecificData
+  );
+
+  try {
+    const response = await validationRead(buildSapModelsUrl(rawBaseUrl), {
+      method: "GET",
+      headers,
+    });
+
+    if (response.ok) {
+      return { valid: true, error: null, method: "sap_models" };
+    }
+
+    if (response.status === 401 || response.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    if (response.status === 429) {
+      return {
+        valid: true,
+        error: null,
+        method: "sap_models",
+        warning: "Rate limited, but credentials are valid",
+      };
+    }
+  } catch {
+    // Fall through to deployment probe when the discovery API is unavailable.
+  }
+
+  const canProbeChat =
+    isSapDeploymentUrl(rawBaseUrl) || /\/chat\/completions$/i.test(normalizeBaseUrl(rawBaseUrl));
+  if (!canProbeChat) {
+    return {
+      valid: false,
+      error:
+        "SAP validation needs either a reachable AI_API_URL or a deployment URL in providerSpecificData.baseUrl",
+    };
+  }
+
+  const validationModelId =
+    typeof providerSpecificData.validationModelId === "string" &&
+    providerSpecificData.validationModelId.trim()
+      ? providerSpecificData.validationModelId.trim()
+      : "gpt-4o";
+
+  try {
+    const response = await validationWrite(buildSapChatUrl(rawBaseUrl), {
+      method: "POST",
+      headers,
+      body: JSON.stringify({
+        model: validationModelId,
+        messages: [{ role: "user", content: "test" }],
+        max_tokens: 1,
+      }),
+    });
+
+    if (
+      response.ok ||
+      response.status === 400 ||
+      response.status === 404 ||
+      response.status === 422 ||
+      response.status === 429
+    ) {
+      return {
+        valid: true,
+        error: null,
+        method: "sap_chat_probe",
+        ...(response.status === 404
+          ? { warning: "SAP credentials are valid, but the deployment URL or model was not found." }
+          : {}),
+      };
+    }
+
+    if (response.status === 401 || response.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    if (response.status >= 500) {
+      return { valid: false, error: `Provider unavailable (${response.status})` };
+    }
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+
+  return { valid: false, error: "Connection failed while testing SAP Generative AI Hub" };
+}
+
diff --git a/src/lib/providers/validation/directChatProbe.ts b/src/lib/providers/validation/directChatProbe.ts
new file mode 100644
index 0000000000..f34c0a0fad
--- /dev/null
+++ b/src/lib/providers/validation/directChatProbe.ts
@@ -0,0 +1,47 @@
+// Generic "POST /chat/completions auth probe" used by several provider validators (command-code,
+// nlpcloud + the enterprise-cloud validators). Extracted from validation.ts (god-file decomposition)
+// into its own leaf so both the host dispatcher and validation/cloudProviders.ts can share it without
+// a cycle. Behavior is byte-identical to the original inline def.
+import { applyCustomUserAgent } from "./headers";
+import { toValidationErrorResult, validationWrite } from "./transport";
+
+export async function validateDirectChatProvider({
+  url,
+  headers,
+  body,
+  providerSpecificData = {},
+  isLocal = false,
+}: any) {
+  try {
+    const response = await validationWrite(
+      url,
+      {
+        method: "POST",
+        headers: applyCustomUserAgent(headers, providerSpecificData),
+        body: JSON.stringify(body),
+      },
+      isLocal
+    );
+
+    if (response.status === 401 || response.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    if (
+      response.ok ||
+      response.status === 400 ||
+      response.status === 422 ||
+      response.status === 429
+    ) {
+      return { valid: true, error: null };
+    }
+
+    if (response.status >= 500) {
+      return { valid: false, error: `Provider unavailable (${response.status})` };
+    }
+
+    return { valid: false, error: `Validation failed: ${response.status}` };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
diff --git a/src/lib/providers/validation/embeddingProviders.ts b/src/lib/providers/validation/embeddingProviders.ts
new file mode 100644
index 0000000000..a6ef2f700e
--- /dev/null
+++ b/src/lib/providers/validation/embeddingProviders.ts
@@ -0,0 +1,143 @@
+// Embedding / rerank / clarifai provider key validators. Extracted from validation.ts (god-file
+// decomposition) — top-level functions with no dispatcher-state captures; behavior is byte-identical
+// to the original inline defs.
+import { normalizeBaseUrl, addModelsSuffix, resolveChatUrl } from "./urlHelpers";
+import { buildBearerHeaders, buildClarifaiHeaders } from "./headers";
+import { toValidationErrorResult, validationRead, validationWrite } from "./transport";
+
+export async function validateClarifaiProvider({ apiKey, providerSpecificData = {} }: any) {
+  const baseUrl =
+    normalizeBaseUrl(providerSpecificData.baseUrl) || "https://api.clarifai.com/v2/ext/openai/v1";
+  const modelsUrl = addModelsSuffix(baseUrl);
+
+  try {
+    const modelsRes = await validationRead(modelsUrl, {
+      method: "GET",
+      headers: buildClarifaiHeaders(apiKey, providerSpecificData),
+    });
+
+    if (modelsRes.ok) {
+      return { valid: true, error: null, method: "clarifai_models" };
+    }
+
+    if (modelsRes.status === 401 || modelsRes.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    const chatUrl = resolveChatUrl("clarifai", baseUrl, providerSpecificData);
+    const chatRes = await validationWrite(chatUrl, {
+      method: "POST",
+      headers: buildClarifaiHeaders(apiKey, providerSpecificData),
+      body: JSON.stringify({
+        model:
+          providerSpecificData?.validationModelId || "openai/chat-completion/models/gpt-oss-120b",
+        messages: [{ role: "user", content: "test" }],
+        max_tokens: 1,
+      }),
+    });
+
+    if (chatRes.ok || chatRes.status === 400 || chatRes.status === 422 || chatRes.status === 429) {
+      return { valid: true, error: null, method: "clarifai_chat_probe" };
+    }
+
+    if (chatRes.status === 401 || chatRes.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    if (chatRes.status === 404 || chatRes.status === 405) {
+      return { valid: false, error: "Provider validation endpoint not supported" };
+    }
+
+    if (chatRes.status >= 500) {
+      return { valid: false, error: `Provider unavailable (${chatRes.status})` };
+    }
+
+    return { valid: true, error: null, method: "clarifai_chat_probe" };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
+
+export async function validateEmbeddingApiProvider({
+  apiKey,
+  providerSpecificData = {},
+  url,
+  modelId,
+}: any) {
+  if (!url) {
+    return { valid: false, error: "Missing embedding endpoint" };
+  }
+
+  try {
+    const response = await validationWrite(url, {
+      method: "POST",
+      headers: buildBearerHeaders(apiKey, providerSpecificData),
+      body: JSON.stringify({
+        model: providerSpecificData?.validationModelId || modelId,
+        input: ["test"],
+      }),
+    });
+
+    if (response.status === 401 || response.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    if (
+      response.ok ||
+      response.status === 400 ||
+      response.status === 422 ||
+      response.status === 429
+    ) {
+      return { valid: true, error: null };
+    }
+
+    if (response.status >= 500) {
+      return { valid: false, error: `Provider unavailable (${response.status})` };
+    }
+
+    return { valid: false, error: `Validation failed: ${response.status}` };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
+
+export async function validateRerankApiProvider({ apiKey, providerSpecificData = {}, url, modelId }: any) {
+  if (!url) {
+    return { valid: false, error: "Missing rerank endpoint" };
+  }
+
+  try {
+    const response = await validationWrite(url, {
+      method: "POST",
+      headers: buildBearerHeaders(apiKey, providerSpecificData),
+      body: JSON.stringify({
+        model: providerSpecificData?.validationModelId || modelId,
+        query: "test",
+        documents: ["test"],
+        top_n: 1,
+        return_documents: false,
+      }),
+    });
+
+    if (response.status === 401 || response.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    if (
+      response.ok ||
+      response.status === 400 ||
+      response.status === 422 ||
+      response.status === 429
+    ) {
+      return { valid: true, error: null };
+    }
+
+    if (response.status >= 500) {
+      return { valid: false, error: `Provider unavailable (${response.status})` };
+    }
+
+    return { valid: false, error: `Validation failed: ${response.status}` };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
diff --git a/src/lib/providers/validation/headers.ts b/src/lib/providers/validation/headers.ts
new file mode 100644
index 0000000000..61b68b67af
--- /dev/null
+++ b/src/lib/providers/validation/headers.ts
@@ -0,0 +1,120 @@
+// Request-header builders + custom-UA handling + a direct (proxy-bypassing) HTTPS helper, extracted
+// from validation.ts (god-file decomposition). Pure header construction except directHttpsRequest,
+// which delegates to safeOutboundFetch with bypassProxyPatch. Behavior is byte-identical.
+import { safeOutboundFetch } from "@/shared/network/safeOutboundFetch";
+
+
+// Standardized desktop Chrome UA for web-cookie/no-auth session probes (minimizes anti-bot detection).
+export const STANDARD_USER_AGENT =
+  "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36";
+
+export function getCustomUserAgent(providerSpecificData: any = {}) {
+  if (typeof providerSpecificData?.customUserAgent !== "string") return null;
+  const customUserAgent = providerSpecificData.customUserAgent.trim();
+  return customUserAgent || null;
+}
+
+export function applyCustomUserAgent(headers: Record<string, string>, providerSpecificData: any = {}) {
+  const customUserAgent = getCustomUserAgent(providerSpecificData);
+  if (!customUserAgent) return headers;
+  headers["User-Agent"] = customUserAgent;
+  if ("user-agent" in headers) {
+    headers["user-agent"] = customUserAgent;
+  }
+  return headers;
+}
+
+export function withCustomUserAgent(init: RequestInit, providerSpecificData: any = {}) {
+  return {
+    ...init,
+    headers: applyCustomUserAgent(
+      { ...((init.headers as Record<string, string> | undefined) || {}) },
+      providerSpecificData
+    ),
+  };
+}
+
+/**
+ * Direct HTTPS request utility that bypasses the global patched fetch.
+ * Used for provider validation where the patched fetch has compatibility issues.
+ * Uses safeOutboundFetch with bypassProxyPatch to use native Node.js fetch directly.
+ */
+export function directHttpsRequest(
+  url: string,
+  options: { method?: string; headers?: Record<string, string>; body?: string },
+  timeoutMs: number
+): Promise<{ status: number; ok: boolean; text: () => Promise<string> }> {
+  return safeOutboundFetch(url, {
+    method: options.method || "GET",
+    headers: (options.headers || {}) as Record<string, string>,
+    body: options.body,
+    timeoutMs,
+    bypassProxyPatch: true,
+    allowRedirect: true,
+    guard: "none",
+    retry: false,
+  }).then(async (response) => ({
+    status: response.status,
+    ok: response.ok,
+    text: async () => await response.text(),
+  }));
+}
+
+export function buildBearerHeaders(apiKey: string, providerSpecificData: any = {}) {
+  const headers: Record<string, string> = {
+    "Content-Type": "application/json",
+  };
+  if (apiKey) {
+    headers.Authorization = `Bearer ${apiKey}`;
+  }
+  return applyCustomUserAgent(headers, providerSpecificData);
+}
+
+export function buildRekaHeaders(apiKey: string, providerSpecificData: any = {}) {
+  const headers: Record<string, string> = {
+    "Content-Type": "application/json",
+  };
+
+  if (apiKey) {
+    headers.Authorization = `Bearer ${apiKey}`;
+    headers["X-Api-Key"] = apiKey;
+  }
+
+  return applyCustomUserAgent(headers, providerSpecificData);
+}
+
+export function buildClarifaiHeaders(apiKey: string, providerSpecificData: any = {}) {
+  const headers: Record<string, string> = {
+    "Content-Type": "application/json",
+  };
+
+  if (apiKey) {
+    headers.Authorization = `Key ${apiKey}`;
+  }
+
+  return applyCustomUserAgent(headers, providerSpecificData);
+}
+
+export function buildKeyHeaders(apiKey: string, providerSpecificData: any = {}) {
+  const headers: Record<string, string> = {
+    "Content-Type": "application/json",
+  };
+
+  if (apiKey) {
+    headers.Authorization = `Key ${apiKey}`;
+  }
+
+  return applyCustomUserAgent(headers, providerSpecificData);
+}
+
+export function buildTokenHeaders(apiKey: string, providerSpecificData: any = {}) {
+  const headers: Record<string, string> = {
+    "Content-Type": "application/json",
+  };
+
+  if (apiKey) {
+    headers.Authorization = `Token ${apiKey}`;
+  }
+
+  return applyCustomUserAgent(headers, providerSpecificData);
+}
diff --git a/src/lib/providers/validation/metaAi.ts b/src/lib/providers/validation/metaAi.ts
new file mode 100644
index 0000000000..aedc190f90
--- /dev/null
+++ b/src/lib/providers/validation/metaAi.ts
@@ -0,0 +1,116 @@
+// Meta AI persisted-query request builder + base62/ID generators, extracted from validation.ts
+// (god-file decomposition). Self-contained: uses only global crypto / Date / Math / Intl. The
+// muse-spark-web validator (validation/webProvidersB.ts) consumes buildMetaAiValidationBody + the
+// META_AI_* request consts. Behavior is byte-identical to the original inline defs.
+export const META_AI_SEND_MESSAGE_DOC_ID = "29ae946c82d1f301196c6ca2226400b5";
+export const META_AI_FRIENDLY_NAME = "useEctoSendMessageSubscription";
+export const META_AI_REQUEST_ANALYTICS_TAGS = "graphservice";
+export const META_AI_ASBD_ID = "129477";
+export const META_AI_USER_AGENT =
+  "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36";
+export const META_AI_BASE62_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+
+export function encodeMetaAiBase62(value: bigint, padLength: number): string {
+  let remaining = value;
+  let encoded = "";
+
+  while (remaining > 0n) {
+    encoded = META_AI_BASE62_ALPHABET[Number(remaining % 62n)] + encoded;
+    remaining /= 62n;
+  }
+
+  return encoded.padStart(padLength, "0");
+}
+
+export function decodeMetaAiBase62(value: string): bigint {
+  let decoded = 0n;
+  for (const char of value) {
+    const index = META_AI_BASE62_ALPHABET.indexOf(char);
+    if (index < 0) {
+      throw new Error(`Invalid Meta AI base62 character: ${char}`);
+    }
+    decoded = decoded * 62n + BigInt(index);
+  }
+  return decoded;
+}
+
+export function randomMetaAiBigInt(byteLength: number): bigint {
+  const bytes = new Uint8Array(byteLength);
+  crypto.getRandomValues(bytes);
+  let result = 0n;
+  for (const byte of bytes) {
+    result = (result << 8n) | BigInt(byte);
+  }
+  return result;
+}
+
+export function generateMetaAiConversationId(): string {
+  const timestamp = BigInt(Date.now()) & ((1n << 44n) - 1n);
+  const random = randomMetaAiBigInt(8) & ((1n << 64n) - 1n);
+  return `c.${encodeMetaAiBase62((timestamp << 64n) | random, 19)}`;
+}
+
+export function generateMetaAiEventId(conversationId: string): string | null {
+  if (!conversationId.startsWith("c.")) {
+    return null;
+  }
+
+  try {
+    const packedConversation = decodeMetaAiBase62(conversationId.slice(2));
+    const conversationRandom = packedConversation & ((1n << 64n) - 1n);
+    const timestamp = BigInt(Date.now()) & ((1n << 44n) - 1n);
+    const eventRandom = randomMetaAiBigInt(4) & ((1n << 32n) - 1n);
+    return `e.${encodeMetaAiBase62((timestamp << (64n + 32n)) | (conversationRandom << 32n) | eventRandom, 25)}`;
+  } catch {
+    return null;
+  }
+}
+
+export function generateMetaAiNumericMessageId(): string {
+  return (
+    BigInt(Date.now()) * 1000n +
+    BigInt(Math.floor(Math.random() * 1000)) +
+    (randomMetaAiBigInt(2) & 0xfffn)
+  ).toString();
+}
+
+export function buildMetaAiValidationBody() {
+  const conversationId = generateMetaAiConversationId();
+  return {
+    doc_id: META_AI_SEND_MESSAGE_DOC_ID,
+    variables: {
+      assistantMessageId: crypto.randomUUID(),
+      attachments: null,
+      clientLatitude: null,
+      clientLongitude: null,
+      clientTimezone:
+        typeof Intl !== "undefined" ? Intl.DateTimeFormat().resolvedOptions().timeZone : "UTC",
+      clippyIp: null,
+      content: "test",
+      conversationId,
+      conversationStarterId: null,
+      currentBranchPath: "0",
+      developerOverridesForMessage: null,
+      devicePixelRatio: 1,
+      entryPoint: "KADABRA__CHAT__UNIFIED_INPUT_BAR",
+      imagineOperationRequest: null,
+      isNewConversation: true,
+      mentions: null,
+      mode: "mode_fast",
+      promptEditType: null,
+      promptSessionId: crypto.randomUUID(),
+      promptType: null,
+      qplJoinId: null,
+      requestedToolCall: null,
+      // See muse-spark-web executor: RewriteOptionsInput was removed from
+      // Meta's schema; sending `rewriteOptions` (even null) breaks the
+      // persisted-query validation. Omit the field.
+      turnId: crypto.randomUUID(),
+      userAgent: META_AI_USER_AGENT,
+      userEventId: generateMetaAiEventId(conversationId),
+      userLocale: "en_US",
+      userMessageId: crypto.randomUUID(),
+      userUniqueMessageId: generateMetaAiNumericMessageId(),
+    },
+  };
+}
diff --git a/src/lib/providers/validation/openaiFormat.ts b/src/lib/providers/validation/openaiFormat.ts
new file mode 100644
index 0000000000..b7e63cf317
--- /dev/null
+++ b/src/lib/providers/validation/openaiFormat.ts
@@ -0,0 +1,473 @@
+// OpenAI/Gemini-format + Bedrock provider key validators (bedrock, openai-like, command-code, gemini-like, openai-compatible).
+// Extracted from validation.ts (god-file decomposition) — top-level functions; behavior is
+// byte-identical to the original inline defs.
+import { randomUUID } from "node:crypto";
+import { getRegistryEntry } from "@omniroute/open-sse/config/providerRegistry.ts";
+import {
+  discoverBedrockNativeModels,
+  isBedrockNativeApiError,
+  isBedrockNativeAuthError,
+} from "@omniroute/open-sse/services/bedrock.ts";
+import {
+  addModelsSuffix,
+  normalizeBaseUrl,
+  resolveChatUrl,
+} from "./urlHelpers";
+import {
+  applyCustomUserAgent,
+  buildBearerHeaders,
+} from "./headers";
+import {
+  toValidationErrorResult,
+  validationRead,
+  validationWrite,
+} from "./transport";
+import { validateDirectChatProvider } from "./directChatProbe";
+
+export async function validateBedrockProvider({ apiKey, providerSpecificData = {} }: any) {
+  if (!apiKey) {
+    return { valid: false, error: "Provider and API key required" };
+  }
+
+  try {
+    const discovery = await discoverBedrockNativeModels({
+      apiKey,
+      providerSpecificData,
+      fetcher: (url, init) => validationRead(url, init),
+    });
+    return {
+      valid: true,
+      error: null,
+      method: "bedrock_native_models",
+      warning: discovery.warnings[0] || null,
+    };
+  } catch (error: any) {
+    if (isBedrockNativeAuthError(error)) {
+      return { valid: false, error: "Invalid API key" };
+    }
+    if (isBedrockNativeApiError(error)) {
+      if (error.status === 429) {
+        return {
+          valid: true,
+          error: null,
+          warning: "Bedrock accepted the key but model discovery is rate limited",
+          method: "bedrock_native_models",
+        };
+      }
+      if (typeof error.status === "number" && error.status >= 500) {
+        return { valid: false, error: `Provider unavailable (${error.status})` };
+      }
+      if (typeof error.status === "number") {
+        return { valid: false, error: `Bedrock validation failed: ${error.status}` };
+      }
+    }
+    return toValidationErrorResult(error);
+  }
+}
+
+
+export async function validateOpenAILikeProvider({
+  provider = "openai",
+  apiKey,
+  baseUrl,
+  headers = {},
+  modelId = "gpt-3.5-turbo",
+  providerSpecificData,
+  modelsUrl = "",
+  isLocal = false,
+}: any) {
+  try {
+    // Guard against a non-string modelsUrl reaching .trim()/.startsWith() — a malformed
+    // providerSpecificData / registry value would otherwise throw a TypeError mid-validation
+    // ("trim is not a function" / "startsWith is not a function"). See #2463 class.
+    const customModelsUrl = (typeof modelsUrl === "string" ? modelsUrl.trim() : "") || "";
+    const endpointUrl = customModelsUrl
+      ? customModelsUrl.startsWith("http")
+        ? customModelsUrl
+        : `${baseUrl.replace(/\/+$/, "")}/${customModelsUrl.replace(/^\/+/, "")}`
+      : // addModelsSuffix strips a trailing /chat/completions before appending /models,
+        // so an OpenAI-style baseUrl validates against /v1/models, not /v1/chat/completions/models.
+        addModelsSuffix(baseUrl);
+
+    const requestUrl =
+      typeof providerSpecificData?.modelsUrl === "string" &&
+      providerSpecificData.modelsUrl.trim() !== ""
+        ? providerSpecificData.modelsUrl.trim()
+        : endpointUrl;
+
+    const response = await validationRead(
+      requestUrl,
+      {
+        headers: {
+          ...headers,
+          ...(apiKey ? { Authorization: `Bearer ${apiKey}` } : {}),
+        },
+      },
+      isLocal
+    );
+
+    if (response.ok) {
+      return { valid: true, error: null };
+    }
+
+    if (response.status === 401) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    // #2929: A 403 on the models endpoint is not always a bad key. Some providers
+    // (e.g. Fireworks Fire Pass `fpk_*` keys) return "...not authorized for this
+    // route." on /models while still serving chat. Fall through to the chat probe
+    // for such route-restriction 403s instead of declaring the key invalid.
+    if (response.status === 403) {
+      const forbiddenBody = await response.text().catch(() => "");
+      if (!/not authorized for this route/i.test(forbiddenBody)) {
+        return { valid: false, error: "Invalid API key" };
+      }
+    }
+
+    const chatUrl = resolveChatUrl(provider, baseUrl, providerSpecificData);
+    if (!chatUrl) {
+      return { valid: false, error: `Validation failed: ${response.status}` };
+    }
+
+    const testModelId = (providerSpecificData as any)?.validationModelId || modelId;
+
+    const testBody = {
+      model: testModelId,
+      messages: [{ role: "user", content: "test" }],
+      max_tokens: 1,
+    };
+
+    const chatRes = await validationWrite(
+      chatUrl,
+      {
+        method: "POST",
+        headers: {
+          ...headers,
+          ...(apiKey ? { Authorization: `Bearer ${apiKey}` } : {}),
+        },
+        body: JSON.stringify(testBody),
+      },
+      isLocal
+    );
+
+    if (chatRes.ok) {
+      return { valid: true, error: null };
+    }
+
+    if (chatRes.status === 401 || chatRes.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    if (chatRes.status === 404 || chatRes.status === 405) {
+      return { valid: false, error: "Provider validation endpoint not supported" };
+    }
+
+    if (chatRes.status >= 500) {
+      return { valid: false, error: `Provider unavailable (${chatRes.status})` };
+    }
+
+    return { valid: true, error: null };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
+
+
+export async function validateCommandCodeProvider({ apiKey, providerSpecificData = {} }: any) {
+  const entry = getRegistryEntry("command-code");
+  const baseUrl = normalizeBaseUrl(entry?.baseUrl || "https://api.commandcode.ai");
+  const chatPath = entry?.chatPath || "/alpha/generate";
+  const url = `${baseUrl}${chatPath.startsWith("/") ? chatPath : `/${chatPath}`}`;
+  const validationModelId =
+    providerSpecificData?.validationModelId ||
+    entry?.models?.find((model) => model.id === "deepseek/deepseek-v4-flash")?.id ||
+    "deepseek/deepseek-v4-flash";
+  const { COMMAND_CODE_VERSION } = await import("@omniroute/open-sse/executors/commandCode.ts");
+
+  return validateDirectChatProvider({
+    url,
+    providerSpecificData,
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${apiKey}`,
+      "x-command-code-version": COMMAND_CODE_VERSION,
+      "x-cli-environment": "external",
+      "x-project-slug": "pi-cc",
+      "x-taste-learning": "false",
+      "x-co-flag": "false",
+      "x-session-id": randomUUID(),
+    },
+    body: {
+      config: {
+        workingDir: "/workspace",
+        date: new Date().toISOString().slice(0, 10),
+        environment: "external",
+        structure: [],
+        isGitRepo: false,
+        currentBranch: "",
+        mainBranch: "",
+        gitStatus: "",
+        recentCommits: [],
+      },
+      memory: "",
+      taste: "",
+      skills: "",
+      permissionMode: "standard",
+      params: {
+        model: validationModelId,
+        messages: [{ role: "user", content: "test" }],
+        tools: [],
+        system: "",
+        max_tokens: 1,
+        stream: true,
+      },
+    },
+  });
+}
+
+
+export async function validateGeminiLikeProvider({
+  apiKey,
+  baseUrl,
+  providerSpecificData = {},
+  authType = "query",
+  isLocal = false,
+}: any) {
+  try {
+    if (!baseUrl) {
+      return { valid: false, error: "Missing base URL" };
+    }
+
+    const normalizedAuthType = String(authType || "query").toLowerCase();
+    // Strip a trailing /models before appending — the default Gemini registry baseUrl is
+    // `.../v1beta/models` (for the chat urlBuilder), so naively appending /models produced
+    // `.../v1beta/models/models` → upstream 404 on connection validation (#2545).
+    const baseForModels = String(baseUrl)
+      .replace(/\/models\/?$/, "")
+      .replace(/\/$/, "");
+    const requestUrl =
+      typeof providerSpecificData?.modelsUrl === "string" &&
+      providerSpecificData.modelsUrl.trim() !== ""
+        ? providerSpecificData.modelsUrl.trim()
+        : `${baseForModels}/models`;
+
+    // Use the correct auth header based on provider config:
+    // - gemini / gemini-cli (API key): x-goog-api-key
+    // - gemini-cli (OAuth): Bearer token
+    const headers: Record<string, string> = {};
+    let urlWithKey = requestUrl;
+
+    if (typeof apiKey === "string" && apiKey.startsWith("ya29.")) {
+      // A Google OAuth access token (ya29.*) must use Bearer auth even when the
+      // connection is configured as an API-key provider — gemini-cli OAuth stores the
+      // access token in the apiKey field. Checked first so authType "apikey"/"header"
+      // doesn't shadow it with x-goog-api-key.
+      headers["Authorization"] = `Bearer ${apiKey}`;
+    } else if (normalizedAuthType === "header" || normalizedAuthType === "apikey") {
+      headers["x-goog-api-key"] = apiKey;
+    } else if (normalizedAuthType === "oauth" || normalizedAuthType === "bearer") {
+      headers["Authorization"] = `Bearer ${apiKey}`;
+    } else if (normalizedAuthType === "query") {
+      urlWithKey = `${requestUrl}?key=${encodeURIComponent(apiKey)}`;
+    }
+
+    applyCustomUserAgent(headers, providerSpecificData);
+
+    const response = await validationRead(
+      urlWithKey,
+      {
+        headers,
+      },
+      isLocal
+    );
+
+    if (response.ok) {
+      return { valid: true, error: null };
+    }
+
+    if (response.status === 429) {
+      return { valid: true, error: null };
+    }
+
+    if (response.status === 400 || response.status === 401 || response.status === 403) {
+      const isAuthError = (body: any) => {
+        const message = (body?.error?.message || "").toLowerCase();
+        const reason = body?.error?.details?.[0]?.reason || "";
+        const status = body?.error?.status || "";
+        const authPatterns = [
+          "api key not valid",
+          "api key expired",
+          "api key invalid",
+          "API_KEY_INVALID",
+          "API_KEY_EXPIRED",
+          "PERMISSION_DENIED",
+          "UNAUTHENTICATED",
+        ];
+        return authPatterns.some(
+          (p) => message.includes(p.toLowerCase()) || reason === p || status === p
+        );
+      };
+
+      try {
+        const body = await response.json();
+        if (isAuthError(body)) {
+          return { valid: false, error: "Invalid API key" };
+        }
+        if (response.status === 401 || response.status === 403) {
+          return { valid: false, error: "Invalid API key" };
+        }
+      } catch {
+        if (response.status === 401 || response.status === 403) {
+          return { valid: false, error: "Invalid API key" };
+        }
+        return { valid: false, error: "Invalid API key" };
+      }
+    }
+
+    return { valid: false, error: `Validation failed: ${response.status}` };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
+
+// ── Specialty providers (non-standard APIs) ──
+
+
+export async function validateOpenAICompatibleProvider({ apiKey, providerSpecificData = {} }: any) {
+  const baseUrl = normalizeBaseUrl(providerSpecificData.baseUrl);
+  if (!baseUrl) {
+    return { valid: false, error: "No base URL configured for OpenAI compatible provider" };
+  }
+
+  const validationModelId =
+    typeof providerSpecificData?.validationModelId === "string"
+      ? providerSpecificData.validationModelId.trim()
+      : "";
+
+  // Step 1: Try GET /models
+  let modelsReachable = false;
+  try {
+    const modelsRes = await validationRead(`${baseUrl}/models`, {
+      method: "GET",
+      headers: buildBearerHeaders(apiKey, providerSpecificData),
+    });
+
+    modelsReachable = true;
+
+    if (modelsRes.ok) {
+      return { valid: true, error: null, method: "models_endpoint" };
+    }
+
+    if (modelsRes.status === 401 || modelsRes.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    // Endpoint responded and auth seems valid, but quota is exhausted/rate-limited.
+    if (modelsRes.status === 429) {
+      return {
+        valid: true,
+        error: null,
+        method: "models_endpoint",
+        warning: "Rate limited, but credentials are valid",
+      };
+    }
+  } catch {
+    // /models fetch failed (network error, etc.) — fall through to chat test
+  }
+
+  // T25: if /models cannot be used and no custom model was provided, return a
+  // clear actionable message instead of a generic connection error.
+  if (!validationModelId) {
+    return {
+      valid: false,
+      error: "Endpoint /models unavailable. Provide a Model ID to validate via /chat/completions.",
+    };
+  }
+
+  // Step 2: Fallback — try a minimal chat completion request
+  // Many providers don't expose /models but accept chat completions fine
+  const apiType = providerSpecificData.apiType || "chat";
+  const chatSuffix = apiType === "responses" ? "/responses" : "/chat/completions";
+  const chatUrl = `${baseUrl}${chatSuffix}`;
+  const testModelId = validationModelId;
+
+  try {
+    const chatRes = await validationWrite(chatUrl, {
+      method: "POST",
+      headers: buildBearerHeaders(apiKey, providerSpecificData),
+      body: JSON.stringify({
+        model: testModelId,
+        messages: [{ role: "user", content: "test" }],
+        max_tokens: 1,
+      }),
+    });
+
+    if (chatRes.ok) {
+      return { valid: true, error: null, method: "chat_completions" };
+    }
+
+    if (chatRes.status === 401 || chatRes.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    if (chatRes.status === 429) {
+      return {
+        valid: true,
+        error: null,
+        method: "chat_completions",
+        warning: "Rate limited, but credentials are valid",
+      };
+    }
+
+    // If /models was reachable but returned non-auth error, and chat succeeds
+    // auth-wise, this still confirms credentials are valid.
+    if (chatRes.status === 400) {
+      return {
+        valid: true,
+        error: null,
+        method: "inference_available",
+        warning: "Model ID may be invalid, but credentials are valid",
+      };
+    }
+
+    // 4xx other than auth (e.g. 400 bad model, 422) usually means auth passed
+    if (chatRes.status >= 400 && chatRes.status < 500) {
+      return {
+        valid: true,
+        error: null,
+        method: "inference_available",
+      };
+    }
+
+    if (chatRes.status >= 500) {
+      return { valid: false, error: `Provider unavailable (${chatRes.status})` };
+    }
+  } catch {
+    // Chat test also failed — fall through to simple connectivity check
+  }
+
+  // Step 3: Final fallback — simple connectivity check
+  // For local providers (Ollama, LM Studio, etc.) that may not respond to
+  // standard OpenAI endpoints but are still reachable
+  if (!modelsReachable) {
+    return { valid: false, error: "Connection failed while testing /chat/completions" };
+  }
+
+  try {
+    const pingRes = await validationRead(baseUrl, {
+      method: "GET",
+      headers: buildBearerHeaders(apiKey, providerSpecificData),
+    });
+
+    // If the server responds at all (even with an error page), it's reachable
+    if (pingRes.status < 500) {
+      return { valid: true, error: null };
+    }
+
+    return { valid: false, error: `Provider unavailable (${pingRes.status})` };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
+
diff --git a/src/lib/providers/validation/searchProviders.ts b/src/lib/providers/validation/searchProviders.ts
new file mode 100644
index 0000000000..cc1aca1809
--- /dev/null
+++ b/src/lib/providers/validation/searchProviders.ts
@@ -0,0 +1,206 @@
+// Web-search provider key validators + their per-provider request configs (serper, tavily, jina-reader,
+// …). Extracted from validation.ts (god-file decomposition) — top-level functions/data with no
+// dispatcher-state captures; behavior is byte-identical to the original inline defs.
+import { SAFE_OUTBOUND_FETCH_PRESETS, safeOutboundFetch } from "@/shared/network/safeOutboundFetch";
+import { getProviderOutboundGuard } from "@/shared/network/outboundUrlGuard";
+import { withCustomUserAgent } from "./headers";
+import { toValidationErrorResult, validationWrite } from "./transport";
+
+export async function validateGenericProvider(
+  baseUrl: string,
+  apiKey: string,
+  providerSpecificData: any = {},
+  provider: string,
+  isLocal: boolean = false
+) {
+  const config = SEARCH_VALIDATOR_CONFIGS[provider];
+  if (!config) {
+    return { valid: false, error: "Validator not found", unsupported: true };
+  }
+  const { url, init } = config(apiKey, providerSpecificData);
+  return validateSearchProvider(url, init, providerSpecificData, isLocal);
+}
+
+export async function validateSearchProvider(
+  url: string,
+  init: RequestInit,
+  providerSpecificData: any = {},
+  isLocal: boolean = false
+): Promise<{ valid: boolean; error: string | null; unsupported: false }> {
+  try {
+    const response = await safeOutboundFetch(url, {
+      ...SAFE_OUTBOUND_FETCH_PRESETS.validationWrite,
+      guard: isLocal ? "none" : getProviderOutboundGuard(),
+      ...withCustomUserAgent(init, providerSpecificData),
+    });
+    if (response.ok) return { valid: true, error: null, unsupported: false };
+    if (response.status === 401 || response.status === 403) {
+      return { valid: false, error: "Invalid API key", unsupported: false };
+    }
+    // For provider setup we only need to confirm authentication passed.
+    // Search providers may return non-auth statuses for exhausted credits,
+    // rate limiting, or request-shape quirks while still accepting the key.
+    if (response.status < 500) {
+      return { valid: true, error: null, unsupported: false };
+    }
+    return { valid: false, error: `Validation failed: ${response.status}`, unsupported: false };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
+
+export const SEARCH_VALIDATOR_CONFIGS: Record<
+  string,
+  (apiKey: string, providerSpecificData?: any) => { url: string; init: RequestInit }
+> = {
+  "serper-search": (apiKey) => ({
+    url: "https://google.serper.dev/search",
+    init: {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "X-API-Key": apiKey },
+      body: JSON.stringify({ q: "test", num: 1 }),
+    },
+  }),
+  "brave-search": (apiKey) => ({
+    url: "https://api.search.brave.com/res/v1/web/search?q=test&count=1",
+    init: {
+      method: "GET",
+      headers: { Accept: "application/json", "X-Subscription-Token": apiKey },
+    },
+  }),
+  "perplexity-search": (apiKey) => ({
+    url: "https://api.perplexity.ai/search",
+    init: {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
+      body: JSON.stringify({ query: "test", max_results: 1 }),
+    },
+  }),
+  "exa-search": (apiKey) => ({
+    url: "https://api.exa.ai/search",
+    init: {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "x-api-key": apiKey },
+      body: JSON.stringify({ query: "test", numResults: 1 }),
+    },
+  }),
+  "tavily-search": (apiKey) => ({
+    url: "https://api.tavily.com/search",
+    init: {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
+      body: JSON.stringify({ query: "test", max_results: 1 }),
+    },
+  }),
+  "google-pse-search": (apiKey, providerSpecificData = {}) => {
+    const cx = providerSpecificData?.cx;
+    if (!cx || typeof cx !== "string") {
+      throw new Error("Programmable Search Engine ID (cx) is required");
+    }
+    return {
+      url: `https://www.googleapis.com/customsearch/v1?key=${encodeURIComponent(apiKey)}&cx=${encodeURIComponent(
+        cx
+      )}&q=test&num=1`,
+      init: {
+        method: "GET",
+        headers: { Accept: "application/json" },
+      },
+    };
+  },
+  "linkup-search": (apiKey) => ({
+    url: "https://api.linkup.so/v1/search",
+    init: {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
+      body: JSON.stringify({
+        q: "test",
+        depth: "standard",
+        outputType: "searchResults",
+        maxResults: 1,
+      }),
+    },
+  }),
+  "searchapi-search": (apiKey) => ({
+    url: `https://www.searchapi.io/api/v1/search?engine=google&q=test&api_key=${encodeURIComponent(
+      apiKey
+    )}`,
+    init: {
+      method: "GET",
+      headers: { Accept: "application/json" },
+    },
+  }),
+  "youcom-search": (apiKey) => ({
+    url: "https://ydc-index.io/v1/search?query=test&count=1",
+    init: {
+      method: "GET",
+      headers: { Accept: "application/json", "X-API-Key": apiKey },
+    },
+  }),
+  "searxng-search": (apiKey, providerSpecificData = {}) => {
+    const baseUrl =
+      typeof providerSpecificData?.baseUrl === "string" && providerSpecificData.baseUrl.trim()
+        ? providerSpecificData.baseUrl.trim().replace(/\/+$/, "")
+        : "http://localhost:8888/search";
+    const searchUrl = baseUrl.endsWith("/search") ? baseUrl : `${baseUrl}/search`;
+    const headers: Record<string, string> = { Accept: "application/json" };
+    if (apiKey) {
+      headers["Authorization"] = `Bearer ${apiKey}`;
+    }
+    return {
+      url: `${searchUrl}?q=test&format=json`,
+      init: {
+        method: "GET",
+        headers,
+      },
+    };
+  },
+  "ollama-search": (apiKey) => ({
+    url: "https://ollama.com/api/web_search",
+    init: {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
+      body: JSON.stringify({ query: "test", max_results: 1 }),
+    },
+  }),
+  "zai-search": (apiKey, providerSpecificData = {}) => {
+    const baseUrl =
+      typeof providerSpecificData?.baseUrl === "string" && providerSpecificData.baseUrl.trim()
+        ? providerSpecificData.baseUrl.trim().replace(/\/+$/, "")
+        : "https://api.z.ai/api/mcp/web_search_prime/mcp";
+    return {
+      url: baseUrl,
+      init: {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
+        body: JSON.stringify({
+          jsonrpc: "2.0",
+          method: "tools/call",
+          params: { name: "web_search_prime", arguments: { search_query: "test" } },
+          id: 1,
+        }),
+      },
+    };
+  },
+  // ── Web-fetch providers (#4401) ──
+  // firecrawl / jina-reader were added as webFetch-kind providers in #2645 with their
+  // own executors but no validator, so the dashboard "Validate" step returned
+  // "Provider validation not supported" and accounts could not be added through the UI.
+  // Probe each provider's real fetch endpoint with the same Bearer auth the executor
+  // uses; validateSearchProvider maps 200/<500 → valid, 401/403 → invalid key,
+  // >=500 → failure (a credit-exhausted / rate-limited key still validates).
+  firecrawl: (apiKey) => ({
+    url: "https://api.firecrawl.dev/v1/scrape",
+    init: {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
+      body: JSON.stringify({ url: "https://example.com", formats: ["markdown"] }),
+    },
+  }),
+  "jina-reader": (apiKey) => ({
+    url: "https://r.jina.ai/https://example.com",
+    init: {
+      method: "GET",
+      headers: { Authorization: `Bearer ${apiKey}` },
+    },
+  }),
+};
diff --git a/src/lib/providers/validation/transport.ts b/src/lib/providers/validation/transport.ts
new file mode 100644
index 0000000000..4909f589fb
--- /dev/null
+++ b/src/lib/providers/validation/transport.ts
@@ -0,0 +1,109 @@
+// Outbound fetch wrappers for provider validation: proxy-fallback, SSRF-aware proxy targeting, and
+// error→result mapping. Extracted from validation.ts (god-file decomposition). Behavior is
+// byte-identical to the original inline defs.
+import {
+  SAFE_OUTBOUND_FETCH_PRESETS,
+  SafeOutboundFetchError,
+  getSafeOutboundFetchErrorStatus,
+  safeOutboundFetch,
+} from "@/shared/network/safeOutboundFetch";
+import { getProviderOutboundGuard, isPrivateHost } from "@/shared/network/outboundUrlGuard";
+import { selectProxyForValidation } from "@omniroute/open-sse/services/proxyAutoSelector.ts";
+
+/**
+ * Wrapped fetch call that auto-retries with a proxy when the direct connection
+ * fails.  This happens transparently so individual validators don't need to
+ * think about proxy fallback.
+ */
+export async function fetchWithProxyFallback(
+  url: string,
+  init: RequestInit,
+  presets: typeof SAFE_OUTBOUND_FETCH_PRESETS.validationRead,
+  isLocal: boolean
+): Promise<Response> {
+  try {
+    return await safeOutboundFetch(url, {
+      ...presets,
+      guard: isLocal ? "none" : getProviderOutboundGuard(),
+      ...init,
+    });
+  } catch (err: unknown) {
+    // Only attempt proxy fallback for retryable errors (network / timeout)
+    // and only when the target is not a local / LAN address.
+    const fetchErr = err as SafeOutboundFetchError;
+    const isNetworkIssue = fetchErr?.code === "NETWORK_ERROR" || fetchErr?.code === "TIMEOUT";
+    const isRetryable = fetchErr?.isRetryable !== false;
+    const isValidTarget = !isLocal && isRetryableProxyTarget(url);
+
+    if (isLocal || !isNetworkIssue || !isRetryable) throw err;
+    if (!isValidTarget) throw err;
+
+    const proxyUrl = await selectProxyForValidation(url);
+    if (!proxyUrl) throw err;
+
+    return safeOutboundFetch(url, {
+      ...presets,
+      guard: isLocal ? "none" : getProviderOutboundGuard(),
+      ...init,
+      proxyConfig: proxyUrl,
+    });
+  }
+}
+
+export function isRetryableProxyTarget(url: string): boolean {
+  try {
+    const hostname = new URL(url).hostname.toLowerCase();
+    // Never proxy-fallback to a private/link-local/metadata host. Delegates to
+    // the canonical SSRF guard (covers 169.254, 0.0.0.0, 172.16/12, CGNAT,
+    // IPv6 fc/fd/fe80, .internal — gaps the previous inline check missed).
+    return !isPrivateHost(hostname);
+  } catch {
+    return false;
+  }
+}
+
+export async function validationRead(url: string, init: RequestInit, isLocal: boolean = false) {
+  return fetchWithProxyFallback(url, init, SAFE_OUTBOUND_FETCH_PRESETS.validationRead, isLocal);
+}
+
+export async function validationWrite(url: string, init: RequestInit, isLocal: boolean = false) {
+  return fetchWithProxyFallback(url, init, SAFE_OUTBOUND_FETCH_PRESETS.validationWrite, isLocal);
+}
+
+// A validation failure should only be flagged `securityBlocked` (which the route
+// surfaces as a `provider.validation.ssrf_blocked` audit event + a security warning in
+// the UI) when it is a GENUINE SSRF/guard block — not for every outbound-guard 503.
+// A blocked redirect (REDIRECT_BLOCKED) to a PUBLIC host is benign: the redirect was
+// never followed, so no SSRF occurred. Web-cookie providers like qwen-web answer their
+// probe with a 307 to a public host, which used to be mislabeled as an SSRF block
+// (#3288 / #3758). Only treat a blocked redirect as a security event when its target is
+// a private/internal host.
+export function isSecurityBlockError(error: unknown): boolean {
+  if (!(error instanceof SafeOutboundFetchError)) return false;
+  if (error.code === "URL_GUARD_BLOCKED" || error.code === "INVALID_URL") return true;
+  if (error.code === "REDIRECT_BLOCKED") {
+    if (!error.location) return false;
+    try {
+      return isPrivateHost(new URL(error.location, error.url).hostname);
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
+
+export function toValidationErrorResult(error: unknown) {
+  const message = error instanceof Error ? error.message : String(error || "Validation failed");
+  const statusCode = getSafeOutboundFetchErrorStatus(error);
+
+  return {
+    valid: false,
+    error: message || "Validation failed",
+    unsupported: false as const,
+    ...(statusCode ? { statusCode } : {}),
+    ...(error instanceof SafeOutboundFetchError && error.code === "TIMEOUT"
+      ? { timeout: true }
+      : {}),
+    ...(isSecurityBlockError(error) ? { securityBlocked: true } : {}),
+  };
+}
diff --git a/src/lib/providers/validation/urlHelpers.ts b/src/lib/providers/validation/urlHelpers.ts
new file mode 100644
index 0000000000..2858618c6c
--- /dev/null
+++ b/src/lib/providers/validation/urlHelpers.ts
@@ -0,0 +1,114 @@
+// URL/format normalizers for provider key validation. Pure string helpers extracted from
+// validation.ts (god-file decomposition): no I/O, no side effects — they only shape base URLs
+// and chat endpoints per provider format. Behavior is byte-identical to the original inline defs.
+import {
+  stripAnthropicMessagesSuffix,
+  stripClaudeCodeCompatibleEndpointSuffix,
+} from "@omniroute/open-sse/services/claudeCodeCompatible.ts";
+import { isOpenAICompatibleProvider } from "@/shared/constants/providers";
+
+export const OPENAI_LIKE_FORMATS = new Set(["openai", "openai-responses"]);
+export const GEMINI_LIKE_FORMATS = new Set(["gemini", "gemini-cli"]);
+
+export function normalizeBaseUrl(baseUrl: string) {
+  // Guard against a non-string baseUrl reaching .trim() / .replace() — see #2463
+  // where NVIDIA NIM validation surfaced as `e.startsWith is not a function`
+  // after the bundler renamed `baseUrl` to `e`. Any malformed providerSpecificData
+  // (e.g. saved as object from a UI bug) would otherwise crash mid-validation.
+  const value = typeof baseUrl === "string" ? baseUrl : "";
+  return value.trim().replace(/\/$/, "");
+}
+
+export function normalizeAzureOpenAIBaseUrl(baseUrl: string) {
+  return normalizeBaseUrl(baseUrl)
+    .replace(/\/openai$/i, "")
+    .replace(/\/openai\/deployments\/[^/]+\/chat\/completions.*$/i, "");
+}
+
+export function normalizeAnthropicBaseUrl(baseUrl: string) {
+  return stripAnthropicMessagesSuffix(baseUrl || "");
+}
+
+export function normalizeClaudeCodeCompatibleBaseUrl(baseUrl: string) {
+  return stripClaudeCodeCompatibleEndpointSuffix(baseUrl || "");
+}
+
+export function addModelsSuffix(baseUrl: string) {
+  const normalized = normalizeBaseUrl(baseUrl);
+  if (!normalized) return "";
+
+  const suffixes = ["/chat/completions", "/responses", "/chat", "/messages"];
+  if (normalized.endsWith("/models")) {
+    return normalized;
+  }
+  for (const suffix of suffixes) {
+    if (normalized.endsWith(suffix)) {
+      return `${normalized.slice(0, -suffix.length)}/models`;
+    }
+  }
+
+  return `${normalized}/models`;
+}
+
+export function resolveBaseUrl(entry: any, providerSpecificData: any = {}) {
+  if (providerSpecificData?.baseUrl) return normalizeBaseUrl(providerSpecificData.baseUrl);
+  if (entry?.baseUrl) return normalizeBaseUrl(entry.baseUrl);
+  return "";
+}
+
+export function resolveChatUrl(provider: string, baseUrl: string, providerSpecificData: any = {}) {
+  const normalized = normalizeBaseUrl(baseUrl);
+  if (!normalized) return "";
+
+  if (isOpenAICompatibleProvider(provider)) {
+    if (providerSpecificData?.chatPath) {
+      return `${normalized}${providerSpecificData.chatPath}`;
+    }
+    if (providerSpecificData?.apiType === "responses") {
+      return `${normalized}/responses`;
+    }
+    return `${normalized}/chat/completions`;
+  }
+
+  if (
+    normalized.endsWith("/chat/completions") ||
+    normalized.endsWith("/responses") ||
+    normalized.endsWith("/chat")
+  ) {
+    return normalized;
+  }
+
+  if (normalized.endsWith("/v1")) {
+    return `${normalized}/chat/completions`;
+  }
+
+  return normalized;
+}
+
+export function normalizeHerokuChatUrl(baseUrl: string) {
+  const normalized = normalizeBaseUrl(baseUrl);
+  if (!normalized) return "";
+  return normalized.endsWith("/v1/chat/completions")
+    ? normalized
+    : `${normalized}/v1/chat/completions`;
+}
+
+export function normalizeDatabricksChatUrl(baseUrl: string) {
+  const normalized = normalizeBaseUrl(baseUrl);
+  if (!normalized) return "";
+  return normalized.endsWith("/chat/completions") ? normalized : `${normalized}/chat/completions`;
+}
+
+export function normalizeSnowflakeChatUrl(baseUrl: string) {
+  const normalized = normalizeBaseUrl(baseUrl)
+    .replace(/\/cortex\/inference:complete$/, "")
+    .replace(/\/api\/v2$/, "");
+  if (!normalized) return "";
+  return `${normalized}/api/v2/cortex/inference:complete`;
+}
+
+export function normalizeGigachatChatUrl(baseUrl: string) {
+  const normalized = normalizeBaseUrl(baseUrl).replace(/\/chat\/completions$/, "");
+  if (!normalized) return "";
+  return `${normalized}/chat/completions`;
+}
diff --git a/src/lib/providers/validation/webProvidersA.ts b/src/lib/providers/validation/webProvidersA.ts
new file mode 100644
index 0000000000..c8439b8c96
--- /dev/null
+++ b/src/lib/providers/validation/webProvidersA.ts
@@ -0,0 +1,681 @@
+// Web-cookie provider key validators (part A): deepseek-web, qwen-web, grok-web, chatgpt-web,
+// perplexity-web, blackbox-web. Extracted from validation.ts (god-file decomposition) — top-level
+// functions with no dispatcher-state captures; behavior is byte-identical to the original inline defs.
+import { addModelsSuffix } from "./urlHelpers";
+import { applyCustomUserAgent } from "./headers";
+import { toValidationErrorResult, validationRead, validationWrite } from "./transport";
+import {
+  buildGrokCookieHeader,
+  buildQwenCookieHeader,
+  extractCookieValue,
+  extractQwenToken,
+  normalizeSessionCookieHeader,
+} from "@/lib/providers/webCookieAuth";
+
+export async function validateDeepSeekWebProvider({ apiKey }: any) {
+  if (!apiKey) {
+    return {
+      valid: false,
+      error:
+        "Missing userToken — paste the value from DevTools → Application → Local Storage → chat.deepseek.com → userToken",
+    };
+  }
+  let token = apiKey;
+  try {
+    const parsed = JSON.parse(token);
+    if (typeof parsed?.value === "string") token = parsed.value;
+  } catch {
+    // not JSON, use as-is
+  }
+
+  try {
+    const resp = await fetch("https://chat.deepseek.com/api/v0/users/current", {
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: "*/*",
+        Origin: "https://chat.deepseek.com",
+        Referer: "https://chat.deepseek.com/",
+        "User-Agent":
+          "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36",
+        "X-App-Version": "20241129.1",
+        "X-Client-Platform": "web",
+      },
+    });
+    if (resp.status === 401 || resp.status === 403) {
+      return {
+        valid: false,
+        error: "userToken is invalid or expired — get a fresh one from localStorage",
+      };
+    }
+    if (!resp.ok) {
+      return { valid: false, error: `DeepSeek returned HTTP ${resp.status}` };
+    }
+    const json = await resp.json();
+    const bizData = json?.data?.biz_data || json?.biz_data;
+    if (!bizData?.token) {
+      return {
+        valid: false,
+        error: `DeepSeek did not return an access token: ${json?.msg || "unknown error"}`,
+      };
+    }
+    return { valid: true, error: null };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
+
+// qwen-web has no `modelsUrl` in its registry entry, so the generic OpenAI-compatible
+// validator derived a probe URL of `https://chat.qwen.ai/api/v2/models` (via
+// addModelsSuffix) — a non-existent path that answers with a 307 redirect, which the
+// outbound guard blocked and the route then mislabeled as an SSRF block (#3288/#3758).
+// This specialty validator probes the real session-validity endpoint instead
+// (`GET /api/v2/user`, the same one Chat2API uses), mirroring the executor's anti-bot
+// headers + cookie-jar replay. It uses plain fetch (like the other web-cookie
+// validators) so it never hits the addModelsSuffix/redirect path.
+export async function validateQwenWebProvider({ apiKey }: any) {
+  const rawCred = String(apiKey ?? "").trim();
+  if (!rawCred) {
+    return {
+      valid: false,
+      error:
+        "Missing Qwen session — paste the full chat.qwen.ai Cookie header (must include token, cna and ssxmod_itna)",
+    };
+  }
+
+  const token = extractQwenToken(rawCred);
+  const cookieHeader = buildQwenCookieHeader(rawCred);
+  if (!token && !cookieHeader) {
+    return {
+      valid: false,
+      error: "Could not find a Qwen token/cookie in the pasted value",
+    };
+  }
+
+  try {
+    const headers: Record<string, string> = {
+      Accept: "*/*",
+      "User-Agent":
+        "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
+      Origin: "https://chat.qwen.ai",
+      Referer: "https://chat.qwen.ai/",
+      source: "web",
+      "bx-v": "2.5.36",
+    };
+    if (token) headers["Authorization"] = `Bearer ${token}`;
+    if (cookieHeader) headers["Cookie"] = cookieHeader;
+
+    const resp = await fetch("https://chat.qwen.ai/api/v2/user", { headers });
+    const contentType = resp.headers.get("content-type") || "";
+
+    if (resp.status === 401 || resp.status === 403) {
+      return {
+        valid: false,
+        error:
+          "Qwen session is invalid or expired — re-login at https://chat.qwen.ai and paste a fresh full Cookie header",
+      };
+    }
+    // Alibaba's WAF / retired-v1 gateway answers with an HTML challenge page (or 504)
+    // instead of JSON. A bearer token alone is no longer enough for the v2 endpoint.
+    if (contentType.includes("text/html") || resp.status === 504) {
+      return {
+        valid: false,
+        error:
+          "Qwen blocked the request with its anti-bot WAF. Re-login at https://chat.qwen.ai and paste a fresh full Cookie header (must include cna, ssxmod_itna and token) — a bearer token alone is not accepted.",
+      };
+    }
+    if (!resp.ok) {
+      return { valid: false, error: `Qwen returned HTTP ${resp.status}` };
+    }
+
+    // Parse JSON response and verify we have a real user object
+    // Qwen returns HTTP 200 even for invalid tokens, so we must check the body
+    try {
+      const data = await resp.json();
+      const user = data?.user || data?.data?.user;
+
+      if (!user) {
+        return {
+          valid: false,
+          error:
+            "Qwen session token is invalid or expired — re-login at https://chat.qwen.ai and paste a fresh full Cookie header",
+        };
+      }
+    } catch (parseError) {
+      return {
+        valid: false,
+        error: "Qwen returned invalid JSON response",
+      };
+    }
+
+    return { valid: true, error: null };
+  } catch (error) {
+    return toValidationErrorResult(error);
+  }
+}
+
+/**
+ * Heuristic for a Grok 403 that is an anti-bot / IP-reputation block rather than
+ * a genuine upstream API error (issue #3474).
+ *
+ * Returns true when the body reads like an anti-bot rejection — Grok's literal
+ * "Request rejected by anti-bot rules." text, or a bare/non-structured forbidden
+ * body that carries no parseable upstream `error.message`. Returns false for a
+ * structured upstream API error (e.g. `{"error":{"message":"Model is not found"}}`),
+ * which must keep surfacing its body to the user/maintainer.
+ *
+ * Callers should run `isCloudflareChallenge()` first; this covers the non-HTML
+ * anti-bot cases that Cloudflare-challenge detection does not.
+ */
+export function isGrokAntiBotBlock(body: string | null | undefined): boolean {
+  const text = (body || "").trim();
+  if (!text) return true; // empty 403 body — pre-auth block, treat as anti-bot
+  if (/anti-bot|forbidden|access denied|blocked|rate.?limit/i.test(text)) return true;
+  // A structured upstream API error has a parseable JSON `error.message`; if one
+  // is present this is a real upstream error, not an anti-bot block.
+  try {
+    const parsed = JSON.parse(text);
+    if (parsed && typeof parsed?.error?.message === "string") return false;
+  } catch {
+    // Non-JSON 403 body with no recognizable structure → treat as anti-bot block.
+    return true;
+  }
+  return false;
+}
+
+export async function validateGrokWebProvider({ apiKey, providerSpecificData = {} }: any) {
+  try {
+    const token = extractCookieValue(apiKey, "sso");
+    if (!token) {
+      return {
+        valid: false,
+        error: "Missing sso cookie — paste the value (or the full grok.com cookie line)",
+      };
+    }
+
+    // Use the TLS-impersonating client — Cloudflare on grok.com pins
+    // cf_clearance to JA3/JA4 + HTTP/2 SETTINGS, so plain Node fetch always
+    // gets "Request rejected by anti-bot rules." regardless of cookies (#3180).
+    const { tlsFetchGrok, TlsClientUnavailableError, isCloudflareChallenge } =
+      await import("@omniroute/open-sse/services/grokTlsClient.ts");
+
+    // Generate the same Cloudflare-bypass headers the GrokWebExecutor uses.
+    const randomHex = (n: number) => {
+      const a = new Uint8Array(n);
+      crypto.getRandomValues(a);
+      return Array.from(a, (b) => b.toString(16).padStart(2, "0")).join("");
+    };
+    const statsigMsg = `e:TypeError: Cannot read properties of null (reading 'children')`;
+    const traceId = randomHex(16);
+    const spanId = randomHex(8);
+
+    let response;
+    try {
+      response = await tlsFetchGrok("https://grok.com/rest/app-chat/conversations/new", {
+        method: "POST",
+        headers: applyCustomUserAgent(
+          {
+            Accept: "*/*",
+            "Accept-Encoding": "gzip, deflate, br, zstd",
+            "Accept-Language": "en-US,en;q=0.9",
+            Baggage:
+              "sentry-environment=production,sentry-release=d6add6fb0460641fd482d767a335ef72b9b6abb8,sentry-public_key=b311e0f2690c81f25e2c4cf6d4f7ce1c",
+            "Cache-Control": "no-cache",
+            "Content-Type": "application/json",
+            Cookie: buildGrokCookieHeader(apiKey),
+            Origin: "https://grok.com",
+            Pragma: "no-cache",
+            Referer: "https://grok.com/",
+            "Sec-Ch-Ua": '"Google Chrome";v="147", "Chromium";v="147", "Not(A:Brand";v="24"',
+            "Sec-Ch-Ua-Mobile": "?0",
+            "Sec-Ch-Ua-Platform": '"macOS"',
+            "Sec-Fetch-Dest": "empty",
+            "Sec-Fetch-Mode": "cors",
+            "Sec-Fetch-Site": "same-origin",
+            "User-Agent":
+              "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36",
+            "x-statsig-id": btoa(statsigMsg),
+            "x-xai-request-id": crypto.randomUUID(),
+            traceparent: `00-${traceId}-${spanId}-00`,
+          },
+          providerSpecificData
+        ),
+        body: JSON.stringify({
+          temporary: true,
+          modeId: "fast",
+          message: "test",
+          fileAttachments: [],
+          imageAttachments: [],
+          disableSearch: true,
+          enableImageGeneration: false,
+          returnImageBytes: false,
+          returnRawGrokInXaiRequest: false,
+          enableImageStreaming: false,
+          imageGenerationCount: 0,
+          forceConcise: true,
+          toolOverrides: {},
+          enableSideBySide: false,
+          sendFinalMetadata: false,
+          isReasoning: false,
+          disableTextFollowUps: true,
+          disableMemory: true,
+          forceSideBySide: false,
+          isAsyncChat: false,
+          disableSelfHarmShortCircuit: false,
+        }),
+        timeoutMs: 15_000,
+      });
+    } catch (err: any) {
+      if (err instanceof TlsClientUnavailableError) {
+        return {
+          valid: false,
+          error: `TLS impersonation client unavailable: ${err.message}`,
+        };
+      }
+      throw err;
+    }
+
+    let errorDetail = "";
+    try {
+      errorDetail = (response.text || "").slice(0, 240);
+    } catch {}
+
+    // Detect Cloudflare challenge pages even with a 200 status from tls-client-node
+    if (isCloudflareChallenge(errorDetail)) {
+      return {
+        valid: false,
+        error: "Grok validation blocked by Cloudflare anti-bot. Try a residential IP or proxy.",
+      };
+    }
+
+    if (response.status >= 200 && response.status < 300) {
+      return { valid: true, error: null };
+    }
+
+    if (response.status === 401) {
+      return {
+        valid: false,
+        error: "Invalid SSO cookie — re-paste from grok.com DevTools → Cookies → sso",
+      };
+    }
+
+    if (response.status === 403) {
+      // Grok uses 403 for auth failures, entitlement issues, geo blocks,
+      // anti-bot/IP-reputation rejections, and resource errors. Classify before
+      // messaging — a misleading "invalid cookie" verdict on an IP-reputation
+      // block (issue #3474) sends users chasing a cookie that is actually fine.
+      //
+      // 1. Auth-shaped → the cookie/session is the problem; re-paste it.
+      if (/invalid-credentials|unauthenticated|unauthorized/i.test(errorDetail)) {
+        return {
+          valid: false,
+          error: "Invalid SSO cookie — re-paste from grok.com DevTools → Cookies → sso",
+        };
+      }
+      // 2. Anti-bot / Cloudflare / IP-reputation block → the cookie is likely
+      //    fine; the request was rejected before auth was even evaluated. This is
+      //    not code-fixable: the datacenter/VPS IP is flagged. A Cloudflare
+      //    challenge body, Grok's "anti-bot rules" rejection, or a bare/non-JSON
+      //    forbidden body (no structured upstream `error.message`) all map here.
+      if (isCloudflareChallenge(errorDetail) || isGrokAntiBotBlock(errorDetail)) {
+        return {
+          valid: false,
+          error:
+            "Grok returned 403 (anti-bot/Cloudflare block). Your sso cookie is likely fine — " +
+            "this is an IP-reputation block on the request, not an auth failure. Retry from a " +
+            "residential IP or configure a proxy for grok-web.",
+        };
+      }
+      // 3. Structured upstream error (e.g. probe model renamed) → surface the body
+      //    so the user/maintainer sees the real cause instead of a wrong verdict.
+      return {
+        valid: false,
+        error: `Grok rejected validation (403)${errorDetail ? `: ${errorDetail.slice(0, 160)}` : ""}`,
+      };
+    }
+
+    if (response.status === 429) {
+      return { valid: false, error: "Grok rate limited during validation (429)" };
+    }
+
+    if (response.status >= 500) {
+      return { valid: false, error: `Grok unavailable (${response.status})` };
+    }
+
+    return {
+      valid: false,
+      error: `Grok validation failed (${response.status})${errorDetail ? `: ${errorDetail}` : ""}`,
+    };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
+
+export async function validateChatGptWebProvider({ apiKey, providerSpecificData = {} }: any) {
+  try {
+    // Accept bare value, unchunked cookie, chunked (.0/.1) cookies, or full
+    // "Cookie: ..." DevTools line. Pass through verbatim once recognised.
+    let cookieHeader = String(apiKey || "").trim();
+    if (/^cookie\s*:\s*/i.test(cookieHeader)) {
+      cookieHeader = cookieHeader.replace(/^cookie\s*:\s*/i, "");
+    }
+    if (!/__Secure-next-auth\.session-token(?:\.\d+)?\s*=/.test(cookieHeader)) {
+      cookieHeader = `__Secure-next-auth.session-token=${cookieHeader}`;
+    }
+
+    // Use the TLS-impersonating client — Cloudflare on chatgpt.com pins
+    // cf_clearance to JA3/JA4 + HTTP/2 SETTINGS, so plain Node fetch always
+    // gets cf-mitigated: challenge regardless of cookies.
+    const { tlsFetchChatGpt, TlsClientUnavailableError } =
+      await import("@omniroute/open-sse/services/chatgptTlsClient.ts");
+
+    let response;
+    try {
+      response = await tlsFetchChatGpt("https://chatgpt.com/api/auth/session", {
+        method: "GET",
+        headers: applyCustomUserAgent(
+          {
+            Accept: "application/json",
+            "Accept-Language": "en-US,en;q=0.9",
+            "Cache-Control": "no-cache",
+            Cookie: cookieHeader,
+            Origin: "https://chatgpt.com",
+            Pragma: "no-cache",
+            Referer: "https://chatgpt.com/",
+            "Sec-Fetch-Dest": "empty",
+            "Sec-Fetch-Mode": "cors",
+            "Sec-Fetch-Site": "same-origin",
+            "User-Agent":
+              "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:148.0) Gecko/20100101 Firefox/148.0",
+          },
+          providerSpecificData
+        ),
+        timeoutMs: 30_000,
+      });
+    } catch (err: any) {
+      if (err instanceof TlsClientUnavailableError) {
+        return {
+          valid: false,
+          error: `${err.message} (chatgpt-web requires this — without it, Cloudflare blocks every request)`,
+        };
+      }
+      throw err;
+    }
+
+    const contentType = response.headers.get("content-type") || "";
+    const cfRay = response.headers.get("cf-ray");
+    const cfMitigated = response.headers.get("cf-mitigated");
+
+    if (response.status === 401 || response.status === 403) {
+      const bodyText = response.text || "";
+      if (cfMitigated || /just a moment|cloudflare|cf-chl|attention required/i.test(bodyText)) {
+        return {
+          valid: false,
+          error:
+            "Cloudflare blocked the validator — open chatgpt.com in your browser, then copy the FULL Cookie line from DevTools (Network → request → Cookie) including cf_clearance, __cf_bm, _cfuvid, and the session-token chunks.",
+        };
+      }
+      return {
+        valid: false,
+        error:
+          "Invalid ChatGPT session cookie — re-paste __Secure-next-auth.session-token from chatgpt.com DevTools → Cookies",
+      };
+    }
+
+    if (response.status >= 500) {
+      return { valid: false, error: `ChatGPT unavailable (${response.status})` };
+    }
+
+    if (response.status >= 400) {
+      return { valid: false, error: `Validation failed: ${response.status}` };
+    }
+
+    if (!contentType.includes("json")) {
+      return {
+        valid: false,
+        error: `ChatGPT returned non-JSON (${contentType || "no content-type"}${cfRay ? `, cf-ray=${cfRay}` : ""}) — paste the FULL Cookie line including cf_clearance, __cf_bm, _cfuvid alongside the session-token chunks.`,
+      };
+    }
+
+    let data: any = {};
+    try {
+      data = JSON.parse(response.text || "{}");
+    } catch {
+      return {
+        valid: false,
+        error:
+          "ChatGPT session response was not JSON — paste the FULL Cookie line including cf_clearance and __cf_bm.",
+      };
+    }
+    if (!data?.accessToken) {
+      return {
+        valid: false,
+        error: "ChatGPT session expired — log into chatgpt.com and copy a fresh cookie",
+      };
+    }
+    return { valid: true, error: null };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
+
+export async function validatePerplexityWebProvider({ apiKey, providerSpecificData = {} }: any) {
+  try {
+    let sessionToken = apiKey;
+    let bearerToken: string | null = null;
+
+    if (sessionToken.startsWith("__Secure-next-auth.session-token=")) {
+      sessionToken = sessionToken.slice("__Secure-next-auth.session-token=".length);
+    } else if (/^bearer\s+/i.test(sessionToken)) {
+      bearerToken = sessionToken.replace(/^bearer\s+/i, "").trim();
+      sessionToken = "";
+    }
+
+    const timezone =
+      typeof Intl !== "undefined" ? Intl.DateTimeFormat().resolvedOptions().timeZone : "UTC";
+    const headers = applyCustomUserAgent(
+      {
+        "Content-Type": "application/json",
+        Accept: "text/event-stream",
+        Origin: "https://www.perplexity.ai",
+        Referer: "https://www.perplexity.ai/",
+        // Firefox 148 — must match the firefox_148 TLS profile of perplexityTlsClient (issue #2459).
+        "User-Agent":
+          "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:148.0) Gecko/20100101 Firefox/148.0",
+        "X-App-ApiClient": "default",
+        "X-App-ApiVersion": "client-1.11.0",
+        ...(bearerToken
+          ? { Authorization: `Bearer ${bearerToken}` }
+          : sessionToken
+            ? { Cookie: `__Secure-next-auth.session-token=${sessionToken}` }
+            : {}),
+      },
+      providerSpecificData
+    );
+
+    // Perplexity is behind Cloudflare Enterprise which pins JA3/JA4 to a real
+    // browser handshake — plain fetch is challenged with a 403 page from
+    // VPS/datacenter IPs even with a valid cookie. Use the Firefox-fingerprinted
+    // TLS client so the validator's verdict reflects the cookie, not the IP (issue #2459).
+    const { tlsFetchPerplexity, isCloudflareChallenge, TlsClientUnavailableError } =
+      await import("@omniroute/open-sse/services/perplexityTlsClient.ts");
+
+    let response: { status: number; text: string | null };
+    try {
+      response = await tlsFetchPerplexity("https://www.perplexity.ai/rest/sse/perplexity_ask", {
+        method: "POST",
+        headers,
+        body: JSON.stringify({
+          query_str: "test",
+          params: {
+            query_str: "test",
+            search_focus: "internet",
+            mode: "concise",
+            model_preference: "default",
+            sources: ["web"],
+            attachments: [],
+            frontend_uuid: crypto.randomUUID(),
+            frontend_context_uuid: crypto.randomUUID(),
+            version: "client-1.11.0",
+            language: "en-US",
+            timezone,
+            search_recency_filter: null,
+            is_incognito: true,
+            use_schematized_api: true,
+            last_backend_uuid: null,
+          },
+        }),
+        timeoutMs: 30_000,
+      });
+    } catch (err) {
+      if (err instanceof TlsClientUnavailableError) {
+        return {
+          valid: false,
+          error: `${err.message} perplexity-web requires it — without it Cloudflare blocks every request.`,
+        };
+      }
+      throw err;
+    }
+
+    if (response.status === 401 || response.status === 403) {
+      if (isCloudflareChallenge(response.text)) {
+        return {
+          valid: false,
+          error:
+            "Cloudflare is blocking connections from this server's IP (TLS fingerprint rejected). " +
+            "The session cookie may still be valid — install tls-client-node's native binary or route " +
+            "perplexity-web through a residential proxy.",
+        };
+      }
+      return {
+        valid: false,
+        error:
+          "Invalid Perplexity session cookie — re-paste __Secure-next-auth.session-token from perplexity.ai",
+      };
+    }
+
+    if (response.status === 200 || (response.status >= 400 && response.status < 500)) {
+      return { valid: true, error: null };
+    }
+
+    if (response.status >= 500) {
+      return { valid: false, error: `Perplexity unavailable (${response.status})` };
+    }
+
+    return { valid: false, error: `Validation failed: ${response.status}` };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
+
+export async function validateBlackboxWebProvider({ apiKey, providerSpecificData = {} }: any) {
+  try {
+    const cookieHeader = normalizeSessionCookieHeader(apiKey, "next-auth.session-token");
+    const sessionHeaders = applyCustomUserAgent(
+      {
+        Accept: "application/json",
+        Cookie: cookieHeader,
+        Origin: "https://app.blackbox.ai",
+        Referer: "https://app.blackbox.ai/",
+        "User-Agent":
+          "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/147.0.0.0",
+      },
+      providerSpecificData
+    );
+
+    const sessionResponse = await validationRead("https://app.blackbox.ai/api/auth/session", {
+      method: "GET",
+      headers: sessionHeaders,
+    });
+
+    const sessionText = await sessionResponse.text();
+    const sessionPayload = sessionText ? JSON.parse(sessionText) : null;
+    const userEmail = sessionPayload?.user?.email;
+
+    if (!sessionResponse.ok || !userEmail) {
+      return {
+        valid: false,
+        error:
+          "Invalid Blackbox session cookie — re-paste __Secure-authjs.session-token from app.blackbox.ai",
+      };
+    }
+
+    const subscriptionHeaders = applyCustomUserAgent(
+      {
+        "Content-Type": "application/json",
+        Accept: "application/json",
+        Cookie: cookieHeader,
+        Origin: "https://app.blackbox.ai",
+        Referer: "https://app.blackbox.ai/",
+        "User-Agent":
+          "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/147.0.0.0",
+      },
+      providerSpecificData
+    );
+
+    const subscriptionResponse = await validationWrite(
+      "https://app.blackbox.ai/api/check-subscription",
+      {
+        method: "POST",
+        headers: subscriptionHeaders,
+        body: JSON.stringify({ email: userEmail }),
+      }
+    );
+
+    const subscriptionText = await subscriptionResponse.text();
+    const subscriptionPayload = subscriptionText ? JSON.parse(subscriptionText) : null;
+    const explicitActive =
+      subscriptionPayload?.hasActiveSubscription === true ||
+      subscriptionPayload?.isTrialSubscription === true ||
+      subscriptionPayload?.status === "PREMIUM";
+    const explicitInactive =
+      subscriptionPayload?.hasActiveSubscription === false ||
+      subscriptionPayload?.status === "FREE";
+    const requiresAuthentication =
+      subscriptionPayload?.requiresAuthentication === true ||
+      /login is required/i.test(subscriptionText || "");
+
+    if (subscriptionResponse.status === 401 || subscriptionResponse.status === 403) {
+      return {
+        valid: false,
+        error:
+          "Invalid Blackbox session cookie — re-paste __Secure-authjs.session-token from app.blackbox.ai",
+      };
+    }
+
+    if (requiresAuthentication) {
+      return {
+        valid: false,
+        error:
+          "Blackbox session expired — re-paste __Secure-authjs.session-token from app.blackbox.ai",
+      };
+    }
+
+    if (subscriptionResponse.ok && explicitActive) {
+      return { valid: true, error: null };
+    }
+
+    if (
+      (subscriptionResponse.ok && explicitInactive) ||
+      subscriptionPayload?.previouslySubscribed
+    ) {
+      return {
+        valid: false,
+        error:
+          "Blackbox account authenticated, but no active paid subscription was detected for premium web models.",
+      };
+    }
+
+    if (subscriptionResponse.ok) {
+      return { valid: true, error: null };
+    }
+
+    if (subscriptionResponse.status >= 500) {
+      return { valid: false, error: `Blackbox unavailable (${subscriptionResponse.status})` };
+    }
+
+    return { valid: false, error: `Validation failed: ${subscriptionResponse.status}` };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
+
diff --git a/src/lib/providers/validation/webProvidersB.ts b/src/lib/providers/validation/webProvidersB.ts
new file mode 100644
index 0000000000..b96e097658
--- /dev/null
+++ b/src/lib/providers/validation/webProvidersB.ts
@@ -0,0 +1,460 @@
+// Web-cookie provider key validators (part B): muse-spark-web, adapta-web, claude-web, gemini-web,
+// copilot-web, t3-web, jules, inner-ai. Extracted from validation.ts (god-file decomposition) —
+// top-level functions with no dispatcher-state captures; behavior is byte-identical to the inline defs.
+import { applyCustomUserAgent } from "./headers";
+import { toValidationErrorResult, validationRead, validationWrite } from "./transport";
+import { normalizeSessionCookieHeader } from "@/lib/providers/webCookieAuth";
+import { buildJulesApiUrl } from "@/lib/cloudAgent/julesApi.ts";
+import {
+  META_AI_ASBD_ID,
+  META_AI_FRIENDLY_NAME,
+  META_AI_REQUEST_ANALYTICS_TAGS,
+  META_AI_USER_AGENT,
+  buildMetaAiValidationBody,
+} from "./metaAi";
+
+export async function validateMuseSparkWebProvider({ apiKey, providerSpecificData = {} }: any) {
+  try {
+    const cookieHeader = normalizeSessionCookieHeader(apiKey, "ecto_1_sess");
+    const response = await validationWrite("https://www.meta.ai/api/graphql", {
+      method: "POST",
+      headers: applyCustomUserAgent(
+        {
+          "Content-Type": "application/json",
+          Accept: "text/event-stream",
+          "Accept-Language": "en-US,en;q=0.9",
+          Cookie: cookieHeader,
+          Origin: "https://www.meta.ai",
+          Referer: "https://www.meta.ai/",
+          "Sec-Fetch-Dest": "empty",
+          "Sec-Fetch-Mode": "cors",
+          "Sec-Fetch-Site": "same-origin",
+          "User-Agent": META_AI_USER_AGENT,
+          "X-ASBD-ID": META_AI_ASBD_ID,
+          "X-FB-Friendly-Name": META_AI_FRIENDLY_NAME,
+          "X-FB-Request-Analytics-Tags": META_AI_REQUEST_ANALYTICS_TAGS,
+        },
+        providerSpecificData
+      ),
+      body: JSON.stringify(buildMetaAiValidationBody()),
+    });
+
+    const responseText = await response.text();
+    if (response.status === 401 || response.status === 403) {
+      return {
+        valid: false,
+        error: "Invalid Meta AI session cookie — re-paste abra_sess from meta.ai",
+      };
+    }
+
+    if (/authentication required to send messages|login is required|sign in/i.test(responseText)) {
+      return {
+        valid: false,
+        error: "Invalid Meta AI session cookie — re-paste abra_sess from meta.ai",
+      };
+    }
+
+    if (
+      response.status === 429 ||
+      /limit exceeded|rate limit|too many requests/i.test(responseText)
+    ) {
+      return { valid: true, error: null };
+    }
+
+    if (response.ok) {
+      return { valid: true, error: null };
+    }
+
+    if (response.status >= 500) {
+      return { valid: false, error: `Meta AI unavailable (${response.status})` };
+    }
+
+    return { valid: false, error: `Validation failed: ${response.status}` };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
+
+export async function validateAdaptaWebProvider({ apiKey, providerSpecificData = {} }: any) {
+  try {
+    const raw = typeof apiKey === "string" ? apiKey.trim() : "";
+    if (!raw)
+      return { valid: false, error: "Paste your __client cookie from .clerk.agent.adapta.one" };
+    const eqIdx = raw.indexOf("=");
+    const clientJwt = eqIdx > 0 && !raw.startsWith("eyJ") ? raw.slice(eqIdx + 1).trim() : raw;
+
+    const response = await validationRead("https://clerk.agent.adapta.one/v1/client", {
+      headers: applyCustomUserAgent(
+        {
+          Cookie: `__client=${clientJwt}`,
+          "User-Agent":
+            "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
+          Origin: "https://agent.adapta.one",
+        },
+        providerSpecificData
+      ),
+    });
+
+    if (response.status === 401 || response.status === 403) {
+      return {
+        valid: false,
+        error: "Invalid or expired __client cookie — re-paste from .clerk.agent.adapta.one",
+      };
+    }
+
+    if (!response.ok) {
+      return { valid: false, error: `Adapta Clerk returned HTTP ${response.status}` };
+    }
+
+    const body = await response.json().catch(() => null);
+    const sessions: Array<{ id: string; status: string }> = body?.response?.sessions ?? [];
+    const hasActive = sessions.some((s) => s.status === "active");
+    if (!hasActive) {
+      return {
+        valid: false,
+        error: "No active Adapta session — your __client cookie may be expired",
+      };
+    }
+
+    return { valid: true, error: null };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
+
+export async function validateClaudeWebProvider({ apiKey, providerSpecificData = {} }: any) {
+  try {
+    const cookieHeader = normalizeSessionCookieHeader(String(apiKey || ""), "sessionKey");
+    if (!cookieHeader) {
+      return { valid: false, error: "Paste your sessionKey cookie from claude.ai" };
+    }
+
+    const { tlsFetchClaude, TlsClientUnavailableError } =
+      await import("@omniroute/open-sse/services/claudeTlsClient.ts");
+
+    let response: { status: number; text: string | null };
+    try {
+      response = await tlsFetchClaude("https://claude.ai/api/organizations", {
+        method: "GET",
+        headers: applyCustomUserAgent(
+          {
+            Accept: "application/json",
+            "Accept-Language": "en-US,en;q=0.9",
+            "Cache-Control": "no-cache",
+            Cookie: cookieHeader,
+            Origin: "https://claude.ai",
+            Pragma: "no-cache",
+            Referer: "https://claude.ai/new",
+            "Sec-Fetch-Dest": "empty",
+            "Sec-Fetch-Mode": "cors",
+            "Sec-Fetch-Site": "same-origin",
+            "User-Agent":
+              "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
+            "anthropic-client-platform": "web_claude_ai",
+          },
+          providerSpecificData
+        ),
+        timeoutMs: 30_000,
+      });
+    } catch (err: any) {
+      if (err instanceof TlsClientUnavailableError) {
+        return {
+          valid: false,
+          error: `${err.message} (claude-web requires this — without it, Cloudflare blocks every request)`,
+        };
+      }
+      throw err;
+    }
+
+    if (response.status === 200) {
+      return { valid: true, error: null };
+    }
+
+    if (response.status === 401 || response.status === 403) {
+      return {
+        valid: false,
+        error:
+          "Invalid or expired session cookie — re-paste sessionKey from claude.ai DevTools → Cookies",
+      };
+    }
+
+    if (response.status === 429) {
+      return { valid: true, error: null };
+    }
+
+    if (response.status >= 500) {
+      return { valid: false, error: `Claude.ai unavailable (${response.status})` };
+    }
+
+    return { valid: false, error: `Claude.ai validation failed (${response.status})` };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
+
+// ── Gemini Web cookie validator ──
+export async function validateGeminiWebProvider({ apiKey, providerSpecificData = {} }: any) {
+  try {
+    const raw = String(apiKey || "").trim();
+    if (!raw) {
+      return { valid: false, error: "Paste your __Secure-1PSID cookie from gemini.google.com" };
+    }
+
+    // Accept full cookie blob or bare value
+    let cookieHeader = raw;
+    if (!raw.includes("=")) {
+      cookieHeader = `__Secure-1PSID=${raw}`;
+    }
+
+    const response = await validationRead("https://gemini.google.com/app", {
+      headers: applyCustomUserAgent(
+        {
+          Accept: "text/html,application/xhtml+xml",
+          Cookie: cookieHeader,
+          Origin: "https://gemini.google.com",
+          Referer: "https://gemini.google.com/",
+        },
+        providerSpecificData
+      ),
+    });
+
+    if (response.status === 401 || response.status === 403) {
+      return {
+        valid: false,
+        error:
+          "Invalid or expired __Secure-1PSID cookie — re-paste from gemini.google.com DevTools → Cookies",
+      };
+    }
+
+    // 200/302 = valid, anything < 500 that isn't auth failure is acceptable
+    if (response.status < 500) {
+      return { valid: true, error: null };
+    }
+
+    return { valid: false, error: `Gemini validation failed (${response.status})` };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
+
+// ── Copilot Web token validator ──
+export async function validateCopilotWebProvider({ apiKey, providerSpecificData = {} }: any) {
+  try {
+    const raw = String(apiKey || "").trim();
+    if (!raw) {
+      return {
+        valid: false,
+        error: "Paste your access_token from copilot.microsoft.com DevTools → Cookies",
+      };
+    }
+
+    // Extract token — may be bare JWT, cookie string with access_token=, or Bearer prefix
+    const { extractAccessToken } = await import("@omniroute/open-sse/executors/copilot-web.ts");
+    const token = extractAccessToken(raw);
+    if (!token) {
+      return { valid: false, error: "Could not extract access_token from input" };
+    }
+
+    // Probe Copilot's conversation API to verify token
+    const response = await validationWrite(
+      "https://copilot.microsoft.com/c/api/conversations?language=en",
+      {
+        method: "GET",
+        headers: applyCustomUserAgent(
+          {
+            Accept: "application/json",
+            Authorization: `Bearer ${token}`,
+            Origin: "https://copilot.microsoft.com",
+            Referer: "https://copilot.microsoft.com/",
+          },
+          providerSpecificData
+        ),
+      }
+    );
+
+    if (response.status === 401 || response.status === 403) {
+      return {
+        valid: false,
+        error:
+          "Invalid or expired access_token — re-paste from copilot.microsoft.com DevTools → Cookies",
+      };
+    }
+
+    if (response.status >= 500) {
+      return { valid: false, error: `Copilot unavailable (${response.status})` };
+    }
+
+    // 200, 400, 404 etc. all indicate the token was accepted
+    return { valid: true, error: null };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
+
+// ── t3.chat Web cookie validator ──
+export async function validateT3WebProvider({ apiKey, providerSpecificData = {} }: any) {
+  try {
+    const raw = String(apiKey || "").trim();
+    if (!raw) {
+      return {
+        valid: false,
+        error: "Paste your Cookie header and convex-session-id from t3.chat",
+      };
+    }
+
+    // The cookie field may contain "cookies=<Cookie header>\nconvexSessionId=<id>"
+    // or just the Cookie header value. Try to parse.
+    let cookieHeader = raw;
+    let convexSessionId = "";
+
+    if (raw.includes("convexSessionId") || raw.includes("convex-session-id")) {
+      // Structured format: "cookies=...; convexSessionId=..."
+      const parts = raw.split(/[,;\n]/).map((s: string) => s.trim());
+      const cookieParts: string[] = [];
+      for (const part of parts) {
+        if (part.startsWith("convexSessionId=") || part.startsWith("convex-session-id=")) {
+          convexSessionId = part.split("=").slice(1).join("=");
+        } else if (part.startsWith("cookies=")) {
+          cookieParts.push(part.slice("cookies=".length));
+        } else if (part.includes("=")) {
+          cookieParts.push(part);
+        }
+      }
+      if (cookieParts.length) cookieHeader = cookieParts.join("; ");
+    }
+
+    // Build final cookie with convex-session-id if found
+    const finalCookie = convexSessionId
+      ? `${cookieHeader}; convex-session-id=${convexSessionId}`
+      : cookieHeader;
+
+    const response = await validationRead("https://t3.chat", {
+      headers: applyCustomUserAgent(
+        {
+          Accept: "text/html",
+          Cookie: finalCookie,
+        },
+        providerSpecificData
+      ),
+    });
+
+    // t3.chat returns 200/302/404 for valid sessions, 5xx for down
+    if (response.status >= 500) {
+      return { valid: false, error: `t3.chat unavailable (${response.status})` };
+    }
+
+    return { valid: true, error: null };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
+
+/** Jules API — GET /v1alpha/sources with X-Goog-Api-Key (see developers.google.com/jules/api). */
+export async function validateJulesProvider({ apiKey }: { apiKey: string }) {
+  try {
+    const response = await validationWrite(buildJulesApiUrl("/sources"), {
+      method: "GET",
+      headers: {
+        "X-Goog-Api-Key": apiKey,
+      },
+    });
+
+    if (response.status === 401 || response.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    if (response.ok) {
+      return { valid: true, error: null };
+    }
+
+    const errorText = await response.text().catch(() => "");
+    return {
+      valid: false,
+      error: errorText.trim() || `Jules API returned ${response.status}`,
+    };
+  } catch (error: unknown) {
+    return toValidationErrorResult(error);
+  }
+}
+
+export async function validateInnerAiProvider({ apiKey, providerSpecificData = {} }: any) {
+  try {
+    const raw = typeof apiKey === "string" ? apiKey.trim() : "";
+    if (!raw) {
+      return {
+        valid: false,
+        error: "Paste your token cookie and email — format: eyJ... user@example.com",
+      };
+    }
+
+    // Parse token and optional email (format: "TOKEN EMAIL")
+    const eqIdx = raw.indexOf("=");
+    const stripped = eqIdx > 0 && !raw.startsWith("eyJ") ? raw.slice(eqIdx + 1).trim() : raw;
+    const lastSpace = stripped.lastIndexOf(" ");
+    let token = stripped;
+    let credEmail = "";
+    if (lastSpace > 0) {
+      const possibleEmail = stripped.slice(lastSpace + 1).trim();
+      if (possibleEmail.includes("@")) {
+        token = stripped.slice(0, lastSpace).trim();
+        credEmail = possibleEmail;
+      }
+    }
+
+    if (!credEmail) {
+      return {
+        valid: false,
+        error:
+          "Email is required — paste token followed by a space and your email: eyJ... user@example.com",
+      };
+    }
+
+    // Validate JWT structure (3 parts separated by dots)
+    const parts = token.split(".");
+    if (parts.length < 3) {
+      return {
+        valid: false,
+        error:
+          "Invalid token format — paste only the token cookie value from .innerai.com (starts with eyJ…)",
+      };
+    }
+
+    // Decode payload and check expiry
+    const b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    let payload: Record<string, unknown> = {};
+    try {
+      payload = JSON.parse(Buffer.from(b64, "base64").toString("utf8"));
+    } catch {
+      return { valid: false, error: "Could not parse Inner.ai token — re-paste from DevTools" };
+    }
+
+    if (typeof payload.exp === "number" && payload.exp * 1000 < Date.now()) {
+      return {
+        valid: false,
+        error:
+          "Inner.ai token has expired — re-login at app.innerai.com and re-paste the token cookie",
+      };
+    }
+
+    // Verify the token carries at least one known Inner.ai identity field
+    const hasIdentity =
+      payload.device_id ??
+      payload.deviceId ??
+      payload["device-id"] ??
+      payload.did ??
+      payload.user_id ??
+      payload.userId ??
+      payload.sub;
+    if (!hasIdentity) {
+      return {
+        valid: false,
+        error:
+          "Token does not look like an Inner.ai session token — re-paste from DevTools → Cookies → .innerai.com",
+      };
+    }
+
+    return { valid: true, error: null };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
diff --git a/src/lib/proxyRelay/cloudflareWorkerScript.ts b/src/lib/proxyRelay/cloudflareWorkerScript.ts
new file mode 100644
index 0000000000..d8a639b376
--- /dev/null
+++ b/src/lib/proxyRelay/cloudflareWorkerScript.ts
@@ -0,0 +1,107 @@
+/**
+ * Cloudflare Worker source emitter for the OmniRoute proxy relay.
+ *
+ * Port of upstream decolua/9router PR #1360. The Worker plays the same role
+ * the Vercel-relay edge function does (`src/app/api/settings/proxy/vercel-deploy/route.ts`):
+ *  - Accepts inbound requests carrying x-relay-target / x-relay-path /
+ *    x-relay-auth headers.
+ *  - Authorises with the embedded relayAuth secret (so a leaked workers.dev URL
+ *    is not an open SSRF proxy).
+ *  - Inlines an SSRF guard rejecting RFC1918 / loopback / link-local / IPv6 ULA
+ *    targets — the Edge runtime cannot import Node helpers, the guard lives
+ *    here as a string.
+ *  - Strips Host + relay control headers before forwarding upstream.
+ *
+ * The string template is fed to Cloudflare's PUT /accounts/{id}/workers/scripts/{name}
+ * API with main_module=index.js (ESM Workers Modules format).
+ *
+ * The OmniRoute variant intentionally diverges from the upstream PR:
+ *  - The upstream worker had NO auth check, leaving the deployed workers.dev URL
+ *    as an open SSRF proxy. We mirror Vercel's x-relay-auth scheme instead so the
+ *    same buildVercelRelayHeaders helper (open-sse/utils/proxyDispatcher.ts) and
+ *    the same proxyFetch relay short-circuit work unchanged.
+ *  - SSRF guard is inlined so a leaked relay URL cannot scan internal IPs.
+ */
+export function buildCloudflareWorkerScript(relayAuth: string): string {
+  // relayAuth is generated server-side via randomBytes(24).toString("hex") — no
+  // user-controlled input ever reaches this template, so direct interpolation
+  // into the worker source string is safe.
+  return `// OmniRoute Cloudflare Worker proxy relay — generated at deploy time.
+function isPrivateHostname(h) {
+  if (!h) return true;
+  const host = h.trim().toLowerCase().replace(/^\\[|\\]$/g, "");
+  if (
+    host === "localhost" ||
+    host === "0.0.0.0" ||
+    host === "127.0.0.1" ||
+    host === "::1" ||
+    host.endsWith(".localhost") ||
+    host.endsWith(".local") ||
+    host.endsWith(".internal") ||
+    host.startsWith("::ffff:")
+  ) return true;
+  const v4 = host.match(/^(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})$/);
+  if (v4) {
+    const a = +v4[1], b = +v4[2];
+    if (a === 0 || a === 10 || a === 127) return true;
+    if (a === 169 && b === 254) return true; // link-local IPv4
+    if (a === 192 && b === 168) return true;
+    if (a === 172 && b >= 16 && b <= 31) return true;
+    if (a === 100 && b >= 64 && b <= 127) return true;
+    return false;
+  }
+  if (host.includes(":")) {
+    // IPv6 loopback/ULA/link-local (fe80::/10)
+    return host === "::1" || host.startsWith("fc") || host.startsWith("fd") || host.startsWith("fe80:");
+  }
+  return false;
+}
+
+export default {
+  async fetch(request, env, ctx) {
+    const auth = request.headers.get("x-relay-auth");
+    if (auth !== "${relayAuth}") {
+      return new Response("Unauthorized", { status: 401 });
+    }
+    const target = request.headers.get("x-relay-target");
+    if (!target) {
+      return new Response("missing x-relay-target", { status: 400 });
+    }
+    let targetUrl;
+    try { targetUrl = new URL(target); } catch { return new Response("invalid x-relay-target", { status: 400 }); }
+    if (targetUrl.protocol !== "http:" && targetUrl.protocol !== "https:") {
+      return new Response("forbidden x-relay-target protocol", { status: 403 });
+    }
+    if (targetUrl.username || targetUrl.password) {
+      return new Response("forbidden x-relay-target (embedded credentials)", { status: 403 });
+    }
+    if (isPrivateHostname(targetUrl.hostname)) {
+      return new Response("forbidden x-relay-target (private/loopback host)", { status: 403 });
+    }
+    const relayPath = request.headers.get("x-relay-path") || "/";
+    const headers = new Headers(request.headers);
+    ["x-relay-target", "x-relay-path", "x-relay-auth", "host"].forEach((h) => headers.delete(h));
+    const init = {
+      method: request.method,
+      headers,
+    };
+    if (request.method !== "GET" && request.method !== "HEAD") {
+      init.body = request.body;
+      init.duplex = "half";
+    }
+    try {
+      const upstream = await fetch(target.replace(/\\/$/, "") + relayPath, init);
+      return new Response(upstream.body, {
+        status: upstream.status,
+        headers: upstream.headers,
+      });
+    } catch (error) {
+      return new Response(JSON.stringify({ error: error && error.message ? error.message : "relay error" }), {
+        status: 502,
+        headers: { "content-type": "application/json" },
+      });
+    }
+  },
+};
+`;
+}
diff --git a/src/lib/quota/accountBuckets.ts b/src/lib/quota/accountBuckets.ts
new file mode 100644
index 0000000000..6b7ac1a14d
--- /dev/null
+++ b/src/lib/quota/accountBuckets.ts
@@ -0,0 +1,225 @@
+/**
+ * accountBuckets.ts — Saturating per-connection, per-window buckets.
+ *
+ * Tracks whether a connection has hit 100 % of a quota window (5h / 7d /
+ * per-model 7d). Each bucket is lazily reset: on read, if now >= resetsAtMs
+ * the entry is cleared and the connection is eligible again. No cron needed —
+ * the reset is probed on the read path.
+ *
+ * Fail-open: missing entry → not saturated. All time input is injectable
+ * (the `nowMs` param) so unit tests drive the clock deterministically — the
+ * tested path never calls Date.now() implicitly.
+ *
+ * Complementary to connectionRecovery.ts: that module recovers DB-backed
+ * request-error cooldowns (testStatus 'unavailable' + rateLimitedUntil); this
+ * module tracks in-process plan-window utilization. Orthogonal concerns.
+ *
+ * Part of: Quota Sharing Engine — Phase 3 (#3 multi-window buckets).
+ */
+
+// ---------------------------------------------------------------------------
+// Types
+// ---------------------------------------------------------------------------
+
+/** In-process state for one (connectionId, windowKey) pair. */
+interface BucketEntry {
+  saturated: boolean;
+  resetsAtMs: number; // 0 when the reset instant is unknown
+}
+
+/**
+ * Minimal shape of a parsed UsageQuota entry, as produced by getClaudeUsage in
+ * open-sse/services/usage.ts. `used` = % consumed (0..100); `total` = 100 for
+ * percent-based windows; `resetAt` = ISO 8601 string or null (already
+ * normalized upstream by parseResetTime).
+ */
+export interface UsageQuotaSlim {
+  used: number;
+  total: number;
+  resetAt: string | null;
+}
+
+/**
+ * Partial shape of the getClaudeUsage() return value this module needs. Only
+ * `quotas` is consumed; other fields (plan, extraUsage, bootstrap) are ignored.
+ */
+export interface ClaudeUsageResult {
+  quotas?: Record<string, UsageQuotaSlim | undefined>;
+}
+
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+
+/**
+ * Utilization threshold (0..100) at/above which a window is considered
+ * saturated. 100 = exhausted. Named so it can be tuned globally if Anthropic
+ * ever soft-throttles below the hard cap.
+ */
+export const SATURATION_THRESHOLD_PCT = 100;
+
+// ---------------------------------------------------------------------------
+// In-process store
+// ---------------------------------------------------------------------------
+
+/** Key: `${connectionId}::${windowKey}`. */
+const _buckets = new Map<string, BucketEntry>();
+
+function storeKey(connectionId: string, windowKey: string): string {
+  return `${connectionId}::${windowKey}`;
+}
+
+/**
+ * Parse an ISO 8601 `resetAt` string to epoch ms. Returns 0 on any failure
+ * (unknown reset time → the lazy reset cannot fire for that bucket).
+ */
+function parseResetAtMs(resetAt: string | null | undefined): number {
+  if (!resetAt) return 0;
+  const ms = Date.parse(resetAt);
+  return Number.isFinite(ms) && ms > 0 ? ms : 0;
+}
+
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+
+/**
+ * Check whether the bucket for (connectionId, windowKey) is currently
+ * saturated.
+ *
+ * Lazy reset: if `nowMs >= entry.resetsAtMs` (and resetsAtMs > 0) the entry is
+ * cleared and `false` is returned — the connection is eligible again without
+ * any background sweep.
+ *
+ * Fail-open: a missing entry returns false (not saturated).
+ *
+ * @param connectionId  Opaque string identifier for the connection.
+ * @param windowKey     One of: "5h", "7d", "7d:<modelName>" (e.g. "7d:designer").
+ * @param nowMs         Current epoch ms; defaults to Date.now() (off-path only).
+ */
+export function isBucketSaturated(
+  connectionId: string,
+  windowKey: string,
+  nowMs: number = Date.now()
+): boolean {
+  if (!connectionId || !windowKey) return false; // fail-open
+  const key = storeKey(connectionId, windowKey);
+  const entry = _buckets.get(key);
+  if (!entry) return false; // fail-open
+
+  // Lazy reset: the window rolled over → the saturation is stale.
+  if (entry.resetsAtMs > 0 && nowMs >= entry.resetsAtMs) {
+    _buckets.delete(key);
+    return false;
+  }
+
+  return entry.saturated;
+}
+
+/**
+ * Record a usage observation for one (connectionId, windowKey) pair.
+ *
+ * Marks the bucket saturated when `usedPct >= SATURATION_THRESHOLD_PCT` and the
+ * window has NOT already rolled over. When the observation is below the
+ * threshold (or already past its reset), any existing entry is cleared so the
+ * connection's eligibility is restored promptly. When `resetAt` is a valid ISO
+ * string, the reset epoch is stored so lazy reset can fire later.
+ *
+ * @param connectionId  Opaque connection identifier.
+ * @param windowKey     "5h", "7d", or "7d:<modelName>".
+ * @param usedPct       Utilization percentage (0..100).
+ * @param resetAt       ISO 8601 string (or null) for when this window resets.
+ * @param nowMs         Current epoch ms; defaults to Date.now() (off-path only).
+ */
+export function recordUsage(
+  connectionId: string,
+  windowKey: string,
+  usedPct: number,
+  resetAt: string | null,
+  nowMs: number = Date.now()
+): void {
+  if (!connectionId || !windowKey) return;
+  const key = storeKey(connectionId, windowKey);
+
+  const resetsAtMs = parseResetAtMs(resetAt);
+
+  // Stale signal: the window already reset — discard any state and bail.
+  if (resetsAtMs > 0 && nowMs >= resetsAtMs) {
+    _buckets.delete(key);
+    return;
+  }
+
+  const saturated = Number.isFinite(usedPct) && usedPct >= SATURATION_THRESHOLD_PCT;
+  if (!saturated) {
+    // Below threshold → clear any stale saturation so the bucket is eligible.
+    _buckets.delete(key);
+    return;
+  }
+
+  _buckets.set(key, { saturated: true, resetsAtMs });
+}
+
+/**
+ * Parse the `quotas` map from a getClaudeUsage() result and record each known
+ * window into its bucket.
+ *
+ * Window key mapping:
+ *   "session (5h)"         → "5h"
+ *   "weekly (7d)"          → "7d"
+ *   "weekly <model> (7d)"  → "7d:<model>" (e.g. "weekly designer (7d)" → "7d:designer")
+ *
+ * Fail-open: a null/undefined result, a missing `quotas` map, or any malformed
+ * quota entry is silently skipped.
+ *
+ * @param connectionId  Connection identifier.
+ * @param usageResult   getClaudeUsage() return value (only `quotas` is read).
+ * @param nowMs         Current epoch ms; defaults to Date.now() (off-path only).
+ */
+export function updateAccountBuckets(
+  connectionId: string,
+  usageResult: ClaudeUsageResult | null | undefined,
+  nowMs: number = Date.now()
+): void {
+  if (!connectionId || !usageResult?.quotas) return;
+  const { quotas } = usageResult;
+
+  // Fixed windows.
+  processQuotaEntry(connectionId, "5h", quotas["session (5h)"], nowMs);
+  processQuotaEntry(connectionId, "7d", quotas["weekly (7d)"], nowMs);
+
+  // Per-model weekly windows: "weekly <model> (7d)" → "7d:<model>".
+  for (const [key, entry] of Object.entries(quotas)) {
+    const match = /^weekly (.+) \(7d\)$/.exec(key);
+    if (match?.[1]) {
+      processQuotaEntry(connectionId, `7d:${match[1]}`, entry, nowMs);
+    }
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Internal helpers
+// ---------------------------------------------------------------------------
+
+function processQuotaEntry(
+  connectionId: string,
+  windowKey: string,
+  entry: UsageQuotaSlim | undefined | null,
+  nowMs: number
+): void {
+  if (!entry || typeof entry.used !== "number") return;
+  recordUsage(connectionId, windowKey, entry.used, entry.resetAt ?? null, nowMs);
+}
+
+// ---------------------------------------------------------------------------
+// Test helpers (never call in production code)
+// ---------------------------------------------------------------------------
+
+/** Clear all bucket entries. Tests only — keeps state isolation between cases. */
+export function _clearBucketsForTest(): void {
+  _buckets.clear();
+}
+
+/** Return the current bucket count. Tests only — black-box size assertion. */
+export function _bucketCountForTest(): number {
+  return _buckets.size;
+}
diff --git a/src/lib/quota/connectionRecovery.ts b/src/lib/quota/connectionRecovery.ts
new file mode 100644
index 0000000000..1e0e8d3034
--- /dev/null
+++ b/src/lib/quota/connectionRecovery.ts
@@ -0,0 +1,303 @@
+/**
+ * connectionRecovery.ts — Proactive recovery of provider connections whose
+ * transient cooldown has elapsed.
+ *
+ * Today the cooldown released by `markAccountUnavailable()` (testStatus
+ * 'unavailable' + a future `rateLimitedUntil`) is recovered LAZILY: a connection
+ * only becomes eligible again when the next real request reads it in
+ * `getProviderCredentials` (src/sse/services/auth.ts). The first request after
+ * the cooldown window therefore pays the latency of re-discovering a healthy
+ * connection.
+ *
+ * Modeled on gpt-load's CronChecker, this module identifies the subset of
+ * connections that are cooling down with an already-elapsed window and clears
+ * their error state OUTSIDE the request hot path, so they are restored before
+ * the next real request arrives.
+ *
+ * This file holds the PURE selection logic (`selectRecoverableConnections`,
+ * `isRecoverableCooldownConnection`) — no DB, no network, time injected — plus a
+ * thin async tick (`runConnectionRecoveryTick`) that wires the helper to the DB.
+ * The tick is NOT auto-started on import; the caller (startup bootstrap) decides
+ * when to schedule it, so importing this module in tests never spawns a timer.
+ */
+
+import { cooldownUntilMs } from "@omniroute/open-sse/services/accountFallback.ts";
+
+/**
+ * The transient-cooldown status written by `markAccountUnavailable()` for a
+ * recoverable failure. Only connections in this status are candidates for
+ * proactive recovery.
+ */
+export const RECOVERABLE_COOLDOWN_STATUS = "unavailable";
+
+/**
+ * Terminal connection statuses that must NEVER be auto-recovered — they stay
+ * unavailable until credentials/settings change or an operator resets them.
+ * Mirrors `isTerminalConnectionStatus` (src/sse/services/auth.ts) and
+ * `TERMINAL_STATUSES` (src/lib/db/providers.ts::clearStaleCrashCooldowns).
+ */
+export const TERMINAL_CONNECTION_STATUSES = new Set<string>([
+  "banned",
+  "expired",
+  "credits_exhausted",
+]);
+
+/** Minimal connection shape needed to decide recoverability. */
+export interface RecoverableConnectionInput {
+  id: string;
+  testStatus?: string | null;
+  rateLimitedUntil?: string | null;
+}
+
+function normalizeStatus(value: string | null | undefined): string {
+  return (value || "").trim().toLowerCase();
+}
+
+/**
+ * True when `rateLimitedUntil` is set and its instant is at or before `nowMs`
+ * (the cooldown window has elapsed). Tolerates ISO strings and numeric-epoch
+ * strings — the `rate_limited_until` TEXT column can hold either (#3954).
+ */
+function hasElapsedCooldown(rateLimitedUntil: string | null | undefined, nowMs: number): boolean {
+  if (!rateLimitedUntil) return false;
+  const ms = cooldownUntilMs(rateLimitedUntil);
+  return Number.isFinite(ms) && ms <= nowMs;
+}
+
+/**
+ * Decide whether a single connection is a proactive-recovery candidate:
+ *   - has a real id, AND
+ *   - testStatus === 'unavailable' (the transient cooldown status), AND
+ *   - rateLimitedUntil is set and already in the past (< nowMs), AND
+ *   - is NOT in a terminal state (banned / expired / credits_exhausted).
+ *
+ * Pure — `nowMs` is injected so callers/tests control the clock.
+ */
+export function isRecoverableCooldownConnection(
+  connection: RecoverableConnectionInput | null | undefined,
+  nowMs: number
+): boolean {
+  if (!connection || typeof connection.id !== "string" || connection.id.length === 0) {
+    return false;
+  }
+  const status = normalizeStatus(connection.testStatus);
+  if (status !== RECOVERABLE_COOLDOWN_STATUS) return false;
+  if (TERMINAL_CONNECTION_STATUSES.has(status)) return false; // defensive; 'unavailable' is never terminal
+  return hasElapsedCooldown(connection.rateLimitedUntil, nowMs);
+}
+
+/**
+ * From a list of connections, return only those whose transient cooldown has
+ * elapsed and are safe to restore. Pure, non-mutating, time injected.
+ */
+export function selectRecoverableConnections<T extends RecoverableConnectionInput>(
+  connections: readonly T[] | null | undefined,
+  nowMs: number
+): T[] {
+  if (!Array.isArray(connections)) return [];
+  return connections.filter((connection) => isRecoverableCooldownConnection(connection, nowMs));
+}
+
+/** Result of one recovery tick (handy for logging / tests of the wiring). */
+export interface ConnectionRecoveryTickResult {
+  scanned: number;
+  recovered: number;
+  recoveredIds: string[];
+}
+
+/**
+ * Run one proactive-recovery pass: load active provider connections, select the
+ * subset whose transient cooldown has elapsed, and clear their error state via
+ * `clearAccountError` so they are eligible again before the next real request.
+ *
+ * Dependencies are injected (default to the real DB / auth modules) so the tick
+ * can be unit-tested without a live database. Best-effort and never throws — a
+ * failure to recover one connection must not abort the others or the scheduler.
+ *
+ * NOTE: not auto-started on import. The startup bootstrap is responsible for
+ * scheduling it (see runConnectionRecoveryTick usage in the report).
+ */
+export async function runConnectionRecoveryTick(
+  deps: {
+    nowMs?: number;
+    loadConnections?: () => Promise<RecoverableConnectionInput[]>;
+    clearConnectionError?: (
+      connectionId: string,
+      current: RecoverableConnectionInput
+    ) => Promise<void>;
+    logger?: { info?: (msg: string) => void; warn?: (msg: string) => void };
+  } = {}
+): Promise<ConnectionRecoveryTickResult> {
+  const nowMs = deps.nowMs ?? Date.now();
+  const result: ConnectionRecoveryTickResult = { scanned: 0, recovered: 0, recoveredIds: [] };
+
+  let connections: RecoverableConnectionInput[];
+  try {
+    const load =
+      deps.loadConnections ??
+      (async () => {
+        // Lazy import keeps this module loadable (and the pure helpers testable)
+        // without a full DB/auth graph.
+        const { getProviderConnections } = await import("@/lib/db/providers");
+        const rows = (await getProviderConnections({ isActive: true })) as Array<{
+          id?: unknown;
+          testStatus?: unknown;
+          rateLimitedUntil?: unknown;
+        }>;
+        return (Array.isArray(rows) ? rows : []).map((row) => ({
+          id: typeof row.id === "string" ? row.id : "",
+          testStatus: typeof row.testStatus === "string" ? row.testStatus : null,
+          rateLimitedUntil:
+            typeof row.rateLimitedUntil === "string" ? row.rateLimitedUntil : null,
+        }));
+      });
+    connections = await load();
+  } catch (err) {
+    deps.logger?.warn?.(
+      `[ConnectionRecovery] failed to load connections: ${err instanceof Error ? err.message : String(err)}`
+    );
+    return result;
+  }
+
+  result.scanned = connections.length;
+  const recoverable = selectRecoverableConnections(connections, nowMs);
+  if (recoverable.length === 0) return result;
+
+  const clear =
+    deps.clearConnectionError ??
+    (async (connectionId: string, current: RecoverableConnectionInput) => {
+      const { clearAccountError } = await import("@/sse/services/auth");
+      await clearAccountError(connectionId, current);
+    });
+
+  for (const connection of recoverable) {
+    try {
+      await clear(connection.id, connection);
+      result.recovered += 1;
+      result.recoveredIds.push(connection.id);
+    } catch (err) {
+      deps.logger?.warn?.(
+        `[ConnectionRecovery] failed to recover ${connection.id.slice(0, 8)}: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+
+  if (result.recovered > 0) {
+    deps.logger?.info?.(
+      `[ConnectionRecovery] proactively restored ${result.recovered} connection(s) with elapsed cooldown`
+    );
+  }
+  return result;
+}
+
+// ── Scheduler (opt-out, low frequency) ──────────────────────────────────────
+// Mirrors src/lib/tokenHealthCheck.ts: a globalThis-guarded singleton so HMR /
+// double-import never stacks timers, an unref'd interval so it never holds the
+// process open, and a self-disable in build/test processes. NOT auto-started on
+// import — startup bootstrap calls initConnectionRecoveryScheduler().
+
+const DEFAULT_TICK_MS = 60 * 1000; // re-validate elapsed cooldowns every 60s
+const MIN_TICK_MS = 5 * 1000; // floor to avoid hot-looping if misconfigured
+const RECOVERY_LOG_PREFIX = "[ConnectionRecovery]";
+const TRUE_ENV_VALUES = new Set(["1", "true", "yes", "on"]);
+
+declare global {
+  var __omnirouteConnRecovery:
+    | { initialized: boolean; interval: ReturnType<typeof setInterval> | null }
+    | undefined;
+}
+
+function getRecoveryState() {
+  if (!globalThis.__omnirouteConnRecovery) {
+    globalThis.__omnirouteConnRecovery = { initialized: false, interval: null };
+  }
+  return globalThis.__omnirouteConnRecovery;
+}
+
+function isEnvFlagEnabled(name: string): boolean {
+  const value = typeof process !== "undefined" ? process.env[name] : undefined;
+  return !!value && TRUE_ENV_VALUES.has(value.trim().toLowerCase());
+}
+
+function isBuildProcess(): boolean {
+  return typeof process !== "undefined" && process.env.NEXT_PHASE === "phase-production-build";
+}
+
+function isAutomatedTestProcess(): boolean {
+  return (
+    typeof process !== "undefined" &&
+    (process.env.NODE_ENV === "test" ||
+      process.env.VITEST !== undefined ||
+      process.argv.some((arg) => arg.includes("test")))
+  );
+}
+
+function isRecoverySchedulerDisabled(): boolean {
+  return (
+    isEnvFlagEnabled("OMNIROUTE_DISABLE_CONNECTION_RECOVERY") ||
+    isEnvFlagEnabled("OMNIROUTE_DISABLE_BACKGROUND_SERVICES") ||
+    isBuildProcess() ||
+    isAutomatedTestProcess()
+  );
+}
+
+/**
+ * Resolve the tick interval (ms) from OMNIROUTE_CONNECTION_RECOVERY_INTERVAL_MS,
+ * falling back to the 60s default and clamping to a small floor.
+ */
+export function resolveConnectionRecoveryIntervalMs(
+  rawValue: string | undefined = typeof process !== "undefined"
+    ? process.env.OMNIROUTE_CONNECTION_RECOVERY_INTERVAL_MS
+    : undefined
+): number {
+  if (!rawValue) return DEFAULT_TICK_MS;
+  const parsed = Number(rawValue);
+  if (!Number.isFinite(parsed) || parsed <= 0) return DEFAULT_TICK_MS;
+  return Math.max(MIN_TICK_MS, Math.floor(parsed));
+}
+
+/**
+ * Start the proactive connection-recovery scheduler (idempotent). No-op in
+ * build/test processes or when disabled via env. Each tick runs
+ * runConnectionRecoveryTick() against the real DB.
+ */
+export function initConnectionRecoveryScheduler(): void {
+  const state = getRecoveryState();
+  if (state.initialized || isRecoverySchedulerDisabled()) return;
+  state.initialized = true;
+
+  const tickMs = resolveConnectionRecoveryIntervalMs();
+  const tickLogger = {
+    info: (msg: string) => console.log(msg),
+    warn: (msg: string) => console.warn(msg),
+  };
+
+  const runTick = () => {
+    runConnectionRecoveryTick({ logger: tickLogger }).catch((err: unknown) => {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.warn(`${RECOVERY_LOG_PREFIX} tick error (non-fatal): ${msg}`);
+    });
+  };
+
+  console.log(
+    `${RECOVERY_LOG_PREFIX} Starting proactive cooldown recovery (tick every ${Math.round(tickMs / 1000)}s)`
+  );
+
+  // Delay the first tick a little so it never piles onto cold-start work.
+  const timer = setTimeout(() => {
+    runTick();
+    state.interval = setInterval(runTick, tickMs);
+    (state.interval as { unref?: () => void } | undefined)?.unref?.();
+  }, 15_000);
+  (timer as { unref?: () => void } | undefined)?.unref?.();
+}
+
+/** Stop the scheduler (tests / hot-reload). */
+export function stopConnectionRecoveryScheduler(): void {
+  const state = getRecoveryState();
+  if (state.interval) {
+    clearInterval(state.interval);
+    state.interval = null;
+  }
+  state.initialized = false;
+}
diff --git a/src/lib/quota/enforce.ts b/src/lib/quota/enforce.ts
index 404538e60d..3d8d844f5a 100644
--- a/src/lib/quota/enforce.ts
+++ b/src/lib/quota/enforce.ts
@@ -21,6 +21,7 @@ import { resolvePlan } from "./planResolver";
 import { getSaturation } from "./saturationSignals";
 import { getQuotaStore } from "./QuotaStore";
 import { listAllocationsForApiKey, getPool } from "@/lib/db/quotaPools";
+import { getModelCap } from "@/lib/db/quotaModelCaps";
 
 // ---------------------------------------------------------------------------
 // Constants
@@ -60,7 +61,10 @@ const COUNTABLE_UNITS = new Set(["requests", "tokens", "usd"]);
  */
 export async function enforceQuotaShare(input: EnforceInput): Promise<EnforceDecision> {
   // 1. Find pools that contain this apiKeyId.
-  let allocations: Array<{ poolId: string; allocation: import("@/lib/db/quotaPools").PoolAllocation }>;
+  let allocations: Array<{
+    poolId: string;
+    allocation: import("@/lib/db/quotaPools").PoolAllocation;
+  }>;
   try {
     allocations = listAllocationsForApiKey(input.apiKeyId);
   } catch {
@@ -103,8 +107,64 @@ export async function enforceQuotaShare(input: EnforceInput): Promise<EnforceDec
     return { kind: "allow" };
   }
 
+  // Obtain the store early — needed for both the model-cap pre-check (step 3b)
+  // and the pool-level dimension loop (step 4).
+  const store = await getQuotaStore();
+
   // 3. Resolve the provider plan (dimensions).
   const plan = resolvePlan(input.connectionId, input.provider);
+
+  // 3b. Per-(key, model) model-cap pre-check (Fase 3 #7).
+  //
+  // If the caller provides a model name, look for a cap row in
+  // quota_allocation_model_caps for (pool.id, apiKeyId, model). When found and
+  // the cap value is real (> EPSILON), peek the per-model consumption bucket and
+  // block ONLY this model if the cap is reached. Other models in the same pool
+  // remain unaffected — cap is per-model, not global.
+  //
+  // Consumption is stored in quota_consumption using a model-scoped dimension key:
+  //   poolId  = "${pool.id}:model:${model}"  (distinct from pool-level rows)
+  //   unit    = cap.capUnit
+  //   window  = "hourly"  (rate-limiting window; fixed for model caps)
+  //
+  // Fail-open per B16: any error reading the cap or peeking the store → skip check.
+  if (input.model) {
+    let modelCap: import("@/lib/db/quotaModelCaps").ModelCap | null = null;
+    try {
+      modelCap = getModelCap(pool.id, input.apiKeyId, input.model);
+    } catch {
+      // DB error — fail-open per B16
+    }
+    if (modelCap && modelCap.capValue > Number.EPSILON) {
+      const modelBucketPoolId = `${pool.id}:model:${input.model}`;
+      const modelDimKey = {
+        poolId: modelBucketPoolId,
+        unit: modelCap.capUnit,
+        window: "hourly" as const,
+      };
+      const modelConsumed = await store.peek(input.apiKeyId, modelDimKey).catch(() => 0);
+      if (modelConsumed >= modelCap.capValue) {
+        try {
+          const { notifyWebhookEvent } = await import("@/lib/webhookDispatcher");
+          notifyWebhookEvent("quota.exceeded", {
+            apiKeyId: input.apiKeyId,
+            provider: input.provider,
+            connectionId: input.connectionId,
+            reason: "model-cap",
+            model: input.model,
+          });
+        } catch {
+          // webhook is best-effort
+        }
+        return {
+          kind: "block",
+          reason: `Model cap reached for your API key on ${input.provider}/${input.model} [model-cap]`,
+          httpStatus: 429,
+        };
+      }
+    }
+  }
+
   if (!plan.dimensions.length) {
     // No dimensions configured → nothing to enforce
     return { kind: "allow" };
@@ -119,7 +179,6 @@ export async function enforceQuotaShare(input: EnforceInput): Promise<EnforceDec
       : 1;
 
   // 4. For each active dimension, peek consumption and saturation.
-  const store = await getQuotaStore();
   const dimensionsInfo: Array<{
     key: { poolId: string; unit: QuotaUnit; window: import("./dimensions").QuotaWindow };
     limit: number;
@@ -129,6 +188,13 @@ export async function enforceQuotaShare(input: EnforceInput): Promise<EnforceDec
   const consumedByThisKey: Record<string, number> = {};
 
   for (const dim of plan.dimensions) {
+    // Skip placeholder dimensions whose limit is unknown (Number.EPSILON / 0 — the
+    // "configure manually" seed for glm/minimax/kimi-coding/deepseek in planRegistry.ts).
+    // An unconfigured limit is NOT a real cap: enforcing it would block every request
+    // after the first one, because decideFairShare's global-saturated gate fires as soon
+    // as consumedTotal exceeds ~EPSILON. The real cap kicks in once a limit is set via
+    // the Wizard "Limite" step (provider_plans override).
+    if (!(dim.limit > Number.EPSILON)) continue;
     const dimKey = { poolId: pool.id, unit: dim.unit, window: dim.window };
     const dimKeyStr = dimensionKeyToString(dimKey);
 
@@ -224,7 +290,10 @@ export async function enforceQuotaShare(input: EnforceInput): Promise<EnforceDec
  * Errors are swallowed (B29): the LLM response has already been delivered.
  */
 export async function recordConsumption(input: RecordConsumptionInput): Promise<void> {
-  let allocations: Array<{ poolId: string; allocation: import("@/lib/db/quotaPools").PoolAllocation }>;
+  let allocations: Array<{
+    poolId: string;
+    allocation: import("@/lib/db/quotaPools").PoolAllocation;
+  }>;
   try {
     allocations = listAllocationsForApiKey(input.apiKeyId);
   } catch {
@@ -257,9 +326,9 @@ export async function recordConsumption(input: RecordConsumptionInput): Promise<
   if (!poolId) return;
 
   const plan = resolvePlan(input.connectionId, input.provider);
-  if (!plan.dimensions.length) return;
-
   const store = await getQuotaStore();
+
+  // Pool-level dimension consumption (existing behaviour).
   for (const dim of plan.dimensions) {
     const dimKey = { poolId, unit: dim.unit, window: dim.window };
     const cost = costForUnit(input.cost, dim.unit);
@@ -269,6 +338,33 @@ export async function recordConsumption(input: RecordConsumptionInput): Promise<
       });
     }
   }
+
+  // Per-(key, model) consumption tracking (Fase 3 #7).
+  // When the caller provides a model name, increment the model-scoped bucket so
+  // that the next enforceQuotaShare call sees an up-to-date per-model count.
+  // Only runs when a cap row actually exists (no cap → no bucket to maintain).
+  if (input.model) {
+    let modelCap: import("@/lib/db/quotaModelCaps").ModelCap | null = null;
+    try {
+      modelCap = getModelCap(poolId, input.apiKeyId, input.model);
+    } catch {
+      // DB not available — silent no-op per B29
+    }
+    if (modelCap && modelCap.capValue > Number.EPSILON) {
+      const cost = costForUnit(input.cost, modelCap.capUnit);
+      if (cost > 0) {
+        const modelBucketPoolId = `${poolId}:model:${input.model}`;
+        const modelDimKey = {
+          poolId: modelBucketPoolId,
+          unit: modelCap.capUnit,
+          window: "hourly" as const,
+        };
+        await store.consume(input.apiKeyId, modelDimKey, cost).catch(() => {
+          // Fail-open per B29
+        });
+      }
+    }
+  }
 }
 
 // ---------------------------------------------------------------------------
@@ -288,10 +384,7 @@ function messageForReason(reason: string, provider: string): string {
   }
 }
 
-function costForUnit(
-  cost: RecordConsumptionInput["cost"],
-  unit: QuotaUnit
-): number {
+function costForUnit(cost: RecordConsumptionInput["cost"], unit: QuotaUnit): number {
   switch (unit) {
     case "tokens":
       return cost.tokens ?? 0;
diff --git a/src/lib/quota/fairShare.ts b/src/lib/quota/fairShare.ts
index 4da7fcb3fa..238dea45d0 100644
--- a/src/lib/quota/fairShare.ts
+++ b/src/lib/quota/fairShare.ts
@@ -61,6 +61,19 @@ function dimensionKeyString(key: FairShareDimension["key"]): string {
   return `${key.poolId}:${key.unit}:${key.window}`;
 }
 
+const KNOWN_POLICIES: ReadonlySet<Policy> = new Set<Policy>(["hard", "soft", "burst"]);
+
+/**
+ * Fail-safe policy normalization. Any value outside the known
+ * `hard | soft | burst` set (e.g. a corrupted DB row that reached this engine
+ * through an unchecked `row.policy as Policy` cast) is treated as the most
+ * restrictive policy, `hard`. This closes a fail-OPEN hole: an unknown policy
+ * used to fall through every `switch` case and return a silent `allow`.
+ */
+function normalizePolicy(policy: Policy): Policy {
+  return KNOWN_POLICIES.has(policy) ? policy : "hard";
+}
+
 // ---------------------------------------------------------------------------
 // Core algorithm
 // ---------------------------------------------------------------------------
@@ -77,6 +90,10 @@ export function decideFairShare(input: FairShareInput): FairShareDecision {
     return { kind: "allow", reason: "ok" };
   }
 
+  // Fail-safe: an unknown/corrupted policy is treated as `hard` (most
+  // restrictive) so it can never silently bypass fair-share enforcement.
+  const effectivePolicy = normalizePolicy(allocation.policy);
+
   let anyPenalized = false;
 
   for (const dim of dimensions) {
@@ -97,7 +114,7 @@ export function decideFairShare(input: FairShareInput): FairShareDecision {
     // If the pool's global limit is already reached AND this key's request
     // would exceed it (burst mode without borrow room), block as "global-saturated".
     if (dim.consumedTotal >= dim.limit) {
-      if (allocation.policy !== "burst") {
+      if (effectivePolicy !== "burst") {
         return { kind: "block", reason: "global-saturated" };
       }
       // burst also blocked when no room at all
@@ -108,7 +125,9 @@ export function decideFairShare(input: FairShareInput): FairShareDecision {
 
     if (isStrict) {
       // ── Strict mode ────────────────────────────────────────────────────
-      switch (allocation.policy) {
+      // effectivePolicy is normalized (unknown → hard), so these cases are
+      // exhaustive and an unknown policy is enforced as hard.
+      switch (effectivePolicy) {
         case "hard":
           // Hard: block once consumed >= fair_share
           if (consumed >= fairShare) {
@@ -131,7 +150,8 @@ export function decideFairShare(input: FairShareInput): FairShareDecision {
     } else {
       // ── Generous mode ──────────────────────────────────────────────────
       // There is slack — allow borrowing up to the global limit.
-      switch (allocation.policy) {
+      // effectivePolicy is normalized (unknown → hard).
+      switch (effectivePolicy) {
         case "hard":
           // Hard in generous mode: allow if global limit not reached AND
           // the key is within global limit (which we know because
diff --git a/src/lib/quota/quotaCombos.ts b/src/lib/quota/quotaCombos.ts
index ed625cf8f9..4d4c17863b 100644
--- a/src/lib/quota/quotaCombos.ts
+++ b/src/lib/quota/quotaCombos.ts
@@ -21,8 +21,21 @@ import {
   updateCombo,
 } from "@/lib/db/combos";
 import { REGISTRY } from "@omniroute/open-sse/config/providerRegistry";
-import { quotaModelName, parseQuotaModelName, isQuotaModelName, quotaGroupSlug } from "./quotaModelNaming";
+import {
+  quotaModelName,
+  parseQuotaModelName,
+  isQuotaModelName,
+  quotaGroupSlug,
+} from "./quotaModelNaming";
 import { createLogger } from "@/shared/utils/logger";
+import type { AnyRoutingStrategyValue } from "@/shared/constants/routingStrategies";
+
+/**
+ * Routing strategy for every auto-minted quota-share (qtSd/) combo. Internal
+ * only — resolves to the dedicated DRR + P2C in-flight + per-model gating
+ * selection in combo.ts (Phase 3 #9). Was "fill-first" before the hardening.
+ */
+export const QUOTA_SHARE_STRATEGY: AnyRoutingStrategyValue = "quota-share";
 
 const log = createLogger("quota/quotaCombos");
 
@@ -87,7 +100,11 @@ function getProviderModelIds(provider: string): string[] {
   const models = entry && Array.isArray(entry.models) ? entry.models : [];
   if (models.length === 0) return [];
   return models
-    .map((m) => (typeof m === "object" && m !== null && typeof (m as { id?: unknown }).id === "string" ? (m as { id: string }).id : null))
+    .map((m) =>
+      typeof m === "object" && m !== null && typeof (m as { id?: unknown }).id === "string"
+        ? (m as { id: string }).id
+        : null
+    )
     .filter((id): id is string => id !== null && id.length > 0);
 }
 
@@ -161,8 +178,9 @@ export async function syncQuotaCombos(poolId: string): Promise<void> {
   const poolProvider: string | undefined = upsertWork[0]?.provider;
 
   // Group steps by model across all connections (Task 3 guarantees a single provider).
-  // This produces one combo per model with ALL connections' steps + strategy "fill-first",
-  // fixing the collision where two same-provider connections would overwrite each other.
+  // This produces one combo per model with ALL connections' steps + the dedicated
+  // "quota-share" strategy (Phase 3 #9), fixing the collision where two same-provider
+  // connections would overwrite each other.
   const byModel = new Map<string, Array<{ connId: string; provider: string }>>();
   for (const { connId, provider, modelIds } of upsertWork) {
     for (const modelId of modelIds) {
@@ -184,7 +202,12 @@ export async function syncQuotaCombos(poolId: string): Promise<void> {
     }));
     try {
       const existing = await getComboByName(comboName);
-      const payload = { name: comboName, models: steps, strategy: "fill-first" as const, isHidden: true };
+      const payload = {
+        name: comboName,
+        models: steps,
+        strategy: QUOTA_SHARE_STRATEGY,
+        isHidden: true,
+      };
       if (existing && typeof existing.id === "string") await updateCombo(existing.id, payload);
       else await createCombo(payload);
     } catch (err) {
@@ -228,7 +251,10 @@ export async function syncQuotaCombos(poolId: string): Promise<void> {
       try {
         await deleteComboByName(name);
       } catch (err) {
-        log.warn({ err: (err as Error)?.message, comboName: name, poolId }, "quota-combo prune failed");
+        log.warn(
+          { err: (err as Error)?.message, comboName: name, poolId },
+          "quota-combo prune failed"
+        );
       }
     }
   }
@@ -261,6 +287,51 @@ export function filterModelsToQuotaPools<T extends { id: string }>(
   });
 }
 
+/**
+ * #4806 — Build the /v1/models catalog list for a quota-exclusive API key.
+ *
+ * The pool's qtSd/<group>/<provider>/<model> combos are isHidden:true, so the
+ * base /v1/models list (which skips hidden combos) never contains them. Filtering
+ * that base list therefore returned nothing and clients (e.g. Claude Desktop)
+ * showed "0 modelo encontrado" once "Cota exclusiva" was enabled on the pool.
+ *
+ * This selects the (hidden) qtSd/* combos whose parsed group slug is in
+ * `poolSlugs` and maps each through `toEntry` — the catalog's own combo-entry
+ * builder — so it stays free of catalog-internal helpers and is unit-testable.
+ *
+ * Fail-closed: an empty `poolSlugs` array yields an empty list (a quota key with
+ * no resolvable pools sees no models).
+ */
+export async function buildQuotaExclusiveModels<TCombo extends { name?: unknown }>(
+  allowedQuotas: string[],
+  combos: TCombo[],
+  timestamp: number,
+  metadataFor: (combo: TCombo) => Record<string, unknown>
+): Promise<Array<Record<string, unknown>>> {
+  const { resolveQuotaKeyScope } = await import("./quotaKey");
+  const scope = await resolveQuotaKeyScope(allowedQuotas);
+  if (scope.poolSlugs.length === 0) return [];
+  const slugSet = new Set(scope.poolSlugs);
+  const out: Array<Record<string, unknown>> = [];
+  for (const combo of combos) {
+    const name = typeof combo.name === "string" ? combo.name : "";
+    if (!isQuotaModelName(name)) continue;
+    const parsed = parseQuotaModelName(name);
+    if (!parsed || !slugSet.has(parsed.groupSlug)) continue;
+    out.push({
+      id: name,
+      object: "model",
+      created: timestamp,
+      owned_by: "combo",
+      permission: [],
+      root: name,
+      parent: null,
+      ...metadataFor(combo),
+    });
+  }
+  return out;
+}
+
 /**
  * Delete ALL `quotaShared-*` combos that belong to the given pool.
  *
@@ -290,7 +361,10 @@ export async function removeQuotaCombosForPool(poolId: string): Promise<void> {
   let poolProvider: string | undefined;
   for (const connId of pool.connectionIds) {
     try {
-      const connection = (await getProviderConnectionById(connId)) as Record<string, unknown> | null;
+      const connection = (await getProviderConnectionById(connId)) as Record<
+        string,
+        unknown
+      > | null;
       if (connection && typeof connection.provider === "string" && connection.provider.length > 0) {
         poolProvider = connection.provider;
         break;
@@ -309,7 +383,10 @@ export async function removeQuotaCombosForPool(poolId: string): Promise<void> {
   try {
     allCombos = await getCombos();
   } catch (err) {
-    log.warn({ err: (err as Error)?.message, poolId }, "removeQuotaCombosForPool: getCombos failed");
+    log.warn(
+      { err: (err as Error)?.message, poolId },
+      "removeQuotaCombosForPool: getCombos failed"
+    );
     return;
   }
 
@@ -328,7 +405,10 @@ export async function removeQuotaCombosForPool(poolId: string): Promise<void> {
     try {
       await deleteComboByName(name);
     } catch (err) {
-      log.warn({ err: (err as Error)?.message, comboName: name, poolId }, "quota-combo remove failed");
+      log.warn(
+        { err: (err as Error)?.message, comboName: name, poolId },
+        "quota-combo remove failed"
+      );
     }
   }
 }
diff --git a/src/lib/quota/saturationSignals.ts b/src/lib/quota/saturationSignals.ts
index c045288707..84b07e441f 100644
--- a/src/lib/quota/saturationSignals.ts
+++ b/src/lib/quota/saturationSignals.ts
@@ -3,11 +3,20 @@
  * for a provider/connection/dimension combination.
  *
  * Strategy (per provider):
- *   codex   → codexQuotaFetcher (dual 5h + weekly window)
- *   bailian → bailianQuotaFetcher (triple 5h + weekly + monthly window)
- *   default → getUsageForProvider (open-sse/services/usage.ts)
+ *   codex            → codexQuotaFetcher (dual 5h + weekly window)
+ *   bailian          → bailianQuotaFetcher (triple 5h + weekly + monthly window)
+ *   anthropic/claude → REAL plan-window utilization from GET /api/oauth/usage
+ *                      (the same path usage.ts already uses): window "5h" →
+ *                      five_hour.utilization, "weekly" → seven_day.utilization.
+ *                      Falls back to the per-minute REQUEST rate-limit headers
+ *                      (anthropic-ratelimit-requests-*) only when no OAuth plan
+ *                      window is available (e.g. API-key Claude connections).
+ *   default          → getUsageForProvider (open-sse/services/usage.ts)
  *
- * Cache: in-memory Map, TTL = 30 seconds.
+ * Cache: in-memory Map, TTL = 30 seconds. The 30s TTL is what keeps the
+ * NON-OFFICIAL, rate-limited oauth/usage endpoint from being polled per
+ * request (it returns 429 under load) — never call it on the hot path without
+ * this cache. usage.ts adds its own 429 cooldown on top.
  * Fail-open: on any error, return 0 (generous mode) and log pino.warn.
  * Hard Rule #12: no stack traces propagated to return values.
  *
@@ -15,6 +24,7 @@
  */
 
 import { createLogger } from "@/shared/utils/logger";
+import { updateAccountBuckets, type ClaudeUsageResult } from "./accountBuckets";
 import type { QuotaUnit, QuotaWindow } from "./dimensions";
 
 const log = createLogger("quota:saturation");
@@ -51,18 +61,124 @@ interface RateLimitHeaderEntry {
   ts: number;
 }
 
+/**
+ * TOKEN rate-limit header snapshot. Unlike the per-minute REQUEST headers, the
+ * token headers ride on EVERY upstream response (success too), so they enable
+ * proactive throttling before a 429. `resetAt` is the upstream reset normalized
+ * to epoch ms (Anthropic RFC3339 → Date.parse; OpenAI duration → now + secs),
+ * or null when the upstream sent no reset header.
+ */
+interface TokenHeaderEntry {
+  limit: number;
+  remaining: number;
+  resetAt: number | null; // epoch ms, normalized; null when unknown
+  ts: number;
+}
+
 const _rateLimitHeaders = new Map<string, RateLimitHeaderEntry>();
+const _tokenHeaders = new Map<string, TokenHeaderEntry>();
 const RL_HEADER_TTL_MS = 5 * 60 * 1000; // 5 minutes
 
+/** Test-only: clear the rate-limit + token header caches between asserts. */
+export function _clearRateLimitHeaders(): void {
+  _rateLimitHeaders.clear();
+  _tokenHeaders.clear();
+}
+
+/**
+ * Parse an OpenAI rate-limit reset DURATION string into milliseconds.
+ * OpenAI reports token/request resets as Go-style durations, e.g. "6m0s",
+ * "1s", "1h30m15s", "1.5s". Returns null when unparseable.
+ */
+function parseDurationMs(raw: string): number | null {
+  const s = raw.trim();
+  if (!s) return null;
+  // Bounded, non-overlapping segments to avoid ReDoS (PII learning #1).
+  const re = /(\d+(?:\.\d+)?)(ms|h|m|s)/g;
+  let total = 0;
+  let matched = false;
+  let m: RegExpExecArray | null;
+  while ((m = re.exec(s)) !== null) {
+    matched = true;
+    const value = Number(m[1]);
+    if (!Number.isFinite(value)) return null;
+    switch (m[2]) {
+      case "h":
+        total += value * 3_600_000;
+        break;
+      case "m":
+        total += value * 60_000;
+        break;
+      case "s":
+        total += value * 1000;
+        break;
+      case "ms":
+        total += value;
+        break;
+    }
+  }
+  return matched ? total : null;
+}
+
+/**
+ * Normalize a token-reset header value to epoch ms.
+ *   - Anthropic: RFC3339 timestamp ("2026-01-01T00:00:30Z") → Date.parse.
+ *   - OpenAI: duration ("6m0s") → now + parsed ms.
+ * Returns null when absent or unparseable.
+ */
+function normalizeTokenReset(raw: string | undefined, nowMs: number): number | null {
+  if (!raw) return null;
+  const s = raw.trim();
+  if (!s) return null;
+  // RFC3339 / ISO-8601 if it looks like a date (YYYY-MM-DD with a time sep).
+  if (/\d{4}-\d{2}-\d{2}/.test(s) && /[T:]/.test(s)) {
+    const t = Date.parse(s);
+    if (Number.isFinite(t)) return t;
+  }
+  // Otherwise treat as an OpenAI-style duration relative to now.
+  const durMs = parseDurationMs(s);
+  return durMs === null ? null : nowMs + durMs;
+}
+
+/**
+ * Pick the first present {limit, remaining[, reset]} triple from a list of
+ * header-key candidates, in priority order. Returns null when none are usable
+ * (missing keys, non-finite, or limit <= 0).
+ */
+function pickTokenTriple(
+  headers: Record<string, string>,
+  candidates: Array<{ limit: string; remaining: string; reset: string }>
+): { limit: number; remaining: number; reset: string | undefined } | null {
+  for (const c of candidates) {
+    const limitStr = headers[c.limit];
+    const remainingStr = headers[c.remaining];
+    if (limitStr === undefined || remainingStr === undefined) continue;
+    const limit = Number(limitStr);
+    const remaining = Number(remainingStr);
+    if (Number.isFinite(limit) && limit > 0 && Number.isFinite(remaining)) {
+      return { limit, remaining, reset: headers[c.reset] };
+    }
+  }
+  return null;
+}
+
 /**
  * Store rate-limit headers from an upstream response for saturation signal use.
  * Called by the response handler after a successful request.
+ *
+ * Captures two independent signals, both keyed `${provider}:${connectionId}`:
+ *   - REQUEST headers (per-minute RPM burst) — legacy, anthropic fallback.
+ *   - TOKEN headers (per-window TPM) — universal proactive saturation; present
+ *     on EVERY response, so we can throttle before the 429.
  */
 export function storeRateLimitHeaders(
   connectionId: string,
   provider: string,
   headers: Record<string, string>
 ): void {
+  const key = `${provider}:${connectionId}`;
+
+  // ── REQUEST headers (legacy path, unchanged) ──────────────────────────────
   // Anthropic: anthropic-ratelimit-requests-limit / anthropic-ratelimit-requests-remaining
   const limitStr =
     headers["anthropic-ratelimit-requests-limit"] ??
@@ -77,13 +193,63 @@ export function storeRateLimitHeaders(
     const limit = Number(limitStr);
     const remaining = Number(remainingStr);
     if (Number.isFinite(limit) && limit > 0 && Number.isFinite(remaining)) {
-      _rateLimitHeaders.set(`${provider}:${connectionId}`, {
-        limit,
-        remaining,
-        ts: Date.now(),
-      });
+      _rateLimitHeaders.set(key, { limit, remaining, ts: Date.now() });
     }
   }
+
+  // ── TOKEN headers (universal proactive saturation) ────────────────────────
+  // Anthropic base tokens, then OpenAI x-ratelimit-*-tokens, then anthropic
+  // input/output variants as a fallback. First usable triple wins.
+  const tokenTriple = pickTokenTriple(headers, [
+    {
+      limit: "anthropic-ratelimit-tokens-limit",
+      remaining: "anthropic-ratelimit-tokens-remaining",
+      reset: "anthropic-ratelimit-tokens-reset",
+    },
+    {
+      limit: "x-ratelimit-limit-tokens",
+      remaining: "x-ratelimit-remaining-tokens",
+      reset: "x-ratelimit-reset-tokens",
+    },
+    {
+      limit: "anthropic-ratelimit-input-tokens-limit",
+      remaining: "anthropic-ratelimit-input-tokens-remaining",
+      reset: "anthropic-ratelimit-input-tokens-reset",
+    },
+    {
+      limit: "anthropic-ratelimit-output-tokens-limit",
+      remaining: "anthropic-ratelimit-output-tokens-remaining",
+      reset: "anthropic-ratelimit-output-tokens-reset",
+    },
+  ]);
+
+  if (tokenTriple) {
+    const now = Date.now();
+    _tokenHeaders.set(key, {
+      limit: tokenTriple.limit,
+      remaining: tokenTriple.remaining,
+      resetAt: normalizeTokenReset(tokenTriple.reset, now),
+      ts: now,
+    });
+  }
+}
+
+/**
+ * Token-header saturation signal for a (provider, connectionId).
+ * Returns `{ saturation, resetAt }` where saturation = 1 − remaining/limit
+ * (clamped 0..1) and resetAt is the normalized epoch-ms reset (or null), or
+ * null when no fresh token-header data exists.
+ */
+export function getTokenHeaderSaturation(
+  provider: string,
+  connectionId: string
+): { saturation: number; resetAt: number | null } | null {
+  const entry = _tokenHeaders.get(`${provider}:${connectionId}`);
+  if (!entry || Date.now() - entry.ts > RL_HEADER_TTL_MS) return null;
+  if (!(entry.limit > 0)) return null;
+  const used = entry.limit - entry.remaining;
+  const saturation = Math.min(1, Math.max(0, used / entry.limit));
+  return { saturation, resetAt: entry.resetAt };
 }
 
 function cacheKey(connectionId: string, provider: string, dim: DimensionSpec): string {
@@ -158,10 +324,13 @@ async function fetchBailianSaturation(
   return Math.min(1, Math.max(0, pct));
 }
 
-async function fetchAnthropicSaturation(
-  connectionId: string,
-  dim: DimensionSpec
-): Promise<number> {
+/**
+ * Per-minute REQUEST rate-limit headers fallback. Used only when the OAuth
+ * plan-window utilization is unavailable (e.g. API-key Claude connections that
+ * have no /api/oauth/usage data). This signal reflects TPM/RPM bursts, NOT the
+ * 5h/weekly plan window, so it is a weak last resort.
+ */
+function anthropicHeaderSaturation(connectionId: string): number {
   const entry = _rateLimitHeaders.get(`anthropic:${connectionId}`);
   if (!entry || Date.now() - entry.ts > RL_HEADER_TTL_MS) return 0;
 
@@ -169,26 +338,175 @@ async function fetchAnthropicSaturation(
   return Math.min(1, Math.max(0, used / entry.limit));
 }
 
+/**
+ * Injectable seam (DB lookup + usage fetch) so the oauth/usage plan-window path
+ * is unit-testable without touching the DB or the network. Defaults are wired
+ * lazily to the real implementations inside fetchAnthropicSaturation.
+ */
+interface AnthropicSaturationDeps {
+  /** Resolve a connection (with decrypted accessToken/authType) by id. */
+  loadConnection: (connectionId: string) => Promise<Record<string, unknown> | null>;
+  /** Fetch usage for the connection (delegates to getUsageForProvider). */
+  fetchUsage: (conn: Record<string, unknown>) => Promise<unknown>;
+}
+
+let _anthropicDepsOverride: AnthropicSaturationDeps | null = null;
+
+/** Test-only: inject ({loadConnection, fetchUsage}); pass null to restore. */
+export function __setAnthropicSaturationDepsForTests(
+  deps: AnthropicSaturationDeps | null
+): void {
+  _anthropicDepsOverride = deps;
+}
+
+async function defaultAnthropicDeps(): Promise<AnthropicSaturationDeps> {
+  const [providersMod, usageMod] = await Promise.all([
+    import("@/lib/db/providers"),
+    import("@omniroute/open-sse/services/usage"),
+  ]);
+  return {
+    loadConnection: (connectionId) =>
+      providersMod.getProviderConnectionById(connectionId) as Promise<Record<
+        string,
+        unknown
+      > | null>,
+    fetchUsage: (conn) =>
+      usageMod.getUsageForProvider(conn as Parameters<typeof usageMod.getUsageForProvider>[0]),
+  };
+}
+
+/**
+ * Map a QuotaWindow to the Claude usage quota key produced by getClaudeUsage
+ * (usage.ts). "session (5h)" carries five_hour.utilization and "weekly (7d)"
+ * carries seven_day.utilization.
+ */
+function claudeUsageKeyForWindow(window: QuotaWindow): string | null {
+  switch (window) {
+    case "5h":
+      return "session (5h)";
+    case "weekly":
+    case "monthly":
+      // Anthropic exposes a 7-day plan window, not a monthly one — treat the
+      // longer requested window as the weekly plan saturation.
+      return "weekly (7d)";
+    default:
+      return null;
+  }
+}
+
+/**
+ * Extract the plan utilization (0..1) for the requested window from a
+ * getClaudeUsage() result, or null when the OAuth plan window is unavailable
+ * (e.g. legacy/admin API-key shape with no per-window quotas).
+ */
+function planUtilizationFromUsage(usage: unknown, window: QuotaWindow): number | null {
+  if (!usage || typeof usage !== "object") return null;
+  const quotas = (usage as Record<string, unknown>).quotas;
+  if (!quotas || typeof quotas !== "object" || Array.isArray(quotas)) return null;
+
+  const key = claudeUsageKeyForWindow(window);
+  if (!key) return null;
+  const entry = (quotas as Record<string, unknown>)[key];
+  if (!entry || typeof entry !== "object") return null;
+
+  // getClaudeUsage stores `used` = utilization (% used, 0..100).
+  const used = (entry as Record<string, unknown>).used;
+  if (typeof used !== "number" || !Number.isFinite(used)) return null;
+  return Math.min(1, Math.max(0, used / 100));
+}
+
+async function fetchAnthropicSaturation(
+  connectionId: string,
+  dim: DimensionSpec
+): Promise<number> {
+  // Try the REAL plan-window utilization first (5h / weekly), via the same
+  // /api/oauth/usage path usage.ts already uses. This is the signal fairShare
+  // actually needs for Claude Pro/Max — the per-minute request headers do not
+  // reflect the plan window. Any failure here falls back to the header path,
+  // and ultimately fails open (0).
+  try {
+    const deps = _anthropicDepsOverride ?? (await defaultAnthropicDeps());
+    const conn = await deps.loadConnection(connectionId);
+    // Only OAuth connections have plan-window usage; API-key Claude does not.
+    const hasOauthToken =
+      !!conn &&
+      typeof conn.accessToken === "string" &&
+      conn.accessToken.length > 0 &&
+      (conn.authType === undefined || conn.authType === "oauth");
+    if (hasOauthToken) {
+      const usage = await deps.fetchUsage(conn as Record<string, unknown>);
+      // Update the per-window saturating buckets (Phase 3 #3) off the request
+      // hot path — this runs behind the 30s saturation cache. Fail-open: any
+      // bucket error must never affect the primary 0..1 saturation signal.
+      try {
+        updateAccountBuckets(connectionId, usage as ClaudeUsageResult, Date.now());
+      } catch {
+        // intentionally swallowed — buckets are additive, never gate-breaking
+      }
+      const util = planUtilizationFromUsage(usage, dim.window);
+      if (util !== null) return util;
+    }
+  } catch (err) {
+    log.warn(
+      { err: (err as Error)?.message, connectionId },
+      "anthropic oauth/usage saturation failed — falling back to rate-limit headers"
+    );
+  }
+
+  // Fallback: per-minute REQUEST rate-limit headers (weak, TPM/RPM only).
+  return anthropicHeaderSaturation(connectionId);
+}
+
+/**
+ * Injectable seam for the generic usage fetch so the token-header
+ * complement/fallback is unit-testable without the open-sse usage service.
+ * Defaults to getUsageForProvider; pass null to restore.
+ */
+type GenericUsageFetcher = (connectionId: string, provider: string) => Promise<unknown>;
+let _genericUsageFetcherOverride: GenericUsageFetcher | null = null;
+
+/** Test-only: inject the generic usage fetcher; pass null to restore. */
+export function __setGenericUsageFetcherForTests(fetcher: GenericUsageFetcher | null): void {
+  _genericUsageFetcherOverride = fetcher;
+}
+
+async function defaultGenericUsageFetch(
+  connectionId: string,
+  provider: string
+): Promise<unknown> {
+  const mod = await import("@omniroute/open-sse/services/usage");
+  const conn = { id: connectionId, provider } as Parameters<typeof mod.getUsageForProvider>[0];
+  return mod.getUsageForProvider(conn);
+}
+
 async function fetchGenericSaturation(
   connectionId: string,
   provider: string
 ): Promise<number> {
+  // 1. Real usage percent is authoritative when present (a provider that
+  //    actually reports utilization beats the burst-window token headers).
   try {
-    const mod = await import("@omniroute/open-sse/services/usage");
-    const conn = { id: connectionId, provider } as Parameters<typeof mod.getUsageForProvider>[0];
-    const result = await mod.getUsageForProvider(conn);
-    if (!result || typeof result !== "object") return 0;
-    const obj = result as Record<string, unknown>;
-    const pct =
-      typeof obj.percentUsed === "number"
-        ? obj.percentUsed
-        : typeof obj.used_percent === "number"
-          ? obj.used_percent
-          : 0;
-    return Math.min(1, Math.max(0, pct));
+    const fetcher = _genericUsageFetcherOverride ?? defaultGenericUsageFetch;
+    const result = await fetcher(connectionId, provider);
+    if (result && typeof result === "object") {
+      const obj = result as Record<string, unknown>;
+      const pct =
+        typeof obj.percentUsed === "number"
+          ? obj.percentUsed
+          : typeof obj.used_percent === "number"
+            ? obj.used_percent
+            : null;
+      if (pct !== null && Number.isFinite(pct)) {
+        return Math.min(1, Math.max(0, pct));
+      }
+    }
   } catch {
-    return 0;
+    // fall through to the token-header complement
   }
+
+  // 2. Complement/fallback: proactive TOKEN-header saturation (universal, rides
+  //    on every response). Fail-open to 0 when no fresh token-header data.
+  return getTokenHeaderSaturation(provider, connectionId)?.saturation ?? 0;
 }
 
 // ---------------------------------------------------------------------------
diff --git a/src/lib/quota/spendRecorder.ts b/src/lib/quota/spendRecorder.ts
index b64c0d0b65..6222ec0920 100644
--- a/src/lib/quota/spendRecorder.ts
+++ b/src/lib/quota/spendRecorder.ts
@@ -122,6 +122,8 @@ export async function recordStreamingConsumption(
       apiKeyId,
       connectionId,
       provider: resolvedProvider,
+      // Per-(key,model) cap accounting on streaming traffic — same resolved model id.
+      model: model || undefined,
       cost: buildConsumptionCost(streamUsage, estimatedCost),
     },
     deps.log
diff --git a/src/lib/quota/types.ts b/src/lib/quota/types.ts
index 98c119e2ee..a612549ab7 100644
--- a/src/lib/quota/types.ts
+++ b/src/lib/quota/types.ts
@@ -66,6 +66,13 @@ export interface EnforceInput {
   apiKeyId: string;
   connectionId: string;
   provider: string;
+  /**
+   * Optional model identifier. When present, `enforceQuotaShare` checks for a
+   * per-(key, model) cap row in `quota_allocation_model_caps` and blocks only
+   * this model if the cap is reached (Fase 3 #7). Fully backward-compatible:
+   * callers that do not pass `model` receive unchanged behaviour.
+   */
+  model?: string;
   estimatedCost?: { tokens?: number; usd?: number; requests?: number };
 }
 
@@ -77,5 +84,11 @@ export interface RecordConsumptionInput {
   apiKeyId: string;
   connectionId: string;
   provider: string;
+  /**
+   * Optional model identifier. When present, `recordConsumption` also
+   * increments the per-(key, model) consumption bucket used by the model-cap
+   * pre-check in `enforceQuotaShare` (Fase 3 #7). Backward-compatible.
+   */
+  model?: string;
   cost: { tokens?: number; usd?: number; requests?: number };
 }
diff --git a/src/lib/resilience/modelLockoutSettings.ts b/src/lib/resilience/modelLockoutSettings.ts
index 463881e28b..39e961e724 100644
--- a/src/lib/resilience/modelLockoutSettings.ts
+++ b/src/lib/resilience/modelLockoutSettings.ts
@@ -30,11 +30,7 @@ function toInteger(
   const min = options.min ?? 0;
   const max = options.max ?? Number.MAX_SAFE_INTEGER;
   const parsed =
-    typeof value === "number"
-      ? value
-      : typeof value === "string"
-        ? Number(value)
-        : fallback;
+    typeof value === "number" ? value : typeof value === "string" ? Number(value) : fallback;
   return Number.isFinite(parsed) ? Math.max(min, Math.min(max, Math.trunc(parsed))) : fallback;
 }
 
@@ -65,10 +61,14 @@ export function resolveModelLockoutSettings(
     process.execArgv.includes("--test") ||
     process.argv.some((arg) => typeof arg === "string" && arg.includes("test"));
 
-  const baseCooldownMs = toInteger(raw.baseCooldownMs, DEFAULT_MODEL_LOCKOUT_SETTINGS.baseCooldownMs, {
-    min: isTest ? 0 : 5_000,
-    max: 600_000,
-  });
+  const baseCooldownMs = toInteger(
+    raw.baseCooldownMs,
+    DEFAULT_MODEL_LOCKOUT_SETTINGS.baseCooldownMs,
+    {
+      min: isTest ? 0 : 5_000,
+      max: 600_000,
+    }
+  );
   const maxCooldownMs = Math.max(
     toInteger(raw.maxCooldownMs, DEFAULT_MODEL_LOCKOUT_SETTINGS.maxCooldownMs, {
       min: isTest ? 0 : 5_000,
diff --git a/src/lib/resilience/settings.ts b/src/lib/resilience/settings.ts
index b726ab1c9e..834a827967 100644
--- a/src/lib/resilience/settings.ts
+++ b/src/lib/resilience/settings.ts
@@ -42,6 +42,36 @@ export interface WaitForCooldownSettings {
   maxRetryWaitMs: number;
 }
 
+/**
+ * Quota-share combo cooldown-aware retry (Variante A). A quota-share (`qtSd/…`)
+ * combo that would crystallize a 429 `model_cooldown` for a SHORT transient
+ * cooldown waits it out and re-dispatches instead. Guards (gating + the
+ * `quota_exhausted`/auth/not-found exclusions) live in
+ * open-sse/services/combo/comboCooldownRetry.ts; `maxWaitMs`/`maxAttempts`/
+ * `budgetMs` bound a single wait, the retry cycles, and the total wait time.
+ */
+export interface ComboCooldownWaitSettings {
+  enabled: boolean;
+  maxWaitMs: number;
+  maxAttempts: number;
+  budgetMs: number;
+}
+
+/**
+ * Per-connection concurrency limit for quota-share (`qtSd/…`) combos (FASE 2.1).
+ * The quota-share gating in selectQuotaShareTarget is fail-open and cannot
+ * hard-limit a single-connection pool, so concurrent requests to one
+ * subscription account can still flood it (→ 429 + cooldown). When a connection
+ * declares a positive `max_concurrent` ceiling, this layer serializes concurrent
+ * requests to that account through a per-connection semaphore (excess requests
+ * wait in the queue instead of flooding). Kill-switch only: the cap itself comes
+ * from each connection's `max_concurrent`. Wiring lives in
+ * open-sse/services/combo/quotaShareConcurrency.ts.
+ */
+export interface QuotaShareConcurrencyLimitSettings {
+  enabled: boolean;
+}
+
 export interface ProviderCooldownSettings {
   /**
    * Minimum cooldown (ms) before a failed provider/connection can be retried.
@@ -125,6 +155,8 @@ export interface ResilienceSettings {
   connectionCooldown: Record<AuthCategory, ConnectionCooldownProfileSettings>;
   providerBreaker: Record<AuthCategory, ProviderBreakerProfileSettings>;
   waitForCooldown: WaitForCooldownSettings;
+  comboCooldownWait: ComboCooldownWaitSettings;
+  quotaShareConcurrencyLimit: QuotaShareConcurrencyLimitSettings;
   providerCooldown: ProviderCooldownSettings;
   quotaPreflight: QuotaPreflightSettings;
   streamRecovery: StreamRecoverySettings;
@@ -135,6 +167,8 @@ export interface ResilienceSettingsPatch {
   connectionCooldown?: Partial<Record<AuthCategory, Partial<ConnectionCooldownProfileSettings>>>;
   providerBreaker?: Partial<Record<AuthCategory, Partial<ProviderBreakerProfileSettings>>>;
   waitForCooldown?: Partial<WaitForCooldownSettings>;
+  comboCooldownWait?: Partial<ComboCooldownWaitSettings>;
+  quotaShareConcurrencyLimit?: Partial<QuotaShareConcurrencyLimitSettings>;
   providerCooldown?: Partial<ProviderCooldownSettings>;
   quotaPreflight?: Partial<QuotaPreflightSettings>;
   streamRecovery?: Partial<StreamRecoverySettings>;
@@ -246,6 +280,22 @@ export const DEFAULT_RESILIENCE_SETTINGS: ResilienceSettings = {
     maxRetryWaitSec: 30,
     maxRetryWaitMs: 30000,
   },
+  // Conservative defaults: wait at most 5s for a single short transient
+  // cooldown, at most 2 redispatch cycles, never more than 8s total. Active only
+  // for quota-share combos and only for transient (non quota_exhausted) reasons.
+  comboCooldownWait: {
+    enabled: true,
+    maxWaitMs: 5000,
+    maxAttempts: 2,
+    budgetMs: 8000,
+  },
+  // FASE 2.1: serialize concurrent quota-share requests per connection when the
+  // connection sets a max_concurrent cap, so a subscription account is not
+  // flooded past its concurrency ceiling. Kill-switch only (default on); the cap
+  // comes from each connection's max_concurrent.
+  quotaShareConcurrencyLimit: {
+    enabled: true,
+  },
   providerCooldown: {
     minRetryCooldownMs: Number(process.env.PROVIDER_COOLDOWN_MIN_MS || "5000"),
     maxRetryCooldownMs: Number(process.env.PROVIDER_COOLDOWN_MAX_MS || "300000"),
@@ -503,6 +553,35 @@ function normalizeWaitForCooldownSettings(
   };
 }
 
+function normalizeComboCooldownWaitSettings(
+  next: unknown,
+  fallback: ComboCooldownWaitSettings
+): ComboCooldownWaitSettings {
+  const record = asRecord(next);
+  // Hard ceiling of 30s on a single wait — this layer only ever exists for
+  // SHORT transient cooldowns; anything longer should fall through to the
+  // existing 429 crystallization (and the cross-request cooldown layers).
+  const maxWaitMs = toInteger(record.maxWaitMs, fallback.maxWaitMs, { min: 0, max: 30000 });
+  const maxAttempts = toInteger(record.maxAttempts, fallback.maxAttempts, { min: 0, max: 10 });
+  // Budget can never be smaller than a single wait, otherwise no wait could
+  // ever fire; floor it at maxWaitMs.
+  const budgetMs = toInteger(record.budgetMs, fallback.budgetMs, {
+    min: maxWaitMs,
+    max: 5 * 60 * 1000,
+  });
+  const enabled = toBoolean(record.enabled, fallback.enabled) && maxWaitMs > 0 && maxAttempts > 0;
+
+  return { enabled, maxWaitMs, maxAttempts, budgetMs };
+}
+
+function normalizeQuotaShareConcurrencyLimitSettings(
+  next: unknown,
+  fallback: QuotaShareConcurrencyLimitSettings
+): QuotaShareConcurrencyLimitSettings {
+  const record = asRecord(next);
+  return { enabled: toBoolean(record.enabled, fallback.enabled) };
+}
+
 function normalizeProviderCooldownSettings(
   next: unknown,
   fallback: ProviderCooldownSettings
@@ -617,6 +696,8 @@ function buildLegacyFallback(settings: JsonRecord): ResilienceSettings {
       maxRetryWaitSec: waitMaxRetrySec,
       maxRetryWaitMs: waitMaxRetrySec * 1000,
     },
+    comboCooldownWait: DEFAULT_RESILIENCE_SETTINGS.comboCooldownWait,
+    quotaShareConcurrencyLimit: DEFAULT_RESILIENCE_SETTINGS.quotaShareConcurrencyLimit,
     providerCooldown: DEFAULT_RESILIENCE_SETTINGS.providerCooldown,
     quotaPreflight: DEFAULT_RESILIENCE_SETTINGS.quotaPreflight,
     streamRecovery: streamRecoveryDefaults,
@@ -656,6 +737,14 @@ export function resolveResilienceSettings(
       current.waitForCooldown,
       fallback.waitForCooldown
     ),
+    comboCooldownWait: normalizeComboCooldownWaitSettings(
+      current.comboCooldownWait,
+      fallback.comboCooldownWait
+    ),
+    quotaShareConcurrencyLimit: normalizeQuotaShareConcurrencyLimitSettings(
+      current.quotaShareConcurrencyLimit,
+      fallback.quotaShareConcurrencyLimit
+    ),
     providerCooldown: normalizeProviderCooldownSettings(
       current.providerCooldown,
       fallback.providerCooldown
@@ -701,6 +790,14 @@ export function mergeResilienceSettings(
       updates.waitForCooldown,
       current.waitForCooldown
     ),
+    comboCooldownWait: normalizeComboCooldownWaitSettings(
+      updates.comboCooldownWait,
+      current.comboCooldownWait
+    ),
+    quotaShareConcurrencyLimit: normalizeQuotaShareConcurrencyLimitSettings(
+      updates.quotaShareConcurrencyLimit,
+      current.quotaShareConcurrencyLimit
+    ),
     providerCooldown: normalizeProviderCooldownSettings(
       updates.providerCooldown,
       current.providerCooldown
diff --git a/src/lib/usage/usageHistory.ts b/src/lib/usage/usageHistory.ts
index f22d053e46..0e5ed1fe82 100644
--- a/src/lib/usage/usageHistory.ts
+++ b/src/lib/usage/usageHistory.ts
@@ -641,8 +641,8 @@ export async function saveRequestUsage(entry: any) {
       `
       INSERT INTO usage_history (provider, model, connection_id, api_key_id, api_key_name,
         tokens_input, tokens_output, tokens_cache_read, tokens_cache_creation, tokens_reasoning,
-        service_tier, status, success, latency_ms, ttft_ms, error_code, combo_strategy, timestamp)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        service_tier, status, success, latency_ms, ttft_ms, error_code, combo_strategy, endpoint, timestamp)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
     `
     ).run(
       entry.provider || null,
@@ -666,6 +666,7 @@ export async function saveRequestUsage(entry: any) {
           : 0,
       entry.errorCode || null,
       entry.comboStrategy || entry.combo_strategy || null,
+      entry.endpoint || null,
       timestamp
     );
 
diff --git a/src/middleware/promptInjectionGuard.ts b/src/middleware/promptInjectionGuard.ts
index a4467784e3..8b144f493e 100644
--- a/src/middleware/promptInjectionGuard.ts
+++ b/src/middleware/promptInjectionGuard.ts
@@ -58,13 +58,16 @@ export function withInjectionGuard(handler: any, options: any = {}) {
       return handler(request, context);
     }
 
+    // Hoist parsed body so it can be threaded to the downstream handler (#4041).
+    let parsedBody: any = null;
+
     try {
       // Clone request so body can still be read by handler
       const cloned = request.clone();
-      const body = await cloned.json().catch(() => null);
+      parsedBody = await cloned.json().catch(() => null);
 
-      if (body) {
-        const { blocked, result }: any = guard(body);
+      if (parsedBody) {
+        const { blocked, result }: any = guard(parsedBody);
 
         if (blocked) {
           return new Response(
@@ -94,6 +97,10 @@ export function withInjectionGuard(handler: any, options: any = {}) {
       });
     }
 
-    return handler(request, context);
+    // Thread the already-parsed body to the handler as a third argument so downstream
+    // handlers (e.g. /v1/responses) can reuse it without re-cloning+re-parsing the
+    // request on the hot path (#4041). Handlers that don't accept a preParsedBody
+    // simply ignore the extra argument — no signature change required for other routes.
+    return handler(request, context, parsedBody);
   };
 }
diff --git a/src/server/authz/headers.ts b/src/server/authz/headers.ts
index a7a3ec574e..002e679739 100644
--- a/src/server/authz/headers.ts
+++ b/src/server/authz/headers.ts
@@ -37,6 +37,22 @@ export const CLI_TOKEN_HEADER = "x-omniroute-cli-token";
  */
 export const PEER_IP_HEADER = "x-omniroute-peer-ip";
 
+/**
+ * Trusted "request arrived via a reverse proxy" marker stamped by the custom
+ * Node server alongside PEER_IP_HEADER, formatted as `<token>|1` when the
+ * inbound TCP request carried forwarding headers (`x-forwarded-for` /
+ * `x-real-ip`) and `<token>|0` otherwise. The middleware combines this with
+ * the stamped peer IP so a loopback / private-LAN socket that is actually the
+ * proxy hop (e.g. OmniRoute behind nginx / Caddy / Cloudflare Tunnel) is NOT
+ * trusted as local — closing the upstream da667836 vulnerability that would
+ * otherwise let a leaked JWT over a public tunnel reach LOCAL_ONLY routes
+ * that spawn child processes. Token-validated like PEER_IP_HEADER, so a
+ * remote caller cannot forge it. Stripped from forwarded headers before
+ * route handlers see it.
+ * Keep in sync with VIA_PROXY_HEADER in scripts/dev/peer-stamp.mjs.
+ */
+export const VIA_PROXY_HEADER = "x-omniroute-via-proxy";
+
 /**
  * Trusted locality verdict ("loopback" | "lan" | "remote") that the pipeline
  * computes from the stamped real peer IP and forwards to route handlers. Route
diff --git a/src/server/authz/peerStamp.ts b/src/server/authz/peerStamp.ts
index df099aa94c..ba80df0189 100644
--- a/src/server/authz/peerStamp.ts
+++ b/src/server/authz/peerStamp.ts
@@ -1,4 +1,5 @@
 import { timingSafeEqual } from "node:crypto";
+import { classifyHostLocality } from "./routeGuard";
 
 /**
  * Resolve the real peer IP from the trusted `<token>|<ip>` stamp that the custom
@@ -32,3 +33,67 @@ export function resolveStampedPeer(
   }
   return ip;
 }
+
+/**
+ * Resolve the trusted "request arrived via a reverse proxy" marker stamped by
+ * the custom Node server (`scripts/dev/peer-stamp.mjs::stampPeerIp`). The stamp
+ * is `<token>|1` when forwarding headers (`x-forwarded-for` / `x-real-ip`) were
+ * present on the inbound TCP request, and `<token>|0` otherwise.
+ *
+ * Returns true ONLY when the token constant-time-matches this process's stamp
+ * token AND the payload is exactly "1". Any other value — no stamp, forged
+ * token, "0", junk — returns false (the safe default: assume no proxy hop).
+ *
+ * SECURITY: paired with `resolveStampedPeer()` to close the upstream
+ * decolua/9router da667836 vulnerability — when OmniRoute itself runs behind
+ * an external reverse proxy (nginx / Caddy / Cloudflare Tunnel),
+ * `req.socket.remoteAddress` is the proxy hop (usually 127.0.0.1), not the
+ * end-user. Without this signal, `classifyHostLocality()` would return
+ * "loopback" for every remote caller arriving via the proxy, granting access
+ * to the LOCAL_ONLY tier that gates spawn-capable routes (Hard Rules #15 +
+ * #17). Consume via `classifyStampedPeerLocality()` below.
+ */
+export function resolveStampedViaProxy(
+  headerValue: string | null,
+  token: string | undefined
+): boolean {
+  if (!headerValue || !token) return false;
+  const sep = headerValue.indexOf("|");
+  if (sep <= 0) return false;
+  const provided = headerValue.slice(0, sep);
+  const payload = headerValue.slice(sep + 1);
+  if (provided.length !== token.length) return false;
+  try {
+    if (!timingSafeEqual(Buffer.from(provided), Buffer.from(token))) return false;
+  } catch {
+    return false;
+  }
+  return payload === "1";
+}
+
+/**
+ * The trusted locality verdict consumed by the LOCAL_ONLY route guard. Wraps
+ * `resolveStampedPeer()` + `resolveStampedViaProxy()` + `classifyHostLocality()`
+ * so the pipeline has a single boundary helper:
+ *
+ *   1. Resolve the real peer IP from PEER_IP_HEADER (or fail closed → remote).
+ *   2. If the via-proxy marker is present, the loopback / private-LAN socket
+ *      is the proxy hop, not the end-user — downgrade to "remote".
+ *      (Public-IP sockets are already remote, so the marker is a no-op there.)
+ *   3. Otherwise classify the raw IP normally (loopback / lan / remote).
+ *
+ * Pure; both header values are token-validated, so an attacker who knows the
+ * header names but not the per-process token cannot influence the verdict in
+ * any direction.
+ */
+export function classifyStampedPeerLocality(
+  peerHeader: string | null,
+  viaProxyHeader: string | null,
+  token: string | undefined
+): "loopback" | "lan" | "remote" {
+  const ip = resolveStampedPeer(peerHeader, token);
+  const viaProxy = resolveStampedViaProxy(viaProxyHeader, token);
+  const locality = classifyHostLocality(ip);
+  if (viaProxy && locality !== "remote") return "remote";
+  return locality;
+}
diff --git a/src/server/authz/pipeline.ts b/src/server/authz/pipeline.ts
index 178ac5dd10..81b039b497 100644
--- a/src/server/authz/pipeline.ts
+++ b/src/server/authz/pipeline.ts
@@ -6,8 +6,7 @@ import { checkBodySize, getBodySizeLimit } from "../../shared/middleware/bodySiz
 import { generateRequestId } from "../../shared/utils/requestId";
 import { applyCorsHeaders } from "../cors/origins";
 import { classifyRoute } from "./classify";
-import { classifyHostLocality } from "./routeGuard";
-import { resolveStampedPeer } from "./peerStamp";
+import { classifyStampedPeerLocality } from "./peerStamp";
 import { clientApiPolicy } from "./policies/clientApi";
 import { managementPolicy } from "./policies/management";
 import { publicPolicy } from "./policies/public";
@@ -21,6 +20,7 @@ import {
   AUTHZ_HEADER_ROUTE_CLASS,
   AUTHZ_TRUSTED_HEADERS,
   PEER_IP_HEADER,
+  VIA_PROXY_HEADER,
 } from "./headers";
 import type { AuthSubject, RouteClass, RouteClassification } from "./types";
 import type { AuthOutcome, RoutePolicy } from "./context";
@@ -232,21 +232,29 @@ export async function runAuthzPipeline(
   for (const trusted of AUTHZ_TRUSTED_HEADERS) {
     requestHeaders.delete(trusted);
   }
-  // The trusted peer-IP stamp is read by the policy from the ORIGINAL request
-  // (above); strip it from the forwarded headers so the per-process token never
-  // reaches route handlers or upstream providers.
+  // The trusted peer-IP + via-proxy stamps are read by the policy from the
+  // ORIGINAL request (above); strip them from the forwarded headers so the
+  // per-process token never reaches route handlers or upstream providers.
   requestHeaders.delete(PEER_IP_HEADER);
+  requestHeaders.delete(VIA_PROXY_HEADER);
 
   requestHeaders.set(AUTHZ_HEADER_ROUTE_CLASS, classification.routeClass);
   requestHeaders.set(AUTHZ_HEADER_REQUEST_ID, requestId);
   // Stamp a trusted, non-secret locality verdict derived from the real stamped
-  // peer IP. Route handlers (e.g. cliTokenAuth) read this instead of re-deriving
-  // locality from the spoofable Host header. The client-supplied value (if any)
-  // was already removed by the AUTHZ_TRUSTED_HEADERS strip above.
+  // peer IP AND the via-proxy marker. Route handlers (e.g. cliTokenAuth) read
+  // this instead of re-deriving locality from the spoofable Host header. The
+  // client-supplied values (if any) were already removed by the
+  // AUTHZ_TRUSTED_HEADERS strip above. When the via-proxy marker is set, a
+  // loopback socket is the proxy hop, not the end-user — verdict is downgraded
+  // to "remote" so the LOCAL_ONLY gate is not bypassed by a request arriving
+  // through an external reverse proxy (nginx / Caddy / Cloudflare Tunnel).
+  // See peerStamp.ts and the upstream da667836 reference for the full rationale.
   requestHeaders.set(
     AUTHZ_HEADER_PEER_LOCALITY,
-    classifyHostLocality(
-      resolveStampedPeer(request.headers.get(PEER_IP_HEADER), process.env.OMNIROUTE_PEER_STAMP_TOKEN)
+    classifyStampedPeerLocality(
+      request.headers.get(PEER_IP_HEADER),
+      request.headers.get(VIA_PROXY_HEADER),
+      process.env.OMNIROUTE_PEER_STAMP_TOKEN
     )
   );
 
diff --git a/src/server/authz/policies/management.ts b/src/server/authz/policies/management.ts
index 42325876ae..9b518c35dd 100644
--- a/src/server/authz/policies/management.ts
+++ b/src/server/authz/policies/management.ts
@@ -8,8 +8,8 @@ import { extractApiKey, isValidApiKey } from "../../../sse/services/auth";
 import { getApiKeyMetadata } from "../../../lib/db/apiKeys";
 import { hasManageScope } from "../../../lib/api/requireManagementAuth";
 import { evaluateAccessTokenAuth } from "../accessTokenAuth";
-import { CLI_TOKEN_HEADER, PEER_IP_HEADER } from "../headers";
-import { resolveStampedPeer } from "../peerStamp";
+import { CLI_TOKEN_HEADER, PEER_IP_HEADER, VIA_PROXY_HEADER } from "../headers";
+import { resolveStampedPeer, resolveStampedViaProxy } from "../peerStamp";
 import {
   isAlwaysProtectedPath,
   isLocalOnlyBypassableByManageScope,
@@ -35,15 +35,34 @@ function requestPeerAddress(ctx: PolicyContext): string | null {
   return ctx.request.ip ?? ctx.request.socket?.remoteAddress ?? null;
 }
 
+/**
+ * True when the inbound TCP request carried forwarding headers
+ * (`x-forwarded-for` / `x-real-ip`), as stamped by the custom Node server. When
+ * set, the socket peer is the reverse-proxy hop, not the end-user — so a
+ * loopback / private-LAN socket must NOT be trusted as local (Hard Rules #15 +
+ * #17, port of decolua/9router da667836). Token-validated; an attacker who
+ * knows the header name but not the per-process token cannot influence it.
+ */
+function isViaProxyRequest(ctx: PolicyContext): boolean {
+  return resolveStampedViaProxy(
+    ctx.request.headers?.get?.(VIA_PROXY_HEADER) ?? null,
+    process.env.OMNIROUTE_PEER_STAMP_TOKEN
+  );
+}
+
 function isLoopbackRequest(ctx: PolicyContext): boolean {
+  if (isViaProxyRequest(ctx)) return false;
   const peerAddress = requestPeerAddress(ctx);
   return peerAddress ? isLoopbackHost(peerAddress) : false;
 }
 
 // Owner-authorized (2026-05-30): allow LOCAL_ONLY *paths* from a trusted private
 // LAN, based on the real socket peer IP (not spoofable). Does NOT relax the
-// CLI-token gate, which stays strictly loopback.
+// CLI-token gate, which stays strictly loopback. Also falls back to "not LAN"
+// when a reverse-proxy hop is detected (the apparent LAN IP would be the proxy,
+// not the end-user — see isViaProxyRequest above).
 function isPrivateLanRequest(ctx: PolicyContext): boolean {
+  if (isViaProxyRequest(ctx)) return false;
   const peerAddress = requestPeerAddress(ctx);
   return peerAddress ? isPrivateLanHost(peerAddress) : false;
 }
diff --git a/src/server/ws/liveServer.ts b/src/server/ws/liveServer.ts
index ccc1f7e8e9..1275545572 100644
--- a/src/server/ws/liveServer.ts
+++ b/src/server/ws/liveServer.ts
@@ -20,7 +20,12 @@ import { randomUUID } from "crypto";
 
 // ── Types ─────────────────────────────────────────────────────────────────
 
-import type { WsClientMessage, WsServerMessage, WsAuthResult } from "./types";
+import type {
+  WsClientMessage,
+  WsServerMessage,
+  WsEventMessage,
+  WsAuthResult,
+} from "./types";
 
 import { emit, on, onAny, getEventHistory, type HistoryEntry } from "@/lib/events/eventBus";
 
@@ -28,6 +33,12 @@ import type { DashboardEventName, DashboardEventMap, DashboardChannel } from "@/
 
 import { CHANNEL_EVENTS, getChannelForEvent } from "@/lib/events/types";
 
+import {
+  buildAllowedOrigins,
+  buildAllowedHosts,
+  isOriginAllowed as isOriginAllowedPure,
+} from "./liveServerAllowList";
+
 // ── Config ────────────────────────────────────────────────────────────────
 
 const DEFAULT_PORT = 20129;
@@ -42,36 +53,21 @@ const MAX_EVENTS_PER_SECOND = 100;
 const MAX_PENDING_MESSAGES_PER_CLIENT = 32;
 const MAX_PENDING_MESSAGE_BYTES = 16_384;
 
-/**
- * Origins allowed to open a WebSocket. Defaults to the loopback dashboard
- * origins; admins can extend via LIVE_WS_ALLOWED_ORIGINS (comma-separated).
- *
- * WS does not honour CORS — a malicious page on origin X can otherwise open
- * a WebSocket to our server and ride the user's API key (if it lives in a
- * cookie or is reachable through the page). Browsers DO send the Origin
- * header on the WS upgrade, so checking it server-side is the standard
- * mitigation. Non-browser clients (CLI, MCP) omit Origin, which we accept.
- */
-function buildAllowedOrigins(): Set<string> {
-  const base = [`http://127.0.0.1:20128`, `http://localhost:20128`, `http://[::1]:20128`];
-  const extra = (process.env.LIVE_WS_ALLOWED_ORIGINS || "")
-    .split(",")
-    .map((s) => s.trim())
-    .filter(Boolean);
-  return new Set([...base, ...extra]);
-}
-
 const ALLOWED_ORIGINS = buildAllowedOrigins();
+const ALLOWED_HOSTS = buildAllowedHosts();
 
+/**
+ * Whether the given Origin is acceptable for a WS upgrade.
+ *
+ * Delegates to `liveServerAllowList` for the actual policy; this wrapper
+ * exists so the connection handler can read the closure-bound allow-lists
+ * without re-parsing env on every connection.
+ */
 function isOriginAllowed(origin: string | undefined): boolean {
-  // Non-browser client (curl, native ws, MCP) — Origin header is omitted by
-  // spec. Allow only when the upstream listener is bound to loopback; if the
-  // operator opted into LAN exposure we require an explicit Origin.
-  if (!origin) {
-    const host = process.env.LIVE_WS_HOST || DEFAULT_HOST;
-    return host === "127.0.0.1" || host === "::1" || host === "localhost";
-  }
-  return ALLOWED_ORIGINS.has(origin);
+  return isOriginAllowedPure(origin, process.env, {
+    allowedOrigins: ALLOWED_ORIGINS,
+    allowedHosts: ALLOWED_HOSTS,
+  });
 }
 
 // ── Client State ──────────────────────────────────────────────────────────
diff --git a/src/server/ws/liveServerAllowList.ts b/src/server/ws/liveServerAllowList.ts
new file mode 100644
index 0000000000..9e3a91d598
--- /dev/null
+++ b/src/server/ws/liveServerAllowList.ts
@@ -0,0 +1,106 @@
+/**
+ * liveServerAllowList — extract of the host/origin allow-list logic from
+ * `src/server/ws/liveServer.ts`.
+ *
+ * Lives in its own module so unit tests can exercise it without booting the
+ * full WebSocket server. The behaviour here MUST match the one used by the
+ * connection handler exactly.
+ *
+ * Bug #1 (plans/2026-06-23-omniroute-v3.8.34-deep-audit.md) added the
+ * `LIVE_WS_ALLOWED_HOSTS` opt-in for LAN/Tailscale deployments.
+ */
+
+const DEFAULT_HOST = "127.0.0.1";
+
+/**
+ * Default origins allowed to open a WebSocket against the local dashboard.
+ * These match the loopback HTTP listener at port 20128.
+ */
+export const DEFAULT_ALLOWED_ORIGINS: readonly string[] = Object.freeze([
+  "http://127.0.0.1:20128",
+  "http://localhost:20128",
+  "http://[::1]:20128",
+]);
+
+/**
+ * Parse a comma-separated env value into a set of trimmed, non-empty entries.
+ * Centralized so tests can exercise empty / whitespace / dup behaviour.
+ */
+export function parseCsvEnv(value: string | undefined | null): Set<string> {
+  return new Set(
+    (value ?? "")
+      .split(",")
+      .map((s) => s.trim())
+      .filter(Boolean)
+  );
+}
+
+/**
+ * Build the static origin allow-list from defaults + LIVE_WS_ALLOWED_ORIGINS.
+ */
+export function buildAllowedOrigins(env: NodeJS.ProcessEnv = process.env): Set<string> {
+  const extra = parseCsvEnv(env.LIVE_WS_ALLOWED_ORIGINS);
+  return new Set([...DEFAULT_ALLOWED_ORIGINS, ...extra]);
+}
+
+/**
+ * Build the host-based allow-list (LAN/Tailscale extension).
+ */
+export function buildAllowedHosts(env: NodeJS.ProcessEnv = process.env): Set<string> {
+  return parseCsvEnv(env.LIVE_WS_ALLOWED_HOSTS);
+}
+
+/**
+ * Parse the host portion of an Origin URL.
+ *
+ * Returns `null` when the input is not a well-formed absolute URL — callers
+ * should treat `null` as "not a match".
+ */
+export function originHost(origin: string): { host: string; hostname: string } | null {
+  try {
+    const url = new URL(origin);
+    return { host: url.host, hostname: url.hostname };
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Whether the given Origin's host (or `host:port`) is in the host
+ * allow-list. Returns false when the list is empty.
+ */
+export function originHostMatches(origin: string, allowedHosts: Set<string>): boolean {
+  if (allowedHosts.size === 0) return false;
+  const parsed = originHost(origin);
+  if (!parsed) return false;
+  return allowedHosts.has(parsed.host) || allowedHosts.has(parsed.hostname);
+}
+
+/**
+ * Top-level Origin allow decision. The contract:
+ *
+ *   - When `origin` is undefined (no Origin header, e.g. CLI/MCP), we only
+ *     accept the request when the WS listener is bound to loopback. This
+ *     prevents drive-by LAN clients from omitting Origin to bypass the
+ *     browser-side check.
+ *
+ *   - When `origin` is present, we accept it if it matches an entry in the
+ *     static origin list (defaults + LIVE_WS_ALLOWED_ORIGINS) or if its
+ *     host matches an entry in the LAN allow-list (LIVE_WS_ALLOWED_HOSTS).
+ */
+export function isOriginAllowed(
+  origin: string | undefined,
+  env: NodeJS.ProcessEnv = process.env,
+  options: { allowedOrigins?: Set<string>; allowedHosts?: Set<string> } = {}
+): boolean {
+  const allowedOrigins = options.allowedOrigins ?? buildAllowedOrigins(env);
+  const allowedHosts = options.allowedHosts ?? buildAllowedHosts(env);
+
+  if (!origin) {
+    const host = env.LIVE_WS_HOST || DEFAULT_HOST;
+    return host === "127.0.0.1" || host === "::1" || host === "localhost";
+  }
+  if (allowedOrigins.has(origin)) return true;
+  if (originHostMatches(origin, allowedHosts)) return true;
+  return false;
+}
diff --git a/src/shared/components/ModelSelectModal.tsx b/src/shared/components/ModelSelectModal.tsx
index 184949303a..c6360bc920 100644
--- a/src/shared/components/ModelSelectModal.tsx
+++ b/src/shared/components/ModelSelectModal.tsx
@@ -38,7 +38,7 @@ type ModelSelectModalProps = {
   onDeselect?: (model: unknown) => void;
   selectedModel?: string;
   selectedModels?: string[];
-  activeProviders?: Array<{ provider: string }>;
+  activeProviders?: Array<{ provider: string; id?: string | number }>;
   title?: string;
   modelAliases?: Record<string, string>;
   addedModelValues?: string[];
@@ -79,6 +79,11 @@ export default function ModelSelectModal({
   const [combos, setCombos] = useState<any[]>([]);
   const [providerNodes, setProviderNodes] = useState<any[]>([]);
   const [customModels, setCustomModels] = useState<Record<string, any>>({});
+  // Models discovered live from a custom provider's upstream `/models` endpoint,
+  // keyed by provider id. Merged into the alias/custom/fallback list below and
+  // tagged with the `auto` source badge. Ported from upstream PR
+  // decolua/9router#2018 (Hamsa_M).
+  const [fetchedModels, setFetchedModels] = useState<Record<string, any[]>>({});
 
   const fetchCombos = async () => {
     try {
@@ -128,6 +133,65 @@ export default function ModelSelectModal({
     if (isOpen) fetchCustomModels();
   }, [isOpen]);
 
+  // Fetch the live model catalog for one custom provider from its connection's
+  // upstream `/models` endpoint. Returns the model array, or null on any failure.
+  const fetchProviderModels = async (providerId: string): Promise<any[] | null> => {
+    try {
+      // Find the connection id for this provider — the route is keyed by connection.
+      const connection = activeProviders.find((p) => p.provider === providerId);
+      if (!connection?.id) return null;
+
+      const res = await fetch(`/api/providers/${connection.id}/models`);
+      if (!res.ok) {
+        console.warn(`Failed to fetch models for ${providerId}: ${res.status}`);
+        return null;
+      }
+      const data = await res.json();
+      return data.models || [];
+    } catch (error) {
+      console.error(`Error fetching models for ${providerId}:`, error);
+      return null;
+    }
+  };
+
+  // When the modal opens, dynamically load models for every connected custom
+  // (openai-/anthropic-compatible) provider in parallel.
+  useEffect(() => {
+    if (!isOpen) return;
+
+    let cancelled = false;
+
+    const loadCustomProviderModels = async () => {
+      const customProviderIds = activeProviders
+        .filter(
+          (p) =>
+            isOpenAICompatibleProvider(p.provider) || isAnthropicCompatibleProvider(p.provider)
+        )
+        .map((p) => p.provider);
+
+      if (customProviderIds.length === 0) return;
+
+      const fetched: Record<string, any[]> = {};
+      await Promise.all(
+        customProviderIds.map(async (providerId) => {
+          const models = await fetchProviderModels(providerId);
+          if (models && models.length > 1) {
+            fetched[providerId] = models;
+          }
+        })
+      );
+
+      if (!cancelled) setFetchedModels(fetched);
+    };
+
+    loadCustomProviderModels();
+
+    return () => {
+      cancelled = true;
+    };
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [isOpen, activeProviders]);
+
   const allProviders = useMemo(
     () => ({ ...OAUTH_PROVIDERS, ...NOAUTH_PROVIDERS, ...APIKEY_PROVIDERS }),
     []
@@ -245,7 +309,29 @@ export default function ModelSelectModal({
             source: normalizeModelCatalogSource(cm.source) === "imported" ? "imported" : "custom",
           }));
 
-        const allModels = [...nodeModels, ...fallbackEntries, ...customEntries];
+        // Models discovered live from the provider's upstream `/models` endpoint.
+        // Deduped against alias, fallback, and user-added custom models; tagged
+        // with the `auto` source so the badge reads "auto".
+        const fetchedEntries = (fetchedModels[providerId] || [])
+          .map((m) => {
+            const id = m.id || m.slug || m.model || m.name;
+            return {
+              id,
+              name: m.name || m.displayName || id,
+              value: `${nodePrefix}/${id}`,
+              isFetched: true,
+              source: "auto",
+            };
+          })
+          .filter(
+            (fm) =>
+              fm.id &&
+              !nodeModels.some((nm) => nm.id === fm.id) &&
+              !fallbackEntries.some((fbm) => fbm.id === fm.id) &&
+              !customEntries.some((cm) => cm.id === fm.id)
+          );
+
+        const allModels = [...nodeModels, ...fallbackEntries, ...customEntries, ...fetchedEntries];
 
         if (allModels.length > 0) {
           groups[providerId] = {
@@ -299,6 +385,7 @@ export default function ModelSelectModal({
     allProviders,
     providerNodes,
     customModels,
+    fetchedModels,
   ]);
 
   // Filter combos by search query
diff --git a/src/shared/components/OAuthModal.tsx b/src/shared/components/OAuthModal.tsx
index 5a498f049d..dacc597011 100644
--- a/src/shared/components/OAuthModal.tsx
+++ b/src/shared/components/OAuthModal.tsx
@@ -269,7 +269,8 @@ export default function OAuthModal({
         provider === "kiro" ||
         provider === "amazon-q" ||
         provider === "kimi-coding" ||
-        provider === "kilocode"
+        provider === "kilocode" ||
+        provider === "codebuddy-cn"
       ) {
         setIsDeviceCode(true);
         setStep("waiting");
diff --git a/src/shared/components/flow/FlowCanvas.tsx b/src/shared/components/flow/FlowCanvas.tsx
index acf8f87683..d27c7ed923 100644
--- a/src/shared/components/flow/FlowCanvas.tsx
+++ b/src/shared/components/flow/FlowCanvas.tsx
@@ -9,6 +9,7 @@ import {
   type NodeTypes,
   type EdgeTypes,
   type NodeMouseHandler,
+  type ReactFlowInstance,
 } from "@xyflow/react";
 import "@xyflow/react/dist/style.css";
 
@@ -42,6 +43,18 @@ type FlowCanvasProps = {
  * behavioural change: auto-fit on init, on resize (ResizeObserver) and on node
  * count change; attribution hidden; read-only by default. Shared by the home
  * topology, the Combo/Routing Studio (Tela B) and the Compression Studio (Tela A).
+ *
+ * ## Stability fix (Bug #4 — plans/2026-06-23-omniroute-v3.8.34-deep-audit.md)
+ *
+ * Earlier revisions captured the ReactFlow instance in a plain `useRef` that
+ * outlived remounts. When the parent re-rendered with a new `fitKey`, the
+ * `<ReactFlow key={fitKey} ...>` remounted the graph (a brand-new instance),
+ * but the `useEffect`s at the bottom of this file could still call
+ * `.fitView()` on the *stale* ref. React Flow walks its internal
+ * `nodeLookup` map and throws "Node cannot be found in the current page"
+ * when the lookup is in a transient state during a remount. The fix is a
+ * generation counter: every `onInit` bumps a counter, and every queued
+ * `fitView` call checks the counter before touching the instance.
  */
 export function FlowCanvas({
   nodes,
@@ -54,12 +67,23 @@ export function FlowCanvas({
   onNodeClick,
   children,
 }: FlowCanvasProps) {
-  const rfInstance = useRef<{ fitView: (opts: typeof FIT_VIEW_OPTIONS) => void } | null>(null);
+  const rfInstance = useRef<ReactFlowInstance | null>(null);
   const containerRef = useRef<HTMLDivElement>(null);
+  // Bumped on every onInit so queued fitView calls can be invalidated when
+  // a new ReactFlow instance mounts (e.g. via fitKey change).
+  const generationRef = useRef(0);
 
-  const onInit = useCallback((instance: { fitView: (opts: typeof FIT_VIEW_OPTIONS) => void }) => {
+  const onInit = useCallback((instance: ReactFlowInstance) => {
+    const generation = ++generationRef.current;
     rfInstance.current = instance;
-    setTimeout(() => instance.fitView(FIT_VIEW_OPTIONS), REFIT_DELAY_MS);
+    // Defer fitView until ReactFlow has measured its viewport, but guard
+    // against the instance being replaced (generation mismatch) before the
+    // timer fires — see Bug #4 in the audit report.
+    setTimeout(() => {
+      if (generationRef.current === generation) {
+        instance.fitView(FIT_VIEW_OPTIONS);
+      }
+    }, REFIT_DELAY_MS);
   }, []);
 
   useEffect(() => {
@@ -73,10 +97,26 @@ export function FlowCanvas({
   }, []);
 
   useEffect(() => {
-    const id = setTimeout(() => rfInstance.current?.fitView(FIT_VIEW_OPTIONS), REFIT_DELAY_MS);
+    // Snapshot the generation so a queued callback that fires after a
+    // remount is silently dropped (no fitView on stale instance).
+    const generation = generationRef.current;
+    const id = setTimeout(() => {
+      if (generationRef.current === generation) {
+        rfInstance.current?.fitView(FIT_VIEW_OPTIONS);
+      }
+    }, REFIT_DELAY_MS);
     return () => clearTimeout(id);
   }, [nodes.length]);
 
+  // Clear the ref on unmount so a late-arriving callback (e.g. a ResizeObserver
+  // tick fired just before the React tree unmounted) cannot reach into a
+  // disposed ReactFlow instance.
+  useEffect(() => {
+    return () => {
+      rfInstance.current = null;
+    };
+  }, []);
+
   return (
     <div ref={containerRef} className={className}>
       <ReactFlow
diff --git a/src/shared/components/lobeProviderIcons.ts b/src/shared/components/lobeProviderIcons.ts
index ea657321df..973bb5caab 100644
--- a/src/shared/components/lobeProviderIcons.ts
+++ b/src/shared/components/lobeProviderIcons.ts
@@ -423,6 +423,7 @@ const LOBE_PROVIDER_ALIASES = {
   tavily: "Tavily",
   "tavily-search": "Tavily",
   tencent: "Tencent",
+  "codebuddy-cn": "Tencent",
   together: "Together",
   topaz: "TopazLabs",
   trae: "Trae",
diff --git a/src/shared/constants/errorCodes.ts b/src/shared/constants/errorCodes.ts
index 99a40ca6f0..471f76bb0e 100644
--- a/src/shared/constants/errorCodes.ts
+++ b/src/shared/constants/errorCodes.ts
@@ -144,6 +144,50 @@ export const ERROR_CODES: Record<string, ErrorCodeDef> = {
     category: "VALIDATION",
   },
 
+  // ── Combos (T-22.b — 400-shape standardization for /api/combos/{id}) ──
+  COMBO_001: {
+    code: "COMBO_001",
+    message: "Request body is not valid JSON",
+    httpStatus: 400,
+    category: "COMBO",
+  },
+  COMBO_002: {
+    code: "COMBO_002",
+    message: "One or more combo fields are invalid",
+    httpStatus: 400,
+    category: "COMBO",
+  },
+  COMBO_003: {
+    code: "COMBO_003",
+    message: "Composite tier configuration is invalid",
+    httpStatus: 400,
+    category: "COMBO",
+  },
+  COMBO_004: {
+    code: "COMBO_004",
+    message: "A combo with this name already exists",
+    httpStatus: 400,
+    category: "COMBO",
+  },
+  COMBO_005: {
+    code: "COMBO_005",
+    message: "Combo reference graph is invalid (cycle or excessive depth)",
+    httpStatus: 400,
+    category: "COMBO",
+  },
+  COMBO_006: {
+    code: "COMBO_006",
+    message: "This combo is managed by Quota Share and cannot be modified here",
+    httpStatus: 409,
+    category: "COMBO",
+  },
+  COMBO_007: {
+    code: "COMBO_007",
+    message: "Combo not found",
+    httpStatus: 404,
+    category: "COMBO",
+  },
+
   // ── Internal ──
   INTERNAL_001: {
     code: "INTERNAL_001",
diff --git a/src/shared/constants/pricing.ts b/src/shared/constants/pricing.ts
index 47fcc174d6..1a56b93859 100644
--- a/src/shared/constants/pricing.ts
+++ b/src/shared/constants/pricing.ts
@@ -1,1576 +1,12 @@
+import { DEFAULT_PRICING } from "./pricing/default-pricing";
+
+export { DEFAULT_PRICING } from "./pricing/default-pricing";
 // Default pricing rates for AI models
 // All rates are in dollars per million tokens ($/1M tokens)
 // Based on user-provided pricing for Antigravity models and industry standards for others
 
 // Shared pricing constants to reduce duplication
-const GPT_5_3_CODEX_PRICING = {
-  input: 5.0,
-  output: 20.0,
-  cached: 2.5,
-  reasoning: 30.0,
-  cache_creation: 5.0,
-};
 
-const GPT_5_5_PRICING = {
-  input: 5.0,
-  output: 30.0,
-  cached: 0.5,
-  reasoning: 30.0,
-  cache_creation: 5.0,
-};
-
-const CLAUDE_FABLE_5_PRICING = {
-  input: 15.0,
-  output: 75.0,
-  cached: 7.5,
-  reasoning: 112.5,
-  cache_creation: 15.0,
-};
-
-const CLAUDE_OPUS_4_PRICING = {
-  input: 15.0,
-  output: 75.0,
-  cached: 7.5,
-  reasoning: 112.5,
-  cache_creation: 15.0,
-};
-
-const CLAUDE_SONNET_4_PRICING = {
-  input: 3.0,
-  output: 15.0,
-  cached: 1.5,
-  reasoning: 15.0,
-  cache_creation: 3.0,
-};
-
-const CLAUDE_OPUS_46_PRICING = {
-  input: 5.0,
-  output: 25.0,
-  cached: 2.5,
-  reasoning: 37.5,
-  cache_creation: 5.0,
-};
-
-const CLAUDE_SONNET_46_PRICING = {
-  input: 3.0,
-  output: 15.0,
-  cached: 1.5,
-  reasoning: 22.5,
-  cache_creation: 3.0,
-};
-
-const GLM_PRICING = {
-  "glm-5.2": {
-    input: 1.2,
-    output: 5,
-    cached: 0.3,
-    reasoning: 5,
-    cache_creation: 1.2,
-  },
-  "glm-5.2-high": {
-    input: 1.2,
-    output: 5,
-    cached: 0.3,
-    reasoning: 5,
-    cache_creation: 1.2,
-  },
-  "glm-5.2-max": {
-    input: 1.2,
-    output: 5,
-    cached: 0.3,
-    reasoning: 5,
-    cache_creation: 1.2,
-  },
-  "glm-5.1": {
-    input: 1.2,
-    output: 5,
-    cached: 0.3,
-    reasoning: 5,
-    cache_creation: 1.2,
-  },
-  "glm-5": {
-    input: 1.0,
-    output: 3.2,
-    cached: 0.2,
-    reasoning: 4.8,
-    cache_creation: 1.0,
-  },
-  "glm-5-turbo": {
-    input: 1.2,
-    output: 4.0,
-    cached: 0.24,
-    reasoning: 4.0,
-    cache_creation: 1.2,
-  },
-  "glm-4.7-flash": {
-    input: 0,
-    output: 0,
-    cached: 0,
-    reasoning: 0,
-    cache_creation: 0,
-  },
-  "glm-4.7": {
-    input: 0.6,
-    output: 2.2,
-    cached: 0.11,
-    reasoning: 2.2,
-    cache_creation: 0.6,
-  },
-  "glm-4.6": {
-    input: 0.6,
-    output: 2.2,
-    cached: 0.11,
-    reasoning: 2.2,
-    cache_creation: 0.6,
-  },
-  "glm-4.6v": {
-    input: 0.3,
-    output: 0.9,
-    cached: 0.05,
-    reasoning: 0.9,
-    cache_creation: 0.3,
-  },
-  "glm-4.5v": {
-    input: 0.6,
-    output: 1.8,
-    cached: 0.11,
-    reasoning: 1.8,
-    cache_creation: 0.6,
-  },
-  "glm-4.5": {
-    input: 0.6,
-    output: 2.2,
-    cached: 0.11,
-    reasoning: 2.2,
-    cache_creation: 0.6,
-  },
-  "glm-4.5-air": {
-    input: 0.2,
-    output: 1.1,
-    cached: 0.03,
-    reasoning: 1.1,
-    cache_creation: 0.2,
-  },
-};
-
-export const DEFAULT_PRICING = {
-  // OAuth Providers (using aliases)
-
-  // Claude Code (cc)
-  // Rates aligned with Anthropic's published per-MTok pricing
-  // (https://platform.claude.com/docs/en/about-claude/pricing).
-  // Cache write = 1.25x input, cache hit = 0.1x input, reasoning = output rate.
-  cc: {
-    "claude-fable-5": {
-      input: 10.0,
-      output: 50.0,
-      cached: 1.0,
-      reasoning: 50.0,
-      cache_creation: 12.5,
-    },
-    "claude-opus-4-8": {
-      input: 5.0,
-      output: 25.0,
-      cached: 0.5,
-      reasoning: 25.0,
-      cache_creation: 6.25,
-    },
-    "claude-opus-4-7": {
-      input: 5.0,
-      output: 25.0,
-      cached: 0.5,
-      reasoning: 25.0,
-      cache_creation: 6.25,
-    },
-    "claude-opus-4-6": {
-      input: 5.0,
-      output: 25.0,
-      cached: 0.5,
-      reasoning: 25.0,
-      cache_creation: 6.25,
-    },
-    "claude-sonnet-4-6": {
-      input: 3.0,
-      output: 15.0,
-      cached: 0.3,
-      reasoning: 15.0,
-      cache_creation: 3.75,
-    },
-    "claude-opus-4-5-20251101": {
-      input: 5.0,
-      output: 25.0,
-      cached: 0.5,
-      reasoning: 25.0,
-      cache_creation: 6.25,
-    },
-    "claude-sonnet-4-5-20250929": {
-      input: 3.0,
-      output: 15.0,
-      cached: 0.3,
-      reasoning: 15.0,
-      cache_creation: 3.75,
-    },
-    "claude-haiku-4-5-20251001": {
-      input: 1.0,
-      output: 5.0,
-      cached: 0.1,
-      reasoning: 5.0,
-      cache_creation: 1.25,
-    },
-  },
-
-  // OpenAI Codex (cx)
-  cx: {
-    "codex-auto-review": GPT_5_5_PRICING,
-    // GPT 5.5
-    "gpt-5.5": GPT_5_5_PRICING,
-    "gpt5.5": GPT_5_5_PRICING,
-    "gpt-5.5-xhigh": GPT_5_5_PRICING,
-    "gpt-5.5-high": GPT_5_5_PRICING,
-    "gpt-5.5-medium": GPT_5_5_PRICING,
-    "gpt-5.5-low": GPT_5_5_PRICING,
-    "gpt-5.5-none": GPT_5_5_PRICING,
-    // GPT 5.4
-    "gpt-5.4": {
-      input: 5.0,
-      output: 20.0,
-      cached: 2.5,
-      reasoning: 30.0,
-      cache_creation: 5.0,
-    },
-    "gpt5.4": {
-      input: 5.0,
-      output: 20.0,
-      cached: 2.5,
-      reasoning: 30.0,
-      cache_creation: 5.0,
-    },
-    // T12: fallback pricing for gpt-5.4 mini variants
-    "gpt-5.4-mini": {
-      input: 1.5,
-      output: 6.0,
-      cached: 0.75,
-      reasoning: 9.0,
-      cache_creation: 1.5,
-    },
-    "gpt5.4-mini": {
-      input: 1.5,
-      output: 6.0,
-      cached: 0.75,
-      reasoning: 9.0,
-      cache_creation: 1.5,
-    },
-    // gpt-5.4 reasoning-effort variants share the gpt-5.4 tier (registry exposes
-    // -xhigh/-high/-medium/-low; without these rows they resolved to $0).
-    "gpt-5.4-xhigh": GPT_5_3_CODEX_PRICING,
-    "gpt-5.4-high": GPT_5_3_CODEX_PRICING,
-    "gpt-5.4-medium": GPT_5_3_CODEX_PRICING,
-    "gpt-5.4-low": GPT_5_3_CODEX_PRICING,
-    // GPT 5.3 Codex family (all same pricing tier)
-    "gpt-5.3-codex-spark": GPT_5_3_CODEX_PRICING,
-    "gpt-5.3-codex": GPT_5_3_CODEX_PRICING,
-    "gpt-5.3-codex-xhigh": GPT_5_3_CODEX_PRICING,
-    "gpt-5.3-codex-high": GPT_5_3_CODEX_PRICING,
-    "gpt-5.3-codex-low": GPT_5_3_CODEX_PRICING,
-    "gpt-5.3-codex-none": GPT_5_3_CODEX_PRICING,
-    "gpt-5.1-codex-mini-high": {
-      input: 1.5,
-      output: 6.0,
-      cached: 0.75,
-      reasoning: 9.0,
-      cache_creation: 1.5,
-    },
-    "gpt-5.2-codex": {
-      input: 5.0,
-      output: 20.0,
-      cached: 2.5,
-      reasoning: 30.0,
-      cache_creation: 5.0,
-    },
-
-    "gpt-5.2": {
-      input: 5.0,
-      output: 20.0,
-      cached: 2.5,
-      reasoning: 30.0,
-      cache_creation: 5.0,
-    },
-    "gpt-5.1-codex-max": {
-      input: 8.0,
-      output: 32.0,
-      cached: 4.0,
-      reasoning: 48.0,
-      cache_creation: 8.0,
-    },
-    "gpt-5.1-codex": {
-      input: 4.0,
-      output: 16.0,
-      cached: 2.0,
-      reasoning: 24.0,
-      cache_creation: 4.0,
-    },
-    "gpt-5.1-codex-mini": {
-      input: 1.5,
-      output: 6.0,
-      cached: 0.75,
-      reasoning: 9.0,
-      cache_creation: 1.5,
-    },
-    "gpt-5.1": {
-      input: 4.0,
-      output: 16.0,
-      cached: 2.0,
-      reasoning: 24.0,
-      cache_creation: 4.0,
-    },
-    "gpt-5-codex": {
-      input: 3.0,
-      output: 12.0,
-      cached: 1.5,
-      reasoning: 18.0,
-      cache_creation: 3.0,
-    },
-    "gpt-5-codex-mini": {
-      input: 1.0,
-      output: 4.0,
-      cached: 0.5,
-      reasoning: 6.0,
-      cache_creation: 1.0,
-    },
-  },
-
-  // Gemini CLI
-  "gemini-cli": {
-    "gemini-3-flash-preview": {
-      input: 0.5,
-      output: 3.0,
-      cached: 0.03,
-      reasoning: 4.5,
-      cache_creation: 0.5,
-    },
-    "gemini-3.1-flash-lite-preview": {
-      input: 0.5,
-      output: 3.0,
-      cached: 0.03,
-      reasoning: 4.5,
-      cache_creation: 0.5,
-    },
-    "gemini-3-pro-preview": {
-      input: 2.0,
-      output: 12.0,
-      cached: 0.25,
-      reasoning: 18.0,
-      cache_creation: 2.0,
-    },
-    "gemini-3.1-pro-preview": {
-      input: 2.0,
-      output: 12.0,
-      cached: 0.25,
-      reasoning: 18.0,
-      cache_creation: 2.0,
-    },
-
-    "gemini-2.5-pro": {
-      input: 2.0,
-      output: 12.0,
-      cached: 0.25,
-      reasoning: 18.0,
-      cache_creation: 2.0,
-    },
-    "gemini-2.5-flash": {
-      input: 0.3,
-      output: 2.5,
-      cached: 0.03,
-      reasoning: 3.75,
-      cache_creation: 0.3,
-    },
-    // Gemini 2.5 Flash Lite — preco corrigido via ClawRouter: $0.10/$0.40 (era $0.15/$1.25)
-    "gemini-2.5-flash-lite": {
-      input: 0.1,
-      output: 0.4,
-      cached: 0.025,
-      reasoning: 0.6,
-      cache_creation: 0.1,
-    },
-  },
-
-  // Qwen Code (qw)
-  qw: {
-    "qwen3-coder-plus": {
-      input: 1.0,
-      output: 4.0,
-      cached: 0.5,
-      reasoning: 6.0,
-      cache_creation: 1.0,
-    },
-    // Next-generation Qwen Coder tier (added Mar 2026)
-    "qwen3-coder-next": {
-      input: 2.0,
-      output: 8.0,
-      cached: 1.0,
-      reasoning: 12.0,
-      cache_creation: 2.0,
-    },
-    "qwen3-coder-flash": {
-      input: 0.5,
-      output: 2.0,
-      cached: 0.25,
-      reasoning: 3.0,
-      cache_creation: 0.5,
-    },
-    "vision-model": {
-      input: 1.5,
-      output: 6.0,
-      cached: 0.75,
-      reasoning: 9.0,
-      cache_creation: 1.5,
-    },
-    // Qwen3.5/3.6 Coder Model — ported from upstream 9router PR #156 (zx07).
-    // Priced identically to the vision tier per upstream defaults.
-    "coder-model": {
-      input: 1.5,
-      output: 6.0,
-      cached: 0.75,
-      reasoning: 9.0,
-      cache_creation: 1.5,
-    },
-  },
-
-  // Qoder AI (if)
-  if: {
-    "qwen3-coder-plus": {
-      input: 1.0,
-      output: 4.0,
-      cached: 0.5,
-      reasoning: 6.0,
-      cache_creation: 1.0,
-    },
-    "kimi-k2": {
-      input: 1.0,
-      output: 4.0,
-      cached: 0.5,
-      reasoning: 6.0,
-      cache_creation: 1.0,
-    },
-    "kimi-k2-thinking": {
-      input: 1.5,
-      output: 6.0,
-      cached: 0.75,
-      reasoning: 9.0,
-      cache_creation: 1.5,
-    },
-    "deepseek-r1": {
-      input: 0.75,
-      output: 3.0,
-      cached: 0.375,
-      reasoning: 4.5,
-      cache_creation: 0.75,
-    },
-    "deepseek-v3.2-chat": {
-      input: 0.28,
-      output: 0.42,
-      cached: 0.014,
-      reasoning: 0.63,
-      cache_creation: 0.28,
-    },
-    "deepseek-v3.2": {
-      input: 0.28,
-      output: 0.42,
-      cached: 0.014,
-      reasoning: 0.63,
-      cache_creation: 0.28,
-    },
-    "deepseek-v3.2-reasoner": {
-      input: 0.55,
-      output: 2.19,
-      cached: 0.14,
-      reasoning: 2.19,
-      cache_creation: 0.55,
-    },
-    // Short-form aliases (Mar 2026)
-    "deepseek-3.1": {
-      input: 0.27,
-      output: 1.1,
-      cached: 0.07,
-      reasoning: 2.2,
-      cache_creation: 0.27,
-    },
-    "deepseek-3.2": {
-      input: 0.27,
-      output: 1.1,
-      cached: 0.07,
-      reasoning: 2.2,
-      cache_creation: 0.27,
-    },
-    "minimax-m2": {
-      input: 0.5,
-      output: 2.0,
-      cached: 0.25,
-      reasoning: 3.0,
-      cache_creation: 0.5,
-    },
-    "glm-4.6": {
-      input: 0.5,
-      output: 2.0,
-      cached: 0.25,
-      reasoning: 3.0,
-      cache_creation: 0.5,
-    },
-    "glm-4.7": {
-      input: 0.75,
-      output: 3.0,
-      cached: 0.375,
-      reasoning: 4.5,
-      cache_creation: 0.75,
-    },
-  },
-
-  // Antigravity (ag) - User-provided pricing
-  ag: {
-    "gemini-3.1-pro-low": {
-      input: 2.0,
-      output: 12.0,
-      cached: 0.25,
-      reasoning: 18.0,
-      cache_creation: 2.0,
-    },
-    "gemini-3.1-pro-high": {
-      input: 4.0,
-      output: 18.0,
-      cached: 0.5,
-      reasoning: 27.0,
-      cache_creation: 4.0,
-    },
-    "gemini-3-flash": {
-      input: 0.5,
-      output: 3.0,
-      cached: 0.03,
-      reasoning: 4.5,
-      cache_creation: 0.5,
-    },
-    // Antigravity 2.0.4+ exposes Gemini 3.5 Flash as three public client ids
-    // (see ANTIGRAVITY_PUBLIC_MODELS in open-sse/config/antigravityModelAliases.ts):
-    //   gemini-3-flash-agent   → "Gemini 3.5 Flash (High)"
-    //   gemini-3.5-flash-low   → "Gemini 3.5 Flash (Medium)"
-    // Both bill at the same per-MTok rates as legacy `gemini-3-flash` above —
-    // without these rows, getPricingForModel("ag", id) returned null and downstream
-    // cost / quota calculations silently fell back to $0.
-    "gemini-3-flash-agent": {
-      input: 0.5,
-      output: 3.0,
-      cached: 0.03,
-      reasoning: 4.5,
-      cache_creation: 0.5,
-    },
-    "gemini-3.5-flash-low": {
-      input: 0.5,
-      output: 3.0,
-      cached: 0.03,
-      reasoning: 4.5,
-      cache_creation: 0.5,
-    },
-    // `gemini-pro-agent` is the Antigravity v1.23+ Agent-mode alias for the
-    // Gemini 3.1 Pro (High) tier — bills at the same rates as `gemini-3.1-pro-high`.
-    "gemini-pro-agent": {
-      input: 4.0,
-      output: 18.0,
-      cached: 0.5,
-      reasoning: 27.0,
-      cache_creation: 4.0,
-    },
-    "claude-sonnet-4-6": {
-      input: 3.0,
-      output: 15.0,
-      cached: 0.3,
-      reasoning: 22.5,
-      cache_creation: 3.0,
-    },
-    "claude-opus-4-6-thinking": {
-      input: 5.0,
-      output: 25.0,
-      cached: 0.5,
-      reasoning: 37.5,
-      cache_creation: 5.0,
-    },
-    "gpt-oss-120b-medium": {
-      input: 0.5,
-      output: 2.0,
-      cached: 0.25,
-      reasoning: 3.0,
-      cache_creation: 0.5,
-    },
-  },
-
-  // GitHub Copilot (gh)
-  gh: {
-    "gpt-5": {
-      input: 3.0,
-      output: 12.0,
-      cached: 1.5,
-      reasoning: 18.0,
-      cache_creation: 3.0,
-    },
-    "gpt-5-mini": {
-      input: 0.75,
-      output: 3.0,
-      cached: 0.375,
-      reasoning: 4.5,
-      cache_creation: 0.75,
-    },
-    "gpt-5.1-codex": {
-      input: 4.0,
-      output: 16.0,
-      cached: 2.0,
-      reasoning: 24.0,
-      cache_creation: 4.0,
-    },
-    "gpt-5.1-codex-max": {
-      input: 8.0,
-      output: 32.0,
-      cached: 4.0,
-      reasoning: 48.0,
-      cache_creation: 8.0,
-    },
-    "gpt-4.1": {
-      input: 2.5,
-      output: 10.0,
-      cached: 1.25,
-      reasoning: 15.0,
-      cache_creation: 2.5,
-    },
-    "claude-4.5-sonnet": {
-      input: 3.0,
-      output: 15.0,
-      cached: 0.3,
-      reasoning: 22.5,
-      cache_creation: 3.0,
-    },
-    "claude-4.5-opus": {
-      input: 5.0,
-      output: 25.0,
-      cached: 0.5,
-      reasoning: 37.5,
-      cache_creation: 5.0,
-    },
-    "claude-4.5-haiku": {
-      input: 0.5,
-      output: 2.5,
-      cached: 0.05,
-      reasoning: 3.75,
-      cache_creation: 0.5,
-    },
-    "gemini-3-pro": {
-      input: 2.0,
-      output: 12.0,
-      cached: 0.25,
-      reasoning: 18.0,
-      cache_creation: 2.0,
-    },
-    "gemini-3-flash": {
-      input: 0.5,
-      output: 3.0,
-      cached: 0.03,
-      reasoning: 4.5,
-      cache_creation: 0.5,
-    },
-    "gemini-2.5-pro": {
-      input: 2.0,
-      output: 12.0,
-      cached: 0.25,
-      reasoning: 18.0,
-      cache_creation: 2.0,
-    },
-    "grok-code-fast-1": {
-      input: 0.5,
-      output: 2.0,
-      cached: 0.25,
-      reasoning: 3.0,
-      cache_creation: 0.5,
-    },
-  },
-
-  // API Key Providers (alias = id)
-
-  // OpenAI
-  openai: {
-    "gpt-5.5": GPT_5_5_PRICING,
-    // The -pro tier mirrors its base family pricing until OpenAI publishes a
-    // distinct pro rate; without these rows the openai provider's gpt-5.x-pro
-    // models (in the registry) resolved to $0 and tripped the catalog pricing gate.
-    "gpt-5.5-pro": GPT_5_5_PRICING,
-    // gpt-5.4 family (public API tier; mirrors the codex 5.4 tier for the
-    // base/mini, with a lower nano tier). Without these rows the openai
-    // provider's gpt-5.4* models resolved to $0.
-    "gpt-5.4": {
-      input: 5.0,
-      output: 20.0,
-      cached: 2.5,
-      reasoning: 30.0,
-      cache_creation: 5.0,
-    },
-    "gpt-5.4-pro": {
-      input: 5.0,
-      output: 20.0,
-      cached: 2.5,
-      reasoning: 30.0,
-      cache_creation: 5.0,
-    },
-    "gpt-5.4-mini": {
-      input: 1.5,
-      output: 6.0,
-      cached: 0.75,
-      reasoning: 9.0,
-      cache_creation: 1.5,
-    },
-    "gpt-5.4-nano": {
-      input: 0.4,
-      output: 1.6,
-      cached: 0.2,
-      reasoning: 2.4,
-      cache_creation: 0.4,
-    },
-    "gpt-4.1": {
-      input: 2.0,
-      output: 8.0,
-      cached: 0.5,
-      reasoning: 12.0,
-      cache_creation: 2.0,
-    },
-    "gpt-4.1-mini": {
-      input: 0.4,
-      output: 1.6,
-      cached: 0.1,
-      reasoning: 2.4,
-      cache_creation: 0.4,
-    },
-    "gpt-4.1-nano": {
-      input: 0.1,
-      output: 0.4,
-      cached: 0.025,
-      reasoning: 0.6,
-      cache_creation: 0.1,
-    },
-    "gpt-4o": {
-      input: 2.5,
-      output: 10.0,
-      cached: 1.25,
-      reasoning: 15.0,
-      cache_creation: 2.5,
-    },
-    "gpt-4o-2024-11-20": {
-      input: 2.5,
-      output: 10.0,
-      cached: 1.25,
-      reasoning: 15.0,
-      cache_creation: 2.5,
-    },
-    "gpt-4o-mini": {
-      input: 0.15,
-      output: 0.6,
-      cached: 0.075,
-      reasoning: 0.9,
-      cache_creation: 0.15,
-    },
-    o3: {
-      input: 2.0,
-      output: 8.0,
-      cached: 0.5,
-      reasoning: 12.0,
-      cache_creation: 2.0,
-    },
-    "o3-mini": {
-      input: 1.1,
-      output: 4.4,
-      cached: 0.55,
-      reasoning: 6.6,
-      cache_creation: 1.1,
-    },
-    "o4-mini": {
-      input: 1.1,
-      output: 4.4,
-      cached: 0.275,
-      reasoning: 6.6,
-      cache_creation: 1.1,
-    },
-    "gpt-4-turbo": {
-      input: 10.0,
-      output: 30.0,
-      cached: 5.0,
-      reasoning: 45.0,
-      cache_creation: 10.0,
-    },
-    o1: {
-      input: 15.0,
-      output: 60.0,
-      cached: 7.5,
-      reasoning: 90.0,
-      cache_creation: 15.0,
-    },
-    "o1-mini": {
-      input: 3.0,
-      output: 12.0,
-      cached: 1.5,
-      reasoning: 18.0,
-      cache_creation: 3.0,
-    },
-  },
-
-  // Anthropic
-  anthropic: {
-    "claude-sonnet-4-20250514": {
-      input: 3.0,
-      output: 15.0,
-      cached: 1.5,
-      reasoning: 15.0,
-      cache_creation: 3.0,
-    },
-    "claude-opus-4-20250514": {
-      input: 15.0,
-      output: 75.0,
-      cached: 7.5,
-      reasoning: 112.5,
-      cache_creation: 15.0,
-    },
-    "claude-3-5-sonnet-20241022": {
-      input: 3.0,
-      output: 15.0,
-      cached: 1.5,
-      reasoning: 15.0,
-      cache_creation: 3.0,
-    },
-    // Claude 4.5 Haiku — modelo eco mais recente da Anthropic (2025-10)
-    "claude-haiku-4-5-20251001": {
-      input: 1.0,
-      output: 5.0,
-      cached: 0.5,
-      reasoning: 7.5,
-      cache_creation: 1.0,
-    },
-    "claude-haiku-4.5": {
-      input: 1.0,
-      output: 5.0,
-      cached: 0.5,
-      reasoning: 7.5,
-      cache_creation: 1.0,
-    },
-    // Claude Sonnet 4.6 — maxOutput 64k tokens, $3/$15/M
-    "claude-sonnet-4-6-20251031": {
-      input: 3.0,
-      output: 15.0,
-      cached: 1.5,
-      reasoning: 22.5,
-      cache_creation: 3.0,
-    },
-    "claude-sonnet-4.6": {
-      input: 3.0,
-      output: 15.0,
-      cached: 1.5,
-      reasoning: 22.5,
-      cache_creation: 3.0,
-    },
-    // Claude Opus 4.6 — mais barato que Opus 4 ($5/$25 vs $15/$75)
-    "claude-opus-4-6-20251031": {
-      input: 5.0,
-      output: 25.0,
-      cached: 2.5,
-      reasoning: 37.5,
-      cache_creation: 5.0,
-    },
-    "claude-opus-4.6": {
-      input: 5.0,
-      output: 25.0,
-      cached: 2.5,
-      reasoning: 37.5,
-      cache_creation: 5.0,
-    },
-    // Common model IDs (without dates) used across providers
-    // Intentional duplicates of dot-notation variants (e.g. claude-opus-4.6)
-    // to cover hyphen-notation IDs (claude-opus-4-6) used by some clients
-    "claude-fable-5": CLAUDE_FABLE_5_PRICING,
-    "claude-opus-4.8": CLAUDE_OPUS_4_PRICING,
-    "claude-opus-4-8": CLAUDE_OPUS_4_PRICING,
-    "claude-opus-4-7": CLAUDE_OPUS_4_PRICING,
-    "claude-opus-4-6": CLAUDE_OPUS_46_PRICING,
-    "claude-sonnet-4-6": CLAUDE_SONNET_46_PRICING,
-    "claude-opus-4-5-20251101": CLAUDE_OPUS_4_PRICING,
-    "claude-sonnet-4-5-20250929": CLAUDE_SONNET_4_PRICING,
-    "claude-sonnet-4": CLAUDE_SONNET_4_PRICING,
-    "claude-opus-4": CLAUDE_OPUS_4_PRICING,
-  },
-
-  // Gemini
-  gemini: {
-    // Gemini 3.1 Pro — novo flagship Google (2026-03-17)
-    // Context: 1.050.000 tokens | Max Output: 65.536
-    "gemini-3.1-pro": {
-      input: 2.0,
-      output: 12.0,
-      cached: 0.25,
-      reasoning: 18.0,
-      cache_creation: 2.0,
-    },
-    "gemini-3-1-pro": {
-      input: 2.0,
-      output: 12.0,
-      cached: 0.25,
-      reasoning: 18.0,
-      cache_creation: 2.0,
-    },
-    "gemini-3-pro-preview": {
-      input: 2.0,
-      output: 12.0,
-      cached: 0.25,
-      reasoning: 18.0,
-      cache_creation: 2.0,
-    },
-    "gemini-3.1-pro-preview": {
-      input: 2.0,
-      output: 12.0,
-      cached: 0.25,
-      reasoning: 18.0,
-      cache_creation: 2.0,
-    },
-    "gemini-2.5-pro": {
-      input: 2.0,
-      output: 12.0,
-      cached: 0.25,
-      reasoning: 18.0,
-      cache_creation: 2.0,
-    },
-    "gemini-2.5-flash": {
-      input: 0.3,
-      output: 2.5,
-      cached: 0.03,
-      reasoning: 3.75,
-      cache_creation: 0.3,
-    },
-    // Gemini 2.5 Flash Lite — preco corrigido: $0.10/$0.40 (ClawRouter)
-    "gemini-2.5-flash-lite": {
-      input: 0.1,
-      output: 0.4,
-      cached: 0.025,
-      reasoning: 0.6,
-      cache_creation: 0.1,
-    },
-  },
-
-  // DeepSeek — API nativa (V3.2 Chat), separada de free providers
-  // Preco: $0.28/$0.42/M tokens (verificado via ClawRouter 2026-03-17)
-  deepseek: {
-    "deepseek-chat": {
-      input: 0.28,
-      output: 0.42,
-      cached: 0.014,
-      reasoning: 0.42,
-      cache_creation: 0.28,
-    },
-    "deepseek-v3": {
-      input: 0.28,
-      output: 0.42,
-      cached: 0.014,
-      reasoning: 0.42,
-      cache_creation: 0.28,
-    },
-    "deepseek-v3.2": {
-      input: 0.28,
-      output: 0.42,
-      cached: 0.014,
-      reasoning: 0.42,
-      cache_creation: 0.28,
-    },
-    "deepseek-reasoner": {
-      input: 0.55,
-      output: 2.19,
-      cached: 0.14,
-      reasoning: 2.19,
-      cache_creation: 0.55,
-    },
-    "deepseek-r1": {
-      input: 0.55,
-      output: 2.19,
-      cached: 0.14,
-      reasoning: 2.19,
-      cache_creation: 0.55,
-    },
-    // DeepSeek V4 Pro — promo until 2026-05-31, then list ($0.145 / $3.48)
-    "deepseek-v4-pro": {
-      input: 0.435,
-      output: 0.87,
-      cached: 0.0036,
-      reasoning: 0.87,
-      cache_creation: 0.435,
-    },
-    "deepseek-v4-flash": {
-      input: 0.07,
-      output: 0.28,
-      cached: 0.014,
-      reasoning: 0.28,
-      cache_creation: 0.07,
-    },
-  },
-
-  // OpenRouter
-  agentrouter: {
-    auto: { input: 2.0, output: 8.0 },
-  },
-  openrouter: {
-    auto: {
-      input: 2.0,
-      output: 8.0,
-      cached: 1.0,
-      reasoning: 12.0,
-      cache_creation: 2.0,
-    },
-  },
-
-  // GLM
-  glm: GLM_PRICING,
-  glmt: GLM_PRICING,
-
-  // Kimi (Moonshot)
-  kimi: {
-    "kimi-latest": {
-      input: 1.0,
-      output: 4.0,
-      cached: 0.5,
-      reasoning: 6.0,
-      cache_creation: 1.0,
-    },
-    // Kimi K2.5 — acesso direto via Moonshot API
-    // Context: 262.144 tokens | Capabilities: reasoning, vision, agentic, tools
-    "kimi-k2.5": {
-      input: 0.6,
-      output: 3.0,
-      cached: 0.3,
-      reasoning: 4.5,
-      cache_creation: 0.6,
-    },
-    "kimi-k2.5-thinking": {
-      input: 0.6,
-      output: 3.0,
-      cached: 0.3,
-      reasoning: 4.5,
-      cache_creation: 0.6,
-    },
-    "kimi-for-coding": {
-      input: 0.6,
-      output: 3.0,
-      cached: 0.3,
-      reasoning: 4.5,
-      cache_creation: 0.6,
-    },
-    "moonshot-kimi-k2.5": {
-      input: 0.6,
-      output: 3.0,
-      cached: 0.3,
-      reasoning: 4.5,
-      cache_creation: 0.6,
-    },
-  },
-
-  // Kimi Coding aliases (OAuth/API key)
-  kmc: {
-    "kimi-k2.5": { input: 0.6, output: 3.0, cached: 0.3, reasoning: 4.5, cache_creation: 0.6 },
-    "kimi-k2.5-thinking": {
-      input: 0.6,
-      output: 3.0,
-      cached: 0.3,
-      reasoning: 4.5,
-      cache_creation: 0.6,
-    },
-    "kimi-latest": { input: 1.0, output: 4.0, cached: 0.5, reasoning: 6.0, cache_creation: 1.0 },
-  },
-  kmca: {
-    "kimi-k2.5": { input: 0.6, output: 3.0, cached: 0.3, reasoning: 4.5, cache_creation: 0.6 },
-    "kimi-k2.5-thinking": {
-      input: 0.6,
-      output: 3.0,
-      cached: 0.3,
-      reasoning: 4.5,
-      cache_creation: 0.6,
-    },
-    "kimi-latest": { input: 1.0, output: 4.0, cached: 0.5, reasoning: 6.0, cache_creation: 1.0 },
-  },
-
-  // MiniMax
-  minimax: {
-    "minimax-m2.1": {
-      input: 0.5,
-      output: 2.0,
-      cached: 0.25,
-      reasoning: 3.0,
-      cache_creation: 0.5,
-    },
-    "MiniMax-M2.1": {
-      input: 0.5,
-      output: 2.0,
-      cached: 0.25,
-      reasoning: 3.0,
-      cache_creation: 0.5,
-    },
-    // MiniMax M2.5 — mais barato que M2.1, reasoning + tools
-    // Context: 204.800 tokens | Max Output: 16.384 tokens
-    "minimax-m2.5": {
-      input: 0.27,
-      output: 0.95,
-      cached: 0.135,
-      reasoning: 1.425,
-      cache_creation: 0.27,
-    },
-    "MiniMax-M2.5": {
-      input: 0.27,
-      output: 0.95,
-      cached: 0.135,
-      reasoning: 1.425,
-      cache_creation: 0.27,
-    },
-    // T12: MiniMax M2.7 — new default model (sub2api PR #1120)
-    // Upgraded from M2.5, same API endpoint api.minimax.io
-    // Pricing estimated, check https://platform.minimaxi.com/document/Price
-    "minimax-m2.7": {
-      input: 0.4,
-      output: 1.6,
-      cached: 0.2,
-      reasoning: 2.4,
-      cache_creation: 0.4,
-    },
-    "MiniMax-M2.7": {
-      input: 0.4,
-      output: 1.6,
-      cached: 0.2,
-      reasoning: 2.4,
-      cache_creation: 0.4,
-    },
-    "minimax-m2.7-highspeed": {
-      input: 0.4,
-      output: 1.6,
-      cached: 0.2,
-      reasoning: 2.4,
-      cache_creation: 0.4,
-    },
-  },
-
-  // ─── Free-tier API Key Providers (nominal $0 pricing) ───
-
-  // Groq
-  groq: {
-    "openai/gpt-oss-120b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-    "gpt-oss-120b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-    "llama-3.3-70b-versatile": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-    "meta-llama/llama-4-maverick-17b-128e-instruct": {
-      input: 0,
-      output: 0,
-      cached: 0,
-      reasoning: 0,
-      cache_creation: 0,
-    },
-    "qwen/qwen3-32b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-  },
-
-  // Blackbox AI
-  blackbox: {
-    "gpt-4o": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-    "gemini-2.5-flash": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-    "claude-sonnet-4": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-    "deepseek-v3": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-    blackboxai: { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-    "blackboxai-pro": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-  },
-
-  // Fireworks
-  fireworks: {
-    "accounts/fireworks/models/gpt-oss-120b": {
-      input: 0,
-      output: 0,
-      cached: 0,
-      reasoning: 0,
-      cache_creation: 0,
-    },
-    "gpt-oss-120b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-    "accounts/fireworks/models/deepseek-v3p1": {
-      input: 0,
-      output: 0,
-      cached: 0,
-      reasoning: 0,
-      cache_creation: 0,
-    },
-    "accounts/fireworks/models/llama-v3p3-70b-instruct": {
-      input: 0,
-      output: 0,
-      cached: 0,
-      reasoning: 0,
-      cache_creation: 0,
-    },
-    "accounts/fireworks/models/qwen3-235b-a22b": {
-      input: 0,
-      output: 0,
-      cached: 0,
-      reasoning: 0,
-      cache_creation: 0,
-    },
-  },
-
-  // Cerebras
-  cerebras: {
-    "gpt-oss-120b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-    "zai-glm-4.7": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-    "llama-3.3-70b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-    "llama-4-scout-17b-16e-instruct": {
-      input: 0,
-      output: 0,
-      cached: 0,
-      reasoning: 0,
-      cache_creation: 0,
-    },
-    "qwen-3-235b-a22b-instruct-2507": {
-      input: 0,
-      output: 0,
-      cached: 0,
-      reasoning: 0,
-      cache_creation: 0,
-    },
-    "qwen-3-32b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-  },
-
-  // Nvidia
-  nvidia: {
-    "nvidia/gpt-oss-120b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-    "openai/gpt-oss-120b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-    "gpt-oss-120b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-    "moonshotai/kimi-k2.5": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-    "z-ai/glm4.7": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-    "deepseek-ai/deepseek-v3.2": {
-      input: 0,
-      output: 0,
-      cached: 0,
-      reasoning: 0,
-      cache_creation: 0,
-    },
-    "nvidia/llama-3.3-70b-instruct": {
-      input: 0,
-      output: 0,
-      cached: 0,
-      reasoning: 0,
-      cache_creation: 0,
-    },
-    "meta/llama-4-maverick-17b-128e-instruct": {
-      input: 0,
-      output: 0,
-      cached: 0,
-      reasoning: 0,
-      cache_creation: 0,
-    },
-    "deepseek/deepseek-r1": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-  },
-
-  // Nebius
-  nebius: {
-    "openai/gpt-oss-120b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-    "gpt-oss-120b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-    "meta-llama/Llama-3.3-70B-Instruct": {
-      input: 0,
-      output: 0,
-      cached: 0,
-      reasoning: 0,
-      cache_creation: 0,
-    },
-  },
-
-  // SiliconFlow
-  siliconflow: {
-    "openai/gpt-oss-120b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-    "gpt-oss-120b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-    "deepseek-ai/DeepSeek-V3.2": {
-      input: 0,
-      output: 0,
-      cached: 0,
-      reasoning: 0,
-      cache_creation: 0,
-    },
-    "deepseek-ai/DeepSeek-V3.1": {
-      input: 0,
-      output: 0,
-      cached: 0,
-      reasoning: 0,
-      cache_creation: 0,
-    },
-    "deepseek-ai/DeepSeek-R1": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-    "Qwen/Qwen3-235B-A22B-Instruct-2507": {
-      input: 0,
-      output: 0,
-      cached: 0,
-      reasoning: 0,
-      cache_creation: 0,
-    },
-    "Qwen/Qwen3-Coder-480B-A35B-Instruct": {
-      input: 0,
-      output: 0,
-      cached: 0,
-      reasoning: 0,
-      cache_creation: 0,
-    },
-    "Qwen/Qwen3-32B": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-    "moonshotai/Kimi-K2.5": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-    "zai-org/GLM-4.7": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-    "baidu/ERNIE-4.5-300B-A47B": {
-      input: 0,
-      output: 0,
-      cached: 0,
-      reasoning: 0,
-      cache_creation: 0,
-    },
-  },
-
-  // Hyperbolic
-  hyperbolic: {
-    "openai/gpt-oss-120b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-    "gpt-oss-120b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-    "Qwen/QwQ-32B": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-    "deepseek-ai/DeepSeek-R1": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-    "deepseek-ai/DeepSeek-V3": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
-    "meta-llama/Llama-3.3-70B-Instruct": {
-      input: 0,
-      output: 0,
-      cached: 0,
-      reasoning: 0,
-      cache_creation: 0,
-    },
-    "meta-llama/Llama-3.2-3B-Instruct": {
-      input: 0,
-      output: 0,
-      cached: 0,
-      reasoning: 0,
-      cache_creation: 0,
-    },
-    "Qwen/Qwen2.5-72B-Instruct": {
-      input: 0,
-      output: 0,
-      cached: 0,
-      reasoning: 0,
-      cache_creation: 0,
-    },
-    "Qwen/Qwen2.5-Coder-32B-Instruct": {
-      input: 0,
-      output: 0,
-      cached: 0,
-      reasoning: 0,
-      cache_creation: 0,
-    },
-    "NousResearch/Hermes-3-Llama-3.1-70B": {
-      input: 0,
-      output: 0,
-      cached: 0,
-      reasoning: 0,
-      cache_creation: 0,
-    },
-  },
-
-  // ─────────────────────────────────────────────────────────────────────
-  // xAI (Grok) — Grok-3 + Grok-4 Family
-  // Source: ClawRouter benchmarks 2026-03-17
-  // Grok-4-fast-non-reasoning: 1143ms P50 (mais rapido do benchmark)
-  // ─────────────────────────────────────────────────────────────────────
-  xai: {
-    "grok-3": {
-      input: 3.0,
-      output: 15.0,
-      cached: 1.5,
-      reasoning: 22.5,
-      cache_creation: 3.0,
-    },
-    "grok-3-mini": {
-      input: 0.3,
-      output: 0.5,
-      cached: 0.15,
-      reasoning: 0.75,
-      cache_creation: 0.3,
-    },
-    // Grok-4 Fast Family — ultrabaratos ($0.20/$0.50/M)
-    "grok-4-fast-non-reasoning": {
-      input: 0.2,
-      output: 0.5,
-      cached: 0.1,
-      reasoning: 0.0,
-      cache_creation: 0.2,
-    },
-    "grok-4-fast-reasoning": {
-      input: 0.2,
-      output: 0.5,
-      cached: 0.1,
-      reasoning: 0.75,
-      cache_creation: 0.2,
-    },
-    "grok-4-1-fast-non-reasoning": {
-      input: 0.2,
-      output: 0.5,
-      cached: 0.1,
-      reasoning: 0.0,
-      cache_creation: 0.2,
-    },
-    "grok-4-1-fast-reasoning": {
-      input: 0.2,
-      output: 0.5,
-      cached: 0.1,
-      reasoning: 0.75,
-      cache_creation: 0.2,
-    },
-    "grok-4-0709": {
-      input: 0.2,
-      output: 1.5,
-      cached: 0.1,
-      reasoning: 2.25,
-      cache_creation: 0.2,
-    },
-  },
-
-  // ─────────────────────────────────────────────────────────────────────
-  // Z.AI / ZhipuAI — GLM-5 Family
-  // Adicionados via ClawRouter 2026-03-17 | maxOutput: 128k tokens!
-  // ─────────────────────────────────────────────────────────────────────
-  zai: {
-    "glm-5": {
-      input: 0.38,
-      output: 1.98,
-      cached: 0.19,
-      reasoning: 2.97,
-      cache_creation: 0.38,
-    },
-    "glm-5-turbo": {
-      input: 1.2,
-      output: 4.0,
-      cached: 0.6,
-      reasoning: 6.0,
-      cache_creation: 1.2,
-    },
-    "glm-4.7": {
-      input: 0.38,
-      output: 1.98,
-      cached: 0.19,
-      reasoning: 2.97,
-      cache_creation: 0.38,
-    },
-  },
-
-  kiro: {
-    "claude-fable-5": {
-      input: 15.0,
-      output: 75.0,
-      cached: 7.5,
-      reasoning: 112.5,
-      cache_creation: 15.0,
-    },
-    "claude-sonnet-4.5": {
-      input: 3.0,
-      output: 15.0,
-      cached: 1.5,
-      reasoning: 15.0,
-      cache_creation: 3.0,
-    },
-    "claude-haiku-4.5": {
-      input: 0.5,
-      output: 2.5,
-      cached: 0.25,
-      reasoning: 2.5,
-      cache_creation: 0.5,
-    },
-    // Models from issue #334
-    "claude-sonnet-4": {
-      input: 3.0,
-      output: 15.0,
-      cached: 1.5,
-      reasoning: 15.0,
-      cache_creation: 3.0,
-    },
-    "claude-opus-4.8": {
-      input: 15.0,
-      output: 75.0,
-      cached: 7.5,
-      reasoning: 75.0,
-      cache_creation: 15.0,
-    },
-    "claude-opus-4.7": {
-      input: 15.0,
-      output: 75.0,
-      cached: 7.5,
-      reasoning: 75.0,
-      cache_creation: 15.0,
-    },
-    "claude-opus-4.6": {
-      input: 15.0,
-      output: 75.0,
-      cached: 7.5,
-      reasoning: 75.0,
-      cache_creation: 15.0,
-    },
-    "claude-sonnet-4.6": {
-      input: 3.0,
-      output: 15.0,
-      cached: 1.5,
-      reasoning: 15.0,
-      cache_creation: 3.0,
-    },
-    "deepseek-v3.2": {
-      input: 0.27,
-      output: 1.1,
-      cached: 0.07,
-      reasoning: 1.1,
-      cache_creation: 0.27,
-    },
-    // Registry exposes this model as "deepseek-3.2" (no "v") — keep both keys priced.
-    "deepseek-3.2": {
-      input: 0.27,
-      output: 1.1,
-      cached: 0.07,
-      reasoning: 1.1,
-      cache_creation: 0.27,
-    },
-    "minimax-m2.1": {
-      input: 0.4,
-      output: 1.6,
-      cached: 0.1,
-      reasoning: 1.6,
-      cache_creation: 0.4,
-    },
-    // MiniMax M2.5 — cheaper than M2.1, reasoning + tools
-    "minimax-m2.5": {
-      input: 0.27,
-      output: 0.95,
-      cached: 0.135,
-      reasoning: 1.425,
-      cache_creation: 0.27,
-    },
-    "glm-5": {
-      input: 1.0,
-      output: 3.2,
-      cached: 0.2,
-      reasoning: 4.8,
-      cache_creation: 1.0,
-    },
-    "qwen3-coder-next": {
-      input: 2.0,
-      output: 8.0,
-      cached: 0.5,
-      reasoning: 8.0,
-      cache_creation: 2.0,
-    },
-    // Kiro "Auto" model — routes to best available
-    auto: {
-      input: 3.0,
-      output: 15.0,
-      cached: 1.5,
-      reasoning: 15.0,
-      cache_creation: 3.0,
-    },
-    // Registry exposes the Auto model as id "auto-kiro" — keep both keys priced.
-    "auto-kiro": {
-      input: 3.0,
-      output: 15.0,
-      cached: 1.5,
-      reasoning: 15.0,
-      cache_creation: 3.0,
-    },
-  },
-};
 
 type ProviderPricingTable = Record<string, Record<string, unknown>>;
 type PricingRow = {
diff --git a/src/shared/constants/pricing/default-pricing.ts b/src/shared/constants/pricing/default-pricing.ts
new file mode 100644
index 0000000000..08b84a86e9
--- /dev/null
+++ b/src/shared/constants/pricing/default-pricing.ts
@@ -0,0 +1,16 @@
+/**
+ * Pricing data — DEFAULT_PRICING barrel (god-file decomposition). Merges the semantic family files
+ * via spread; preserves every entry. Keys are grouped by provider family (was partN order);
+ * pricing lookups are by-key (getPricingForModel) so this is a cosmetic-only ordering change.
+ */
+import { DEFAULT_PRICING_OAUTH } from "./oauth-subscriptions";
+import { DEFAULT_PRICING_FRONTIER } from "./frontier-labs";
+import { DEFAULT_PRICING_INFERENCE } from "./inference-hosts";
+import { DEFAULT_PRICING_REGIONAL } from "./regional";
+
+export const DEFAULT_PRICING = {
+  ...DEFAULT_PRICING_OAUTH,
+  ...DEFAULT_PRICING_FRONTIER,
+  ...DEFAULT_PRICING_INFERENCE,
+  ...DEFAULT_PRICING_REGIONAL,
+};
diff --git a/src/shared/constants/pricing/frontier-labs.ts b/src/shared/constants/pricing/frontier-labs.ts
new file mode 100644
index 0000000000..f8da44774f
--- /dev/null
+++ b/src/shared/constants/pricing/frontier-labs.ts
@@ -0,0 +1,384 @@
+/**
+ * Pricing data — frontier-labs family (first-party frontier model labs).
+ * Pure data; merged by default-pricing.ts via spread (god-file decomposition; semantic split).
+ */
+import {
+  GPT_5_5_PRICING,
+  CLAUDE_FABLE_5_PRICING,
+  CLAUDE_OPUS_4_PRICING,
+  CLAUDE_SONNET_4_PRICING,
+  CLAUDE_OPUS_46_PRICING,
+  CLAUDE_SONNET_46_PRICING,
+} from "./shared-tiers";
+
+export const DEFAULT_PRICING_FRONTIER = {
+  openai: {
+    "gpt-5.5": GPT_5_5_PRICING,
+    // The -pro tier mirrors its base family pricing until OpenAI publishes a
+    // distinct pro rate; without these rows the openai provider's gpt-5.x-pro
+    // models (in the registry) resolved to $0 and tripped the catalog pricing gate.
+    "gpt-5.5-pro": GPT_5_5_PRICING,
+    // gpt-5.4 family (public API tier; mirrors the codex 5.4 tier for the
+    // base/mini, with a lower nano tier). Without these rows the openai
+    // provider's gpt-5.4* models resolved to $0.
+    "gpt-5.4": {
+      input: 5.0,
+      output: 20.0,
+      cached: 2.5,
+      reasoning: 30.0,
+      cache_creation: 5.0,
+    },
+    "gpt-5.4-pro": {
+      input: 5.0,
+      output: 20.0,
+      cached: 2.5,
+      reasoning: 30.0,
+      cache_creation: 5.0,
+    },
+    "gpt-5.4-mini": {
+      input: 1.5,
+      output: 6.0,
+      cached: 0.75,
+      reasoning: 9.0,
+      cache_creation: 1.5,
+    },
+    "gpt-5.4-nano": {
+      input: 0.4,
+      output: 1.6,
+      cached: 0.2,
+      reasoning: 2.4,
+      cache_creation: 0.4,
+    },
+    "gpt-4.1": {
+      input: 2.0,
+      output: 8.0,
+      cached: 0.5,
+      reasoning: 12.0,
+      cache_creation: 2.0,
+    },
+    "gpt-4.1-mini": {
+      input: 0.4,
+      output: 1.6,
+      cached: 0.1,
+      reasoning: 2.4,
+      cache_creation: 0.4,
+    },
+    "gpt-4.1-nano": {
+      input: 0.1,
+      output: 0.4,
+      cached: 0.025,
+      reasoning: 0.6,
+      cache_creation: 0.1,
+    },
+    "gpt-4o": {
+      input: 2.5,
+      output: 10.0,
+      cached: 1.25,
+      reasoning: 15.0,
+      cache_creation: 2.5,
+    },
+    "gpt-4o-2024-11-20": {
+      input: 2.5,
+      output: 10.0,
+      cached: 1.25,
+      reasoning: 15.0,
+      cache_creation: 2.5,
+    },
+    "gpt-4o-mini": {
+      input: 0.15,
+      output: 0.6,
+      cached: 0.075,
+      reasoning: 0.9,
+      cache_creation: 0.15,
+    },
+    o3: {
+      input: 2.0,
+      output: 8.0,
+      cached: 0.5,
+      reasoning: 12.0,
+      cache_creation: 2.0,
+    },
+    "o3-mini": {
+      input: 1.1,
+      output: 4.4,
+      cached: 0.55,
+      reasoning: 6.6,
+      cache_creation: 1.1,
+    },
+    "o4-mini": {
+      input: 1.1,
+      output: 4.4,
+      cached: 0.275,
+      reasoning: 6.6,
+      cache_creation: 1.1,
+    },
+    "gpt-4-turbo": {
+      input: 10.0,
+      output: 30.0,
+      cached: 5.0,
+      reasoning: 45.0,
+      cache_creation: 10.0,
+    },
+    o1: {
+      input: 15.0,
+      output: 60.0,
+      cached: 7.5,
+      reasoning: 90.0,
+      cache_creation: 15.0,
+    },
+    "o1-mini": {
+      input: 3.0,
+      output: 12.0,
+      cached: 1.5,
+      reasoning: 18.0,
+      cache_creation: 3.0,
+    },
+  },
+  anthropic: {
+    "claude-sonnet-4-20250514": {
+      input: 3.0,
+      output: 15.0,
+      cached: 1.5,
+      reasoning: 15.0,
+      cache_creation: 3.0,
+    },
+    "claude-opus-4-20250514": {
+      input: 15.0,
+      output: 75.0,
+      cached: 7.5,
+      reasoning: 112.5,
+      cache_creation: 15.0,
+    },
+    "claude-3-5-sonnet-20241022": {
+      input: 3.0,
+      output: 15.0,
+      cached: 1.5,
+      reasoning: 15.0,
+      cache_creation: 3.0,
+    },
+    // Claude 4.5 Haiku — modelo eco mais recente da Anthropic (2025-10)
+    "claude-haiku-4-5-20251001": {
+      input: 1.0,
+      output: 5.0,
+      cached: 0.5,
+      reasoning: 7.5,
+      cache_creation: 1.0,
+    },
+    "claude-haiku-4.5": {
+      input: 1.0,
+      output: 5.0,
+      cached: 0.5,
+      reasoning: 7.5,
+      cache_creation: 1.0,
+    },
+    // Claude Sonnet 4.6 — maxOutput 64k tokens, $3/$15/M
+    "claude-sonnet-4-6-20251031": {
+      input: 3.0,
+      output: 15.0,
+      cached: 1.5,
+      reasoning: 22.5,
+      cache_creation: 3.0,
+    },
+    "claude-sonnet-4.6": {
+      input: 3.0,
+      output: 15.0,
+      cached: 1.5,
+      reasoning: 22.5,
+      cache_creation: 3.0,
+    },
+    // Claude Opus 4.6 — mais barato que Opus 4 ($5/$25 vs $15/$75)
+    "claude-opus-4-6-20251031": {
+      input: 5.0,
+      output: 25.0,
+      cached: 2.5,
+      reasoning: 37.5,
+      cache_creation: 5.0,
+    },
+    "claude-opus-4.6": {
+      input: 5.0,
+      output: 25.0,
+      cached: 2.5,
+      reasoning: 37.5,
+      cache_creation: 5.0,
+    },
+    // Common model IDs (without dates) used across providers
+    // Intentional duplicates of dot-notation variants (e.g. claude-opus-4.6)
+    // to cover hyphen-notation IDs (claude-opus-4-6) used by some clients
+    "claude-fable-5": CLAUDE_FABLE_5_PRICING,
+    "claude-opus-4.8": CLAUDE_OPUS_4_PRICING,
+    "claude-opus-4-8": CLAUDE_OPUS_4_PRICING,
+    "claude-opus-4-7": CLAUDE_OPUS_4_PRICING,
+    "claude-opus-4-6": CLAUDE_OPUS_46_PRICING,
+    "claude-sonnet-4-6": CLAUDE_SONNET_46_PRICING,
+    "claude-opus-4-5-20251101": CLAUDE_OPUS_4_PRICING,
+    "claude-sonnet-4-5-20250929": CLAUDE_SONNET_4_PRICING,
+    "claude-sonnet-4": CLAUDE_SONNET_4_PRICING,
+    "claude-opus-4": CLAUDE_OPUS_4_PRICING,
+  },
+  gemini: {
+    // Gemini 3.1 Pro — novo flagship Google (2026-03-17)
+    // Context: 1.050.000 tokens | Max Output: 65.536
+    "gemini-3.1-pro": {
+      input: 2.0,
+      output: 12.0,
+      cached: 0.25,
+      reasoning: 18.0,
+      cache_creation: 2.0,
+    },
+    "gemini-3-1-pro": {
+      input: 2.0,
+      output: 12.0,
+      cached: 0.25,
+      reasoning: 18.0,
+      cache_creation: 2.0,
+    },
+    "gemini-3-pro-preview": {
+      input: 2.0,
+      output: 12.0,
+      cached: 0.25,
+      reasoning: 18.0,
+      cache_creation: 2.0,
+    },
+    "gemini-3.1-pro-preview": {
+      input: 2.0,
+      output: 12.0,
+      cached: 0.25,
+      reasoning: 18.0,
+      cache_creation: 2.0,
+    },
+    "gemini-2.5-pro": {
+      input: 2.0,
+      output: 12.0,
+      cached: 0.25,
+      reasoning: 18.0,
+      cache_creation: 2.0,
+    },
+    "gemini-2.5-flash": {
+      input: 0.3,
+      output: 2.5,
+      cached: 0.03,
+      reasoning: 3.75,
+      cache_creation: 0.3,
+    },
+    // Gemini 2.5 Flash Lite — preco corrigido: $0.10/$0.40 (ClawRouter)
+    "gemini-2.5-flash-lite": {
+      input: 0.1,
+      output: 0.4,
+      cached: 0.025,
+      reasoning: 0.6,
+      cache_creation: 0.1,
+    },
+  },
+  deepseek: {
+    "deepseek-chat": {
+      input: 0.28,
+      output: 0.42,
+      cached: 0.014,
+      reasoning: 0.42,
+      cache_creation: 0.28,
+    },
+    "deepseek-v3": {
+      input: 0.28,
+      output: 0.42,
+      cached: 0.014,
+      reasoning: 0.42,
+      cache_creation: 0.28,
+    },
+    "deepseek-v3.2": {
+      input: 0.28,
+      output: 0.42,
+      cached: 0.014,
+      reasoning: 0.42,
+      cache_creation: 0.28,
+    },
+    "deepseek-reasoner": {
+      input: 0.55,
+      output: 2.19,
+      cached: 0.14,
+      reasoning: 2.19,
+      cache_creation: 0.55,
+    },
+    "deepseek-r1": {
+      input: 0.55,
+      output: 2.19,
+      cached: 0.14,
+      reasoning: 2.19,
+      cache_creation: 0.55,
+    },
+    // DeepSeek V4 Pro — promo until 2026-05-31, then list ($0.145 / $3.48)
+    "deepseek-v4-pro": {
+      input: 0.435,
+      output: 0.87,
+      cached: 0.0036,
+      reasoning: 0.87,
+      cache_creation: 0.435,
+    },
+    "deepseek-v4-flash": {
+      input: 0.07,
+      output: 0.28,
+      cached: 0.014,
+      reasoning: 0.28,
+      cache_creation: 0.07,
+    },
+  },
+  blackbox: {
+    "gpt-4o": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+    "gemini-2.5-flash": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+    "claude-sonnet-4": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+    "deepseek-v3": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+    blackboxai: { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+    "blackboxai-pro": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+  },
+  xai: {
+    "grok-3": {
+      input: 3.0,
+      output: 15.0,
+      cached: 1.5,
+      reasoning: 22.5,
+      cache_creation: 3.0,
+    },
+    "grok-3-mini": {
+      input: 0.3,
+      output: 0.5,
+      cached: 0.15,
+      reasoning: 0.75,
+      cache_creation: 0.3,
+    },
+    // Grok-4 Fast Family — ultrabaratos ($0.20/$0.50/M)
+    "grok-4-fast-non-reasoning": {
+      input: 0.2,
+      output: 0.5,
+      cached: 0.1,
+      reasoning: 0.0,
+      cache_creation: 0.2,
+    },
+    "grok-4-fast-reasoning": {
+      input: 0.2,
+      output: 0.5,
+      cached: 0.1,
+      reasoning: 0.75,
+      cache_creation: 0.2,
+    },
+    "grok-4-1-fast-non-reasoning": {
+      input: 0.2,
+      output: 0.5,
+      cached: 0.1,
+      reasoning: 0.0,
+      cache_creation: 0.2,
+    },
+    "grok-4-1-fast-reasoning": {
+      input: 0.2,
+      output: 0.5,
+      cached: 0.1,
+      reasoning: 0.75,
+      cache_creation: 0.2,
+    },
+    "grok-4-0709": {
+      input: 0.2,
+      output: 1.5,
+      cached: 0.1,
+      reasoning: 2.25,
+      cache_creation: 0.2,
+    },
+  },
+};
diff --git a/src/shared/constants/pricing/inference-hosts.ts b/src/shared/constants/pricing/inference-hosts.ts
new file mode 100644
index 0000000000..d3c4c14b5f
--- /dev/null
+++ b/src/shared/constants/pricing/inference-hosts.ts
@@ -0,0 +1,207 @@
+/**
+ * Pricing data — inference-hosts family (serverless GPU / OSS-model hosts + aggregator gateways).
+ * Pure data; merged by default-pricing.ts via spread (god-file decomposition; semantic split).
+ */
+export const DEFAULT_PRICING_INFERENCE = {
+  agentrouter: {
+    auto: { input: 2.0, output: 8.0 },
+  },
+  openrouter: {
+    auto: {
+      input: 2.0,
+      output: 8.0,
+      cached: 1.0,
+      reasoning: 12.0,
+      cache_creation: 2.0,
+    },
+  },
+  groq: {
+    "openai/gpt-oss-120b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+    "gpt-oss-120b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+    "llama-3.3-70b-versatile": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+    "meta-llama/llama-4-maverick-17b-128e-instruct": {
+      input: 0,
+      output: 0,
+      cached: 0,
+      reasoning: 0,
+      cache_creation: 0,
+    },
+    "qwen/qwen3-32b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+  },
+  fireworks: {
+    "accounts/fireworks/models/gpt-oss-120b": {
+      input: 0,
+      output: 0,
+      cached: 0,
+      reasoning: 0,
+      cache_creation: 0,
+    },
+    "gpt-oss-120b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+    "accounts/fireworks/models/deepseek-v3p1": {
+      input: 0,
+      output: 0,
+      cached: 0,
+      reasoning: 0,
+      cache_creation: 0,
+    },
+    "accounts/fireworks/models/llama-v3p3-70b-instruct": {
+      input: 0,
+      output: 0,
+      cached: 0,
+      reasoning: 0,
+      cache_creation: 0,
+    },
+    "accounts/fireworks/models/qwen3-235b-a22b": {
+      input: 0,
+      output: 0,
+      cached: 0,
+      reasoning: 0,
+      cache_creation: 0,
+    },
+  },
+  cerebras: {
+    "gpt-oss-120b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+    "zai-glm-4.7": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+    "llama-3.3-70b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+    "llama-4-scout-17b-16e-instruct": {
+      input: 0,
+      output: 0,
+      cached: 0,
+      reasoning: 0,
+      cache_creation: 0,
+    },
+    "qwen-3-235b-a22b-instruct-2507": {
+      input: 0,
+      output: 0,
+      cached: 0,
+      reasoning: 0,
+      cache_creation: 0,
+    },
+    "qwen-3-32b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+  },
+  nvidia: {
+    "nvidia/gpt-oss-120b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+    "openai/gpt-oss-120b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+    "gpt-oss-120b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+    "moonshotai/kimi-k2.5": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+    "z-ai/glm4.7": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+    "deepseek-ai/deepseek-v3.2": {
+      input: 0,
+      output: 0,
+      cached: 0,
+      reasoning: 0,
+      cache_creation: 0,
+    },
+    "nvidia/llama-3.3-70b-instruct": {
+      input: 0,
+      output: 0,
+      cached: 0,
+      reasoning: 0,
+      cache_creation: 0,
+    },
+    "meta/llama-4-maverick-17b-128e-instruct": {
+      input: 0,
+      output: 0,
+      cached: 0,
+      reasoning: 0,
+      cache_creation: 0,
+    },
+    "deepseek/deepseek-r1": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+  },
+  nebius: {
+    "openai/gpt-oss-120b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+    "gpt-oss-120b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+    "meta-llama/Llama-3.3-70B-Instruct": {
+      input: 0,
+      output: 0,
+      cached: 0,
+      reasoning: 0,
+      cache_creation: 0,
+    },
+  },
+  siliconflow: {
+    "openai/gpt-oss-120b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+    "gpt-oss-120b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+    "deepseek-ai/DeepSeek-V3.2": {
+      input: 0,
+      output: 0,
+      cached: 0,
+      reasoning: 0,
+      cache_creation: 0,
+    },
+    "deepseek-ai/DeepSeek-V3.1": {
+      input: 0,
+      output: 0,
+      cached: 0,
+      reasoning: 0,
+      cache_creation: 0,
+    },
+    "deepseek-ai/DeepSeek-R1": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+    "Qwen/Qwen3-235B-A22B-Instruct-2507": {
+      input: 0,
+      output: 0,
+      cached: 0,
+      reasoning: 0,
+      cache_creation: 0,
+    },
+    "Qwen/Qwen3-Coder-480B-A35B-Instruct": {
+      input: 0,
+      output: 0,
+      cached: 0,
+      reasoning: 0,
+      cache_creation: 0,
+    },
+    "Qwen/Qwen3-32B": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+    "moonshotai/Kimi-K2.5": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+    "zai-org/GLM-4.7": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+    "baidu/ERNIE-4.5-300B-A47B": {
+      input: 0,
+      output: 0,
+      cached: 0,
+      reasoning: 0,
+      cache_creation: 0,
+    },
+  },
+  hyperbolic: {
+    "openai/gpt-oss-120b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+    "gpt-oss-120b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+    "Qwen/QwQ-32B": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+    "deepseek-ai/DeepSeek-R1": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+    "deepseek-ai/DeepSeek-V3": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
+    "meta-llama/Llama-3.3-70B-Instruct": {
+      input: 0,
+      output: 0,
+      cached: 0,
+      reasoning: 0,
+      cache_creation: 0,
+    },
+    "meta-llama/Llama-3.2-3B-Instruct": {
+      input: 0,
+      output: 0,
+      cached: 0,
+      reasoning: 0,
+      cache_creation: 0,
+    },
+    "Qwen/Qwen2.5-72B-Instruct": {
+      input: 0,
+      output: 0,
+      cached: 0,
+      reasoning: 0,
+      cache_creation: 0,
+    },
+    "Qwen/Qwen2.5-Coder-32B-Instruct": {
+      input: 0,
+      output: 0,
+      cached: 0,
+      reasoning: 0,
+      cache_creation: 0,
+    },
+    "NousResearch/Hermes-3-Llama-3.1-70B": {
+      input: 0,
+      output: 0,
+      cached: 0,
+      reasoning: 0,
+      cache_creation: 0,
+    },
+  },
+};
diff --git a/src/shared/constants/pricing/oauth-subscriptions.ts b/src/shared/constants/pricing/oauth-subscriptions.ts
new file mode 100644
index 0000000000..9403a2413f
--- /dev/null
+++ b/src/shared/constants/pricing/oauth-subscriptions.ts
@@ -0,0 +1,646 @@
+/**
+ * Pricing data — oauth-subscriptions family (OAuth / IDE subscription aliases (cc, codex, gemini-cli, antigravity, copilot, kiro…)).
+ * Pure data; merged by default-pricing.ts via spread (god-file decomposition; semantic split).
+ */
+import {
+  GPT_5_3_CODEX_PRICING,
+  GPT_5_5_PRICING,
+} from "./shared-tiers";
+
+export const DEFAULT_PRICING_OAUTH = {
+  cc: {
+    "claude-fable-5": {
+      input: 10.0,
+      output: 50.0,
+      cached: 1.0,
+      reasoning: 50.0,
+      cache_creation: 12.5,
+    },
+    "claude-opus-4-8": {
+      input: 5.0,
+      output: 25.0,
+      cached: 0.5,
+      reasoning: 25.0,
+      cache_creation: 6.25,
+    },
+    "claude-opus-4-7": {
+      input: 5.0,
+      output: 25.0,
+      cached: 0.5,
+      reasoning: 25.0,
+      cache_creation: 6.25,
+    },
+    "claude-opus-4-6": {
+      input: 5.0,
+      output: 25.0,
+      cached: 0.5,
+      reasoning: 25.0,
+      cache_creation: 6.25,
+    },
+    "claude-sonnet-4-6": {
+      input: 3.0,
+      output: 15.0,
+      cached: 0.3,
+      reasoning: 15.0,
+      cache_creation: 3.75,
+    },
+    "claude-opus-4-5-20251101": {
+      input: 5.0,
+      output: 25.0,
+      cached: 0.5,
+      reasoning: 25.0,
+      cache_creation: 6.25,
+    },
+    "claude-sonnet-4-5-20250929": {
+      input: 3.0,
+      output: 15.0,
+      cached: 0.3,
+      reasoning: 15.0,
+      cache_creation: 3.75,
+    },
+    "claude-haiku-4-5-20251001": {
+      input: 1.0,
+      output: 5.0,
+      cached: 0.1,
+      reasoning: 5.0,
+      cache_creation: 1.25,
+    },
+  },
+  cx: {
+    "codex-auto-review": GPT_5_5_PRICING,
+    // GPT 5.5
+    "gpt-5.5": GPT_5_5_PRICING,
+    "gpt5.5": GPT_5_5_PRICING,
+    "gpt-5.5-xhigh": GPT_5_5_PRICING,
+    "gpt-5.5-high": GPT_5_5_PRICING,
+    "gpt-5.5-medium": GPT_5_5_PRICING,
+    "gpt-5.5-low": GPT_5_5_PRICING,
+    "gpt-5.5-none": GPT_5_5_PRICING,
+    // GPT 5.4
+    "gpt-5.4": {
+      input: 5.0,
+      output: 20.0,
+      cached: 2.5,
+      reasoning: 30.0,
+      cache_creation: 5.0,
+    },
+    "gpt5.4": {
+      input: 5.0,
+      output: 20.0,
+      cached: 2.5,
+      reasoning: 30.0,
+      cache_creation: 5.0,
+    },
+    // T12: fallback pricing for gpt-5.4 mini variants
+    "gpt-5.4-mini": {
+      input: 1.5,
+      output: 6.0,
+      cached: 0.75,
+      reasoning: 9.0,
+      cache_creation: 1.5,
+    },
+    "gpt5.4-mini": {
+      input: 1.5,
+      output: 6.0,
+      cached: 0.75,
+      reasoning: 9.0,
+      cache_creation: 1.5,
+    },
+    // gpt-5.4 reasoning-effort variants share the gpt-5.4 tier (registry exposes
+    // -xhigh/-high/-medium/-low; without these rows they resolved to $0).
+    "gpt-5.4-xhigh": GPT_5_3_CODEX_PRICING,
+    "gpt-5.4-high": GPT_5_3_CODEX_PRICING,
+    "gpt-5.4-medium": GPT_5_3_CODEX_PRICING,
+    "gpt-5.4-low": GPT_5_3_CODEX_PRICING,
+    // GPT 5.3 Codex family (all same pricing tier)
+    "gpt-5.3-codex-spark": GPT_5_3_CODEX_PRICING,
+    "gpt-5.3-codex": GPT_5_3_CODEX_PRICING,
+    "gpt-5.3-codex-xhigh": GPT_5_3_CODEX_PRICING,
+    "gpt-5.3-codex-high": GPT_5_3_CODEX_PRICING,
+    "gpt-5.3-codex-low": GPT_5_3_CODEX_PRICING,
+    "gpt-5.3-codex-none": GPT_5_3_CODEX_PRICING,
+    "gpt-5.1-codex-mini-high": {
+      input: 1.5,
+      output: 6.0,
+      cached: 0.75,
+      reasoning: 9.0,
+      cache_creation: 1.5,
+    },
+    "gpt-5.2-codex": {
+      input: 5.0,
+      output: 20.0,
+      cached: 2.5,
+      reasoning: 30.0,
+      cache_creation: 5.0,
+    },
+
+    "gpt-5.2": {
+      input: 5.0,
+      output: 20.0,
+      cached: 2.5,
+      reasoning: 30.0,
+      cache_creation: 5.0,
+    },
+    "gpt-5.1-codex-max": {
+      input: 8.0,
+      output: 32.0,
+      cached: 4.0,
+      reasoning: 48.0,
+      cache_creation: 8.0,
+    },
+    "gpt-5.1-codex": {
+      input: 4.0,
+      output: 16.0,
+      cached: 2.0,
+      reasoning: 24.0,
+      cache_creation: 4.0,
+    },
+    "gpt-5.1-codex-mini": {
+      input: 1.5,
+      output: 6.0,
+      cached: 0.75,
+      reasoning: 9.0,
+      cache_creation: 1.5,
+    },
+    "gpt-5.1": {
+      input: 4.0,
+      output: 16.0,
+      cached: 2.0,
+      reasoning: 24.0,
+      cache_creation: 4.0,
+    },
+    "gpt-5-codex": {
+      input: 3.0,
+      output: 12.0,
+      cached: 1.5,
+      reasoning: 18.0,
+      cache_creation: 3.0,
+    },
+    "gpt-5-codex-mini": {
+      input: 1.0,
+      output: 4.0,
+      cached: 0.5,
+      reasoning: 6.0,
+      cache_creation: 1.0,
+    },
+  },
+  "gemini-cli": {
+    "gemini-3-flash-preview": {
+      input: 0.5,
+      output: 3.0,
+      cached: 0.03,
+      reasoning: 4.5,
+      cache_creation: 0.5,
+    },
+    "gemini-3.1-flash-lite-preview": {
+      input: 0.5,
+      output: 3.0,
+      cached: 0.03,
+      reasoning: 4.5,
+      cache_creation: 0.5,
+    },
+    "gemini-3-pro-preview": {
+      input: 2.0,
+      output: 12.0,
+      cached: 0.25,
+      reasoning: 18.0,
+      cache_creation: 2.0,
+    },
+    "gemini-3.1-pro-preview": {
+      input: 2.0,
+      output: 12.0,
+      cached: 0.25,
+      reasoning: 18.0,
+      cache_creation: 2.0,
+    },
+
+    "gemini-2.5-pro": {
+      input: 2.0,
+      output: 12.0,
+      cached: 0.25,
+      reasoning: 18.0,
+      cache_creation: 2.0,
+    },
+    "gemini-2.5-flash": {
+      input: 0.3,
+      output: 2.5,
+      cached: 0.03,
+      reasoning: 3.75,
+      cache_creation: 0.3,
+    },
+    // Gemini 2.5 Flash Lite — preco corrigido via ClawRouter: $0.10/$0.40 (era $0.15/$1.25)
+    "gemini-2.5-flash-lite": {
+      input: 0.1,
+      output: 0.4,
+      cached: 0.025,
+      reasoning: 0.6,
+      cache_creation: 0.1,
+    },
+  },
+  qw: {
+    "qwen3-coder-plus": {
+      input: 1.0,
+      output: 4.0,
+      cached: 0.5,
+      reasoning: 6.0,
+      cache_creation: 1.0,
+    },
+    // Next-generation Qwen Coder tier (added Mar 2026)
+    "qwen3-coder-next": {
+      input: 2.0,
+      output: 8.0,
+      cached: 1.0,
+      reasoning: 12.0,
+      cache_creation: 2.0,
+    },
+    "qwen3-coder-flash": {
+      input: 0.5,
+      output: 2.0,
+      cached: 0.25,
+      reasoning: 3.0,
+      cache_creation: 0.5,
+    },
+    "vision-model": {
+      input: 1.5,
+      output: 6.0,
+      cached: 0.75,
+      reasoning: 9.0,
+      cache_creation: 1.5,
+    },
+    // Qwen3.5/3.6 Coder Model — ported from upstream 9router PR #156 (zx07).
+    // Priced identically to the vision tier per upstream defaults.
+    "coder-model": {
+      input: 1.5,
+      output: 6.0,
+      cached: 0.75,
+      reasoning: 9.0,
+      cache_creation: 1.5,
+    },
+  },
+  if: {
+    "qwen3-coder-plus": {
+      input: 1.0,
+      output: 4.0,
+      cached: 0.5,
+      reasoning: 6.0,
+      cache_creation: 1.0,
+    },
+    "kimi-k2": {
+      input: 1.0,
+      output: 4.0,
+      cached: 0.5,
+      reasoning: 6.0,
+      cache_creation: 1.0,
+    },
+    "kimi-k2-thinking": {
+      input: 1.5,
+      output: 6.0,
+      cached: 0.75,
+      reasoning: 9.0,
+      cache_creation: 1.5,
+    },
+    "deepseek-r1": {
+      input: 0.75,
+      output: 3.0,
+      cached: 0.375,
+      reasoning: 4.5,
+      cache_creation: 0.75,
+    },
+    "deepseek-v3.2-chat": {
+      input: 0.28,
+      output: 0.42,
+      cached: 0.014,
+      reasoning: 0.63,
+      cache_creation: 0.28,
+    },
+    "deepseek-v3.2": {
+      input: 0.28,
+      output: 0.42,
+      cached: 0.014,
+      reasoning: 0.63,
+      cache_creation: 0.28,
+    },
+    "deepseek-v3.2-reasoner": {
+      input: 0.55,
+      output: 2.19,
+      cached: 0.14,
+      reasoning: 2.19,
+      cache_creation: 0.55,
+    },
+    // Short-form aliases (Mar 2026)
+    "deepseek-3.1": {
+      input: 0.27,
+      output: 1.1,
+      cached: 0.07,
+      reasoning: 2.2,
+      cache_creation: 0.27,
+    },
+    "deepseek-3.2": {
+      input: 0.27,
+      output: 1.1,
+      cached: 0.07,
+      reasoning: 2.2,
+      cache_creation: 0.27,
+    },
+    "minimax-m2": {
+      input: 0.5,
+      output: 2.0,
+      cached: 0.25,
+      reasoning: 3.0,
+      cache_creation: 0.5,
+    },
+    "glm-4.6": {
+      input: 0.5,
+      output: 2.0,
+      cached: 0.25,
+      reasoning: 3.0,
+      cache_creation: 0.5,
+    },
+    "glm-4.7": {
+      input: 0.75,
+      output: 3.0,
+      cached: 0.375,
+      reasoning: 4.5,
+      cache_creation: 0.75,
+    },
+  },
+  ag: {
+    "gemini-3.1-pro-low": {
+      input: 2.0,
+      output: 12.0,
+      cached: 0.25,
+      reasoning: 18.0,
+      cache_creation: 2.0,
+    },
+    "gemini-3.1-pro-high": {
+      input: 4.0,
+      output: 18.0,
+      cached: 0.5,
+      reasoning: 27.0,
+      cache_creation: 4.0,
+    },
+    "gemini-3-flash": {
+      input: 0.5,
+      output: 3.0,
+      cached: 0.03,
+      reasoning: 4.5,
+      cache_creation: 0.5,
+    },
+    // Antigravity 2.0.4+ exposes Gemini 3.5 Flash as three public client ids
+    // (see ANTIGRAVITY_PUBLIC_MODELS in open-sse/config/antigravityModelAliases.ts):
+    //   gemini-3-flash-agent   → "Gemini 3.5 Flash (High)"
+    //   gemini-3.5-flash-low   → "Gemini 3.5 Flash (Medium)"
+    // Both bill at the same per-MTok rates as legacy `gemini-3-flash` above —
+    // without these rows, getPricingForModel("ag", id) returned null and downstream
+    // cost / quota calculations silently fell back to $0.
+    "gemini-3-flash-agent": {
+      input: 0.5,
+      output: 3.0,
+      cached: 0.03,
+      reasoning: 4.5,
+      cache_creation: 0.5,
+    },
+    "gemini-3.5-flash-low": {
+      input: 0.5,
+      output: 3.0,
+      cached: 0.03,
+      reasoning: 4.5,
+      cache_creation: 0.5,
+    },
+    // `gemini-pro-agent` is the Antigravity v1.23+ Agent-mode alias for the
+    // Gemini 3.1 Pro (High) tier — bills at the same rates as `gemini-3.1-pro-high`.
+    "gemini-pro-agent": {
+      input: 4.0,
+      output: 18.0,
+      cached: 0.5,
+      reasoning: 27.0,
+      cache_creation: 4.0,
+    },
+    "claude-sonnet-4-6": {
+      input: 3.0,
+      output: 15.0,
+      cached: 0.3,
+      reasoning: 22.5,
+      cache_creation: 3.0,
+    },
+    "claude-opus-4-6-thinking": {
+      input: 5.0,
+      output: 25.0,
+      cached: 0.5,
+      reasoning: 37.5,
+      cache_creation: 5.0,
+    },
+    "gpt-oss-120b-medium": {
+      input: 0.5,
+      output: 2.0,
+      cached: 0.25,
+      reasoning: 3.0,
+      cache_creation: 0.5,
+    },
+  },
+  gh: {
+    "gpt-5": {
+      input: 3.0,
+      output: 12.0,
+      cached: 1.5,
+      reasoning: 18.0,
+      cache_creation: 3.0,
+    },
+    "gpt-5-mini": {
+      input: 0.75,
+      output: 3.0,
+      cached: 0.375,
+      reasoning: 4.5,
+      cache_creation: 0.75,
+    },
+    "gpt-5.1-codex": {
+      input: 4.0,
+      output: 16.0,
+      cached: 2.0,
+      reasoning: 24.0,
+      cache_creation: 4.0,
+    },
+    "gpt-5.1-codex-max": {
+      input: 8.0,
+      output: 32.0,
+      cached: 4.0,
+      reasoning: 48.0,
+      cache_creation: 8.0,
+    },
+    "gpt-4.1": {
+      input: 2.5,
+      output: 10.0,
+      cached: 1.25,
+      reasoning: 15.0,
+      cache_creation: 2.5,
+    },
+    "claude-4.5-sonnet": {
+      input: 3.0,
+      output: 15.0,
+      cached: 0.3,
+      reasoning: 22.5,
+      cache_creation: 3.0,
+    },
+    "claude-4.5-opus": {
+      input: 5.0,
+      output: 25.0,
+      cached: 0.5,
+      reasoning: 37.5,
+      cache_creation: 5.0,
+    },
+    "claude-4.5-haiku": {
+      input: 0.5,
+      output: 2.5,
+      cached: 0.05,
+      reasoning: 3.75,
+      cache_creation: 0.5,
+    },
+    "gemini-3-pro": {
+      input: 2.0,
+      output: 12.0,
+      cached: 0.25,
+      reasoning: 18.0,
+      cache_creation: 2.0,
+    },
+    "gemini-3-flash": {
+      input: 0.5,
+      output: 3.0,
+      cached: 0.03,
+      reasoning: 4.5,
+      cache_creation: 0.5,
+    },
+    "gemini-2.5-pro": {
+      input: 2.0,
+      output: 12.0,
+      cached: 0.25,
+      reasoning: 18.0,
+      cache_creation: 2.0,
+    },
+    "grok-code-fast-1": {
+      input: 0.5,
+      output: 2.0,
+      cached: 0.25,
+      reasoning: 3.0,
+      cache_creation: 0.5,
+    },
+  },
+  kiro: {
+    "claude-fable-5": {
+      input: 15.0,
+      output: 75.0,
+      cached: 7.5,
+      reasoning: 112.5,
+      cache_creation: 15.0,
+    },
+    "claude-sonnet-4.5": {
+      input: 3.0,
+      output: 15.0,
+      cached: 1.5,
+      reasoning: 15.0,
+      cache_creation: 3.0,
+    },
+    "claude-haiku-4.5": {
+      input: 0.5,
+      output: 2.5,
+      cached: 0.25,
+      reasoning: 2.5,
+      cache_creation: 0.5,
+    },
+    // Models from issue #334
+    "claude-sonnet-4": {
+      input: 3.0,
+      output: 15.0,
+      cached: 1.5,
+      reasoning: 15.0,
+      cache_creation: 3.0,
+    },
+    "claude-opus-4.8": {
+      input: 15.0,
+      output: 75.0,
+      cached: 7.5,
+      reasoning: 75.0,
+      cache_creation: 15.0,
+    },
+    "claude-opus-4.7": {
+      input: 15.0,
+      output: 75.0,
+      cached: 7.5,
+      reasoning: 75.0,
+      cache_creation: 15.0,
+    },
+    "claude-opus-4.6": {
+      input: 15.0,
+      output: 75.0,
+      cached: 7.5,
+      reasoning: 75.0,
+      cache_creation: 15.0,
+    },
+    "claude-sonnet-4.6": {
+      input: 3.0,
+      output: 15.0,
+      cached: 1.5,
+      reasoning: 15.0,
+      cache_creation: 3.0,
+    },
+    "deepseek-v3.2": {
+      input: 0.27,
+      output: 1.1,
+      cached: 0.07,
+      reasoning: 1.1,
+      cache_creation: 0.27,
+    },
+    // Registry exposes this model as "deepseek-3.2" (no "v") — keep both keys priced.
+    "deepseek-3.2": {
+      input: 0.27,
+      output: 1.1,
+      cached: 0.07,
+      reasoning: 1.1,
+      cache_creation: 0.27,
+    },
+    "minimax-m2.1": {
+      input: 0.4,
+      output: 1.6,
+      cached: 0.1,
+      reasoning: 1.6,
+      cache_creation: 0.4,
+    },
+    // MiniMax M2.5 — cheaper than M2.1, reasoning + tools
+    "minimax-m2.5": {
+      input: 0.27,
+      output: 0.95,
+      cached: 0.135,
+      reasoning: 1.425,
+      cache_creation: 0.27,
+    },
+    "glm-5": {
+      input: 1.0,
+      output: 3.2,
+      cached: 0.2,
+      reasoning: 4.8,
+      cache_creation: 1.0,
+    },
+    "qwen3-coder-next": {
+      input: 2.0,
+      output: 8.0,
+      cached: 0.5,
+      reasoning: 8.0,
+      cache_creation: 2.0,
+    },
+    // Kiro "Auto" model — routes to best available
+    auto: {
+      input: 3.0,
+      output: 15.0,
+      cached: 1.5,
+      reasoning: 15.0,
+      cache_creation: 3.0,
+    },
+    // Registry exposes the Auto model as id "auto-kiro" — keep both keys priced.
+    "auto-kiro": {
+      input: 3.0,
+      output: 15.0,
+      cached: 1.5,
+      reasoning: 15.0,
+      cache_creation: 3.0,
+    },
+  },
+};
diff --git a/src/shared/constants/pricing/regional.ts b/src/shared/constants/pricing/regional.ts
new file mode 100644
index 0000000000..739ec566fe
--- /dev/null
+++ b/src/shared/constants/pricing/regional.ts
@@ -0,0 +1,152 @@
+/**
+ * Pricing data — regional family (China + other regional providers (incl. GLM/Zhipu)).
+ * Pure data; merged by default-pricing.ts via spread (god-file decomposition; semantic split).
+ */
+import {
+  GLM_PRICING,
+} from "./shared-tiers";
+
+export const DEFAULT_PRICING_REGIONAL = {
+  glm: GLM_PRICING,
+  glmt: GLM_PRICING,
+  kimi: {
+    "kimi-latest": {
+      input: 1.0,
+      output: 4.0,
+      cached: 0.5,
+      reasoning: 6.0,
+      cache_creation: 1.0,
+    },
+    // Kimi K2.5 — acesso direto via Moonshot API
+    // Context: 262.144 tokens | Capabilities: reasoning, vision, agentic, tools
+    "kimi-k2.5": {
+      input: 0.6,
+      output: 3.0,
+      cached: 0.3,
+      reasoning: 4.5,
+      cache_creation: 0.6,
+    },
+    "kimi-k2.5-thinking": {
+      input: 0.6,
+      output: 3.0,
+      cached: 0.3,
+      reasoning: 4.5,
+      cache_creation: 0.6,
+    },
+    "kimi-for-coding": {
+      input: 0.6,
+      output: 3.0,
+      cached: 0.3,
+      reasoning: 4.5,
+      cache_creation: 0.6,
+    },
+    "moonshot-kimi-k2.5": {
+      input: 0.6,
+      output: 3.0,
+      cached: 0.3,
+      reasoning: 4.5,
+      cache_creation: 0.6,
+    },
+  },
+  kmc: {
+    "kimi-k2.5": { input: 0.6, output: 3.0, cached: 0.3, reasoning: 4.5, cache_creation: 0.6 },
+    "kimi-k2.5-thinking": {
+      input: 0.6,
+      output: 3.0,
+      cached: 0.3,
+      reasoning: 4.5,
+      cache_creation: 0.6,
+    },
+    "kimi-latest": { input: 1.0, output: 4.0, cached: 0.5, reasoning: 6.0, cache_creation: 1.0 },
+  },
+  kmca: {
+    "kimi-k2.5": { input: 0.6, output: 3.0, cached: 0.3, reasoning: 4.5, cache_creation: 0.6 },
+    "kimi-k2.5-thinking": {
+      input: 0.6,
+      output: 3.0,
+      cached: 0.3,
+      reasoning: 4.5,
+      cache_creation: 0.6,
+    },
+    "kimi-latest": { input: 1.0, output: 4.0, cached: 0.5, reasoning: 6.0, cache_creation: 1.0 },
+  },
+  minimax: {
+    "minimax-m2.1": {
+      input: 0.5,
+      output: 2.0,
+      cached: 0.25,
+      reasoning: 3.0,
+      cache_creation: 0.5,
+    },
+    "MiniMax-M2.1": {
+      input: 0.5,
+      output: 2.0,
+      cached: 0.25,
+      reasoning: 3.0,
+      cache_creation: 0.5,
+    },
+    // MiniMax M2.5 — mais barato que M2.1, reasoning + tools
+    // Context: 204.800 tokens | Max Output: 16.384 tokens
+    "minimax-m2.5": {
+      input: 0.27,
+      output: 0.95,
+      cached: 0.135,
+      reasoning: 1.425,
+      cache_creation: 0.27,
+    },
+    "MiniMax-M2.5": {
+      input: 0.27,
+      output: 0.95,
+      cached: 0.135,
+      reasoning: 1.425,
+      cache_creation: 0.27,
+    },
+    // T12: MiniMax M2.7 — new default model (sub2api PR #1120)
+    // Upgraded from M2.5, same API endpoint api.minimax.io
+    // Pricing estimated, check https://platform.minimaxi.com/document/Price
+    "minimax-m2.7": {
+      input: 0.4,
+      output: 1.6,
+      cached: 0.2,
+      reasoning: 2.4,
+      cache_creation: 0.4,
+    },
+    "MiniMax-M2.7": {
+      input: 0.4,
+      output: 1.6,
+      cached: 0.2,
+      reasoning: 2.4,
+      cache_creation: 0.4,
+    },
+    "minimax-m2.7-highspeed": {
+      input: 0.4,
+      output: 1.6,
+      cached: 0.2,
+      reasoning: 2.4,
+      cache_creation: 0.4,
+    },
+  },
+  zai: {
+    "glm-5": {
+      input: 0.38,
+      output: 1.98,
+      cached: 0.19,
+      reasoning: 2.97,
+      cache_creation: 0.38,
+    },
+    "glm-5-turbo": {
+      input: 1.2,
+      output: 4.0,
+      cached: 0.6,
+      reasoning: 6.0,
+      cache_creation: 1.2,
+    },
+    "glm-4.7": {
+      input: 0.38,
+      output: 1.98,
+      cached: 0.19,
+      reasoning: 2.97,
+      cache_creation: 0.38,
+    },
+  },
+};
diff --git a/src/shared/constants/pricing/shared-tiers.ts b/src/shared/constants/pricing/shared-tiers.ts
new file mode 100644
index 0000000000..768642c5a3
--- /dev/null
+++ b/src/shared/constants/pricing/shared-tiers.ts
@@ -0,0 +1,152 @@
+/**
+ * Pricing data — shared per-MTok tier constants (god-file decomposition). Pure data; merged by the barrel.
+ */
+export const GPT_5_3_CODEX_PRICING = {
+  input: 5.0,
+  output: 20.0,
+  cached: 2.5,
+  reasoning: 30.0,
+  cache_creation: 5.0,
+};
+
+export const GPT_5_5_PRICING = {
+  input: 5.0,
+  output: 30.0,
+  cached: 0.5,
+  reasoning: 30.0,
+  cache_creation: 5.0,
+};
+
+export const CLAUDE_FABLE_5_PRICING = {
+  input: 15.0,
+  output: 75.0,
+  cached: 7.5,
+  reasoning: 112.5,
+  cache_creation: 15.0,
+};
+
+export const CLAUDE_OPUS_4_PRICING = {
+  input: 15.0,
+  output: 75.0,
+  cached: 7.5,
+  reasoning: 112.5,
+  cache_creation: 15.0,
+};
+
+export const CLAUDE_SONNET_4_PRICING = {
+  input: 3.0,
+  output: 15.0,
+  cached: 1.5,
+  reasoning: 15.0,
+  cache_creation: 3.0,
+};
+
+export const CLAUDE_OPUS_46_PRICING = {
+  input: 5.0,
+  output: 25.0,
+  cached: 2.5,
+  reasoning: 37.5,
+  cache_creation: 5.0,
+};
+
+export const CLAUDE_SONNET_46_PRICING = {
+  input: 3.0,
+  output: 15.0,
+  cached: 1.5,
+  reasoning: 22.5,
+  cache_creation: 3.0,
+};
+
+export const GLM_PRICING = {
+  "glm-5.2": {
+    input: 1.2,
+    output: 5,
+    cached: 0.3,
+    reasoning: 5,
+    cache_creation: 1.2,
+  },
+  "glm-5.2-high": {
+    input: 1.2,
+    output: 5,
+    cached: 0.3,
+    reasoning: 5,
+    cache_creation: 1.2,
+  },
+  "glm-5.2-max": {
+    input: 1.2,
+    output: 5,
+    cached: 0.3,
+    reasoning: 5,
+    cache_creation: 1.2,
+  },
+  "glm-5.1": {
+    input: 1.2,
+    output: 5,
+    cached: 0.3,
+    reasoning: 5,
+    cache_creation: 1.2,
+  },
+  "glm-5": {
+    input: 1.0,
+    output: 3.2,
+    cached: 0.2,
+    reasoning: 4.8,
+    cache_creation: 1.0,
+  },
+  "glm-5-turbo": {
+    input: 1.2,
+    output: 4.0,
+    cached: 0.24,
+    reasoning: 4.0,
+    cache_creation: 1.2,
+  },
+  "glm-4.7-flash": {
+    input: 0,
+    output: 0,
+    cached: 0,
+    reasoning: 0,
+    cache_creation: 0,
+  },
+  "glm-4.7": {
+    input: 0.6,
+    output: 2.2,
+    cached: 0.11,
+    reasoning: 2.2,
+    cache_creation: 0.6,
+  },
+  "glm-4.6": {
+    input: 0.6,
+    output: 2.2,
+    cached: 0.11,
+    reasoning: 2.2,
+    cache_creation: 0.6,
+  },
+  "glm-4.6v": {
+    input: 0.3,
+    output: 0.9,
+    cached: 0.05,
+    reasoning: 0.9,
+    cache_creation: 0.3,
+  },
+  "glm-4.5v": {
+    input: 0.6,
+    output: 1.8,
+    cached: 0.11,
+    reasoning: 1.8,
+    cache_creation: 0.6,
+  },
+  "glm-4.5": {
+    input: 0.6,
+    output: 2.2,
+    cached: 0.11,
+    reasoning: 2.2,
+    cache_creation: 0.6,
+  },
+  "glm-4.5-air": {
+    input: 0.2,
+    output: 1.1,
+    cached: 0.03,
+    reasoning: 1.1,
+    cache_creation: 0.2,
+  },
+};
diff --git a/src/shared/constants/providers.ts b/src/shared/constants/providers.ts
index 1150c2e78d..3a33de4756 100644
--- a/src/shared/constants/providers.ts
+++ b/src/shared/constants/providers.ts
@@ -22,2439 +22,40 @@ export interface ProviderRiskNoticeFields {
   isEmbeddedService?: boolean;
 }
 
+import { NOAUTH_PROVIDERS } from "./providers/noauth";
+import { OAUTH_PROVIDERS } from "./providers/oauth";
+import { WEB_COOKIE_PROVIDERS } from "./providers/web-cookie";
+import { APIKEY_PROVIDERS } from "./providers/apikey";
+import { LOCAL_PROVIDERS } from "./providers/local";
+import { SEARCH_PROVIDERS } from "./providers/search";
+import { AUDIO_ONLY_PROVIDERS } from "./providers/audio";
+import { UPSTREAM_PROXY_PROVIDERS } from "./providers/upstream-proxy";
+import { CLOUD_AGENT_PROVIDERS } from "./providers/cloud-agent";
+import { SYSTEM_PROVIDERS } from "./providers/system";
+
 export const FREE_PROVIDERS = {};
 
 // No-auth Providers
-export const NOAUTH_PROVIDERS = {
-  opencode: {
-    id: "opencode",
-    alias: "oc",
-    name: "OpenCode Free",
-    icon: "terminal",
-    color: "#E87040",
-    textIcon: "OC",
-    website: "https://opencode.ai",
-    noAuth: true,
-    hasFree: true,
-    serviceKinds: ["llm"],
-    authHint: "No API key required — uses OpenCode's public free endpoint.",
-    freeNote:
-      "No API key required — public OpenCode endpoint with Kimi, GLM, Qwen, MiMo, MiniMax models.",
-    notice: {
-      text: "OpenCode Free uses the public OpenCode endpoint (https://opencode.ai/zen/v1). No signup or API key needed. Rate limits apply.",
-    },
-  },
-  "duckduckgo-web": {
-    id: "duckduckgo-web",
-    alias: "ddgw",
-    name: "DuckDuckGo AI Chat",
-    icon: "auto_awesome",
-    color: "#DE5833",
-    textIcon: "DDG",
-    website: "https://duckduckgo.com/duckchat",
-    noAuth: true,
-    hasFree: true,
-    serviceKinds: ["llm"],
-    freeNote: "Free — anonymous access to multiple AI models via DuckDuckGo.",
-    authHint: "No credentials required — DuckDuckGo AI Chat is anonymous and free.",
-  },
-  theoldllm: {
-    id: "theoldllm",
-    alias: "tllm",
-    name: "The Old LLM (Free)",
-    icon: "auto_awesome",
-    color: "#8B5CF6",
-    textIcon: "TL",
-    website: "https://theoldllm.vercel.app",
-    noAuth: true,
-    hasFree: true,
-    serviceKinds: ["llm"],
-    freeNote:
-      "Free — GPT-5.4, Claude 4.6 Opus/Sonnet/Haiku, + more. No API key — tokens auto-generated via browser.",
-    authHint:
-      "No credentials required. The executor auto-generates access tokens via an embedded Playwright browser instance.",
-  },
-  chipotle: {
-    id: "chipotle",
-    alias: "pepper",
-    name: "Chipotle Pepper AI (Free)",
-    icon: "restaurant",
-    color: "#C41230",
-    textIcon: "🌯",
-    website: "https://amelia.chipotle.com",
-    noAuth: true,
-    hasFree: true,
-    serviceKinds: ["llm"],
-    freeNote:
-      "Free — Chipotle's Pepper AI (IPsoft Amelia). Anonymous sessions, no API key. Rate-limited.",
-    authHint:
-      "No credentials required. Uses Chipotle's public support chatbot via reverse-engineered SockJS/STOMP protocol.",
-  },
-  "veoaifree-web": {
-    id: "veoaifree-web",
-    alias: "veo-free",
-    name: "Veo AI Free",
-    icon: "videocam",
-    color: "#8B5CF6",
-    textIcon: "VF",
-    website: "https://veoaifree.com",
-    noAuth: true,
-    hasFree: true,
-    serviceKinds: ["video"],
-    freeNote: "Free video generation — VEO 3.1, Seedance. 6 requests/hour.",
-    authHint: "No auth required. Rate limited to 6 requests/hour per IP.",
-  },
-  mimocode: {
-    id: "mimocode",
-    alias: "mcode",
-    name: "MiMoCode (Free)",
-    icon: "devices",
-    color: "#FF6B35",
-    textIcon: "MC",
-    website: "https://mimo.mi.com",
-    noAuth: true,
-    hasFree: true,
-    serviceKinds: ["llm"],
-    freeNote:
-      "Free — Xiaomi MiMo models via bootstrap JWT auth. No API key required. Supports streaming.",
-    authHint:
-      "No API key required. The executor auto-generates JWT tokens via device fingerprint bootstrap.",
-    notice: {
-      text: "MiMoCode uses Xiaomi's public free AI endpoint with bootstrap-based JWT authentication. No signup needed. Rate limits apply.",
-    },
-  },
-};
 
-export const FREE_APIKEY_PROVIDER_IDS = new Set(["qoder", "mimocode", "opencode"]);
+export const FREE_APIKEY_PROVIDER_IDS = new Set([
+  "qoder",
+  "mimocode",
+  "opencode",
+  // codebuddy-cn is OAuth-primary but the Tencent gateway also accepts a direct
+  // API key (Authorization: Bearer). Admit it through the same managed-provider
+  // gate so POST /api/providers accepts the dual-auth shape.
+  "codebuddy-cn",
+]);
 
 export function supportsApiKeyOnFreeProvider(providerId: unknown): boolean {
   return typeof providerId === "string" && FREE_APIKEY_PROVIDER_IDS.has(providerId);
 }
 
 // OAuth Providers
-export const OAUTH_PROVIDERS = {
-  qoder: {
-    id: "qoder",
-    alias: "if",
-    name: "Qoder AI",
-    icon: "water_drop",
-    color: "#6366F1",
-    subscriptionRisk: true,
-    riskNoticeVariant: "oauth",
-    hasFree: true,
-  },
-  qwen: {
-    id: "qwen",
-    alias: "qw",
-    name: "Qwen Code",
-    icon: "psychology",
-    color: "#10B981",
-    subscriptionRisk: true,
-    riskNoticeVariant: "deprecated",
-    deprecated: true,
-    deprecationReason:
-      "Qwen OAuth free tier was discontinued on 2026-04-15. Use 'bailian-coding-plan', 'alibaba', 'alibaba-cn', or 'openrouter' provider with API key instead.",
-  },
-  "gemini-cli": {
-    id: "gemini-cli",
-    alias: "gemini-cli",
-    name: "Gemini CLI",
-    icon: "terminal",
-    color: "#4285F4",
-    subscriptionRisk: true,
-    riskNoticeVariant: "deprecated",
-    hasFree: true,
-    authHint:
-      "Uses Gemini CLI OAuth / Cloud Code credentials. Pro models require an eligible Google account or paid plan.",
-  },
-  agy: {
-    id: "agy",
-    alias: "agy",
-    name: "Antigravity CLI",
-    icon: "terminal",
-    color: "#F59E0B",
-    textIcon: "AGY",
-    website: "https://antigravity.google",
-    subscriptionRisk: true,
-    riskNoticeVariant: "oauth",
-    hasFree: true,
-    authHint:
-      "Import your Antigravity CLI (`agy`) login (paste/upload its token file), auto-detect a local CLI login, or sign in with Google. Shares the Antigravity backend (incl. Claude models).",
-  },
-  kiro: {
-    id: "kiro",
-    alias: "kr",
-    name: "Kiro AI",
-    icon: "psychology_alt",
-    color: "#FF6B35",
-    subscriptionRisk: true,
-    riskNoticeVariant: "deprecated",
-    hasFree: true,
-    freeNote:
-      "Free tier: 50 credits/month (~25K–100K tokens). ⚠️ Kiro ToS prohibits third-party proxy/harness use.",
-  },
-  "amazon-q": {
-    id: "amazon-q",
-    alias: "aq",
-    name: "Amazon Q",
-    icon: "cloud",
-    color: "#FF9900",
-    textIcon: "AQ",
-    website: "https://aws.amazon.com/q/developer/",
-    hasFree: true,
-    authHint:
-      "Uses the same AWS Builder ID or imported refresh-token flow as Kiro, but keeps Amazon Q connections separate.",
-  },
-  claude: {
-    id: "claude",
-    alias: "cc",
-    name: "Claude Code",
-    icon: "smart_toy",
-    color: "#D97757",
-    subscriptionRisk: true,
-    riskNoticeVariant: "oauth",
-  },
-  antigravity: {
-    id: "antigravity",
-    alias: undefined,
-    name: "Antigravity",
-    icon: "rocket_launch",
-    color: "#F59E0B",
-    subscriptionRisk: true,
-    riskNoticeVariant: "oauth",
-  },
-  codex: {
-    id: "codex",
-    alias: "cx",
-    name: "OpenAI Codex",
-    icon: "code",
-    color: "#3B82F6",
-    subscriptionRisk: true,
-    riskNoticeVariant: "oauth",
-  },
-  github: { id: "github", alias: "gh", name: "GitHub Copilot", icon: "code", color: "#333333" },
-  "gitlab-duo": {
-    id: "gitlab-duo",
-    alias: "gitlab-duo",
-    name: "GitLab Duo",
-    icon: "hub",
-    color: "#FC6D26",
-    textIcon: "GL",
-    website: "https://docs.gitlab.com/user/duo_agent_platform/code_suggestions/",
-    authHint:
-      "OAuth application with ai_features + read_user scopes. Configure GITLAB_DUO_OAUTH_CLIENT_ID and optionally GITLAB_DUO_OAUTH_CLIENT_SECRET on this OmniRoute instance.",
-  },
-  cursor: {
-    id: "cursor",
-    alias: "cu",
-    name: "Cursor IDE",
-    icon: "edit_note",
-    color: "#00D4AA",
-    subscriptionRisk: true,
-    riskNoticeVariant: "oauth",
-  },
-  zed: {
-    id: "zed",
-    alias: "zd",
-    name: "Zed IDE",
-    icon: "code",
-    color: "#084CCF",
-    textIcon: "ZD",
-    website: "https://zed.dev",
-    authHint:
-      "Zed stores LLM provider credentials (OpenAI, Anthropic, Google, Mistral, xAI) in the OS keychain. Use the Import button below to discover and import them automatically.",
-  },
-  trae: {
-    id: "trae",
-    alias: "tr",
-    name: "Trae",
-    icon: "edit_square",
-    color: "#FF7849",
-    textIcon: "TR",
-    website: "https://trae.ai",
-    authHint:
-      "Trae is an AI-native IDE by ByteDance (SOLO remote agent). Authorize via trae.ai in the popup, or sign in at solo.trae.ai and paste the Cloud-IDE-JWT (sent as 'Authorization: Cloud-IDE-JWT <token>', ~14-day lifetime) as the access token; web_id/biz_user_id/user_unique_id/scope/tenant/region propagate via providerSpecificData. No headless refresh for pasted tokens — re-paste on expiry.",
-  },
-  "kimi-coding": {
-    id: "kimi-coding",
-    alias: "kmc",
-    name: "Kimi Coding",
-    icon: "psychology",
-    color: "#1E40AF",
-    textIcon: "KC",
-    subscriptionRisk: true,
-    riskNoticeVariant: "oauth",
-  },
-  kilocode: {
-    id: "kilocode",
-    alias: "kc",
-    name: "Kilo Code",
-    icon: "code",
-    color: "#FF6B35",
-    textIcon: "KC",
-    subscriptionRisk: true,
-    riskNoticeVariant: "oauth",
-  },
-  cline: {
-    id: "cline",
-    alias: "cl",
-    name: "Cline",
-    icon: "smart_toy",
-    color: "#5B9BD5",
-    textIcon: "CL",
-    subscriptionRisk: true,
-    riskNoticeVariant: "oauth",
-  },
-  windsurf: {
-    id: "windsurf",
-    alias: "ws",
-    name: "Windsurf (Devin CLI)",
-    icon: "air",
-    color: "#00C5A0",
-    textIcon: "WS",
-    subscriptionRisk: true,
-    riskNoticeVariant: "oauth",
-    authHint:
-      'In the Windsurf / VS Code IDE, open the command palette and run `Windsurf: Provide Auth Token` (or click the Jupyter "Get Windsurf Authentication Token" button), then copy the shown token and paste it here. Note: opening windsurf.com/show-auth-token directly only renders a "Redirecting" page — the IDE must initiate the flow (it adds a `?state=...` param) for the token to appear.',
-    website: "https://windsurf.com",
-  },
-  "devin-cli": {
-    id: "devin-cli",
-    alias: "dv",
-    name: "Devin CLI (Official)",
-    icon: "terminal",
-    color: "#6366F1",
-    textIcon: "DV",
-    authHint:
-      "Requires the Devin CLI binary. Run `devin auth login` to authenticate, or provide your WINDSURF_API_KEY. Install: https://cli.devin.ai",
-    website: "https://cli.devin.ai",
-  },
-};
 
 // Web / Cookie Providers
-export const WEB_COOKIE_PROVIDERS = {
-  "chatgpt-web": {
-    id: "chatgpt-web",
-    alias: "cgpt-web",
-    name: "ChatGPT Web (Plus/Pro)",
-    icon: "auto_awesome",
-    color: "#10A37F",
-    textIcon: "CG",
-    website: "https://chatgpt.com",
-    authHint: "Paste your __Secure-next-auth.session-token cookie value from chatgpt.com",
-    subscriptionRisk: true,
-    riskNoticeVariant: "webCookie",
-  },
-  "grok-web": {
-    id: "grok-web",
-    alias: "gw",
-    name: "Grok Web (Subscription)",
-    icon: "auto_awesome",
-    color: "#1DA1F2",
-    textIcon: "GW",
-    website: "https://grok.com",
-    authHint:
-      "Paste the full grok.com cookie line from DevTools → Application → Cookies. Include both `sso` and `sso-rw` (e.g. `sso=...; sso-rw=...`) — Grok's anti-bot rejects `sso` on its own.",
-    subscriptionRisk: true,
-    riskNoticeVariant: "webCookie",
-  },
-  "gemini-web": {
-    id: "gemini-web",
-    alias: "gweb",
-    name: "Gemini Web (Free)",
-    icon: "auto_awesome",
-    color: "#4285F4",
-    textIcon: "GWeb",
-    website: "https://gemini.google.com",
-    authHint:
-      "Paste your __Secure-1PSID cookie value from gemini.google.com. Optionally add __Secure-1PSIDTS separated by semicolon.",
-    subscriptionRisk: true,
-    riskNoticeVariant: "webCookie",
-  },
-  "perplexity-web": {
-    id: "perplexity-web",
-    alias: "pplx-web",
-    name: "Perplexity Web (Pro/Max)",
-    icon: "search",
-    color: "#20808D",
-    textIcon: "PW",
-    website: "https://www.perplexity.ai",
-    authHint: "Paste your __Secure-next-auth.session-token cookie value from perplexity.ai",
-    subscriptionRisk: true,
-    riskNoticeVariant: "webCookie",
-  },
-  "blackbox-web": {
-    id: "blackbox-web",
-    alias: "bb-web",
-    name: "Blackbox Web (Subscription)",
-    icon: "view_in_ar",
-    color: "#1A1A2E",
-    textIcon: "BW",
-    website: "https://app.blackbox.ai",
-    authHint:
-      "Paste your __Secure-authjs.session-token value or full cookie header from app.blackbox.ai",
-    subscriptionRisk: true,
-    riskNoticeVariant: "webCookie",
-  },
-  "muse-spark-web": {
-    id: "muse-spark-web",
-    alias: "ms-web",
-    name: "Muse Spark Web (Meta AI)",
-    icon: "auto_awesome",
-    color: "#0866FF",
-    textIcon: "MS",
-    website: "https://www.meta.ai",
-    hasFree: true,
-    freeNote: "Free with login — Meta AI platform with Llama models.",
-    authHint: "Paste your abra_sess value or full cookie header from meta.ai",
-  },
-  "claude-web": {
-    id: "claude-web",
-    alias: "cw",
-    name: "Claude Web",
-    icon: "auto_awesome",
-    color: "#D97757",
-    textIcon: "CW",
-    website: "https://claude.ai",
-    authHint: "Paste your session cookie from claude.ai",
-    subscriptionRisk: true,
-    riskNoticeVariant: "webCookie",
-  },
-  "deepseek-web": {
-    id: "deepseek-web",
-    alias: "ds-web",
-    name: "DeepSeek Web",
-    icon: "auto_awesome",
-    color: "#4D6BFE",
-    textIcon: "DS",
-    website: "https://chat.deepseek.com",
-    authHint:
-      "Paste your userToken from chat.deepseek.com — DevTools → Application → Local Storage → userToken",
-    subscriptionRisk: true,
-    riskNoticeVariant: "webCookie",
-  },
-  "copilot-web": {
-    id: "copilot-web",
-    alias: "copilot",
-    name: "Microsoft Copilot Web",
-    icon: "auto_awesome",
-    color: "#0078D4",
-    textIcon: "CP",
-    website: "https://copilot.microsoft.com",
-    authHint:
-      "Paste your access_token from copilot.microsoft.com (or export a .har file from DevTools while logged in)",
-    subscriptionRisk: true,
-    riskNoticeVariant: "webCookie",
-  },
-  "t3-web": {
-    id: "t3-web",
-    alias: "t3chat",
-    name: "t3.chat (Pro/Free)",
-    icon: "auto_awesome",
-    color: "#7C3AED",
-    textIcon: "T3",
-    website: "https://t3.chat",
-    hasFree: true,
-    freeNote: "Free tier gives limited model access. Pro ($8/month) unlocks 50+ models.",
-    authHint:
-      "Open t3.chat in your browser, log in, then open DevTools → Application → Local Storage → https://t3.chat. " +
-      "Copy the value of 'convex-session-id'. Also open DevTools → Network, copy the Cookie header from any request. " +
-      "Paste both values here. See provider setup docs for a step-by-step guide.",
-  },
-  "inner-ai": {
-    id: "inner-ai",
-    alias: "in-ai",
-    name: "Inner.ai (Subscription)",
-    icon: "auto_awesome",
-    color: "#1A56DB",
-    textIcon: "IA",
-    website: "https://app.innerai.com",
-    subscriptionRisk: true,
-    riskNoticeVariant: "webCookie",
-    authHint:
-      "Paste your token cookie and email separated by a space: open DevTools → Application → Cookies → .innerai.com, copy the token value, then append a space and your Inner.ai login email. Example: eyJhbG... user@example.com",
-  },
-  "adapta-web": {
-    id: "adapta-web",
-    alias: "adp-web",
-    name: "Adapta.org (Adapta One Web)",
-    icon: "auto_awesome",
-    color: "#6E3AD3",
-    textIcon: "AW",
-    website: "https://agent.adapta.one",
-    subscriptionRisk: true,
-    riskNoticeVariant: "webCookie",
-    authHint:
-      "Paste your __client cookie value from .clerk.agent.adapta.one (DevTools → Application → Cookies)",
-  },
-  lmarena: {
-    id: "lmarena",
-    alias: "lma",
-    name: "LMArena (Free)",
-    icon: "auto_awesome",
-    color: "#FF6B6B",
-    textIcon: "LMA",
-    website: "https://lmarena.ai",
-    hasFree: true,
-    freeNote:
-      "Free model comparison platform — 40+ models (GPT, Claude, Gemini, Llama). No subscription required.",
-    authHint:
-      "Paste the full Cookie header from lmarena.ai (DevTools → Network → request → Cookie). The session is now split across arena-auth-prod-v1.0, .1, … — copy the whole header. Optional — works with free tier for basic comparisons.",
-    riskNoticeVariant: "webCookie",
-  },
-  huggingchat: {
-    id: "huggingchat",
-    // "hc" belongs to the hackclub provider; huggingchat uses its own id as alias.
-    alias: "huggingchat",
-    name: "HuggingChat (Free)",
-    icon: "auto_awesome",
-    color: "#FFD21E",
-    textIcon: "HC",
-    website: "https://huggingface.co/chat",
-    hasFree: true,
-    freeNote: "Free LLM chat — no subscription required. Rate limits apply.",
-    authHint:
-      "Paste your hf-chat cookie value from huggingface.co/chat (DevTools → Application → Cookies → hf-chat). Optional — works without auth for basic use.",
-    riskNoticeVariant: "webCookie",
-  },
-  phind: {
-    id: "phind",
-    alias: "ph",
-    name: "Phind (Free)",
-    icon: "auto_awesome",
-    color: "#000000",
-    textIcon: "PH",
-    website: "https://www.phind.com",
-    hasFree: false,
-    freeNote: "Discontinued 2026 — phind.com shut down (2026-01); no free tier.",
-    authHint:
-      "Paste your session cookie from phind.com (DevTools → Application → Cookies). Optional — works with free tier.",
-    subscriptionRisk: true,
-    riskNoticeVariant: "deprecated",
-    deprecated: true,
-    deprecationReason:
-      "Phind shut down its API (2026-01); the /api/chat endpoint no longer serves (sweep 2026-06-19).",
-  },
-  "poe-web": {
-    id: "poe-web",
-    alias: "poe",
-    name: "Poe Web (Subscription)",
-    icon: "auto_awesome",
-    color: "#6C3AED",
-    textIcon: "PW",
-    website: "https://poe.com",
-    authHint: "Paste your p-b cookie value from poe.com (DevTools → Application → Cookies → p-b)",
-    subscriptionRisk: true,
-    riskNoticeVariant: "webCookie",
-  },
-  "venice-web": {
-    id: "venice-web",
-    alias: "ven",
-    name: "Venice Web (Privacy)",
-    icon: "auto_awesome",
-    color: "#22C55E",
-    textIcon: "VW",
-    website: "https://venice.ai",
-    authHint: "Paste your session cookie from venice.ai (DevTools → Application → Cookies)",
-    riskNoticeVariant: "webCookie",
-  },
-  "v0-vercel-web": {
-    id: "v0-vercel-web",
-    alias: "v0",
-    name: "v0 Vercel Web (Code Gen)",
-    icon: "auto_awesome",
-    color: "#000000",
-    textIcon: "V0",
-    website: "https://v0.dev",
-    authHint: "Paste your session cookie from v0.dev (DevTools → Application → Cookies)",
-    riskNoticeVariant: "webCookie",
-  },
-  "kimi-web": {
-    id: "kimi-web",
-    // Primary "kimi" provider keeps the short alias; web variant uses its own id.
-    alias: "kimi-web",
-    name: "Kimi Web (Moonshot AI)",
-    icon: "auto_awesome",
-    color: "#2563EB",
-    textIcon: "KW",
-    website: "https://kimi.moonshot.cn",
-    authHint: "Paste your session cookie from kimi.moonshot.cn (DevTools → Application → Cookies)",
-    subscriptionRisk: true,
-    riskNoticeVariant: "webCookie",
-  },
-  "doubao-web": {
-    id: "doubao-web",
-    alias: "db",
-    name: "Doubao Web (ByteDance)",
-    icon: "auto_awesome",
-    color: "#3B82F6",
-    textIcon: "DW",
-    website: "https://www.doubao.com",
-    authHint: "Paste your session cookie from doubao.com (DevTools → Application → Cookies)",
-    subscriptionRisk: true,
-    riskNoticeVariant: "webCookie",
-  },
-  "qwen-web": {
-    id: "qwen-web",
-    // Primary "qwen" provider keeps the short alias; web variant uses its own id.
-    alias: "qwen-web",
-    name: "Qwen Web (Free)",
-    icon: "auto_awesome",
-    color: "#10B981",
-    textIcon: "QW",
-    website: "https://chat.qwen.ai",
-    hasFree: true,
-    freeNote: "Free — Qwen models via chat.qwen.ai with login token. No subscription required.",
-    authHint:
-      "Open chat.qwen.ai, log in, then open DevTools → Application → Local Storage → " +
-      'copy the "token" value (or use tongyi_sso_ticket cookie as Bearer token).',
-  },
-  "gemini-business": {
-    id: "gemini-business",
-    alias: "gembiz",
-    name: "Gemini Business (Enterprise)",
-    icon: "business_center",
-    color: "#4285F4",
-    textIcon: "GB",
-    website: "https://business.gemini.google",
-    hasFree: true,
-    freeNote:
-      "Free for Google Workspace enterprise accounts — enterprise Gemini models (Pro, Flash, image, video) via direct StreamGenerate HTTP API. No subscription required, just enterprise SSO.",
-    authHint:
-      "From your enterprise account: open business.gemini.google/home/cid/{your-cid}, then copy __Secure-1PSID and __Secure-1PSIDTS cookies from DevTools → Application → Cookies. Paste as a cookie header below.",
-  },
-};
 
 // API Key Providers
-export const APIKEY_PROVIDERS = {
-  agentrouter: {
-    id: "agentrouter",
-    alias: "agentrouter",
-    name: "AgentRouter",
-    icon: "router",
-    color: "#10B981",
-    textIcon: "AR",
-    passthroughModels: true,
-    website: "https://agentrouter.org",
-    hasFree: true,
-    freeNote: "$200 free credits on signup - multi-model routing gateway",
-    apiHint: "Get $200 free credits at https://agentrouter.org/register — no credit card required.",
-  },
-  "command-code": {
-    id: "command-code",
-    alias: "cmd",
-    name: "Command Code",
-    icon: "terminal",
-    color: "#111827",
-    textIcon: "CC",
-    website: "https://commandcode.ai/",
-    authHint:
-      "Use a Command Code API key. Requests are sent to Command Code's /alpha/generate endpoint.",
-    apiHint: "Create or copy an API key from Command Code, then paste it here as a Bearer token.",
-  },
-  openrouter: {
-    id: "openrouter",
-    alias: "openrouter",
-    name: "OpenRouter",
-    icon: "router",
-    color: "#F97316",
-    textIcon: "OR",
-    passthroughModels: true,
-    website: "https://openrouter.ai",
-    hasFree: true,
-    freeNote: "Free models at $0/token with :free suffix - 20 RPM / 200 RPD",
-  },
-  orcarouter: {
-    id: "orcarouter",
-    alias: "orcarouter",
-    name: "OrcaRouter",
-    icon: "router",
-    color: "#0891B2",
-    textIcon: "ORC",
-    passthroughModels: true,
-    website: "https://www.orcarouter.ai",
-    apiHint:
-      "Create an API key (starts with sk-orca-) at https://www.orcarouter.ai, then paste it as a Bearer token. OpenAI-compatible endpoint at https://api.orcarouter.ai/v1.",
-  },
-  "api-airforce": {
-    id: "api-airforce",
-    alias: "af",
-    name: "Api.airforce",
-    icon: "flight",
-    color: "#1E3A5F",
-    textIcon: "AF",
-    website: "https://api.airforce",
-    hasFree: true,
-    freeNote:
-      "55 free tier models including Grok-3, Claude 3.7, Qwen3, Kimi-K2, Gemini 2.5 Flash, DeepSeek-V3",
-    apiHint:
-      "Get your API key from https://panel.api.airforce — OpenAI-compatible endpoint at https://api.airforce/v1",
-  },
-  qianfan: {
-    id: "qianfan",
-    alias: "qianfan",
-    name: "Baidu Qianfan",
-    icon: "cloud",
-    color: "#2468F2",
-    textIcon: "BD",
-    website: "https://cloud.baidu.com/product/wenxinworkshop",
-    apiHint:
-      "Use a Qianfan API key from Baidu AI Cloud. The default endpoint is OpenAI-compatible v2.",
-  },
-  glm: {
-    id: "glm",
-    alias: "glm",
-    name: "GLM Coding",
-    icon: "code",
-    color: "#2563EB",
-    textIcon: "GL",
-    website: "https://z.ai/subscribe",
-  },
-  "glm-cn": {
-    id: "glm-cn",
-    alias: "glmcn",
-    name: "GLM Coding (China)",
-    icon: "code",
-    color: "#DC2626",
-    textIcon: "GC",
-    website: "https://open.bigmodel.cn",
-  },
-  glmt: {
-    id: "glmt",
-    alias: "glmt",
-    name: "GLM Thinking",
-    icon: "psychology",
-    color: "#1D4ED8",
-    textIcon: "GT",
-    website: "https://open.bigmodel.cn",
-    apiHint: "Preset GLM profile with higher token budget, thinking enabled, and longer timeout.",
-  },
-  "bailian-coding-plan": {
-    id: "bailian-coding-plan",
-    alias: "bcp",
-    name: "Alibaba Coding Plan",
-    icon: "code",
-    color: "#FF6A00",
-    textIcon: "BCP",
-    website: "https://www.alibabacloud.com/help/en/model-studio/coding-plan",
-  },
-  kimi: {
-    id: "kimi",
-    alias: "kimi",
-    name: "Kimi",
-    icon: "psychology",
-    color: "#1E3A8A",
-    textIcon: "KM",
-    website: "https://platform.moonshot.ai",
-  },
-  "kimi-coding-apikey": {
-    id: "kimi-coding-apikey",
-    alias: "kmca",
-    name: "Kimi Coding (API Key)",
-    icon: "psychology",
-    color: "#1E40AF",
-    textIcon: "KC",
-    website: "https://www.kimi.com/code",
-  },
-  minimax: {
-    id: "minimax",
-    alias: "minimax",
-    name: "Minimax Coding",
-    icon: "memory",
-    color: "#7C3AED",
-    textIcon: "MM",
-    website: "https://www.minimax.io",
-  },
-  "minimax-cn": {
-    id: "minimax-cn",
-    alias: "minimax-cn",
-    name: "Minimax (China)",
-    icon: "memory",
-    color: "#DC2626",
-    textIcon: "MC",
-    website: "https://www.minimaxi.com",
-  },
-  crof: {
-    id: "crof",
-    alias: "crof",
-    name: "CrofAI",
-    icon: "auto_awesome",
-    color: "#0EA5E9",
-    textIcon: "CR",
-    website: "https://crof.ai",
-  },
-  openai: {
-    id: "openai",
-    alias: "openai",
-    name: "OpenAI",
-    icon: "auto_awesome",
-    color: "#10A37F",
-    textIcon: "OA",
-    website: "https://platform.openai.com",
-  },
-  "azure-openai": {
-    id: "azure-openai",
-    alias: "azure",
-    name: "Azure OpenAI",
-    icon: "cloud",
-    color: "#0078D4",
-    textIcon: "AZ",
-    website: "https://azure.microsoft.com/products/ai-services/openai-service",
-    authHint:
-      "Use your Azure OpenAI API key. Base URL should be your resource endpoint, for example https://my-resource.openai.azure.com.",
-    passthroughModels: true,
-  },
-  "azure-ai": {
-    id: "azure-ai",
-    alias: "azure-ai",
-    name: "Azure AI Foundry",
-    icon: "cloud",
-    color: "#2563EB",
-    textIcon: "AF",
-    website: "https://learn.microsoft.com/azure/ai-foundry",
-    authHint:
-      "Use your Azure AI Foundry key. Base URL can be https://<resource>.services.ai.azure.com/openai/v1/ or https://<resource>.openai.azure.com/openai/v1/.",
-    apiHint:
-      "Foundry uses the OpenAI v1 surface with deployment names as models. OmniRoute normalizes root resource URLs to the v1 chat and /models endpoints.",
-    passthroughModels: true,
-  },
-  bedrock: {
-    id: "bedrock",
-    alias: "bedrock",
-    name: "Amazon Bedrock",
-    icon: "cloud",
-    color: "#FF9900",
-    textIcon: "BR",
-    website: "https://aws.amazon.com/bedrock",
-    authHint:
-      "Use your Amazon Bedrock API key and configure the AWS region where your models are enabled (for example eu-west-2). OmniRoute calls Bedrock's native Converse API directly.",
-    apiHint:
-      "Native Bedrock integration: model discovery uses Bedrock foundation models and inference profiles, while chat uses the regional Bedrock Runtime Converse/ConverseStream APIs.",
-    passthroughModels: true,
-  },
-  watsonx: {
-    id: "watsonx",
-    alias: "watsonx",
-    name: "IBM watsonx.ai Gateway",
-    icon: "hub",
-    color: "#0F62FE",
-    textIcon: "WX",
-    website: "https://www.ibm.com/products/watsonx-ai",
-    authHint:
-      "Use your watsonx bearer token. Base URL can be https://<region>.ml.cloud.ibm.com/ml/gateway/v1/ or a self-managed /ml/gateway/v1 endpoint.",
-    apiHint:
-      "The watsonx model gateway exposes OpenAI-compatible /chat/completions and /models under /ml/gateway/v1.",
-    passthroughModels: true,
-  },
-  oci: {
-    id: "oci",
-    alias: "oci",
-    name: "OCI Generative AI",
-    icon: "cloud",
-    color: "#C74634",
-    textIcon: "OCI",
-    website: "https://www.oracle.com/artificial-intelligence/generative-ai",
-    authHint:
-      "Use your OCI Generative AI API key or IAM bearer token. Base URL can be https://inference.generativeai.<region>.oci.oraclecloud.com/openai/v1/.",
-    apiHint:
-      "OCI exposes OpenAI-compatible chat and responses endpoints. Project ID is optional in OmniRoute but may be required for Responses and agentic workflows.",
-    passthroughModels: true,
-  },
-  sap: {
-    id: "sap",
-    alias: "sap",
-    name: "SAP Generative AI Hub",
-    icon: "business",
-    color: "#0FAAFF",
-    textIcon: "SAP",
-    website:
-      "https://help.sap.com/docs/sap-ai-core/sap-ai-core-service-guide/generative-ai-hub-in-sap-ai-core",
-    authHint:
-      "Use your SAP AI Core bearer token. Base URL can be your AI_API_URL root or a deploymentUrl from Generative AI Hub.",
-    apiHint:
-      "Model discovery uses /v2/lm/scenarios/foundation-models/models on AI_API_URL. Chat requests use deploymentUrl/chat/completions and require AI-Resource-Group.",
-    passthroughModels: true,
-  },
-  modal: {
-    id: "modal",
-    alias: "mdl",
-    name: "Modal",
-    icon: "cloud_queue",
-    color: "#7C3AED",
-    textIcon: "MDL",
-    website: "https://modal.com/docs",
-    authHint:
-      "Use the bearer token that protects your Modal deployment, if enabled. Base URL should point to your OpenAI-compatible Modal app, for example https://<workspace>--<app>.modal.run/v1.",
-    apiHint:
-      "Modal commonly serves user-hosted OpenAI-compatible apps on /v1. OmniRoute will probe /v1/models and route chat traffic to /v1/chat/completions.",
-    hasFree: true,
-    freeNote: "$30/month free credits for new accounts",
-    passthroughModels: true,
-  },
-  reka: {
-    id: "reka",
-    alias: "reka",
-    name: "Reka",
-    icon: "auto_awesome",
-    color: "#111827",
-    textIcon: "RK",
-    website: "https://docs.reka.ai/chat/overview",
-    authHint:
-      "Use your Reka API key. OmniRoute supports the OpenAI-compatible base URL https://api.reka.ai/v1 and sends both Authorization and X-Api-Key headers for compatibility.",
-    apiHint:
-      "Reka Chat is OpenAI-compatible on /v1. OmniRoute probes /v1/models and routes chat traffic to /v1/chat/completions.",
-    hasFree: true,
-    freeNote: "$10/month recurring free API credits",
-  },
-  nlpcloud: {
-    id: "nlpcloud",
-    alias: "nlpc",
-    name: "NLP Cloud",
-    icon: "psychology",
-    color: "#2196F3",
-    textIcon: "NLPC",
-    website: "https://docs.nlpcloud.com",
-    authHint:
-      "Use your NLP Cloud API key in Authorization: Token <key>. OmniRoute targets the chatbot endpoint on https://api.nlpcloud.io/v1/gpu/<model>/chatbot by default.",
-    apiHint:
-      "NLP Cloud uses a proprietary chatbot API instead of OpenAI chat/completions. OmniRoute adapts OpenAI messages to input/context/history and exposes a local catalog of supported chatbot models.",
-    hasFree: true,
-    freeNote: "Trial credits for new accounts",
-  },
-  runwayml: {
-    id: "runwayml",
-    alias: "runway",
-    name: "Runway",
-    icon: "movie",
-    color: "#111827",
-    textIcon: "RW",
-    website: "https://docs.dev.runwayml.com",
-    authHint:
-      "Use your Runway API key in Authorization: Bearer <key>. OmniRoute targets the current Runway API at https://api.dev.runwayml.com/v1 and sends the required X-Runway-Version header automatically.",
-    apiHint:
-      "Runway video generation is task-based. OmniRoute submits text-to-video or image-to-video jobs, polls /v1/tasks/{id}, and normalizes the finished video outputs back into the OpenAI-like /v1/videos/generations response.",
-  },
-  anthropic: {
-    id: "anthropic",
-    alias: "anthropic",
-    name: "Anthropic",
-    icon: "smart_toy",
-    color: "#D97757",
-    textIcon: "AN",
-    website: "https://platform.claude.com",
-  },
-  gemini: {
-    id: "gemini",
-    alias: "gemini",
-    name: "Gemini (Google AI Studio)",
-    icon: "diamond",
-    color: "#4285F4",
-    textIcon: "GE",
-    website: "https://aistudio.google.com",
-    hasFree: true,
-    freeNote:
-      "Free forever: 1,500 req/day for Gemini 2.5 Flash — no credit card, get key at aistudio.google.com",
-  },
-  deepseek: {
-    id: "deepseek",
-    alias: "ds",
-    name: "DeepSeek",
-    icon: "bolt",
-    color: "#4D6BFE",
-    textIcon: "DS",
-    website: "https://platform.deepseek.com",
-    hasFree: true,
-    freeNote: "5M free tokens on signup - no credit card required",
-  },
-  groq: {
-    id: "groq",
-    alias: "groq",
-    name: "Groq",
-    icon: "speed",
-    color: "#F55036",
-    textIcon: "GQ",
-    website: "https://groq.com",
-    hasFree: true,
-    freeNote: "Free tier: 30 RPM / 14.4K RPD — no credit card",
-  },
-  blackbox: {
-    id: "blackbox",
-    alias: "bb",
-    name: "Blackbox AI",
-    icon: "view_in_ar",
-    color: "#1A1A2E",
-    textIcon: "BB",
-    website: "https://blackbox.ai",
-    hasFree: true,
-    freeNote: "Free tier: unlimited basic chat plus Minimax-M2.5, no credit card required",
-  },
-  bazaarlink: {
-    id: "bazaarlink",
-    alias: "bzl",
-    name: "BazaarLink",
-    icon: "storefront",
-    color: "#6366F1",
-    textIcon: "BZ",
-    website: "https://bazaarlink.ai",
-    hasFree: true,
-    freeNote:
-      "Free tier: 4M tokens/day per account with auto:free routing — zero-cost inference, no credit card required.",
-    authHint:
-      "Use your BazaarLink API key (starts with sk-bl-) in Authorization: Bearer <key>. OpenAI SDK works with base URL https://bazaarlink.ai/api/v1. Models use provider/model-name format.",
-    apiHint:
-      "Create a free API key at https://bazaarlink.ai — model 'auto:free' routes to zero-cost inference. All models use the provider/model-name format, e.g. xiaomi/mimo-v2.5-pro.",
-  },
-  xai: {
-    id: "xai",
-    alias: "xai",
-    name: "xAI (Grok)",
-    icon: "auto_awesome",
-    color: "#1DA1F2",
-    textIcon: "XA",
-    website: "https://x.ai",
-  },
-  mistral: {
-    id: "mistral",
-    alias: "mistral",
-    name: "Mistral",
-    icon: "air",
-    color: "#FF7000",
-    textIcon: "MI",
-    website: "https://mistral.ai",
-    hasFree: true,
-    freeNote: "Free Experiment tier: rate-limited access to all models, no credit card required",
-  },
-  perplexity: {
-    id: "perplexity",
-    alias: "pplx",
-    name: "Perplexity",
-    icon: "search",
-    color: "#20808D",
-    textIcon: "PP",
-    website: "https://www.perplexity.ai",
-  },
-  together: {
-    id: "together",
-    alias: "together",
-    name: "Together AI",
-    icon: "group_work",
-    color: "#0F6FFF",
-    textIcon: "TG",
-    website: "https://www.together.ai",
-    hasFree: true,
-    freeNote:
-      "$25 signup credits + 3 permanently free models: Llama 3.3 70B, Vision, DeepSeek-R1 distill",
-  },
-  fireworks: {
-    id: "fireworks",
-    alias: "fireworks",
-    name: "Fireworks AI",
-    icon: "local_fire_department",
-    color: "#7B2EF2",
-    textIcon: "FW",
-    website: "https://fireworks.ai",
-    hasFree: true,
-    freeNote: "$1 free starter credits on signup for API testing",
-  },
-  cerebras: {
-    id: "cerebras",
-    alias: "cerebras",
-    name: "Cerebras",
-    icon: "memory",
-    color: "#FF4F00",
-    textIcon: "CB",
-    website: "https://inference.cerebras.ai",
-    hasFree: true,
-    freeNote: "Free Trial: 1M tokens/day, 30K TPM, 5 RPM — no credit card.",
-  },
-  cohere: {
-    id: "cohere",
-    alias: "cohere",
-    name: "Cohere",
-    icon: "hub",
-    color: "#39594D",
-    textIcon: "CO",
-    website: "https://cohere.com",
-    hasFree: true,
-    freeNote: "Free Trial: 1,000 API calls/month for testing, no credit card required",
-  },
-  nvidia: {
-    id: "nvidia",
-    alias: "nvidia",
-    name: "NVIDIA NIM",
-    icon: "developer_board",
-    color: "#76B900",
-    textIcon: "NV",
-    website: "https://build.nvidia.com",
-    hasFree: true,
-    freeNote: "Free dev access: ~40 RPM, 70+ models (Kimi K2.5, GLM 4.7, DeepSeek V3.2...)",
-  },
-  nebius: {
-    id: "nebius",
-    alias: "nebius",
-    name: "Nebius AI",
-    icon: "cloud",
-    color: "#6C5CE7",
-    textIcon: "NB",
-    website: "https://nebius.com",
-    hasFree: true,
-    freeNote: "~$1 trial credits on signup for API testing",
-  },
-  siliconflow: {
-    id: "siliconflow",
-    alias: "siliconflow",
-    name: "SiliconFlow",
-    icon: "cloud_queue",
-    color: "#5B6EF5",
-    textIcon: "SF",
-    website: "https://cloud.siliconflow.com",
-    hasFree: true,
-    freeNote: "$1 free credits plus permanently free models after identity verification",
-  },
-  hyperbolic: {
-    id: "hyperbolic",
-    alias: "hyp",
-    name: "Hyperbolic",
-    icon: "bolt",
-    color: "#00D4FF",
-    textIcon: "HY",
-    website: "https://hyperbolic.xyz",
-    hasFree: true,
-    freeNote: "$1-5 trial credits on signup for serverless inference",
-  },
-  kie: {
-    id: "kie",
-    alias: "kie",
-    name: "KIE.AI",
-    icon: "hub",
-    color: "#2563EB",
-    textIcon: "KIE",
-    website: "https://kie.ai",
-  },
-  "ollama-cloud": {
-    id: "ollama-cloud",
-    alias: "ollamacloud",
-    name: "Ollama Cloud",
-    icon: "cloud",
-    color: "#58A6FF",
-    textIcon: "OC",
-    website: "https://ollama.com/settings/api-keys",
-    hasFree: true,
-  },
-  huggingface: {
-    id: "huggingface",
-    alias: "hf",
-    name: "HuggingFace",
-    icon: "face",
-    color: "#FFD21E",
-    textIcon: "HF",
-    website: "https://huggingface.co",
-    hasFree: true,
-    freeNote: "Free Inference API for thousands of models (Whisper, VITS, SDXL…)",
-  },
-  synthetic: {
-    id: "synthetic",
-    alias: "synthetic",
-    name: "Synthetic",
-    icon: "verified_user",
-    color: "#6366F1",
-    textIcon: "SY",
-    website: "https://synthetic.new",
-    passthroughModels: true,
-  },
-  "kilo-gateway": {
-    id: "kilo-gateway",
-    alias: "kg",
-    name: "Kilo Gateway",
-    icon: "hub",
-    color: "#617A91",
-    textIcon: "KG",
-    website: "https://kilo.ai",
-    passthroughModels: true,
-  },
-  vertex: {
-    id: "vertex",
-    alias: "vertex",
-    name: "Vertex AI",
-    icon: "cloud",
-    color: "#4285F4",
-    textIcon: "VA",
-    website: "https://cloud.google.com/vertex-ai",
-    hasFree: true,
-    authHint: "Provide Service Account JSON or OAuth access_token",
-  },
-  "vertex-partner": {
-    id: "vertex-partner",
-    alias: "vp",
-    name: "Vertex AI Partners",
-    icon: "cloud",
-    color: "#34A853",
-    textIcon: "VP",
-    website: "https://cloud.google.com/vertex-ai",
-    authHint: "Provide the same Service Account JSON used for Vertex AI partner models.",
-  },
-  zai: {
-    id: "zai",
-    alias: "zai",
-    name: "Z.AI",
-    icon: "psychology",
-    color: "#2563EB",
-    textIcon: "ZA",
-    website: "https://open.bigmodel.cn",
-    apiHint: "API key from https://open.bigmodel.cn/usercenter/apikeys",
-  },
-  wafer: {
-    id: "wafer",
-    alias: "wafer",
-    name: "Wafer AI",
-    icon: "layers",
-    color: "#6366F1",
-    textIcon: "WF",
-    website: "https://wafer.ai",
-    apiHint: "API key from https://wafer.ai",
-  },
-  "opencode-zen": {
-    id: "opencode-zen",
-    alias: "opencode-zen",
-    name: "OpenCode Zen",
-    icon: "opencode",
-    color: "#6366f1",
-    website: "https://opencode.ai/zen",
-    anonymousFallback: true,
-  },
-  "opencode-go": {
-    id: "opencode-go",
-    alias: "opencode-go",
-    name: "OpenCode Go",
-    icon: "opencode",
-    color: "#6366f1",
-    website: "https://opencode.ai/go",
-    anonymousFallback: true,
-  },
-  alibaba: {
-    id: "alibaba",
-    alias: "ali",
-    name: "Alibaba",
-    icon: "cloud_queue",
-    color: "#FF6600",
-    textIcon: "AL",
-    website: "https://dashscope-intl.aliyuncs.com",
-    hasFree: false,
-  },
-  "alibaba-cn": {
-    id: "alibaba-cn",
-    alias: "ali-cn",
-    name: "Alibaba (China)",
-    icon: "cloud_queue",
-    color: "#FF6600",
-    textIcon: "AL",
-    website: "https://dashscope.aliyuncs.com",
-    hasFree: false,
-  },
-  longcat: {
-    id: "longcat",
-    alias: "lc",
-    name: "LongCat AI",
-    icon: "auto_awesome",
-    color: "#FF6B9D",
-    textIcon: "LC",
-    website: "https://longcat.chat/platform/docs",
-    hasFree: true,
-    freeNote:
-      "Free: 5M tokens/day on LongCat-2.0-Preview (Flash models retired 2026-05-29); up to 120M/day via feedback.",
-  },
-  pollinations: {
-    id: "pollinations",
-    alias: "pol",
-    name: "Pollinations AI",
-    icon: "local_florist",
-    color: "#4CAF50",
-    textIcon: "PO",
-    website: "https://pollinations.ai",
-    hasFree: true,
-    anonymousFallback: true,
-    freeNote:
-      "Free keyless tier: openai, openai-fast, openai-large, qwen-coder, mistral, deepseek, grok, gemini-flash-lite-3.1, perplexity-fast, perplexity-reasoning. Premium models (claude, gemini, midijourney) require a Pollinations API key from enter.pollinations.ai.",
-  },
-  puter: {
-    id: "puter",
-    alias: "pu",
-    name: "Puter AI",
-    icon: "cloud_circle",
-    color: "#6366F1",
-    textIcon: "PU",
-    website: "https://puter.com",
-    hasFree: true,
-    freeNote:
-      "500+ models (GPT-5, Claude Opus 4, Gemini 3 Pro, Grok 4, DeepSeek V3...) — Users pay via free Puter account",
-    passthroughModels: true,
-    authHint: "Get token at puter.com/dashboard → Copy Auth Token",
-  },
-  uncloseai: {
-    id: "uncloseai",
-    alias: "unc",
-    name: "UncloseAI",
-    icon: "auto_awesome",
-    color: "#8B5CF6",
-    textIcon: "UN",
-    website: "https://uncloseai.com",
-    hasFree: true,
-    freeNote: "Free forever — no signup, no credit card. OpenAI-compatible endpoints.",
-    passthroughModels: true,
-    authHint: "No auth required. API accepts any non-empty string as key for identification.",
-  },
-  hackclub: {
-    id: "hackclub",
-    alias: "hc",
-    name: "Hackclub AI",
-    icon: "auto_awesome",
-    color: "#FF6B00",
-    textIcon: "HC",
-    website: "https://ai.hackclub.com",
-    hasFree: true,
-    freeNote: "Free AI for Hack Club members — 30+ models, no credit card.",
-    passthroughModels: true,
-    authHint: "Sign in with your Hack Club account at ai.hackclub.com.",
-  },
-  "github-models": {
-    id: "github-models",
-    alias: "ghm",
-    name: "GitHub Models",
-    icon: "code",
-    color: "#238636",
-    textIcon: "GH",
-    website: "https://github.com/marketplace/models",
-    hasFree: true,
-    freeNote: "Free GPT-5, o-series, DeepSeek-R1, Llama 4, Grok 3 — GitHub account only.",
-    authHint: "Create a GitHub PAT with 'models: read' scope at github.com/settings/tokens",
-  },
-  haiper: {
-    id: "haiper",
-    alias: "hp",
-    name: "Haiper",
-    icon: "videocam",
-    color: "#6366F1",
-    textIcon: "HP",
-    website: "https://haiper.ai",
-    authHint: "Get API key at haiper.ai/haiper-api",
-  },
-  leonardo: {
-    id: "leonardo",
-    alias: "leo",
-    name: "Leonardo AI",
-    icon: "palette",
-    color: "#8B5CF6",
-    textIcon: "LE",
-    website: "https://leonardo.ai",
-    authHint: "Get API key at leonardo.ai/developer",
-  },
-  ideogram: {
-    id: "ideogram",
-    alias: "ideo",
-    name: "Ideogram",
-    icon: "image",
-    color: "#EC4899",
-    textIcon: "ID",
-    website: "https://ideogram.ai",
-    authHint: "Get API key at ideogram.ai/docs/api",
-  },
-  suno: {
-    id: "suno",
-    alias: "suno",
-    name: "Suno",
-    icon: "music_note",
-    color: "#F59E0B",
-    textIcon: "SU",
-    website: "https://suno.ai",
-    authHint: "Paste session cookie from suno.ai (Clerk auth)",
-  },
-  udio: {
-    id: "udio",
-    alias: "udio",
-    name: "Udio",
-    icon: "music_note",
-    color: "#10B981",
-    textIcon: "UD",
-    website: "https://udio.com",
-    authHint: "Paste session cookie from udio.com (Supabase auth)",
-  },
-  "cloudflare-ai": {
-    id: "cloudflare-ai",
-    alias: "cf",
-    name: "Cloudflare Workers AI",
-    icon: "cloud",
-    color: "#F48120",
-    textIcon: "CF",
-    website: "https://developers.cloudflare.com/workers-ai",
-    hasFree: true,
-    freeNote:
-      "Free 10K Neurons/day: ~150 LLM responses or 500s Whisper audio — edge inference globally",
-    authHint: "Requires API Token AND Account ID (found at dash.cloudflare.com)",
-  },
-  scaleway: {
-    id: "scaleway",
-    alias: "scw",
-    name: "Scaleway AI",
-    icon: "cloud",
-    color: "#4F0599",
-    textIcon: "SCW",
-    website: "https://www.scaleway.com/en/ai/generative-apis",
-    hasFree: true,
-    freeNote: "1M free tokens for new accounts — EU/GDPR compliant (Paris), Qwen3 235B & Llama 70B",
-  },
-  deepinfra: {
-    id: "deepinfra",
-    alias: "deepinfra",
-    name: "DeepInfra",
-    icon: "hub",
-    color: "#2563EB",
-    textIcon: "DI",
-    website: "https://deepinfra.com",
-    hasFree: true,
-    freeNote: "Free signup credits for API testing and model exploration",
-  },
-  "vercel-ai-gateway": {
-    id: "vercel-ai-gateway",
-    alias: "vag",
-    name: "Vercel AI Gateway",
-    icon: "route",
-    color: "#111827",
-    textIcon: "VAI",
-    website: "https://vercel.com/docs/ai-gateway",
-  },
-  "lambda-ai": {
-    id: "lambda-ai",
-    alias: "lambda",
-    name: "Lambda AI",
-    icon: "bolt",
-    color: "#7C3AED",
-    textIcon: "LA",
-    website: "https://lambda.ai",
-  },
-  sambanova: {
-    id: "sambanova",
-    alias: "samba",
-    name: "SambaNova",
-    icon: "memory",
-    color: "#DC2626",
-    textIcon: "SN",
-    website: "https://sambanova.ai",
-    hasFree: true,
-    freeNote: "$5 free credits on signup (30-day validity), no credit card required",
-  },
-  nscale: {
-    id: "nscale",
-    alias: "nscale",
-    name: "nScale",
-    icon: "token",
-    color: "#0891B2",
-    textIcon: "NS",
-    website: "https://nscale.com",
-    hasFree: true,
-    freeNote: "$5 free credits on signup for inference testing",
-  },
-  ovhcloud: {
-    id: "ovhcloud",
-    alias: "ovh",
-    name: "OVHcloud AI",
-    icon: "cloud",
-    color: "#2563EB",
-    textIcon: "OVH",
-    website: "https://www.ovhcloud.com",
-  },
-  baseten: {
-    id: "baseten",
-    alias: "baseten",
-    name: "Baseten",
-    icon: "deployed_code",
-    color: "#111827",
-    textIcon: "BT",
-    website: "https://baseten.co",
-    hasFree: true,
-    freeNote: "$30 free trial credits for GPU inference",
-  },
-  publicai: {
-    id: "publicai",
-    alias: "publicai",
-    name: "PublicAI",
-    icon: "public",
-    color: "#059669",
-    textIcon: "PA",
-    website: "https://publicai.co",
-    // #3558: PublicAI requires an API key (registry authType:"apikey"); signup grants a
-    // one-time credit, then it bills per-model. It is NOT a keyless/free tier.
-    hasFree: false,
-    freeNote: "Requires an API key — one-time signup credit, then paid",
-  },
-  moonshot: {
-    id: "moonshot",
-    alias: "moonshot",
-    name: "Moonshot AI",
-    icon: "rocket_launch",
-    color: "#1E40AF",
-    textIcon: "MS",
-    website: "https://platform.moonshot.ai",
-  },
-  "meta-llama": {
-    id: "meta-llama",
-    alias: "meta",
-    name: "Meta Llama API",
-    icon: "smart_toy",
-    color: "#0F766E",
-    textIcon: "ML",
-    website: "https://llama.developer.meta.com",
-  },
-  "v0-vercel": {
-    id: "v0-vercel",
-    alias: "v0",
-    name: "v0 (Vercel)",
-    icon: "code_blocks",
-    color: "#111827",
-    textIcon: "V0",
-    website: "https://v0.dev",
-  },
-  morph: {
-    id: "morph",
-    alias: "morph",
-    name: "Morph",
-    icon: "auto_fix_high",
-    color: "#2563EB",
-    textIcon: "MP",
-    website: "https://morphllm.com",
-    hasFree: true,
-    freeNote: "Free tier: 250K credits/month, $0",
-  },
-  "featherless-ai": {
-    id: "featherless-ai",
-    alias: "featherless",
-    name: "Featherless AI",
-    icon: "flutter_dash",
-    color: "#EA580C",
-    textIcon: "FL",
-    website: "https://featherless.ai",
-    hasFree: true,
-    freeNote: "Free tier available — no credit card required",
-  },
-  llm7: {
-    id: "llm7",
-    alias: "llm7",
-    name: "LLM7.io",
-    icon: "hub",
-    color: "#6366F1",
-    textIcon: "LM",
-    website: "https://llm7.io",
-    hasFree: true,
-    freeNote: "No signup required - 2 req/s, 20 RPM, 100 req/hr free tier",
-    apiHint:
-      "Works without API key (use 'unused' as key). Get free token at token.llm7.io for higher limits.",
-  },
-  kluster: {
-    id: "kluster",
-    alias: "kluster",
-    name: "Kluster AI",
-    icon: "hub",
-    color: "#8B5CF6",
-    textIcon: "KL",
-    website: "https://kluster.ai",
-    hasFree: false,
-    freeNote: "Discontinued 2026 — kluster.ai sunset (2026-06-09); no free tier.",
-    apiHint: "Get API key at https://kluster.ai/dashboard/api-keys",
-    subscriptionRisk: true,
-    riskNoticeVariant: "deprecated",
-    deprecated: true,
-    deprecationReason:
-      "kluster.ai shut down (2026-06-09); api.kluster.ai no longer resolves (sweep 2026-06-19). Use another OpenAI-compatible provider.",
-  },
-  friendliai: {
-    id: "friendliai",
-    alias: "friendli",
-    name: "FriendliAI",
-    icon: "handshake",
-    color: "#EC4899",
-    textIcon: "FR",
-    website: "https://friendli.ai",
-    hasFree: true,
-    freeNote: "Free tier for serverless inference — no credit card required",
-  },
-  llamagate: {
-    id: "llamagate",
-    alias: "llamagate",
-    name: "LlamaGate",
-    icon: "gate",
-    color: "#16A34A",
-    textIcon: "LG",
-    website: "https://llamagate.ai",
-  },
-  heroku: {
-    id: "heroku",
-    alias: "heroku",
-    name: "Heroku AI",
-    icon: "cloud_upload",
-    color: "#7C3AED",
-    textIcon: "HK",
-    website: "https://www.heroku.com",
-  },
-  galadriel: {
-    id: "galadriel",
-    alias: "galadriel",
-    name: "Galadriel",
-    icon: "auto_awesome",
-    color: "#F59E0B",
-    textIcon: "GA",
-    website: "https://galadriel.com",
-    subscriptionRisk: true,
-    riskNoticeVariant: "deprecated",
-    deprecated: true,
-    deprecationReason:
-      "api.galadriel.ai no longer resolves (sweep 2026-06-19); the inference API appears discontinued.",
-  },
-  databricks: {
-    id: "databricks",
-    alias: "databricks",
-    name: "Databricks",
-    icon: "table_chart",
-    color: "#F97316",
-    textIcon: "DB",
-    website: "https://www.databricks.com",
-  },
-  datarobot: {
-    id: "datarobot",
-    alias: "datarobot",
-    name: "DataRobot",
-    icon: "precision_manufacturing",
-    color: "#6D28D9",
-    textIcon: "DR",
-    website: "https://docs.datarobot.com",
-    authHint:
-      "Use your DataRobot API token. Optional Base URL can be the account root (for LLM Gateway) or a deployment URL under /api/v2/deployments/<id>.",
-    apiHint:
-      "The default gateway catalogs active models from /genai/llmgw/catalog/. Deployment URLs are also supported for direct OpenAI-compatible chat requests.",
-    passthroughModels: true,
-  },
-  clarifai: {
-    id: "clarifai",
-    alias: "clarifai",
-    name: "Clarifai",
-    icon: "hub",
-    color: "#7C3AED",
-    textIcon: "CF",
-    website: "https://docs.clarifai.com",
-    authHint:
-      "Use your Clarifai PAT or app-specific API key. OmniRoute targets the OpenAI-compatible endpoint at https://api.clarifai.com/v2/ext/openai/v1 and authenticates with Authorization: Key <token>.",
-    apiHint:
-      "Clarifai exposes OpenAI-compatible chat, responses and /models on /v2/ext/openai/v1. Public/community models typically require a PAT; app-scoped keys only work for resources inside that app.",
-    passthroughModels: true,
-  },
-  snowflake: {
-    id: "snowflake",
-    alias: "snowflake",
-    name: "Snowflake Cortex",
-    icon: "ac_unit",
-    color: "#29B5E8",
-    textIcon: "SF",
-    website: "https://www.snowflake.com",
-  },
-  wandb: {
-    id: "wandb",
-    alias: "wandb",
-    name: "Weights & Biases Inference",
-    icon: "monitoring",
-    color: "#FFBE0B",
-    textIcon: "WB",
-    website: "https://wandb.ai",
-  },
-  volcengine: {
-    id: "volcengine",
-    alias: "volcengine",
-    name: "Volcengine",
-    icon: "local_fire_department",
-    color: "#DC2626",
-    textIcon: "VE",
-    website: "https://www.volcengine.com",
-  },
-  ai21: {
-    id: "ai21",
-    alias: "ai21",
-    name: "AI21 Labs",
-    icon: "psychology_alt",
-    color: "#0284C7",
-    textIcon: "AI21",
-    website: "https://www.ai21.com",
-    hasFree: true,
-    freeNote: "$10 trial credits on signup (valid 3 months), no credit card required",
-  },
-  gigachat: {
-    id: "gigachat",
-    alias: "gigachat",
-    name: "GigaChat (Sber)",
-    icon: "lock_person",
-    color: "#10B981",
-    textIcon: "GC",
-    website: "https://developers.sber.ru",
-  },
-  venice: {
-    id: "venice",
-    alias: "venice",
-    name: "Venice.ai",
-    icon: "travel_explore",
-    color: "#0EA5E9",
-    textIcon: "VN",
-    website: "https://venice.ai",
-  },
-  codestral: {
-    id: "codestral",
-    alias: "codestral",
-    name: "Codestral",
-    icon: "terminal",
-    color: "#FF7000",
-    textIcon: "CS",
-    website: "https://mistral.ai",
-  },
-  upstage: {
-    id: "upstage",
-    alias: "upstage",
-    name: "Upstage",
-    icon: "trending_up",
-    color: "#0F766E",
-    textIcon: "UP",
-    website: "https://www.upstage.ai",
-  },
-  maritalk: {
-    id: "maritalk",
-    alias: "maritalk",
-    name: "Maritalk",
-    icon: "translate",
-    color: "#1D4ED8",
-    textIcon: "MT",
-    website: "https://www.maritaca.ai",
-  },
-  "xiaomi-mimo": {
-    id: "xiaomi-mimo",
-    alias: "mimo",
-    name: "Xiaomi MiMo",
-    icon: "devices",
-    color: "#EA580C",
-    textIcon: "MM",
-    website: "https://mimo.mi.com",
-  },
-  gitlawb: {
-    id: "gitlawb",
-    alias: "glb",
-    name: "Gitlawb Opengateway (MiMo)",
-    icon: "hub",
-    color: "#10B981",
-    textIcon: "GLB",
-    website: "https://opengateway.gitlawb.com",
-    hasFree: false,
-    freeNote:
-      "Free MiMo (xiaomi/mimo-v2.5) revoked 2026-05 — Opengateway is now a pay-as-you-go credit gateway; no recurring free model.",
-    apiHint: "Get your API key from Gitlawb Opengateway dashboard.",
-  },
-  "gitlawb-gmi": {
-    id: "gitlawb-gmi",
-    alias: "glb-gmi",
-    name: "Gitlawb Opengateway (GMI Cloud)",
-    icon: "hub",
-    color: "#10B981",
-    textIcon: "GMI",
-    website: "https://opengateway.gitlawb.com",
-    hasFree: false,
-    freeNote:
-      "Free Nemotron promo ended 2026-06 — the GMI Cloud route is now pay-as-you-go credit only.",
-    apiHint: "Get your API key from Gitlawb Opengateway dashboard.",
-  },
-  "inference-net": {
-    id: "inference-net",
-    alias: "inet",
-    name: "Inference.net",
-    icon: "dns",
-    color: "#2563EB",
-    textIcon: "IN",
-    website: "https://inference.net",
-    hasFree: true,
-    freeNote: "$25 free credits on signup plus research grants available",
-  },
-  nanogpt: {
-    id: "nanogpt",
-    alias: "nanogpt",
-    name: "NanoGPT",
-    icon: "chat",
-    color: "#4F46E5",
-    textIcon: "NG",
-    website: "https://nano-gpt.com",
-  },
-  predibase: {
-    id: "predibase",
-    alias: "predibase",
-    name: "Predibase",
-    icon: "deployed_code_history",
-    color: "#0F766E",
-    textIcon: "PB",
-    website: "https://predibase.com",
-    hasFree: false,
-    freeNote: "$25 free trial credits (30-day validity)",
-    subscriptionRisk: true,
-    riskNoticeVariant: "deprecated",
-    deprecated: true,
-    deprecationReason:
-      "serving.app.predibase.com no longer resolves (sweep 2026-06-19); the managed serving API appears discontinued.",
-  },
-  bytez: {
-    id: "bytez",
-    alias: "bytez",
-    name: "Bytez",
-    icon: "api",
-    color: "#6366F1",
-    textIcon: "BZ",
-    website: "https://bytez.com",
-    hasFree: true,
-    freeNote: "$1 free credits, refreshes every 4 weeks",
-  },
-  aimlapi: {
-    id: "aimlapi",
-    alias: "aiml",
-    name: "AI/ML API",
-    icon: "hub",
-    color: "#6366F1",
-    textIcon: "AI",
-    website: "https://aimlapi.com",
-    hasFree: false,
-    freeNote:
-      "Free tier paused (2026) — AI/ML API is now pay-as-you-go only (min $20 top-up); no recurring free credits.",
-    passthroughModels: true,
-  },
-  novita: {
-    id: "novita",
-    alias: "novita",
-    name: "Novita AI",
-    icon: "auto_awesome",
-    color: "#FF4081",
-    textIcon: "NV",
-    website: "https://novita.ai",
-    hasFree: true,
-    freeNote: "$0.50 trial credits on signup (valid about 1 year)",
-    passthroughModels: true,
-  },
-  piapi: {
-    id: "piapi",
-    alias: "pi",
-    name: "PiAPI",
-    icon: "api",
-    color: "#7C4DFF",
-    textIcon: "PI",
-    website: "https://piapi.ai",
-    passthroughModels: true,
-  },
-  getgoapi: {
-    id: "getgoapi",
-    alias: "ggo",
-    name: "GoAPI",
-    icon: "rocket_launch",
-    color: "#FF6D00",
-    textIcon: "GO",
-    website: "https://api.getgoapi.com",
-    passthroughModels: true,
-  },
-  laozhang: {
-    id: "laozhang",
-    alias: "lz",
-    name: "LaoZhang AI",
-    icon: "hub",
-    color: "#FF1744",
-    textIcon: "LZ",
-    website: "https://api.laozhang.ai",
-    passthroughModels: true,
-  },
-  glhf: {
-    id: "glhf",
-    alias: "glhf",
-    name: "GLHF Chat",
-    icon: "hub",
-    color: "#10B981",
-    textIcon: "GH",
-    website: "https://glhf.chat",
-    authHint: "Bearer API key for the GLHF OpenAI-compatible gateway.",
-    hasFree: false,
-    freeNote: "Discontinued 2026 — glhf.chat free beta ended; no free tier.",
-    passthroughModels: true,
-    subscriptionRisk: true,
-    riskNoticeVariant: "deprecated",
-    deprecated: true,
-    deprecationReason:
-      "glhf.chat shut down (2026); its api.laf.run gateway no longer serves the catalog (sweep 2026-06-19).",
-  },
-  cablyai: {
-    id: "cablyai",
-    alias: "cablyai",
-    name: "CablyAI",
-    icon: "hub",
-    color: "#FF4081",
-    textIcon: "CA",
-    website: "https://cablyai.com",
-    authHint: "Bearer API key for the CablyAI OpenAI-compatible gateway.",
-    passthroughModels: true,
-  },
-  thebai: {
-    id: "thebai",
-    alias: "thebai",
-    name: "TheB.AI",
-    icon: "hub",
-    color: "#3B82F6",
-    textIcon: "TB",
-    website: "https://theb.ai",
-    authHint: "Bearer API key for the TheB.AI OpenAI-compatible gateway.",
-    passthroughModels: true,
-  },
-  fenayai: {
-    id: "fenayai",
-    alias: "fenayai",
-    name: "FenayAI",
-    icon: "hub",
-    color: "#FF9800",
-    textIcon: "FN",
-    website: "https://fenayai.com",
-    authHint: "Bearer API key for the FenayAI OpenAI-compatible gateway.",
-    passthroughModels: true,
-  },
-  empower: {
-    id: "empower",
-    alias: "empower",
-    name: "Empower",
-    icon: "hub",
-    color: "#14B8A6",
-    textIcon: "EM",
-    website: "https://docs.empower.dev",
-    authHint: "Bearer API key for the Empower OpenAI-compatible endpoint.",
-    apiHint:
-      "Empower exposes OpenAI-compatible chat on https://app.empower.dev/api/v1 with tool-calling support on empower-functions.",
-    passthroughModels: true,
-  },
-  "nous-research": {
-    id: "nous-research",
-    alias: "nous",
-    name: "Nous Research",
-    icon: "hub",
-    color: "#2563EB",
-    textIcon: "NO",
-    website: "https://portal.nousresearch.com/help",
-    authHint:
-      "Use your Nous Portal API key. OmniRoute targets the official OpenAI-compatible inference endpoint at https://inference-api.nousresearch.com/v1.",
-    apiHint:
-      "Nous exposes an OpenAI-compatible /v1 surface with a large remote /models catalog. The /chat/completions endpoint requires a valid API key for programmatic inference.",
-    hasFree: true,
-    freeNote: "Free tier: 50 RPM, 500,000 TPM — no credit card",
-  },
-  poe: {
-    id: "poe",
-    alias: "poe",
-    name: "Poe",
-    icon: "hub",
-    color: "#F97316",
-    textIcon: "PO",
-    website: "https://creator.poe.com/api-reference",
-    authHint: "Bearer API key for the Poe OpenAI-compatible API.",
-    apiHint:
-      "Poe exposes OpenAI-compatible chat and responses on https://api.poe.com/v1, with authenticated balance checks on /usage/current_balance.",
-    passthroughModels: true,
-  },
-  gitlab: {
-    id: "gitlab",
-    alias: "gitlab",
-    name: "GitLab Duo PAT",
-    icon: "hub",
-    color: "#FC6D26",
-    textIcon: "GL",
-    website: "https://docs.gitlab.com/user/duo_agent_platform/code_suggestions/",
-    authHint:
-      "GitLab personal access token for the public Code Suggestions API. Configure a self-hosted base URL when not using gitlab.com.",
-  },
-  chutes: {
-    id: "chutes",
-    alias: "chutes",
-    name: "Chutes.ai",
-    icon: "hub",
-    color: "#06B6D4",
-    textIcon: "CH",
-    website: "https://chutes.ai",
-    hasFree: false,
-    freeNote:
-      "No free tier as of 2026 — Chutes moved to pay-as-you-go (free Early Access ended 2026-03).",
-    authHint: "Bearer API key for the Chutes OpenAI-compatible gateway.",
-    passthroughModels: true,
-  },
-  "voyage-ai": {
-    id: "voyage-ai",
-    alias: "voyage",
-    name: "Voyage AI",
-    icon: "blur_on",
-    color: "#0F766E",
-    textIcon: "VA",
-    website: "https://www.voyageai.com",
-    authHint: "Bearer API key for Voyage AI embeddings and rerank APIs.",
-    hasFree: true,
-    freeNote: "200M free tokens for embeddings and reranking",
-  },
-  "jina-ai": {
-    id: "jina-ai",
-    alias: "jina",
-    name: "Jina AI",
-    icon: "sort",
-    color: "#2563EB",
-    textIcon: "JA",
-    website: "https://jina.ai",
-    authHint: "Bearer API key for the Jina AI rerank API.",
-    hasFree: true,
-    freeNote: "10M free tokens on signup (non-commercial), no credit card required",
-  },
-  "fal-ai": {
-    id: "fal-ai",
-    alias: "fal",
-    name: "Fal.ai",
-    icon: "image",
-    color: "#2563EB",
-    textIcon: "FL",
-    website: "https://fal.ai",
-  },
-  "stability-ai": {
-    id: "stability-ai",
-    alias: "stability",
-    name: "Stability AI",
-    icon: "image",
-    color: "#8B5CF6",
-    textIcon: "SA",
-    website: "https://stability.ai",
-  },
-  "black-forest-labs": {
-    id: "black-forest-labs",
-    alias: "bfl",
-    name: "Black Forest Labs",
-    icon: "image",
-    color: "#111827",
-    textIcon: "BF",
-    website: "https://blackforestlabs.ai",
-  },
-  recraft: {
-    id: "recraft",
-    alias: "recraft",
-    name: "Recraft",
-    icon: "image",
-    color: "#EC4899",
-    textIcon: "RC",
-    website: "https://recraft.ai",
-  },
-  topaz: {
-    id: "topaz",
-    alias: "topaz",
-    name: "Topaz",
-    icon: "image",
-    color: "#059669",
-    textIcon: "TP",
-    website: "https://topazlabs.com",
-  },
-  baidu: {
-    id: "baidu",
-    alias: "baidu",
-    name: "Baidu (ERNIE)",
-    icon: "auto_awesome",
-    color: "#2932E1",
-    textIcon: "BD",
-    website: "https://yiyan.baidu.com",
-    hasFree: true,
-    freeNote: "Free ERNIE Speed/Lite models. China's #2 LLM.",
-    passthroughModels: true,
-    authHint: "Get API key at console.bce.baidu.com",
-  },
-  tencent: {
-    id: "tencent",
-    alias: "tencent",
-    name: "Tencent Hunyuan",
-    icon: "auto_awesome",
-    color: "#07C160",
-    textIcon: "TC",
-    website: "https://hunyuan.tencent.com",
-    hasFree: true,
-    freeNote: "Free Hunyuan Lite models. WeChat ecosystem.",
-    passthroughModels: true,
-    authHint: "Get API key at console.cloud.tencent.com",
-  },
-  iflytek: {
-    id: "iflytek",
-    alias: "iflytek",
-    name: "iFlytek Spark",
-    icon: "auto_awesome",
-    color: "#0066FF",
-    textIcon: "IF",
-    website: "https://xinghuo.xfyun.cn",
-    hasFree: true,
-    freeNote:
-      "Spark Lite is free (2 QPS rate-limited), but iFlytek ToS §2.4(3) prohibits programmatic extraction and requires Chinese real-name auth — use with caution.",
-    passthroughModels: true,
-    authHint: "Get API key at console.xfyun.cn",
-  },
-  baichuan: {
-    id: "baichuan",
-    alias: "baichuan",
-    name: "Baichuan",
-    icon: "auto_awesome",
-    color: "#6366F1",
-    textIcon: "BC",
-    website: "https://baichuan.com",
-    hasFree: true,
-    freeNote: "Free Baichuan models. Popular Chinese LLM startup.",
-    passthroughModels: true,
-    authHint: "Get API key at platform.baichuan-ai.com",
-  },
-  yi: {
-    id: "yi",
-    alias: "yi",
-    name: "Yi (01.AI)",
-    icon: "auto_awesome",
-    color: "#10B981",
-    textIcon: "YI",
-    website: "https://01.ai",
-    hasFree: false,
-    freeNote:
-      "No free API tier (2026) — Yi-Light retired; platform.01.ai is pay-as-you-go (Yi-Lightning paid). Open weights are download-only.",
-    passthroughModels: true,
-    authHint: "Get API key at platform.lingyiwanwu.com",
-  },
-  stepfun: {
-    id: "stepfun",
-    alias: "stepfun",
-    name: "StepFun",
-    icon: "auto_awesome",
-    color: "#8B5CF6",
-    textIcon: "SF",
-    website: "https://stepfun.com",
-    hasFree: true,
-    freeNote: "Free Step-2 models. Chinese AI company.",
-    passthroughModels: true,
-    authHint: "Get API key at platform.stepfun.com",
-  },
-  coze: {
-    id: "coze",
-    alias: "coze",
-    name: "Coze",
-    icon: "smart_toy",
-    color: "#3B82F6",
-    textIcon: "CZ",
-    website: "https://coze.com",
-    hasFree: true,
-    freeNote: "Free ByteDance agent platform. Bot building + LLM access.",
-    passthroughModels: true,
-    authHint: "Get API key at coze.com/open/api",
-  },
-  "360ai": {
-    id: "360ai",
-    alias: "360ai",
-    name: "360 AI",
-    icon: "auto_awesome",
-    color: "#00B96B",
-    textIcon: "360",
-    website: "https://ai.360.cn",
-    hasFree: true,
-    freeNote: "Free 360 AI Brain models. Major Chinese security company.",
-    passthroughModels: true,
-    authHint: "Get API key at ai.360.cn",
-  },
-  doubao: {
-    id: "doubao",
-    alias: "doubao",
-    name: "Doubao",
-    icon: "auto_awesome",
-    color: "#FE2C55",
-    textIcon: "DB",
-    website: "https://doubao.com",
-    hasFree: true,
-    freeNote: "Free Doubao models. ByteDance's chatbot.",
-    passthroughModels: true,
-    authHint: "Get API key at console.volcengine.com",
-  },
-  sensenova: {
-    id: "sensenova",
-    alias: "sensenova",
-    name: "SenseNova",
-    icon: "auto_awesome",
-    color: "#0066FF",
-    textIcon: "SN",
-    website: "https://platform.sensenova.cn",
-    hasFree: true,
-    freeNote: "Free SenseTime models. Computer vision leader.",
-    passthroughModels: true,
-    authHint: "Get API key at platform.sensenova.cn",
-  },
-  sparkdesk: {
-    id: "sparkdesk",
-    alias: "sparkdesk",
-    name: "SparkDesk",
-    icon: "auto_awesome",
-    color: "#0066FF",
-    textIcon: "SD",
-    website: "https://xinghuo.xfyun.cn",
-    hasFree: true,
-    freeNote:
-      "Spark Lite free (alias for iflytek), but ToS restricts to personal/non-commercial use and prohibits relaying access to third parties — use with caution.",
-    passthroughModels: true,
-    authHint: "Get API key at console.xfyun.cn",
-  },
-  phind: {
-    id: "phind",
-    alias: "phind",
-    name: "Phind",
-    icon: "search",
-    color: "#EC4899",
-    textIcon: "PH",
-    website: "https://phind.com",
-    hasFree: false,
-    freeNote: "Discontinued 2026 — phind.com shut down (2026-01); no free tier.",
-    passthroughModels: true,
-    authHint: "Get API key at phind.com",
-  },
-  huggingchat: {
-    id: "huggingchat",
-    alias: "huggingchat",
-    name: "HuggingChat",
-    icon: "chat",
-    color: "#FFD21E",
-    textIcon: "HC",
-    website: "https://huggingface.co/chat",
-    hasFree: true,
-    freeNote: "Free chat with open models (Llama, Mistral, etc.).",
-    passthroughModels: true,
-    authHint: "No API key required for basic access.",
-  },
-  dify: {
-    id: "dify",
-    alias: "dify",
-    name: "Dify",
-    icon: "smart_toy",
-    color: "#6366F1",
-    textIcon: "DF",
-    website: "https://dify.ai",
-    hasFree: true,
-    freeNote: "Free open-source AI app builder + RAG platform.",
-    passthroughModels: true,
-    authHint: "Get API key from your Dify instance.",
-  },
-  "arcee-ai": {
-    id: "arcee-ai",
-    alias: "arcee",
-    name: "Arcee AI",
-    icon: "auto_awesome",
-    color: "#8B5CF6",
-    textIcon: "AR",
-    website: "https://arcee.ai",
-    hasFree: true,
-    freeNote: "Free Trinity Large Thinking model (262K context). No credit card required.",
-    passthroughModels: true,
-    authHint: "Get API key at arcee.ai",
-  },
-  inclusionai: {
-    id: "inclusionai",
-    alias: "inclusion",
-    name: "InclusionAI",
-    icon: "psychology",
-    color: "#10B981",
-    textIcon: "IA",
-    website: "https://inclusionai.com",
-    hasFree: true,
-    freeNote: "Free Ling-2.6-flash model (1T-param MoE, 262K context). No credit card required.",
-    passthroughModels: true,
-    authHint: "Get API key at inclusionai.com",
-    subscriptionRisk: true,
-    riskNoticeVariant: "deprecated",
-    deprecated: true,
-    deprecationReason:
-      "api.inclusionai.tech no longer resolves (sweep 2026-06-19); the inference API appears discontinued.",
-  },
-  liquid: {
-    id: "liquid",
-    alias: "liquid",
-    name: "Liquid AI",
-    icon: "water_drop",
-    color: "#06B6D4",
-    textIcon: "LQ",
-    website: "https://liquid.ai",
-    hasFree: true,
-    freeNote:
-      "Free LFM2.5-1.2B-Thinking and LFM2.5-1.2B-Instruct models. MIT spinoff, hybrid architecture.",
-    passthroughModels: true,
-    authHint: "Get API key at liquid.ai",
-  },
-  nomic: {
-    id: "nomic",
-    alias: "nomic",
-    name: "Nomic",
-    icon: "hub",
-    color: "#7C3AED",
-    textIcon: "NM",
-    website: "https://nomic.ai",
-    hasFree: true,
-    freeNote: "Free Nomic Embed API. Open-source embeddings, no credit card required.",
-    passthroughModels: true,
-    authHint: "Get API key at atlas.nomic.ai",
-  },
-  monsterapi: {
-    id: "monsterapi",
-    alias: "monster",
-    name: "MonsterAPI",
-    icon: "cloud",
-    color: "#EF4444",
-    textIcon: "MA",
-    website: "https://monsterapi.ai",
-    hasFree: true,
-    freeNote:
-      "One-time signup trial credits for decentralized GPU inference (no recurring free plan). No credit card required.",
-    passthroughModels: true,
-    authHint: "Get API key at monsterapi.ai",
-  },
-  // ── Web Fetch Providers ─────────────────────────────────────────────────────
-  firecrawl: {
-    id: "firecrawl",
-    alias: "fc",
-    name: "Firecrawl",
-    icon: "language",
-    color: "#FB923C",
-    textIcon: "FC",
-    website: "https://firecrawl.dev",
-    hasFree: true,
-    notice: {
-      text: "Free tier: 500 fetches/month, no credit card needed.",
-      apiKeyUrl: "https://firecrawl.dev/app/api-keys",
-    },
-    serviceKinds: ["webFetch"],
-  },
-  "jina-reader": {
-    id: "jina-reader",
-    alias: "jr",
-    name: "Jina Reader",
-    icon: "menu_book",
-    color: "#0EA5E9",
-    textIcon: "JR",
-    website: "https://jina.ai/reader",
-    hasFree: true,
-    notice: {
-      text: "Free tier: 1M fetches/month.",
-      apiKeyUrl: "https://jina.ai/api-dashboard",
-    },
-    serviceKinds: ["webFetch"],
-  },
-  byteplus: {
-    id: "byteplus",
-    alias: "bpm",
-    name: "BytePlus ModelArk",
-    icon: "cloud",
-    color: "#2563EB",
-    textIcon: "BP",
-    website: "https://console.byteplus.com/ark",
-    hasFree: true,
-    notice: {
-      text: "Free credits for new accounts. Seed 2.0, Kimi K2 Thinking, GLM 4.7, GPT-OSS-120B available.",
-      apiKeyUrl: "https://console.byteplus.com/ark/region:ark+ap-southeast-1/apiKey",
-    },
-    serviceKinds: ["llm"],
-  },
-  bluesminds: {
-    id: "bluesminds",
-    alias: "bm",
-    name: "BluesMinds",
-    icon: "psychology",
-    color: "#3B82F6",
-    textIcon: "BM",
-    website: "https://www.bluesminds.com",
-    hasFree: true,
-    freeNote:
-      "Free daily pi credits — supports 200+ models including GPT-4o, GPT-4.1, Claude Sonnet 4.5, Gemini 2.0 Flash, DeepSeek V4, Qwen, Kimi K2",
-    apiHint:
-      "Get your API key at https://www.bluesminds.com — OpenAI-compatible endpoint at https://api.bluesminds.com/v1 with free daily credits. VIP models (Claude Opus 4.5, Gemini 2.5 Pro) consume pi credits.",
-  },
-  "freemodel-dev": {
-    id: "freemodel-dev",
-    alias: "fmd",
-    name: "FreeModel.dev",
-    icon: "auto_awesome",
-    color: "#8B5CF6",
-    textIcon: "FM",
-    website: "https://freemodel.dev",
-    hasFree: true,
-    freeNote:
-      "$300 free credits on signup — no credit card required. Access GPT-5.4 and GPT-5.5 (OpenAI's latest flagship models) through an OpenAI-compatible API.",
-    apiHint:
-      "Get $300 free API credits at https://freemodel.dev — no payment info required. OpenAI-compatible endpoint. GPT-5.4 and GPT-5.5 models available.",
-  },
-  freeaiapikey: {
-    id: "freeaiapikey",
-    alias: "faik",
-    name: "FreeAIAPIKey",
-    icon: "vpn_key",
-    color: "#F59E0B",
-    textIcon: "FK",
-    website: "https://freeaiapikey.com",
-    apiHint:
-      "Discounted API proxy for 40+ models including GPT-5, Claude Opus 4.6, Claude Sonnet 4.6, Qwen 3.5. Get your API key at https://freeaiapikey.com/dashboard. Base URL: https://freeaiapikey.com/v1.",
-  },
-  zenmux: {
-    id: "zenmux",
-    alias: "zm",
-    name: "ZenMux",
-    icon: "neurology",
-    color: "#7C3AED",
-    textIcon: "ZM",
-    website: "https://zenmux.ai",
-    hasFree: true,
-    freeNote:
-      "Free tier includes access to Gemini 3 Flash, DeepSeek V3.2, Grok 4.1 Fast, Mistral Large, and more. Get your API key at https://zenmux.ai.",
-    authHint:
-      "Use your ZenMux API key in Authorization: Bearer <key>. ZenMux is fully OpenAI-compatible. Base URL: https://zenmux.ai/api/v1.",
-    apiHint:
-      "ZenMux exposes an OpenAI-compatible chat completions endpoint at /api/v1/chat/completions, plus Anthropic Messages (/api/anthropic/v1/messages) and Google Gemini (/api/vertex-ai) protocol surfaces. OmniRoute uses the OpenAI protocol.",
-  },
-  openadapter: {
-    id: "openadapter",
-    alias: "oad",
-    name: "OpenAdapter",
-    icon: "hub",
-    color: "#10B981",
-    textIcon: "OD",
-    website: "https://openadapter.dev",
-    hasFree: true,
-    freeNote:
-      "Free tier with a generous quota and no credit card — 15+ open-source models with daily quota. Get your API key at https://dashboard.openadapter.in.",
-    authHint:
-      "Use your OpenAdapter API key in Authorization: Bearer sk-cv-<key>. Fully OpenAI-compatible. API base URL: https://api.openadapter.in/v1.",
-    apiHint:
-      "OpenAdapter exposes an OpenAI-compatible chat completions endpoint at https://api.openadapter.in/v1/chat/completions, aggregating 70+ open-source models (DeepSeek, Qwen, Kimi, MiniMax, GLM, Llama, Mistral, …). OmniRoute uses the OpenAI protocol.",
-  },
-  dit: {
-    id: "dit",
-    alias: "dai",
-    name: "DIT.ai",
-    icon: "hub",
-    color: "#0EA5E9",
-    textIcon: "DT",
-    website: "https://dit.ai",
-    authHint:
-      "Use your dit.ai API key in Authorization: Bearer <key>. Fully OpenAI-compatible — a drop-in replacement, just change the base URL to https://api.dit.ai/v1.",
-    apiHint:
-      "dit.ai (Distributed Intelligence Trade) is an OpenAI-compatible router/gateway with dynamic per-request pricing, exposing /v1/chat/completions at https://api.dit.ai/v1. OmniRoute uses the OpenAI protocol; spend/savings analytics live in the dit.ai dashboard.",
-  },
-  tokenrouter: {
-    id: "tokenrouter",
-    alias: "trk",
-    name: "TokenRouter",
-    icon: "hub",
-    color: "#F59E0B",
-    textIcon: "TK",
-    website: "https://tokenrouter.com",
-    hasFree: true,
-    freeNote:
-      "Free tier includes the MiniMax 3 model. Get your API key at https://tokenrouter.com.",
-    authHint:
-      "Use your TokenRouter API key in Authorization: Bearer <key>. Fully OpenAI-compatible. API base URL: https://api.tokenrouter.com/v1.",
-    apiHint:
-      "TokenRouter exposes an OpenAI-compatible chat completions endpoint at https://api.tokenrouter.com/v1/chat/completions, plus a working /v1/models catalog. OmniRoute uses the OpenAI protocol.",
-  },
-};
 
 // Sub-categories within APIKEY_PROVIDERS (used by dashboard and catalog views).
 export const IMAGE_ONLY_PROVIDER_IDS = new Set([
@@ -2523,343 +124,10 @@ export const IDE_PROVIDER_IDS = new Set(["cursor", "zed", "trae"]);
 export const EMBEDDING_RERANK_PROVIDER_IDS = new Set(["voyage-ai", "jina-ai"]);
 
 // Local / Self-Hosted Providers
-export const LOCAL_PROVIDERS = {
-  "lm-studio": {
-    id: "lm-studio",
-    alias: "lmstudio",
-    name: "LM Studio",
-    icon: "server",
-    color: "#4A148C",
-    textIcon: "LM",
-    website: "https://lmstudio.ai",
-    authHint:
-      "API key optional. Configure the local LM Studio OpenAI-compatible base URL (default: http://localhost:1234/v1).",
-    localDefault: "http://localhost:1234/v1",
-    passthroughModels: true,
-  },
-  vllm: {
-    id: "vllm",
-    alias: "vllm",
-    name: "vLLM",
-    icon: "memory",
-    color: "#0F766E",
-    textIcon: "VL",
-    website: "https://github.com/vllm-project/vllm",
-    authHint:
-      "API key optional. Configure the local vLLM OpenAI-compatible base URL (default: http://localhost:8000/v1).",
-    localDefault: "http://localhost:8000/v1",
-    passthroughModels: true,
-  },
-  lemonade: {
-    id: "lemonade",
-    alias: "lemonade",
-    name: "Lemonade Server",
-    icon: "bolt",
-    color: "#F59E0B",
-    textIcon: "LM",
-    website: "https://lemonade-server.ai",
-    authHint:
-      "API key optional. Configure the local Lemonade OpenAI-compatible base URL (default: http://localhost:13305/api/v1).",
-    localDefault: "http://localhost:13305/api/v1",
-    passthroughModels: true,
-  },
-  llamafile: {
-    id: "llamafile",
-    alias: "llamafile",
-    name: "Llamafile",
-    icon: "article",
-    color: "#EA580C",
-    textIcon: "LF",
-    website: "https://github.com/Mozilla-Ocho/llamafile",
-    authHint:
-      "API key optional. Configure the local Llamafile OpenAI-compatible base URL (default: http://127.0.0.1:8080/v1).",
-    localDefault: "http://127.0.0.1:8080/v1",
-    passthroughModels: true,
-  },
-  "llama-cpp": {
-    id: "llama-cpp",
-    alias: "llamacpp",
-    name: "llama.cpp",
-    icon: "memory",
-    color: "#795548",
-    textIcon: "LC",
-    website: "https://github.com/ggml-org/llama.cpp",
-    authHint:
-      "API key optional (use any value, e.g. sk-no-key-required). Configure the llama-server OpenAI-compatible base URL (default: http://127.0.0.1:8080/v1). Note: if Llamafile is also installed, both default to port 8080 — run only one at a time or override the port.",
-    localDefault: "http://127.0.0.1:8080/v1",
-    passthroughModels: true,
-  },
-  triton: {
-    id: "triton",
-    alias: "triton",
-    name: "NVIDIA Triton",
-    icon: "developer_board",
-    color: "#76B900",
-    textIcon: "TR",
-    website: "https://developer.nvidia.com/triton-inference-server",
-    authHint:
-      "API key optional. Configure the Triton OpenAI-compatible base URL (default: http://localhost:8000/v1).",
-    localDefault: "http://localhost:8000/v1",
-    passthroughModels: true,
-  },
-  "docker-model-runner": {
-    id: "docker-model-runner",
-    alias: "dmr",
-    name: "Docker Model Runner",
-    icon: "inventory_2",
-    color: "#2496ED",
-    textIcon: "DM",
-    website: "https://docs.docker.com/ai/model-runner/",
-    authHint:
-      "API key optional. Configure the local Docker Model Runner OpenAI-compatible base URL (default: http://localhost:12434/v1).",
-    localDefault: "http://localhost:12434/v1",
-    passthroughModels: true,
-  },
-  xinference: {
-    id: "xinference",
-    alias: "xinference",
-    name: "XInference",
-    icon: "hub",
-    color: "#DC2626",
-    textIcon: "XI",
-    website: "https://inference.readthedocs.io",
-    authHint:
-      "API key optional. Configure the local XInference OpenAI-compatible base URL (default: http://localhost:9997/v1).",
-    localDefault: "http://localhost:9997/v1",
-    passthroughModels: true,
-  },
-  oobabooga: {
-    id: "oobabooga",
-    alias: "ooba",
-    name: "oobabooga",
-    icon: "dns",
-    color: "#8B5CF6",
-    textIcon: "OO",
-    website: "https://github.com/oobabooga/text-generation-webui",
-    authHint:
-      "API key optional. Configure the local oobabooga OpenAI-compatible base URL (default: http://localhost:5000/v1).",
-    localDefault: "http://localhost:5000/v1",
-    passthroughModels: true,
-  },
-  sdwebui: {
-    id: "sdwebui",
-    alias: "sdwebui",
-    name: "SD WebUI",
-    icon: "brush",
-    color: "#FF7043",
-    textIcon: "SD",
-    website: "https://github.com/AUTOMATIC1111/stable-diffusion-webui",
-    hasFree: true,
-    authHint:
-      "No API key required. Configure the local WebUI base URL (default: http://localhost:7860).",
-    localDefault: "http://localhost:7860",
-  },
-  comfyui: {
-    id: "comfyui",
-    alias: "comfyui",
-    name: "ComfyUI",
-    icon: "account_tree",
-    color: "#4CAF50",
-    textIcon: "CF",
-    website: "https://github.com/comfyanonymous/ComfyUI",
-    hasFree: true,
-    authHint:
-      "No API key required. Configure the local ComfyUI base URL (default: http://localhost:8188).",
-    localDefault: "http://localhost:8188",
-  },
-};
 
 // Search Providers
-export const SEARCH_PROVIDERS = {
-  "perplexity-search": {
-    id: "perplexity-search",
-    alias: "pplx-search",
-    name: "Perplexity Search",
-    icon: "search",
-    color: "#20808D",
-    textIcon: "PS",
-    website: "https://docs.perplexity.ai/guides/search-quickstart",
-    authHint: "Same API key as Perplexity (pplx-...)",
-  },
-  "serper-search": {
-    id: "serper-search",
-    alias: "serper-search",
-    name: "Serper Search",
-    icon: "search",
-    color: "#4285F4",
-    textIcon: "SP",
-    website: "https://serper.dev",
-    hasFree: true,
-    authHint: "API key from serper.dev dashboard",
-    serviceKinds: ["webSearch"],
-  },
-  "brave-search": {
-    id: "brave-search",
-    alias: "brave-search",
-    name: "Brave Search",
-    icon: "travel_explore",
-    color: "#FB542B",
-    textIcon: "BR",
-    website: "https://brave.com/search/api",
-    hasFree: true,
-    authHint: "Subscription token from Brave Search API dashboard",
-  },
-  "exa-search": {
-    id: "exa-search",
-    alias: "exa-search",
-    name: "Exa Search",
-    icon: "neurology",
-    color: "#1E40AF",
-    textIcon: "EX",
-    website: "https://exa.ai",
-    hasFree: true,
-    authHint: "API key from dashboard.exa.ai",
-    serviceKinds: ["webSearch", "webFetch"],
-  },
-  "tavily-search": {
-    id: "tavily-search",
-    alias: "tavily-search",
-    name: "Tavily Search",
-    icon: "manage_search",
-    color: "#5B4FDB",
-    textIcon: "TV",
-    website: "https://tavily.com",
-    hasFree: true,
-    authHint: "API key from app.tavily.com (format: tvly-...)",
-    serviceKinds: ["webSearch", "webFetch"],
-  },
-  "google-pse-search": {
-    id: "google-pse-search",
-    alias: "google-pse",
-    name: "Google Programmable Search",
-    icon: "travel_explore",
-    color: "#4285F4",
-    textIcon: "GP",
-    website: "https://developers.google.com/custom-search/v1/overview",
-    authHint: "Requires a Google API key and your Programmable Search Engine ID (cx)",
-  },
-  "linkup-search": {
-    id: "linkup-search",
-    alias: "linkup",
-    name: "Linkup Search",
-    icon: "public",
-    color: "#0F766E",
-    textIcon: "LU",
-    website: "https://docs.linkup.so",
-    authHint: "Bearer API key from the Linkup dashboard",
-  },
-  "searchapi-search": {
-    id: "searchapi-search",
-    alias: "searchapi",
-    name: "SearchAPI",
-    icon: "manage_search",
-    color: "#2563EB",
-    textIcon: "SA",
-    website: "https://www.searchapi.io/docs",
-    authHint: "API key from SearchAPI (query param or Bearer auth)",
-  },
-  "youcom-search": {
-    id: "youcom-search",
-    alias: "youcom-search",
-    name: "You.com Search",
-    icon: "travel_explore",
-    color: "#2563EB",
-    textIcon: "YOU",
-    website: "https://you.com/docs/search/overview",
-    authHint: "X-API-Key from the You.com platform dashboard",
-  },
-  "searxng-search": {
-    id: "searxng-search",
-    alias: "searxng",
-    name: "SearXNG Search",
-    icon: "search",
-    color: "#1A237E",
-    textIcon: "SX",
-    website: "https://docs.searxng.org",
-    hasFree: true,
-    authHint:
-      "API key is optional. Set your SearXNG base URL. Some instances may require a bearer token for access.",
-  },
-  "ollama-search": {
-    id: "ollama-search",
-    alias: "ollama-search",
-    name: "Ollama Search",
-    icon: "search",
-    color: "#58A6FF",
-    textIcon: "OS",
-    website: "https://ollama.com/settings/api-keys",
-    authHint: "Same API key as Ollama Cloud (from ollama.com/settings/api-keys)",
-  },
-};
 
 // Audio Only Providers
-export const AUDIO_ONLY_PROVIDERS = {
-  deepgram: {
-    id: "deepgram",
-    alias: "dg",
-    name: "Deepgram",
-    icon: "mic",
-    color: "#13EF93",
-    textIcon: "DG",
-    website: "https://deepgram.com",
-  },
-  assemblyai: {
-    id: "assemblyai",
-    alias: "aai",
-    name: "AssemblyAI",
-    icon: "record_voice_over",
-    color: "#0062FF",
-    textIcon: "AA",
-    website: "https://assemblyai.com",
-  },
-  elevenlabs: {
-    id: "elevenlabs",
-    alias: "el",
-    name: "ElevenLabs",
-    icon: "record_voice_over",
-    color: "#6C47FF",
-    textIcon: "EL",
-    website: "https://elevenlabs.io",
-  },
-  cartesia: {
-    id: "cartesia",
-    alias: "cartesia",
-    name: "Cartesia",
-    icon: "spatial_audio",
-    color: "#FF4F8B",
-    textIcon: "CA",
-    website: "https://cartesia.ai",
-  },
-  playht: {
-    id: "playht",
-    alias: "playht",
-    name: "PlayHT",
-    icon: "play_circle",
-    color: "#00B4D8",
-    textIcon: "PH",
-    website: "https://play.ht",
-  },
-  inworld: {
-    id: "inworld",
-    alias: "inworld",
-    name: "Inworld",
-    icon: "voice_chat",
-    color: "#7B2EF2",
-    textIcon: "IW",
-    website: "https://inworld.ai",
-  },
-  "aws-polly": {
-    id: "aws-polly",
-    alias: "polly",
-    name: "AWS Polly",
-    icon: "record_voice_over",
-    color: "#FF9900",
-    textIcon: "PL",
-    website: "https://aws.amazon.com/polly/",
-    authHint:
-      "Use AWS Secret Access Key as API key; set providerSpecificData.accessKeyId and optional region.",
-  },
-};
 
 export const OPENAI_COMPATIBLE_PREFIX = "openai-compatible-";
 export const ANTHROPIC_COMPATIBLE_PREFIX = "anthropic-compatible-";
@@ -2873,71 +141,7 @@ export function isAnthropicCompatibleProvider(providerId: unknown): providerId i
   return typeof providerId === "string" && providerId.startsWith(ANTHROPIC_COMPATIBLE_PREFIX);
 }
 
-export const UPSTREAM_PROXY_PROVIDERS = {
-  cliproxyapi: {
-    id: "cliproxyapi",
-    alias: "cpa",
-    name: "CLIProxyAPI",
-    icon: "proxy",
-    color: "#6366F1",
-    textIcon: "CPA",
-    website: "https://github.com/router-for-me/CLIProxyAPI",
-    defaultPort: 8317,
-    healthEndpoint: "/v1/models",
-    managementPrefix: "/v0/management",
-    configDir: "~/.cli-proxy-api",
-    binaryName: "cli-proxy-api",
-    githubRepo: "router-for-me/CLIProxyAPI",
-  },
-  "9router": {
-    id: "9router",
-    alias: "nr",
-    name: "9router",
-    icon: "router",
-    color: "#0EA5E9",
-    textIcon: "9R",
-    website: "https://www.npmjs.com/package/9router",
-    defaultPort: 20130,
-    healthEndpoint: "/api/health",
-    npmPackage: "9router",
-    embedded: true,
-    isEmbeddedService: true,
-    riskNoticeVariant: "embedded-service" as const,
-  },
-};
 
-export const CLOUD_AGENT_PROVIDERS = {
-  jules: {
-    id: "jules",
-    alias: "jules",
-    name: "Google Jules",
-    icon: "engineering",
-    color: "#4285F4",
-    textIcon: "JL",
-    website: "https://jules.google",
-    authHint: "Jules API key for creating and managing cloud coding tasks.",
-  },
-  devin: {
-    id: "devin",
-    alias: "devin",
-    name: "Devin",
-    icon: "smart_toy",
-    color: "#111827",
-    textIcon: "DV",
-    website: "https://devin.ai",
-    authHint: "Devin API key for cloud agent sessions.",
-  },
-  "codex-cloud": {
-    id: "codex-cloud",
-    alias: "codex-cloud",
-    name: "Codex Cloud",
-    icon: "cloud",
-    color: "#10A37F",
-    textIcon: "CC",
-    website: "https://openai.com/codex",
-    authHint: "OpenAI API key with Codex Cloud task access.",
-  },
-};
 
 export function isClaudeCodeCompatibleProvider(providerId: unknown): providerId is string {
   return typeof providerId === "string" && providerId.startsWith(CLAUDE_CODE_COMPATIBLE_PREFIX);
@@ -3015,18 +219,6 @@ export function supportsBulkApiKey(providerId: unknown): boolean {
 }
 
 // ── System Providers (virtual, not user-connectable) ──────────────────────────
-export const SYSTEM_PROVIDERS = {
-  auto: {
-    id: "auto",
-    alias: "auto",
-    name: "Auto (Zero-Config)",
-    icon: "auto_awesome",
-    color: "#6366F1",
-    textIcon: "Auto",
-    systemOnly: true,
-    description: "Zero-config auto-routing with LKGP across all connected providers",
-  },
-};
 
 const _PROVIDER_SECTIONS = [
   NOAUTH_PROVIDERS,
@@ -3234,9 +426,25 @@ export const USAGE_SUPPORTED_PROVIDERS = [
   "xiaomi-mimo",
   "vertex",
   "vertex-partner",
+  "codebuddy-cn",
 ];
 
 // ── Zod validation at module load (Phase 7.2) ──
+
+// Re-export the extracted data catalogs so external importers of providers.ts are unchanged.
+export {
+  NOAUTH_PROVIDERS,
+  OAUTH_PROVIDERS,
+  WEB_COOKIE_PROVIDERS,
+  APIKEY_PROVIDERS,
+  LOCAL_PROVIDERS,
+  SEARCH_PROVIDERS,
+  AUDIO_ONLY_PROVIDERS,
+  UPSTREAM_PROXY_PROVIDERS,
+  CLOUD_AGENT_PROVIDERS,
+  SYSTEM_PROVIDERS,
+};
+
 import { validateProviders } from "../validation/providerSchema";
 
 validateProviders(NOAUTH_PROVIDERS, "NOAUTH_PROVIDERS");
diff --git a/src/shared/constants/providers/apikey/enterprise-cloud.ts b/src/shared/constants/providers/apikey/enterprise-cloud.ts
new file mode 100644
index 0000000000..614ca9e49c
--- /dev/null
+++ b/src/shared/constants/providers/apikey/enterprise-cloud.ts
@@ -0,0 +1,214 @@
+/**
+ * APIKEY provider catalog — enterprise-cloud family (hyperscaler & enterprise cloud platforms).
+ * Pure data; merged by apikey/index.ts via spread (god-file decomposition; semantic split).
+ */
+export const APIKEY_PROVIDERS_ENTERPRISE = {
+  "azure-openai": {
+    id: "azure-openai",
+    alias: "azure",
+    name: "Azure OpenAI",
+    icon: "cloud",
+    color: "#0078D4",
+    textIcon: "AZ",
+    website: "https://azure.microsoft.com/products/ai-services/openai-service",
+    authHint:
+      "Use your Azure OpenAI API key. Base URL should be your resource endpoint, for example https://my-resource.openai.azure.com.",
+    passthroughModels: true,
+  },
+  "azure-ai": {
+    id: "azure-ai",
+    alias: "azure-ai",
+    name: "Azure AI Foundry",
+    icon: "cloud",
+    color: "#2563EB",
+    textIcon: "AF",
+    website: "https://learn.microsoft.com/azure/ai-foundry",
+    authHint:
+      "Use your Azure AI Foundry key. Base URL can be https://<resource>.services.ai.azure.com/openai/v1/ or https://<resource>.openai.azure.com/openai/v1/.",
+    apiHint:
+      "Foundry uses the OpenAI v1 surface with deployment names as models. OmniRoute normalizes root resource URLs to the v1 chat and /models endpoints.",
+    passthroughModels: true,
+  },
+  bedrock: {
+    id: "bedrock",
+    alias: "bedrock",
+    name: "Amazon Bedrock",
+    icon: "cloud",
+    color: "#FF9900",
+    textIcon: "BR",
+    website: "https://aws.amazon.com/bedrock",
+    authHint:
+      "Use your Amazon Bedrock API key and configure the AWS region where your models are enabled (for example eu-west-2). OmniRoute calls Bedrock's native Converse API directly.",
+    apiHint:
+      "Native Bedrock integration: model discovery uses Bedrock foundation models and inference profiles, while chat uses the regional Bedrock Runtime Converse/ConverseStream APIs.",
+    passthroughModels: true,
+  },
+  watsonx: {
+    id: "watsonx",
+    alias: "watsonx",
+    name: "IBM watsonx.ai Gateway",
+    icon: "hub",
+    color: "#0F62FE",
+    textIcon: "WX",
+    website: "https://www.ibm.com/products/watsonx-ai",
+    authHint:
+      "Use your watsonx bearer token. Base URL can be https://<region>.ml.cloud.ibm.com/ml/gateway/v1/ or a self-managed /ml/gateway/v1 endpoint.",
+    apiHint:
+      "The watsonx model gateway exposes OpenAI-compatible /chat/completions and /models under /ml/gateway/v1.",
+    passthroughModels: true,
+  },
+  oci: {
+    id: "oci",
+    alias: "oci",
+    name: "OCI Generative AI",
+    icon: "cloud",
+    color: "#C74634",
+    textIcon: "OCI",
+    website: "https://www.oracle.com/artificial-intelligence/generative-ai",
+    authHint:
+      "Use your OCI Generative AI API key or IAM bearer token. Base URL can be https://inference.generativeai.<region>.oci.oraclecloud.com/openai/v1/.",
+    apiHint:
+      "OCI exposes OpenAI-compatible chat and responses endpoints. Project ID is optional in OmniRoute but may be required for Responses and agentic workflows.",
+    passthroughModels: true,
+  },
+  sap: {
+    id: "sap",
+    alias: "sap",
+    name: "SAP Generative AI Hub",
+    icon: "business",
+    color: "#0FAAFF",
+    textIcon: "SAP",
+    website:
+      "https://help.sap.com/docs/sap-ai-core/sap-ai-core-service-guide/generative-ai-hub-in-sap-ai-core",
+    authHint:
+      "Use your SAP AI Core bearer token. Base URL can be your AI_API_URL root or a deploymentUrl from Generative AI Hub.",
+    apiHint:
+      "Model discovery uses /v2/lm/scenarios/foundation-models/models on AI_API_URL. Chat requests use deploymentUrl/chat/completions and require AI-Resource-Group.",
+    passthroughModels: true,
+  },
+  modal: {
+    id: "modal",
+    alias: "mdl",
+    name: "Modal",
+    icon: "cloud_queue",
+    color: "#7C3AED",
+    textIcon: "MDL",
+    website: "https://modal.com/docs",
+    authHint:
+      "Use the bearer token that protects your Modal deployment, if enabled. Base URL should point to your OpenAI-compatible Modal app, for example https://<workspace>--<app>.modal.run/v1.",
+    apiHint:
+      "Modal commonly serves user-hosted OpenAI-compatible apps on /v1. OmniRoute will probe /v1/models and route chat traffic to /v1/chat/completions.",
+    hasFree: true,
+    freeNote: "$30/month free credits for new accounts",
+    passthroughModels: true,
+  },
+  vertex: {
+    id: "vertex",
+    alias: "vertex",
+    name: "Vertex AI",
+    icon: "cloud",
+    color: "#4285F4",
+    textIcon: "VA",
+    website: "https://cloud.google.com/vertex-ai",
+    hasFree: true,
+    authHint: "Provide Service Account JSON or OAuth access_token",
+  },
+  "vertex-partner": {
+    id: "vertex-partner",
+    alias: "vp",
+    name: "Vertex AI Partners",
+    icon: "cloud",
+    color: "#34A853",
+    textIcon: "VP",
+    website: "https://cloud.google.com/vertex-ai",
+    authHint: "Provide the same Service Account JSON used for Vertex AI partner models.",
+  },
+  "cloudflare-ai": {
+    id: "cloudflare-ai",
+    alias: "cf",
+    name: "Cloudflare Workers AI",
+    icon: "cloud",
+    color: "#F48120",
+    textIcon: "CF",
+    website: "https://developers.cloudflare.com/workers-ai",
+    hasFree: true,
+    freeNote:
+      "Free 10K Neurons/day: ~150 LLM responses or 500s Whisper audio — edge inference globally",
+    authHint: "Requires API Token AND Account ID (found at dash.cloudflare.com)",
+  },
+  scaleway: {
+    id: "scaleway",
+    alias: "scw",
+    name: "Scaleway AI",
+    icon: "cloud",
+    color: "#4F0599",
+    textIcon: "SCW",
+    website: "https://www.scaleway.com/en/ai/generative-apis",
+    hasFree: true,
+    freeNote: "1M free tokens for new accounts — EU/GDPR compliant (Paris), Qwen3 235B & Llama 70B",
+  },
+  ovhcloud: {
+    id: "ovhcloud",
+    alias: "ovh",
+    name: "OVHcloud AI",
+    icon: "cloud",
+    color: "#2563EB",
+    textIcon: "OVH",
+    website: "https://www.ovhcloud.com",
+  },
+  heroku: {
+    id: "heroku",
+    alias: "heroku",
+    name: "Heroku AI",
+    icon: "cloud_upload",
+    color: "#7C3AED",
+    textIcon: "HK",
+    website: "https://www.heroku.com",
+  },
+  databricks: {
+    id: "databricks",
+    alias: "databricks",
+    name: "Databricks",
+    icon: "table_chart",
+    color: "#F97316",
+    textIcon: "DB",
+    website: "https://www.databricks.com",
+  },
+  datarobot: {
+    id: "datarobot",
+    alias: "datarobot",
+    name: "DataRobot",
+    icon: "precision_manufacturing",
+    color: "#6D28D9",
+    textIcon: "DR",
+    website: "https://docs.datarobot.com",
+    authHint:
+      "Use your DataRobot API token. Optional Base URL can be the account root (for LLM Gateway) or a deployment URL under /api/v2/deployments/<id>.",
+    apiHint:
+      "The default gateway catalogs active models from /genai/llmgw/catalog/. Deployment URLs are also supported for direct OpenAI-compatible chat requests.",
+    passthroughModels: true,
+  },
+  clarifai: {
+    id: "clarifai",
+    alias: "clarifai",
+    name: "Clarifai",
+    icon: "hub",
+    color: "#7C3AED",
+    textIcon: "CF",
+    website: "https://docs.clarifai.com",
+    authHint:
+      "Use your Clarifai PAT or app-specific API key. OmniRoute targets the OpenAI-compatible endpoint at https://api.clarifai.com/v2/ext/openai/v1 and authenticates with Authorization: Key <token>.",
+    apiHint:
+      "Clarifai exposes OpenAI-compatible chat, responses and /models on /v2/ext/openai/v1. Public/community models typically require a PAT; app-scoped keys only work for resources inside that app.",
+    passthroughModels: true,
+  },
+  snowflake: {
+    id: "snowflake",
+    alias: "snowflake",
+    name: "Snowflake Cortex",
+    icon: "ac_unit",
+    color: "#29B5E8",
+    textIcon: "SF",
+    website: "https://www.snowflake.com",
+  },
+};
diff --git a/src/shared/constants/providers/apikey/frontier-labs.ts b/src/shared/constants/providers/apikey/frontier-labs.ts
new file mode 100644
index 0000000000..1339e374e1
--- /dev/null
+++ b/src/shared/constants/providers/apikey/frontier-labs.ts
@@ -0,0 +1,249 @@
+/**
+ * APIKEY provider catalog — frontier-labs family (first-party frontier model labs).
+ * Pure data; merged by apikey/index.ts via spread (god-file decomposition; semantic split).
+ */
+export const APIKEY_PROVIDERS_FRONTIER = {
+  openai: {
+    id: "openai",
+    alias: "openai",
+    name: "OpenAI",
+    icon: "auto_awesome",
+    color: "#10A37F",
+    textIcon: "OA",
+    website: "https://platform.openai.com",
+  },
+  reka: {
+    id: "reka",
+    alias: "reka",
+    name: "Reka",
+    icon: "auto_awesome",
+    color: "#111827",
+    textIcon: "RK",
+    website: "https://docs.reka.ai/chat/overview",
+    authHint:
+      "Use your Reka API key. OmniRoute supports the OpenAI-compatible base URL https://api.reka.ai/v1 and sends both Authorization and X-Api-Key headers for compatibility.",
+    apiHint:
+      "Reka Chat is OpenAI-compatible on /v1. OmniRoute probes /v1/models and routes chat traffic to /v1/chat/completions.",
+    hasFree: true,
+    freeNote: "$10/month recurring free API credits",
+  },
+  anthropic: {
+    id: "anthropic",
+    alias: "anthropic",
+    name: "Anthropic",
+    icon: "smart_toy",
+    color: "#D97757",
+    textIcon: "AN",
+    website: "https://platform.claude.com",
+  },
+  gemini: {
+    id: "gemini",
+    alias: "gemini",
+    name: "Gemini (Google AI Studio)",
+    icon: "diamond",
+    color: "#4285F4",
+    textIcon: "GE",
+    website: "https://aistudio.google.com",
+    hasFree: true,
+    freeNote:
+      "Free forever: 1,500 req/day for Gemini 2.5 Flash — no credit card, get key at aistudio.google.com",
+  },
+  groq: {
+    id: "groq",
+    alias: "groq",
+    name: "Groq",
+    icon: "speed",
+    color: "#F55036",
+    textIcon: "GQ",
+    website: "https://groq.com",
+    hasFree: true,
+    freeNote: "Free tier: 30 RPM / 14.4K RPD — no credit card",
+  },
+  blackbox: {
+    id: "blackbox",
+    alias: "bb",
+    name: "Blackbox AI",
+    icon: "view_in_ar",
+    color: "#1A1A2E",
+    textIcon: "BB",
+    website: "https://blackbox.ai",
+    hasFree: true,
+    freeNote: "Free tier: unlimited basic chat plus Minimax-M2.5, no credit card required",
+  },
+  xai: {
+    id: "xai",
+    alias: "xai",
+    name: "xAI (Grok)",
+    icon: "auto_awesome",
+    color: "#1DA1F2",
+    textIcon: "XA",
+    website: "https://x.ai",
+  },
+  mistral: {
+    id: "mistral",
+    alias: "mistral",
+    name: "Mistral",
+    icon: "air",
+    color: "#FF7000",
+    textIcon: "MI",
+    website: "https://mistral.ai",
+    hasFree: true,
+    freeNote: "Free Experiment tier: rate-limited access to all models, no credit card required",
+  },
+  perplexity: {
+    id: "perplexity",
+    alias: "pplx",
+    name: "Perplexity",
+    icon: "search",
+    color: "#20808D",
+    textIcon: "PP",
+    website: "https://www.perplexity.ai",
+  },
+  cohere: {
+    id: "cohere",
+    alias: "cohere",
+    name: "Cohere",
+    icon: "hub",
+    color: "#39594D",
+    textIcon: "CO",
+    website: "https://cohere.com",
+    hasFree: true,
+    freeNote: "Free Trial: 1,000 API calls/month for testing, no credit card required",
+  },
+  "meta-llama": {
+    id: "meta-llama",
+    alias: "meta",
+    name: "Meta Llama API",
+    icon: "smart_toy",
+    color: "#0F766E",
+    textIcon: "ML",
+    website: "https://llama.developer.meta.com",
+  },
+  morph: {
+    id: "morph",
+    alias: "morph",
+    name: "Morph",
+    icon: "auto_fix_high",
+    color: "#2563EB",
+    textIcon: "MP",
+    website: "https://morphllm.com",
+    hasFree: true,
+    freeNote: "Free tier: 250K credits/month, $0",
+  },
+  galadriel: {
+    id: "galadriel",
+    alias: "galadriel",
+    name: "Galadriel",
+    icon: "auto_awesome",
+    color: "#F59E0B",
+    textIcon: "GA",
+    website: "https://galadriel.com",
+    subscriptionRisk: true,
+    riskNoticeVariant: "deprecated",
+    deprecated: true,
+    deprecationReason:
+      "api.galadriel.ai no longer resolves (sweep 2026-06-19); the inference API appears discontinued.",
+  },
+  ai21: {
+    id: "ai21",
+    alias: "ai21",
+    name: "AI21 Labs",
+    icon: "psychology_alt",
+    color: "#0284C7",
+    textIcon: "AI21",
+    website: "https://www.ai21.com",
+    hasFree: true,
+    freeNote: "$10 trial credits on signup (valid 3 months), no credit card required",
+  },
+  venice: {
+    id: "venice",
+    alias: "venice",
+    name: "Venice.ai",
+    icon: "travel_explore",
+    color: "#0EA5E9",
+    textIcon: "VN",
+    website: "https://venice.ai",
+  },
+  codestral: {
+    id: "codestral",
+    alias: "codestral",
+    name: "Codestral",
+    icon: "terminal",
+    color: "#FF7000",
+    textIcon: "CS",
+    website: "https://mistral.ai",
+  },
+  upstage: {
+    id: "upstage",
+    alias: "upstage",
+    name: "Upstage",
+    icon: "trending_up",
+    color: "#0F766E",
+    textIcon: "UP",
+    website: "https://www.upstage.ai",
+  },
+  maritalk: {
+    id: "maritalk",
+    alias: "maritalk",
+    name: "Maritalk",
+    icon: "translate",
+    color: "#1D4ED8",
+    textIcon: "MT",
+    website: "https://www.maritaca.ai",
+  },
+  "nous-research": {
+    id: "nous-research",
+    alias: "nous",
+    name: "Nous Research",
+    icon: "hub",
+    color: "#2563EB",
+    textIcon: "NO",
+    website: "https://portal.nousresearch.com/help",
+    authHint:
+      "Use your Nous Portal API key. OmniRoute targets the official OpenAI-compatible inference endpoint at https://inference-api.nousresearch.com/v1.",
+    apiHint:
+      "Nous exposes an OpenAI-compatible /v1 surface with a large remote /models catalog. The /chat/completions endpoint requires a valid API key for programmatic inference.",
+    hasFree: true,
+    freeNote: "Free tier: 50 RPM, 500,000 TPM — no credit card",
+  },
+  phind: {
+    id: "phind",
+    alias: "phind",
+    name: "Phind",
+    icon: "search",
+    color: "#EC4899",
+    textIcon: "PH",
+    website: "https://phind.com",
+    hasFree: false,
+    freeNote: "Discontinued 2026 — phind.com shut down (2026-01); no free tier.",
+    passthroughModels: true,
+    authHint: "Get API key at phind.com",
+  },
+  "arcee-ai": {
+    id: "arcee-ai",
+    alias: "arcee",
+    name: "Arcee AI",
+    icon: "auto_awesome",
+    color: "#8B5CF6",
+    textIcon: "AR",
+    website: "https://arcee.ai",
+    hasFree: true,
+    freeNote: "Free Trinity Large Thinking model (262K context). No credit card required.",
+    passthroughModels: true,
+    authHint: "Get API key at arcee.ai",
+  },
+  liquid: {
+    id: "liquid",
+    alias: "liquid",
+    name: "Liquid AI",
+    icon: "water_drop",
+    color: "#06B6D4",
+    textIcon: "LQ",
+    website: "https://liquid.ai",
+    hasFree: true,
+    freeNote:
+      "Free LFM2.5-1.2B-Thinking and LFM2.5-1.2B-Instruct models. MIT spinoff, hybrid architecture.",
+    passthroughModels: true,
+    authHint: "Get API key at liquid.ai",
+  },
+};
diff --git a/src/shared/constants/providers/apikey/gateways.ts b/src/shared/constants/providers/apikey/gateways.ts
new file mode 100644
index 0000000000..51ca63fbae
--- /dev/null
+++ b/src/shared/constants/providers/apikey/gateways.ts
@@ -0,0 +1,511 @@
+/**
+ * APIKEY provider catalog — gateways family (aggregators, multi-model routers & API marketplaces).
+ * Pure data; merged by apikey/index.ts via spread (god-file decomposition; semantic split).
+ */
+export const APIKEY_PROVIDERS_GATEWAYS = {
+  agentrouter: {
+    id: "agentrouter",
+    alias: "agentrouter",
+    name: "AgentRouter",
+    icon: "router",
+    color: "#10B981",
+    textIcon: "AR",
+    passthroughModels: true,
+    website: "https://agentrouter.org",
+    hasFree: true,
+    freeNote: "$200 free credits on signup - multi-model routing gateway",
+    apiHint: "Get $200 free credits at https://agentrouter.org/register — no credit card required.",
+  },
+  "command-code": {
+    id: "command-code",
+    alias: "cmd",
+    name: "Command Code",
+    icon: "terminal",
+    color: "#111827",
+    textIcon: "CC",
+    website: "https://commandcode.ai/",
+    authHint:
+      "Use a Command Code API key. Requests are sent to Command Code's /alpha/generate endpoint.",
+    apiHint: "Create or copy an API key from Command Code, then paste it here as a Bearer token.",
+  },
+  openrouter: {
+    id: "openrouter",
+    alias: "openrouter",
+    name: "OpenRouter",
+    icon: "router",
+    color: "#F97316",
+    textIcon: "OR",
+    passthroughModels: true,
+    website: "https://openrouter.ai",
+    hasFree: true,
+    freeNote: "Free models at $0/token with :free suffix - 20 RPM / 200 RPD",
+  },
+  orcarouter: {
+    id: "orcarouter",
+    alias: "orcarouter",
+    name: "OrcaRouter",
+    icon: "router",
+    color: "#0891B2",
+    textIcon: "ORC",
+    passthroughModels: true,
+    website: "https://www.orcarouter.ai",
+    apiHint:
+      "Create an API key (starts with sk-orca-) at https://www.orcarouter.ai, then paste it as a Bearer token. OpenAI-compatible endpoint at https://api.orcarouter.ai/v1.",
+  },
+  "api-airforce": {
+    id: "api-airforce",
+    alias: "af",
+    name: "Api.airforce",
+    icon: "flight",
+    color: "#1E3A5F",
+    textIcon: "AF",
+    website: "https://api.airforce",
+    hasFree: true,
+    freeNote:
+      "55 free tier models including Grok-3, Claude 3.7, Qwen3, Kimi-K2, Gemini 2.5 Flash, DeepSeek-V3",
+    apiHint:
+      "Get your API key from https://panel.api.airforce — OpenAI-compatible endpoint at https://api.airforce/v1",
+  },
+  crof: {
+    id: "crof",
+    alias: "crof",
+    name: "CrofAI",
+    icon: "auto_awesome",
+    color: "#0EA5E9",
+    textIcon: "CR",
+    website: "https://crof.ai",
+  },
+  bazaarlink: {
+    id: "bazaarlink",
+    alias: "bzl",
+    name: "BazaarLink",
+    icon: "storefront",
+    color: "#6366F1",
+    textIcon: "BZ",
+    website: "https://bazaarlink.ai",
+    hasFree: true,
+    freeNote:
+      "Free tier: 4M tokens/day per account with auto:free routing — zero-cost inference, no credit card required.",
+    authHint:
+      "Use your BazaarLink API key (starts with sk-bl-) in Authorization: Bearer <key>. OpenAI SDK works with base URL https://bazaarlink.ai/api/v1. Models use provider/model-name format.",
+    apiHint:
+      "Create a free API key at https://bazaarlink.ai — model 'auto:free' routes to zero-cost inference. All models use the provider/model-name format, e.g. xiaomi/mimo-v2.5-pro.",
+  },
+  synthetic: {
+    id: "synthetic",
+    alias: "synthetic",
+    name: "Synthetic",
+    icon: "verified_user",
+    color: "#6366F1",
+    textIcon: "SY",
+    website: "https://synthetic.new",
+    passthroughModels: true,
+  },
+  "kilo-gateway": {
+    id: "kilo-gateway",
+    alias: "kg",
+    name: "Kilo Gateway",
+    icon: "hub",
+    color: "#617A91",
+    textIcon: "KG",
+    website: "https://kilo.ai",
+    passthroughModels: true,
+  },
+  wafer: {
+    id: "wafer",
+    alias: "wafer",
+    name: "Wafer AI",
+    icon: "layers",
+    color: "#6366F1",
+    textIcon: "WF",
+    website: "https://wafer.ai",
+    apiHint: "API key from https://wafer.ai",
+  },
+  "opencode-zen": {
+    id: "opencode-zen",
+    alias: "opencode-zen",
+    name: "OpenCode Zen",
+    icon: "opencode",
+    color: "#6366f1",
+    website: "https://opencode.ai/zen",
+    anonymousFallback: true,
+  },
+  "opencode-go": {
+    id: "opencode-go",
+    alias: "opencode-go",
+    name: "OpenCode Go",
+    icon: "opencode",
+    color: "#6366f1",
+    website: "https://opencode.ai/go",
+    anonymousFallback: true,
+  },
+  puter: {
+    id: "puter",
+    alias: "pu",
+    name: "Puter AI",
+    icon: "cloud_circle",
+    color: "#6366F1",
+    textIcon: "PU",
+    website: "https://puter.com",
+    hasFree: true,
+    freeNote:
+      "500+ models (GPT-5, Claude Opus 4, Gemini 3 Pro, Grok 4, DeepSeek V3...) — Users pay via free Puter account",
+    passthroughModels: true,
+    authHint: "Get token at puter.com/dashboard → Copy Auth Token",
+  },
+  uncloseai: {
+    id: "uncloseai",
+    alias: "unc",
+    name: "UncloseAI",
+    icon: "auto_awesome",
+    color: "#8B5CF6",
+    textIcon: "UN",
+    website: "https://uncloseai.com",
+    hasFree: true,
+    freeNote: "Free forever — no signup, no credit card. OpenAI-compatible endpoints.",
+    passthroughModels: true,
+    authHint: "No auth required. API accepts any non-empty string as key for identification.",
+  },
+  hackclub: {
+    id: "hackclub",
+    alias: "hc",
+    name: "Hackclub AI",
+    icon: "auto_awesome",
+    color: "#FF6B00",
+    textIcon: "HC",
+    website: "https://ai.hackclub.com",
+    hasFree: true,
+    freeNote: "Free AI for Hack Club members — 30+ models, no credit card.",
+    passthroughModels: true,
+    authHint: "Sign in with your Hack Club account at ai.hackclub.com.",
+  },
+  "vercel-ai-gateway": {
+    id: "vercel-ai-gateway",
+    alias: "vag",
+    name: "Vercel AI Gateway",
+    icon: "route",
+    color: "#111827",
+    textIcon: "VAI",
+    website: "https://vercel.com/docs/ai-gateway",
+  },
+  llm7: {
+    id: "llm7",
+    alias: "llm7",
+    name: "LLM7.io",
+    icon: "hub",
+    color: "#6366F1",
+    textIcon: "LM",
+    website: "https://llm7.io",
+    hasFree: true,
+    freeNote: "No signup required - 2 req/s, 20 RPM, 100 req/hr free tier",
+    apiHint:
+      "Works without API key (use 'unused' as key). Get free token at token.llm7.io for higher limits.",
+  },
+  kluster: {
+    id: "kluster",
+    alias: "kluster",
+    name: "Kluster AI",
+    icon: "hub",
+    color: "#8B5CF6",
+    textIcon: "KL",
+    website: "https://kluster.ai",
+    hasFree: false,
+    freeNote: "Discontinued 2026 — kluster.ai sunset (2026-06-09); no free tier.",
+    apiHint: "Get API key at https://kluster.ai/dashboard/api-keys",
+    subscriptionRisk: true,
+    riskNoticeVariant: "deprecated",
+    deprecated: true,
+    deprecationReason:
+      "kluster.ai shut down (2026-06-09); api.kluster.ai no longer resolves (sweep 2026-06-19). Use another OpenAI-compatible provider.",
+  },
+  llamagate: {
+    id: "llamagate",
+    alias: "llamagate",
+    name: "LlamaGate",
+    icon: "gate",
+    color: "#16A34A",
+    textIcon: "LG",
+    website: "https://llamagate.ai",
+  },
+  gitlawb: {
+    id: "gitlawb",
+    alias: "glb",
+    name: "Gitlawb Opengateway (MiMo)",
+    icon: "hub",
+    color: "#10B981",
+    textIcon: "GLB",
+    website: "https://opengateway.gitlawb.com",
+    hasFree: false,
+    freeNote:
+      "Free MiMo (xiaomi/mimo-v2.5) revoked 2026-05 — Opengateway is now a pay-as-you-go credit gateway; no recurring free model.",
+    apiHint: "Get your API key from Gitlawb Opengateway dashboard.",
+  },
+  "gitlawb-gmi": {
+    id: "gitlawb-gmi",
+    alias: "glb-gmi",
+    name: "Gitlawb Opengateway (GMI Cloud)",
+    icon: "hub",
+    color: "#10B981",
+    textIcon: "GMI",
+    website: "https://opengateway.gitlawb.com",
+    hasFree: false,
+    freeNote:
+      "Free Nemotron promo ended 2026-06 — the GMI Cloud route is now pay-as-you-go credit only.",
+    apiHint: "Get your API key from Gitlawb Opengateway dashboard.",
+  },
+  nanogpt: {
+    id: "nanogpt",
+    alias: "nanogpt",
+    name: "NanoGPT",
+    icon: "chat",
+    color: "#4F46E5",
+    textIcon: "NG",
+    website: "https://nano-gpt.com",
+  },
+  aimlapi: {
+    id: "aimlapi",
+    alias: "aiml",
+    name: "AI/ML API",
+    icon: "hub",
+    color: "#6366F1",
+    textIcon: "AI",
+    website: "https://aimlapi.com",
+    hasFree: false,
+    freeNote:
+      "Free tier paused (2026) — AI/ML API is now pay-as-you-go only (min $20 top-up); no recurring free credits.",
+    passthroughModels: true,
+  },
+  novita: {
+    id: "novita",
+    alias: "novita",
+    name: "Novita AI",
+    icon: "auto_awesome",
+    color: "#FF4081",
+    textIcon: "NV",
+    website: "https://novita.ai",
+    hasFree: true,
+    freeNote: "$0.50 trial credits on signup (valid about 1 year)",
+    passthroughModels: true,
+  },
+  piapi: {
+    id: "piapi",
+    alias: "pi",
+    name: "PiAPI",
+    icon: "api",
+    color: "#7C4DFF",
+    textIcon: "PI",
+    website: "https://piapi.ai",
+    passthroughModels: true,
+  },
+  getgoapi: {
+    id: "getgoapi",
+    alias: "ggo",
+    name: "GoAPI",
+    icon: "rocket_launch",
+    color: "#FF6D00",
+    textIcon: "GO",
+    website: "https://api.getgoapi.com",
+    passthroughModels: true,
+  },
+  laozhang: {
+    id: "laozhang",
+    alias: "lz",
+    name: "LaoZhang AI",
+    icon: "hub",
+    color: "#FF1744",
+    textIcon: "LZ",
+    website: "https://api.laozhang.ai",
+    passthroughModels: true,
+  },
+  glhf: {
+    id: "glhf",
+    alias: "glhf",
+    name: "GLHF Chat",
+    icon: "hub",
+    color: "#10B981",
+    textIcon: "GH",
+    website: "https://glhf.chat",
+    authHint: "Bearer API key for the GLHF OpenAI-compatible gateway.",
+    hasFree: false,
+    freeNote: "Discontinued 2026 — glhf.chat free beta ended; no free tier.",
+    passthroughModels: true,
+    subscriptionRisk: true,
+    riskNoticeVariant: "deprecated",
+    deprecated: true,
+    deprecationReason:
+      "glhf.chat shut down (2026); its api.laf.run gateway no longer serves the catalog (sweep 2026-06-19).",
+  },
+  cablyai: {
+    id: "cablyai",
+    alias: "cablyai",
+    name: "CablyAI",
+    icon: "hub",
+    color: "#FF4081",
+    textIcon: "CA",
+    website: "https://cablyai.com",
+    authHint: "Bearer API key for the CablyAI OpenAI-compatible gateway.",
+    passthroughModels: true,
+  },
+  thebai: {
+    id: "thebai",
+    alias: "thebai",
+    name: "TheB.AI",
+    icon: "hub",
+    color: "#3B82F6",
+    textIcon: "TB",
+    website: "https://theb.ai",
+    authHint: "Bearer API key for the TheB.AI OpenAI-compatible gateway.",
+    passthroughModels: true,
+  },
+  fenayai: {
+    id: "fenayai",
+    alias: "fenayai",
+    name: "FenayAI",
+    icon: "hub",
+    color: "#FF9800",
+    textIcon: "FN",
+    website: "https://fenayai.com",
+    authHint: "Bearer API key for the FenayAI OpenAI-compatible gateway.",
+    passthroughModels: true,
+  },
+  empower: {
+    id: "empower",
+    alias: "empower",
+    name: "Empower",
+    icon: "hub",
+    color: "#14B8A6",
+    textIcon: "EM",
+    website: "https://docs.empower.dev",
+    authHint: "Bearer API key for the Empower OpenAI-compatible endpoint.",
+    apiHint:
+      "Empower exposes OpenAI-compatible chat on https://app.empower.dev/api/v1 with tool-calling support on empower-functions.",
+    passthroughModels: true,
+  },
+  poe: {
+    id: "poe",
+    alias: "poe",
+    name: "Poe",
+    icon: "hub",
+    color: "#F97316",
+    textIcon: "PO",
+    website: "https://creator.poe.com/api-reference",
+    authHint: "Bearer API key for the Poe OpenAI-compatible API.",
+    apiHint:
+      "Poe exposes OpenAI-compatible chat and responses on https://api.poe.com/v1, with authenticated balance checks on /usage/current_balance.",
+    passthroughModels: true,
+  },
+  chutes: {
+    id: "chutes",
+    alias: "chutes",
+    name: "Chutes.ai",
+    icon: "hub",
+    color: "#06B6D4",
+    textIcon: "CH",
+    website: "https://chutes.ai",
+    hasFree: false,
+    freeNote:
+      "No free tier as of 2026 — Chutes moved to pay-as-you-go (free Early Access ended 2026-03).",
+    authHint: "Bearer API key for the Chutes OpenAI-compatible gateway.",
+    passthroughModels: true,
+  },
+  bluesminds: {
+    id: "bluesminds",
+    alias: "bm",
+    name: "BluesMinds",
+    icon: "psychology",
+    color: "#3B82F6",
+    textIcon: "BM",
+    website: "https://www.bluesminds.com",
+    hasFree: true,
+    freeNote:
+      "Free daily pi credits — supports 200+ models including GPT-4o, GPT-4.1, Claude Sonnet 4.5, Gemini 2.0 Flash, DeepSeek V4, Qwen, Kimi K2",
+    apiHint:
+      "Get your API key at https://www.bluesminds.com — OpenAI-compatible endpoint at https://api.bluesminds.com/v1 with free daily credits. VIP models (Claude Opus 4.5, Gemini 2.5 Pro) consume pi credits.",
+  },
+  "freemodel-dev": {
+    id: "freemodel-dev",
+    alias: "fmd",
+    name: "FreeModel.dev",
+    icon: "auto_awesome",
+    color: "#8B5CF6",
+    textIcon: "FM",
+    website: "https://freemodel.dev",
+    hasFree: true,
+    freeNote:
+      "$300 free credits on signup — no credit card required. Access GPT-5.4 and GPT-5.5 (OpenAI's latest flagship models) through an OpenAI-compatible API.",
+    apiHint:
+      "Get $300 free API credits at https://freemodel.dev — no payment info required. OpenAI-compatible endpoint. GPT-5.4 and GPT-5.5 models available.",
+  },
+  freeaiapikey: {
+    id: "freeaiapikey",
+    alias: "faik",
+    name: "FreeAIAPIKey",
+    icon: "vpn_key",
+    color: "#F59E0B",
+    textIcon: "FK",
+    website: "https://freeaiapikey.com",
+    apiHint:
+      "Discounted API proxy for 40+ models including GPT-5, Claude Opus 4.6, Claude Sonnet 4.6, Qwen 3.5. Get your API key at https://freeaiapikey.com/dashboard. Base URL: https://freeaiapikey.com/v1.",
+  },
+  zenmux: {
+    id: "zenmux",
+    alias: "zm",
+    name: "ZenMux",
+    icon: "neurology",
+    color: "#7C3AED",
+    textIcon: "ZM",
+    website: "https://zenmux.ai",
+    hasFree: true,
+    freeNote:
+      "Free tier includes access to Gemini 3 Flash, DeepSeek V3.2, Grok 4.1 Fast, Mistral Large, and more. Get your API key at https://zenmux.ai.",
+    authHint:
+      "Use your ZenMux API key in Authorization: Bearer <key>. ZenMux is fully OpenAI-compatible. Base URL: https://zenmux.ai/api/v1.",
+    apiHint:
+      "ZenMux exposes an OpenAI-compatible chat completions endpoint at /api/v1/chat/completions, plus Anthropic Messages (/api/anthropic/v1/messages) and Google Gemini (/api/vertex-ai) protocol surfaces. OmniRoute uses the OpenAI protocol.",
+  },
+  openadapter: {
+    id: "openadapter",
+    alias: "oad",
+    name: "OpenAdapter",
+    icon: "hub",
+    color: "#10B981",
+    textIcon: "OD",
+    website: "https://openadapter.dev",
+    hasFree: true,
+    freeNote:
+      "Free tier with a generous quota and no credit card — 15+ open-source models with daily quota. Get your API key at https://dashboard.openadapter.in.",
+    authHint:
+      "Use your OpenAdapter API key in Authorization: Bearer sk-cv-<key>. Fully OpenAI-compatible. API base URL: https://api.openadapter.in/v1.",
+    apiHint:
+      "OpenAdapter exposes an OpenAI-compatible chat completions endpoint at https://api.openadapter.in/v1/chat/completions, aggregating 70+ open-source models (DeepSeek, Qwen, Kimi, MiniMax, GLM, Llama, Mistral, …). OmniRoute uses the OpenAI protocol.",
+  },
+  dit: {
+    id: "dit",
+    alias: "dai",
+    name: "DIT.ai",
+    icon: "hub",
+    color: "#0EA5E9",
+    textIcon: "DT",
+    website: "https://dit.ai",
+    authHint:
+      "Use your dit.ai API key in Authorization: Bearer <key>. Fully OpenAI-compatible — a drop-in replacement, just change the base URL to https://api.dit.ai/v1.",
+    apiHint:
+      "dit.ai (Distributed Intelligence Trade) is an OpenAI-compatible router/gateway with dynamic per-request pricing, exposing /v1/chat/completions at https://api.dit.ai/v1. OmniRoute uses the OpenAI protocol; spend/savings analytics live in the dit.ai dashboard.",
+  },
+  tokenrouter: {
+    id: "tokenrouter",
+    alias: "trk",
+    name: "TokenRouter",
+    icon: "hub",
+    color: "#F59E0B",
+    textIcon: "TK",
+    website: "https://tokenrouter.com",
+    hasFree: true,
+    freeNote:
+      "Free tier includes the MiniMax 3 model. Get your API key at https://tokenrouter.com.",
+    authHint:
+      "Use your TokenRouter API key in Authorization: Bearer <key>. Fully OpenAI-compatible. API base URL: https://api.tokenrouter.com/v1.",
+    apiHint:
+      "TokenRouter exposes an OpenAI-compatible chat completions endpoint at https://api.tokenrouter.com/v1/chat/completions, plus a working /v1/models catalog. OmniRoute uses the OpenAI protocol.",
+  },
+};
diff --git a/src/shared/constants/providers/apikey/index.ts b/src/shared/constants/providers/apikey/index.ts
new file mode 100644
index 0000000000..fa8ed1f02a
--- /dev/null
+++ b/src/shared/constants/providers/apikey/index.ts
@@ -0,0 +1,21 @@
+/**
+ * APIKEY provider catalog barrel — merges the semantic family files into one object
+ * (god-file decomposition). Pure data; spread preserves every entry. Keys are now grouped
+ * by provider family (was historical-accretion order); lookups are by-key so this is a
+ * cosmetic-only iteration-order change (e.g. the dashboard blocked-providers grid).
+ */
+import { APIKEY_PROVIDERS_GATEWAYS } from "./gateways";
+import { APIKEY_PROVIDERS_FRONTIER } from "./frontier-labs";
+import { APIKEY_PROVIDERS_INFERENCE } from "./inference-hosts";
+import { APIKEY_PROVIDERS_ENTERPRISE } from "./enterprise-cloud";
+import { APIKEY_PROVIDERS_REGIONAL } from "./regional";
+import { APIKEY_PROVIDERS_SPECIALTY } from "./specialty-media";
+
+export const APIKEY_PROVIDERS = {
+  ...APIKEY_PROVIDERS_GATEWAYS,
+  ...APIKEY_PROVIDERS_FRONTIER,
+  ...APIKEY_PROVIDERS_INFERENCE,
+  ...APIKEY_PROVIDERS_ENTERPRISE,
+  ...APIKEY_PROVIDERS_REGIONAL,
+  ...APIKEY_PROVIDERS_SPECIALTY,
+};
diff --git a/src/shared/constants/providers/apikey/inference-hosts.ts b/src/shared/constants/providers/apikey/inference-hosts.ts
new file mode 100644
index 0000000000..fa6c7b30db
--- /dev/null
+++ b/src/shared/constants/providers/apikey/inference-hosts.ts
@@ -0,0 +1,294 @@
+/**
+ * APIKEY provider catalog — inference-hosts family (serverless GPU / OSS-model inference hosts).
+ * Pure data; merged by apikey/index.ts via spread (god-file decomposition; semantic split).
+ */
+export const APIKEY_PROVIDERS_INFERENCE = {
+  together: {
+    id: "together",
+    alias: "together",
+    name: "Together AI",
+    icon: "group_work",
+    color: "#0F6FFF",
+    textIcon: "TG",
+    website: "https://www.together.ai",
+    hasFree: true,
+    freeNote:
+      "$25 signup credits + 3 permanently free models: Llama 3.3 70B, Vision, DeepSeek-R1 distill",
+  },
+  fireworks: {
+    id: "fireworks",
+    alias: "fireworks",
+    name: "Fireworks AI",
+    icon: "local_fire_department",
+    color: "#7B2EF2",
+    textIcon: "FW",
+    website: "https://fireworks.ai",
+    hasFree: true,
+    freeNote: "$1 free starter credits on signup for API testing",
+  },
+  cerebras: {
+    id: "cerebras",
+    alias: "cerebras",
+    name: "Cerebras",
+    icon: "memory",
+    color: "#FF4F00",
+    textIcon: "CB",
+    website: "https://inference.cerebras.ai",
+    hasFree: true,
+    freeNote: "Free Trial: 1M tokens/day, 30K TPM, 5 RPM — no credit card.",
+  },
+  nvidia: {
+    id: "nvidia",
+    alias: "nvidia",
+    name: "NVIDIA NIM",
+    icon: "developer_board",
+    color: "#76B900",
+    textIcon: "NV",
+    website: "https://build.nvidia.com",
+    hasFree: true,
+    freeNote: "Free dev access: ~40 RPM, 70+ models (Kimi K2.5, GLM 4.7, DeepSeek V3.2...)",
+  },
+  nebius: {
+    id: "nebius",
+    alias: "nebius",
+    name: "Nebius AI",
+    icon: "cloud",
+    color: "#6C5CE7",
+    textIcon: "NB",
+    website: "https://nebius.com",
+    hasFree: true,
+    freeNote: "~$1 trial credits on signup for API testing",
+  },
+  siliconflow: {
+    id: "siliconflow",
+    alias: "siliconflow",
+    name: "SiliconFlow",
+    icon: "cloud_queue",
+    color: "#5B6EF5",
+    textIcon: "SF",
+    website: "https://cloud.siliconflow.com",
+    hasFree: true,
+    freeNote: "$1 free credits plus permanently free models after identity verification",
+  },
+  hyperbolic: {
+    id: "hyperbolic",
+    alias: "hyp",
+    name: "Hyperbolic",
+    icon: "bolt",
+    color: "#00D4FF",
+    textIcon: "HY",
+    website: "https://hyperbolic.xyz",
+    hasFree: true,
+    freeNote: "$1-5 trial credits on signup for serverless inference",
+  },
+  "ollama-cloud": {
+    id: "ollama-cloud",
+    alias: "ollamacloud",
+    name: "Ollama Cloud",
+    icon: "cloud",
+    color: "#58A6FF",
+    textIcon: "OC",
+    website: "https://ollama.com/settings/api-keys",
+    hasFree: true,
+  },
+  huggingface: {
+    id: "huggingface",
+    alias: "hf",
+    name: "HuggingFace",
+    icon: "face",
+    color: "#FFD21E",
+    textIcon: "HF",
+    website: "https://huggingface.co",
+    hasFree: true,
+    freeNote: "Free Inference API for thousands of models (Whisper, VITS, SDXL…)",
+  },
+  "github-models": {
+    id: "github-models",
+    alias: "ghm",
+    name: "GitHub Models",
+    icon: "code",
+    color: "#238636",
+    textIcon: "GH",
+    website: "https://github.com/marketplace/models",
+    hasFree: true,
+    freeNote: "Free GPT-5, o-series, DeepSeek-R1, Llama 4, Grok 3 — GitHub account only.",
+    authHint: "Create a GitHub PAT with 'models: read' scope at github.com/settings/tokens",
+  },
+  deepinfra: {
+    id: "deepinfra",
+    alias: "deepinfra",
+    name: "DeepInfra",
+    icon: "hub",
+    color: "#2563EB",
+    textIcon: "DI",
+    website: "https://deepinfra.com",
+    hasFree: true,
+    freeNote: "Free signup credits for API testing and model exploration",
+  },
+  "lambda-ai": {
+    id: "lambda-ai",
+    alias: "lambda",
+    name: "Lambda AI",
+    icon: "bolt",
+    color: "#7C3AED",
+    textIcon: "LA",
+    website: "https://lambda.ai",
+  },
+  sambanova: {
+    id: "sambanova",
+    alias: "samba",
+    name: "SambaNova",
+    icon: "memory",
+    color: "#DC2626",
+    textIcon: "SN",
+    website: "https://sambanova.ai",
+    hasFree: true,
+    freeNote: "$5 free credits on signup (30-day validity), no credit card required",
+  },
+  nscale: {
+    id: "nscale",
+    alias: "nscale",
+    name: "nScale",
+    icon: "token",
+    color: "#0891B2",
+    textIcon: "NS",
+    website: "https://nscale.com",
+    hasFree: true,
+    freeNote: "$5 free credits on signup for inference testing",
+  },
+  baseten: {
+    id: "baseten",
+    alias: "baseten",
+    name: "Baseten",
+    icon: "deployed_code",
+    color: "#111827",
+    textIcon: "BT",
+    website: "https://baseten.co",
+    hasFree: true,
+    freeNote: "$30 free trial credits for GPU inference",
+  },
+  publicai: {
+    id: "publicai",
+    alias: "publicai",
+    name: "PublicAI",
+    icon: "public",
+    color: "#059669",
+    textIcon: "PA",
+    website: "https://publicai.co",
+    // #3558: PublicAI requires an API key (registry authType:"apikey"); signup grants a
+    // one-time credit, then it bills per-model. It is NOT a keyless/free tier.
+    hasFree: false,
+    freeNote: "Requires an API key — one-time signup credit, then paid",
+  },
+  "featherless-ai": {
+    id: "featherless-ai",
+    alias: "featherless",
+    name: "Featherless AI",
+    icon: "flutter_dash",
+    color: "#EA580C",
+    textIcon: "FL",
+    website: "https://featherless.ai",
+    hasFree: true,
+    freeNote: "Free tier available — no credit card required",
+  },
+  friendliai: {
+    id: "friendliai",
+    alias: "friendli",
+    name: "FriendliAI",
+    icon: "handshake",
+    color: "#EC4899",
+    textIcon: "FR",
+    website: "https://friendli.ai",
+    hasFree: true,
+    freeNote: "Free tier for serverless inference — no credit card required",
+  },
+  wandb: {
+    id: "wandb",
+    alias: "wandb",
+    name: "Weights & Biases Inference",
+    icon: "monitoring",
+    color: "#FFBE0B",
+    textIcon: "WB",
+    website: "https://wandb.ai",
+  },
+  "inference-net": {
+    id: "inference-net",
+    alias: "inet",
+    name: "Inference.net",
+    icon: "dns",
+    color: "#2563EB",
+    textIcon: "IN",
+    website: "https://inference.net",
+    hasFree: true,
+    freeNote: "$25 free credits on signup plus research grants available",
+  },
+  predibase: {
+    id: "predibase",
+    alias: "predibase",
+    name: "Predibase",
+    icon: "deployed_code_history",
+    color: "#0F766E",
+    textIcon: "PB",
+    website: "https://predibase.com",
+    hasFree: false,
+    freeNote: "$25 free trial credits (30-day validity)",
+    subscriptionRisk: true,
+    riskNoticeVariant: "deprecated",
+    deprecated: true,
+    deprecationReason:
+      "serving.app.predibase.com no longer resolves (sweep 2026-06-19); the managed serving API appears discontinued.",
+  },
+  bytez: {
+    id: "bytez",
+    alias: "bytez",
+    name: "Bytez",
+    icon: "api",
+    color: "#6366F1",
+    textIcon: "BZ",
+    website: "https://bytez.com",
+    hasFree: true,
+    freeNote: "$1 free credits, refreshes every 4 weeks",
+  },
+  huggingchat: {
+    id: "huggingchat",
+    alias: "huggingchat",
+    name: "HuggingChat",
+    icon: "chat",
+    color: "#FFD21E",
+    textIcon: "HC",
+    website: "https://huggingface.co/chat",
+    hasFree: true,
+    freeNote: "Free chat with open models (Llama, Mistral, etc.).",
+    passthroughModels: true,
+    authHint: "No API key required for basic access.",
+  },
+  monsterapi: {
+    id: "monsterapi",
+    alias: "monster",
+    name: "MonsterAPI",
+    icon: "cloud",
+    color: "#EF4444",
+    textIcon: "MA",
+    website: "https://monsterapi.ai",
+    hasFree: true,
+    freeNote:
+      "One-time signup trial credits for decentralized GPU inference (no recurring free plan). No credit card required.",
+    passthroughModels: true,
+    authHint: "Get API key at monsterapi.ai",
+  },
+  byteplus: {
+    id: "byteplus",
+    alias: "bpm",
+    name: "BytePlus ModelArk",
+    icon: "cloud",
+    color: "#2563EB",
+    textIcon: "BP",
+    website: "https://console.byteplus.com/ark",
+    hasFree: true,
+    notice: {
+      text: "Free credits for new accounts. Seed 2.0, Kimi K2 Thinking, GLM 4.7, GPT-OSS-120B available.",
+      apiKeyUrl: "https://console.byteplus.com/ark/region:ark+ap-southeast-1/apiKey",
+    },
+    serviceKinds: ["llm"],
+  },
+};
diff --git a/src/shared/constants/providers/apikey/regional.ts b/src/shared/constants/providers/apikey/regional.ts
new file mode 100644
index 0000000000..8e6f8f55e5
--- /dev/null
+++ b/src/shared/constants/providers/apikey/regional.ts
@@ -0,0 +1,343 @@
+/**
+ * APIKEY provider catalog — regional family (China + other regional providers).
+ * Pure data; merged by apikey/index.ts via spread (god-file decomposition; semantic split).
+ */
+export const APIKEY_PROVIDERS_REGIONAL = {
+  qianfan: {
+    id: "qianfan",
+    alias: "qianfan",
+    name: "Baidu Qianfan",
+    icon: "cloud",
+    color: "#2468F2",
+    textIcon: "BD",
+    website: "https://cloud.baidu.com/product/wenxinworkshop",
+    apiHint:
+      "Use a Qianfan API key from Baidu AI Cloud. The default endpoint is OpenAI-compatible v2.",
+  },
+  glm: {
+    id: "glm",
+    alias: "glm",
+    name: "GLM Coding",
+    icon: "code",
+    color: "#2563EB",
+    textIcon: "GL",
+    website: "https://z.ai/subscribe",
+  },
+  "glm-cn": {
+    id: "glm-cn",
+    alias: "glmcn",
+    name: "GLM Coding (China)",
+    icon: "code",
+    color: "#DC2626",
+    textIcon: "GC",
+    website: "https://open.bigmodel.cn",
+  },
+  glmt: {
+    id: "glmt",
+    alias: "glmt",
+    name: "GLM Thinking",
+    icon: "psychology",
+    color: "#1D4ED8",
+    textIcon: "GT",
+    website: "https://open.bigmodel.cn",
+    apiHint: "Preset GLM profile with higher token budget, thinking enabled, and longer timeout.",
+  },
+  "bailian-coding-plan": {
+    id: "bailian-coding-plan",
+    alias: "bcp",
+    name: "Alibaba Coding Plan",
+    icon: "code",
+    color: "#FF6A00",
+    textIcon: "BCP",
+    website: "https://www.alibabacloud.com/help/en/model-studio/coding-plan",
+  },
+  kimi: {
+    id: "kimi",
+    alias: "kimi",
+    name: "Kimi",
+    icon: "psychology",
+    color: "#1E3A8A",
+    textIcon: "KM",
+    website: "https://platform.moonshot.ai",
+  },
+  "kimi-coding-apikey": {
+    id: "kimi-coding-apikey",
+    alias: "kmca",
+    name: "Kimi Coding (API Key)",
+    icon: "psychology",
+    color: "#1E40AF",
+    textIcon: "KC",
+    website: "https://www.kimi.com/code",
+  },
+  minimax: {
+    id: "minimax",
+    alias: "minimax",
+    name: "Minimax Coding",
+    icon: "memory",
+    color: "#7C3AED",
+    textIcon: "MM",
+    website: "https://www.minimax.io",
+  },
+  "minimax-cn": {
+    id: "minimax-cn",
+    alias: "minimax-cn",
+    name: "Minimax (China)",
+    icon: "memory",
+    color: "#DC2626",
+    textIcon: "MC",
+    website: "https://www.minimaxi.com",
+  },
+  deepseek: {
+    id: "deepseek",
+    alias: "ds",
+    name: "DeepSeek",
+    icon: "bolt",
+    color: "#4D6BFE",
+    textIcon: "DS",
+    website: "https://platform.deepseek.com",
+    hasFree: true,
+    freeNote: "5M free tokens on signup - no credit card required",
+  },
+  zai: {
+    id: "zai",
+    alias: "zai",
+    name: "Z.AI",
+    icon: "psychology",
+    color: "#2563EB",
+    textIcon: "ZA",
+    website: "https://open.bigmodel.cn",
+    apiHint: "API key from https://open.bigmodel.cn/usercenter/apikeys",
+  },
+  alibaba: {
+    id: "alibaba",
+    alias: "ali",
+    name: "Alibaba",
+    icon: "cloud_queue",
+    color: "#FF6600",
+    textIcon: "AL",
+    website: "https://dashscope-intl.aliyuncs.com",
+    hasFree: false,
+  },
+  "alibaba-cn": {
+    id: "alibaba-cn",
+    alias: "ali-cn",
+    name: "Alibaba (China)",
+    icon: "cloud_queue",
+    color: "#FF6600",
+    textIcon: "AL",
+    website: "https://dashscope.aliyuncs.com",
+    hasFree: false,
+  },
+  longcat: {
+    id: "longcat",
+    alias: "lc",
+    name: "LongCat AI",
+    icon: "auto_awesome",
+    color: "#FF6B9D",
+    textIcon: "LC",
+    website: "https://longcat.chat/platform/docs",
+    hasFree: true,
+    freeNote:
+      "Free: 5M tokens/day on LongCat-2.0-Preview (Flash models retired 2026-05-29); up to 120M/day via feedback.",
+  },
+  moonshot: {
+    id: "moonshot",
+    alias: "moonshot",
+    name: "Moonshot AI",
+    icon: "rocket_launch",
+    color: "#1E40AF",
+    textIcon: "MS",
+    website: "https://platform.moonshot.ai",
+  },
+  volcengine: {
+    id: "volcengine",
+    alias: "volcengine",
+    name: "Volcengine",
+    icon: "local_fire_department",
+    color: "#DC2626",
+    textIcon: "VE",
+    website: "https://www.volcengine.com",
+  },
+  gigachat: {
+    id: "gigachat",
+    alias: "gigachat",
+    name: "GigaChat (Sber)",
+    icon: "lock_person",
+    color: "#10B981",
+    textIcon: "GC",
+    website: "https://developers.sber.ru",
+  },
+  "xiaomi-mimo": {
+    id: "xiaomi-mimo",
+    alias: "mimo",
+    name: "Xiaomi MiMo",
+    icon: "devices",
+    color: "#EA580C",
+    textIcon: "MM",
+    website: "https://mimo.mi.com",
+  },
+  baidu: {
+    id: "baidu",
+    alias: "baidu",
+    name: "Baidu (ERNIE)",
+    icon: "auto_awesome",
+    color: "#2932E1",
+    textIcon: "BD",
+    website: "https://yiyan.baidu.com",
+    hasFree: true,
+    freeNote: "Free ERNIE Speed/Lite models. China's #2 LLM.",
+    passthroughModels: true,
+    authHint: "Get API key at console.bce.baidu.com",
+  },
+  tencent: {
+    id: "tencent",
+    alias: "tencent",
+    name: "Tencent Hunyuan",
+    icon: "auto_awesome",
+    color: "#07C160",
+    textIcon: "TC",
+    website: "https://hunyuan.tencent.com",
+    hasFree: true,
+    freeNote: "Free Hunyuan Lite models. WeChat ecosystem.",
+    passthroughModels: true,
+    authHint: "Get API key at console.cloud.tencent.com",
+  },
+  iflytek: {
+    id: "iflytek",
+    alias: "iflytek",
+    name: "iFlytek Spark",
+    icon: "auto_awesome",
+    color: "#0066FF",
+    textIcon: "IF",
+    website: "https://xinghuo.xfyun.cn",
+    hasFree: true,
+    freeNote:
+      "Spark Lite is free (2 QPS rate-limited), but iFlytek ToS §2.4(3) prohibits programmatic extraction and requires Chinese real-name auth — use with caution.",
+    passthroughModels: true,
+    authHint: "Get API key at console.xfyun.cn",
+  },
+  baichuan: {
+    id: "baichuan",
+    alias: "baichuan",
+    name: "Baichuan",
+    icon: "auto_awesome",
+    color: "#6366F1",
+    textIcon: "BC",
+    website: "https://baichuan.com",
+    hasFree: true,
+    freeNote: "Free Baichuan models. Popular Chinese LLM startup.",
+    passthroughModels: true,
+    authHint: "Get API key at platform.baichuan-ai.com",
+  },
+  yi: {
+    id: "yi",
+    alias: "yi",
+    name: "Yi (01.AI)",
+    icon: "auto_awesome",
+    color: "#10B981",
+    textIcon: "YI",
+    website: "https://01.ai",
+    hasFree: false,
+    freeNote:
+      "No free API tier (2026) — Yi-Light retired; platform.01.ai is pay-as-you-go (Yi-Lightning paid). Open weights are download-only.",
+    passthroughModels: true,
+    authHint: "Get API key at platform.lingyiwanwu.com",
+  },
+  stepfun: {
+    id: "stepfun",
+    alias: "stepfun",
+    name: "StepFun",
+    icon: "auto_awesome",
+    color: "#8B5CF6",
+    textIcon: "SF",
+    website: "https://stepfun.com",
+    hasFree: true,
+    freeNote: "Free Step-2 models. Chinese AI company.",
+    passthroughModels: true,
+    authHint: "Get API key at platform.stepfun.com",
+  },
+  coze: {
+    id: "coze",
+    alias: "coze",
+    name: "Coze",
+    icon: "smart_toy",
+    color: "#3B82F6",
+    textIcon: "CZ",
+    website: "https://coze.com",
+    hasFree: true,
+    freeNote: "Free ByteDance agent platform. Bot building + LLM access.",
+    passthroughModels: true,
+    authHint: "Get API key at coze.com/open/api",
+  },
+  "360ai": {
+    id: "360ai",
+    alias: "360ai",
+    name: "360 AI",
+    icon: "auto_awesome",
+    color: "#00B96B",
+    textIcon: "360",
+    website: "https://ai.360.cn",
+    hasFree: true,
+    freeNote: "Free 360 AI Brain models. Major Chinese security company.",
+    passthroughModels: true,
+    authHint: "Get API key at ai.360.cn",
+  },
+  doubao: {
+    id: "doubao",
+    alias: "doubao",
+    name: "Doubao",
+    icon: "auto_awesome",
+    color: "#FE2C55",
+    textIcon: "DB",
+    website: "https://doubao.com",
+    hasFree: true,
+    freeNote: "Free Doubao models. ByteDance's chatbot.",
+    passthroughModels: true,
+    authHint: "Get API key at console.volcengine.com",
+  },
+  sensenova: {
+    id: "sensenova",
+    alias: "sensenova",
+    name: "SenseNova",
+    icon: "auto_awesome",
+    color: "#0066FF",
+    textIcon: "SN",
+    website: "https://platform.sensenova.cn",
+    hasFree: true,
+    freeNote: "Free SenseTime models. Computer vision leader.",
+    passthroughModels: true,
+    authHint: "Get API key at platform.sensenova.cn",
+  },
+  sparkdesk: {
+    id: "sparkdesk",
+    alias: "sparkdesk",
+    name: "SparkDesk",
+    icon: "auto_awesome",
+    color: "#0066FF",
+    textIcon: "SD",
+    website: "https://xinghuo.xfyun.cn",
+    hasFree: true,
+    freeNote:
+      "Spark Lite free (alias for iflytek), but ToS restricts to personal/non-commercial use and prohibits relaying access to third parties — use with caution.",
+    passthroughModels: true,
+    authHint: "Get API key at console.xfyun.cn",
+  },
+  inclusionai: {
+    id: "inclusionai",
+    alias: "inclusion",
+    name: "InclusionAI",
+    icon: "psychology",
+    color: "#10B981",
+    textIcon: "IA",
+    website: "https://inclusionai.com",
+    hasFree: true,
+    freeNote: "Free Ling-2.6-flash model (1T-param MoE, 262K context). No credit card required.",
+    passthroughModels: true,
+    authHint: "Get API key at inclusionai.com",
+    subscriptionRisk: true,
+    riskNoticeVariant: "deprecated",
+    deprecated: true,
+    deprecationReason:
+      "api.inclusionai.tech no longer resolves (sweep 2026-06-19); the inference API appears discontinued.",
+  },
+};
diff --git a/src/shared/constants/providers/apikey/specialty-media.ts b/src/shared/constants/providers/apikey/specialty-media.ts
new file mode 100644
index 0000000000..c72bf69454
--- /dev/null
+++ b/src/shared/constants/providers/apikey/specialty-media.ts
@@ -0,0 +1,251 @@
+/**
+ * APIKEY provider catalog — specialty-media family (image / video / audio / embeddings / rerank / reader / coding tools).
+ * Pure data; merged by apikey/index.ts via spread (god-file decomposition; semantic split).
+ */
+export const APIKEY_PROVIDERS_SPECIALTY = {
+  nlpcloud: {
+    id: "nlpcloud",
+    alias: "nlpc",
+    name: "NLP Cloud",
+    icon: "psychology",
+    color: "#2196F3",
+    textIcon: "NLPC",
+    website: "https://docs.nlpcloud.com",
+    authHint:
+      "Use your NLP Cloud API key in Authorization: Token <key>. OmniRoute targets the chatbot endpoint on https://api.nlpcloud.io/v1/gpu/<model>/chatbot by default.",
+    apiHint:
+      "NLP Cloud uses a proprietary chatbot API instead of OpenAI chat/completions. OmniRoute adapts OpenAI messages to input/context/history and exposes a local catalog of supported chatbot models.",
+    hasFree: true,
+    freeNote: "Trial credits for new accounts",
+  },
+  runwayml: {
+    id: "runwayml",
+    alias: "runway",
+    name: "Runway",
+    icon: "movie",
+    color: "#111827",
+    textIcon: "RW",
+    website: "https://docs.dev.runwayml.com",
+    authHint:
+      "Use your Runway API key in Authorization: Bearer <key>. OmniRoute targets the current Runway API at https://api.dev.runwayml.com/v1 and sends the required X-Runway-Version header automatically.",
+    apiHint:
+      "Runway video generation is task-based. OmniRoute submits text-to-video or image-to-video jobs, polls /v1/tasks/{id}, and normalizes the finished video outputs back into the OpenAI-like /v1/videos/generations response.",
+  },
+  kie: {
+    id: "kie",
+    alias: "kie",
+    name: "KIE.AI",
+    icon: "hub",
+    color: "#2563EB",
+    textIcon: "KIE",
+    website: "https://kie.ai",
+  },
+  pollinations: {
+    id: "pollinations",
+    alias: "pol",
+    name: "Pollinations AI",
+    icon: "local_florist",
+    color: "#4CAF50",
+    textIcon: "PO",
+    website: "https://pollinations.ai",
+    hasFree: true,
+    anonymousFallback: true,
+    freeNote:
+      "Free keyless tier: openai, openai-fast, openai-large, qwen-coder, mistral, deepseek, grok, gemini-flash-lite-3.1, perplexity-fast, perplexity-reasoning. Premium models (claude, gemini, midijourney) require a Pollinations API key from enter.pollinations.ai.",
+  },
+  haiper: {
+    id: "haiper",
+    alias: "hp",
+    name: "Haiper",
+    icon: "videocam",
+    color: "#6366F1",
+    textIcon: "HP",
+    website: "https://haiper.ai",
+    authHint: "Get API key at haiper.ai/haiper-api",
+  },
+  leonardo: {
+    id: "leonardo",
+    alias: "leo",
+    name: "Leonardo AI",
+    icon: "palette",
+    color: "#8B5CF6",
+    textIcon: "LE",
+    website: "https://leonardo.ai",
+    authHint: "Get API key at leonardo.ai/developer",
+  },
+  ideogram: {
+    id: "ideogram",
+    alias: "ideo",
+    name: "Ideogram",
+    icon: "image",
+    color: "#EC4899",
+    textIcon: "ID",
+    website: "https://ideogram.ai",
+    authHint: "Get API key at ideogram.ai/docs/api",
+  },
+  suno: {
+    id: "suno",
+    alias: "suno",
+    name: "Suno",
+    icon: "music_note",
+    color: "#F59E0B",
+    textIcon: "SU",
+    website: "https://suno.ai",
+    authHint: "Paste session cookie from suno.ai (Clerk auth)",
+  },
+  udio: {
+    id: "udio",
+    alias: "udio",
+    name: "Udio",
+    icon: "music_note",
+    color: "#10B981",
+    textIcon: "UD",
+    website: "https://udio.com",
+    authHint: "Paste session cookie from udio.com (Supabase auth)",
+  },
+  "v0-vercel": {
+    id: "v0-vercel",
+    alias: "v0",
+    name: "v0 (Vercel)",
+    icon: "code_blocks",
+    color: "#111827",
+    textIcon: "V0",
+    website: "https://v0.dev",
+  },
+  gitlab: {
+    id: "gitlab",
+    alias: "gitlab",
+    name: "GitLab Duo PAT",
+    icon: "hub",
+    color: "#FC6D26",
+    textIcon: "GL",
+    website: "https://docs.gitlab.com/user/duo_agent_platform/code_suggestions/",
+    authHint:
+      "GitLab personal access token for the public Code Suggestions API. Configure a self-hosted base URL when not using gitlab.com.",
+  },
+  "voyage-ai": {
+    id: "voyage-ai",
+    alias: "voyage",
+    name: "Voyage AI",
+    icon: "blur_on",
+    color: "#0F766E",
+    textIcon: "VA",
+    website: "https://www.voyageai.com",
+    authHint: "Bearer API key for Voyage AI embeddings and rerank APIs.",
+    hasFree: true,
+    freeNote: "200M free tokens for embeddings and reranking",
+  },
+  "jina-ai": {
+    id: "jina-ai",
+    alias: "jina",
+    name: "Jina AI",
+    icon: "sort",
+    color: "#2563EB",
+    textIcon: "JA",
+    website: "https://jina.ai",
+    authHint: "Bearer API key for the Jina AI rerank API.",
+    hasFree: true,
+    freeNote: "10M free tokens on signup (non-commercial), no credit card required",
+  },
+  "fal-ai": {
+    id: "fal-ai",
+    alias: "fal",
+    name: "Fal.ai",
+    icon: "image",
+    color: "#2563EB",
+    textIcon: "FL",
+    website: "https://fal.ai",
+  },
+  "stability-ai": {
+    id: "stability-ai",
+    alias: "stability",
+    name: "Stability AI",
+    icon: "image",
+    color: "#8B5CF6",
+    textIcon: "SA",
+    website: "https://stability.ai",
+  },
+  "black-forest-labs": {
+    id: "black-forest-labs",
+    alias: "bfl",
+    name: "Black Forest Labs",
+    icon: "image",
+    color: "#111827",
+    textIcon: "BF",
+    website: "https://blackforestlabs.ai",
+  },
+  recraft: {
+    id: "recraft",
+    alias: "recraft",
+    name: "Recraft",
+    icon: "image",
+    color: "#EC4899",
+    textIcon: "RC",
+    website: "https://recraft.ai",
+  },
+  topaz: {
+    id: "topaz",
+    alias: "topaz",
+    name: "Topaz",
+    icon: "image",
+    color: "#059669",
+    textIcon: "TP",
+    website: "https://topazlabs.com",
+  },
+  dify: {
+    id: "dify",
+    alias: "dify",
+    name: "Dify",
+    icon: "smart_toy",
+    color: "#6366F1",
+    textIcon: "DF",
+    website: "https://dify.ai",
+    hasFree: true,
+    freeNote: "Free open-source AI app builder + RAG platform.",
+    passthroughModels: true,
+    authHint: "Get API key from your Dify instance.",
+  },
+  nomic: {
+    id: "nomic",
+    alias: "nomic",
+    name: "Nomic",
+    icon: "hub",
+    color: "#7C3AED",
+    textIcon: "NM",
+    website: "https://nomic.ai",
+    hasFree: true,
+    freeNote: "Free Nomic Embed API. Open-source embeddings, no credit card required.",
+    passthroughModels: true,
+    authHint: "Get API key at atlas.nomic.ai",
+  },
+  firecrawl: {
+    id: "firecrawl",
+    alias: "fc",
+    name: "Firecrawl",
+    icon: "language",
+    color: "#FB923C",
+    textIcon: "FC",
+    website: "https://firecrawl.dev",
+    hasFree: true,
+    notice: {
+      text: "Free tier: 500 fetches/month, no credit card needed.",
+      apiKeyUrl: "https://firecrawl.dev/app/api-keys",
+    },
+    serviceKinds: ["webFetch"],
+  },
+  "jina-reader": {
+    id: "jina-reader",
+    alias: "jr",
+    name: "Jina Reader",
+    icon: "menu_book",
+    color: "#0EA5E9",
+    textIcon: "JR",
+    website: "https://jina.ai/reader",
+    hasFree: true,
+    notice: {
+      text: "Free tier: 1M fetches/month.",
+      apiKeyUrl: "https://jina.ai/api-dashboard",
+    },
+    serviceKinds: ["webFetch"],
+  },
+};
diff --git a/src/shared/constants/providers/audio.ts b/src/shared/constants/providers/audio.ts
new file mode 100644
index 0000000000..9db4591524
--- /dev/null
+++ b/src/shared/constants/providers/audio.ts
@@ -0,0 +1,71 @@
+/**
+ * Provider catalog data — extracted from providers.ts (god-file decomposition).
+ * Pure data literal; re-exported by the providers.ts barrel. No behavior change.
+ */
+export const AUDIO_ONLY_PROVIDERS = {
+  deepgram: {
+    id: "deepgram",
+    alias: "dg",
+    name: "Deepgram",
+    icon: "mic",
+    color: "#13EF93",
+    textIcon: "DG",
+    website: "https://deepgram.com",
+  },
+  assemblyai: {
+    id: "assemblyai",
+    alias: "aai",
+    name: "AssemblyAI",
+    icon: "record_voice_over",
+    color: "#0062FF",
+    textIcon: "AA",
+    website: "https://assemblyai.com",
+  },
+  elevenlabs: {
+    id: "elevenlabs",
+    alias: "el",
+    name: "ElevenLabs",
+    icon: "record_voice_over",
+    color: "#6C47FF",
+    textIcon: "EL",
+    website: "https://elevenlabs.io",
+  },
+  cartesia: {
+    id: "cartesia",
+    alias: "cartesia",
+    name: "Cartesia",
+    icon: "spatial_audio",
+    color: "#FF4F8B",
+    textIcon: "CA",
+    website: "https://cartesia.ai",
+  },
+  playht: {
+    id: "playht",
+    alias: "playht",
+    name: "PlayHT",
+    icon: "play_circle",
+    color: "#00B4D8",
+    textIcon: "PH",
+    website: "https://play.ht",
+  },
+  inworld: {
+    id: "inworld",
+    alias: "inworld",
+    name: "Inworld",
+    icon: "voice_chat",
+    color: "#7B2EF2",
+    textIcon: "IW",
+    website: "https://inworld.ai",
+  },
+  "aws-polly": {
+    id: "aws-polly",
+    alias: "polly",
+    name: "AWS Polly",
+    icon: "record_voice_over",
+    color: "#FF9900",
+    textIcon: "PL",
+    website: "https://aws.amazon.com/polly/",
+    authHint:
+      "Use AWS Secret Access Key as API key; set providerSpecificData.accessKeyId and optional region.",
+  },
+};
diff --git a/src/shared/constants/providers/cloud-agent.ts b/src/shared/constants/providers/cloud-agent.ts
new file mode 100644
index 0000000000..72bb6ca96c
--- /dev/null
+++ b/src/shared/constants/providers/cloud-agent.ts
@@ -0,0 +1,36 @@
+/**
+ * Provider catalog data — extracted from providers.ts (god-file decomposition).
+ * Pure data literal; re-exported by the providers.ts barrel. No behavior change.
+ */
+export const CLOUD_AGENT_PROVIDERS = {
+  jules: {
+    id: "jules",
+    alias: "jules",
+    name: "Google Jules",
+    icon: "engineering",
+    color: "#4285F4",
+    textIcon: "JL",
+    website: "https://jules.google",
+    authHint: "Jules API key for creating and managing cloud coding tasks.",
+  },
+  devin: {
+    id: "devin",
+    alias: "devin",
+    name: "Devin",
+    icon: "smart_toy",
+    color: "#111827",
+    textIcon: "DV",
+    website: "https://devin.ai",
+    authHint: "Devin API key for cloud agent sessions.",
+  },
+  "codex-cloud": {
+    id: "codex-cloud",
+    alias: "codex-cloud",
+    name: "Codex Cloud",
+    icon: "cloud",
+    color: "#10A37F",
+    textIcon: "CC",
+    website: "https://openai.com/codex",
+    authHint: "OpenAI API key with Codex Cloud task access.",
+  },
+};
diff --git a/src/shared/constants/providers/local.ts b/src/shared/constants/providers/local.ts
new file mode 100644
index 0000000000..1d32bac27e
--- /dev/null
+++ b/src/shared/constants/providers/local.ts
@@ -0,0 +1,149 @@
+/**
+ * Provider catalog data — extracted from providers.ts (god-file decomposition).
+ * Pure data literal; re-exported by the providers.ts barrel. No behavior change.
+ */
+export const LOCAL_PROVIDERS = {
+  "lm-studio": {
+    id: "lm-studio",
+    alias: "lmstudio",
+    name: "LM Studio",
+    icon: "server",
+    color: "#4A148C",
+    textIcon: "LM",
+    website: "https://lmstudio.ai",
+    authHint:
+      "API key optional. Configure the local LM Studio OpenAI-compatible base URL (default: http://localhost:1234/v1).",
+    localDefault: "http://localhost:1234/v1",
+    passthroughModels: true,
+  },
+  vllm: {
+    id: "vllm",
+    alias: "vllm",
+    name: "vLLM",
+    icon: "memory",
+    color: "#0F766E",
+    textIcon: "VL",
+    website: "https://github.com/vllm-project/vllm",
+    authHint:
+      "API key optional. Configure the local vLLM OpenAI-compatible base URL (default: http://localhost:8000/v1).",
+    localDefault: "http://localhost:8000/v1",
+    passthroughModels: true,
+  },
+  lemonade: {
+    id: "lemonade",
+    alias: "lemonade",
+    name: "Lemonade Server",
+    icon: "bolt",
+    color: "#F59E0B",
+    textIcon: "LM",
+    website: "https://lemonade-server.ai",
+    authHint:
+      "API key optional. Configure the local Lemonade OpenAI-compatible base URL (default: http://localhost:13305/api/v1).",
+    localDefault: "http://localhost:13305/api/v1",
+    passthroughModels: true,
+  },
+  llamafile: {
+    id: "llamafile",
+    alias: "llamafile",
+    name: "Llamafile",
+    icon: "article",
+    color: "#EA580C",
+    textIcon: "LF",
+    website: "https://github.com/Mozilla-Ocho/llamafile",
+    authHint:
+      "API key optional. Configure the local Llamafile OpenAI-compatible base URL (default: http://127.0.0.1:8080/v1).",
+    localDefault: "http://127.0.0.1:8080/v1",
+    passthroughModels: true,
+  },
+  "llama-cpp": {
+    id: "llama-cpp",
+    alias: "llamacpp",
+    name: "llama.cpp",
+    icon: "memory",
+    color: "#795548",
+    textIcon: "LC",
+    website: "https://github.com/ggml-org/llama.cpp",
+    authHint:
+      "API key optional (use any value, e.g. sk-no-key-required). Configure the llama-server OpenAI-compatible base URL (default: http://127.0.0.1:8080/v1). Note: if Llamafile is also installed, both default to port 8080 — run only one at a time or override the port.",
+    localDefault: "http://127.0.0.1:8080/v1",
+    passthroughModels: true,
+  },
+  triton: {
+    id: "triton",
+    alias: "triton",
+    name: "NVIDIA Triton",
+    icon: "developer_board",
+    color: "#76B900",
+    textIcon: "TR",
+    website: "https://developer.nvidia.com/triton-inference-server",
+    authHint:
+      "API key optional. Configure the Triton OpenAI-compatible base URL (default: http://localhost:8000/v1).",
+    localDefault: "http://localhost:8000/v1",
+    passthroughModels: true,
+  },
+  "docker-model-runner": {
+    id: "docker-model-runner",
+    alias: "dmr",
+    name: "Docker Model Runner",
+    icon: "inventory_2",
+    color: "#2496ED",
+    textIcon: "DM",
+    website: "https://docs.docker.com/ai/model-runner/",
+    authHint:
+      "API key optional. Configure the local Docker Model Runner OpenAI-compatible base URL (default: http://localhost:12434/v1).",
+    localDefault: "http://localhost:12434/v1",
+    passthroughModels: true,
+  },
+  xinference: {
+    id: "xinference",
+    alias: "xinference",
+    name: "XInference",
+    icon: "hub",
+    color: "#DC2626",
+    textIcon: "XI",
+    website: "https://inference.readthedocs.io",
+    authHint:
+      "API key optional. Configure the local XInference OpenAI-compatible base URL (default: http://localhost:9997/v1).",
+    localDefault: "http://localhost:9997/v1",
+    passthroughModels: true,
+  },
+  oobabooga: {
+    id: "oobabooga",
+    alias: "ooba",
+    name: "oobabooga",
+    icon: "dns",
+    color: "#8B5CF6",
+    textIcon: "OO",
+    website: "https://github.com/oobabooga/text-generation-webui",
+    authHint:
+      "API key optional. Configure the local oobabooga OpenAI-compatible base URL (default: http://localhost:5000/v1).",
+    localDefault: "http://localhost:5000/v1",
+    passthroughModels: true,
+  },
+  sdwebui: {
+    id: "sdwebui",
+    alias: "sdwebui",
+    name: "SD WebUI",
+    icon: "brush",
+    color: "#FF7043",
+    textIcon: "SD",
+    website: "https://github.com/AUTOMATIC1111/stable-diffusion-webui",
+    hasFree: true,
+    authHint:
+      "No API key required. Configure the local WebUI base URL (default: http://localhost:7860).",
+    localDefault: "http://localhost:7860",
+  },
+  comfyui: {
+    id: "comfyui",
+    alias: "comfyui",
+    name: "ComfyUI",
+    icon: "account_tree",
+    color: "#4CAF50",
+    textIcon: "CF",
+    website: "https://github.com/comfyanonymous/ComfyUI",
+    hasFree: true,
+    authHint:
+      "No API key required. Configure the local ComfyUI base URL (default: http://localhost:8188).",
+    localDefault: "http://localhost:8188",
+  },
+};
diff --git a/src/shared/constants/providers/noauth.ts b/src/shared/constants/providers/noauth.ts
new file mode 100644
index 0000000000..1375f6cdc5
--- /dev/null
+++ b/src/shared/constants/providers/noauth.ts
@@ -0,0 +1,103 @@
+/**
+ * Provider catalog data — extracted from providers.ts (god-file decomposition).
+ * Pure data literal; re-exported by the providers.ts barrel. No behavior change.
+ */
+export const NOAUTH_PROVIDERS = {
+  opencode: {
+    id: "opencode",
+    alias: "oc",
+    name: "OpenCode Free",
+    icon: "terminal",
+    color: "#E87040",
+    textIcon: "OC",
+    website: "https://opencode.ai",
+    noAuth: true,
+    hasFree: true,
+    serviceKinds: ["llm"],
+    authHint: "No API key required — uses OpenCode's public free endpoint.",
+    freeNote:
+      "No API key required — public OpenCode endpoint with Kimi, GLM, Qwen, MiMo, MiniMax models.",
+    notice: {
+      text: "OpenCode Free uses the public OpenCode endpoint (https://opencode.ai/zen/v1). No signup or API key needed. Rate limits apply.",
+    },
+  },
+  "duckduckgo-web": {
+    id: "duckduckgo-web",
+    alias: "ddgw",
+    name: "DuckDuckGo AI Chat",
+    icon: "auto_awesome",
+    color: "#DE5833",
+    textIcon: "DDG",
+    website: "https://duckduckgo.com/duckchat",
+    noAuth: true,
+    hasFree: true,
+    serviceKinds: ["llm"],
+    freeNote: "Free — anonymous access to multiple AI models via DuckDuckGo.",
+    authHint: "No credentials required — DuckDuckGo AI Chat is anonymous and free.",
+  },
+  theoldllm: {
+    id: "theoldllm",
+    alias: "tllm",
+    name: "The Old LLM (Free)",
+    icon: "auto_awesome",
+    color: "#8B5CF6",
+    textIcon: "TL",
+    website: "https://theoldllm.vercel.app",
+    noAuth: true,
+    hasFree: true,
+    serviceKinds: ["llm"],
+    freeNote:
+      "Free — GPT-5.4, Claude 4.6 Opus/Sonnet/Haiku, + more. No API key — tokens auto-generated via browser.",
+    authHint:
+      "No credentials required. The executor auto-generates access tokens via an embedded Playwright browser instance.",
+  },
+  chipotle: {
+    id: "chipotle",
+    alias: "pepper",
+    name: "Chipotle Pepper AI (Free)",
+    icon: "restaurant",
+    color: "#C41230",
+    textIcon: "🌯",
+    website: "https://amelia.chipotle.com",
+    noAuth: true,
+    hasFree: true,
+    serviceKinds: ["llm"],
+    freeNote:
+      "Free — Chipotle's Pepper AI (IPsoft Amelia). Anonymous sessions, no API key. Rate-limited.",
+    authHint:
+      "No credentials required. Uses Chipotle's public support chatbot via reverse-engineered SockJS/STOMP protocol.",
+  },
+  "veoaifree-web": {
+    id: "veoaifree-web",
+    alias: "veo-free",
+    name: "Veo AI Free",
+    icon: "videocam",
+    color: "#8B5CF6",
+    textIcon: "VF",
+    website: "https://veoaifree.com",
+    noAuth: true,
+    hasFree: true,
+    serviceKinds: ["video"],
+    freeNote: "Free video generation — VEO 3.1, Seedance. 6 requests/hour.",
+    authHint: "No auth required. Rate limited to 6 requests/hour per IP.",
+  },
+  mimocode: {
+    id: "mimocode",
+    alias: "mcode",
+    name: "MiMoCode (Free)",
+    icon: "devices",
+    color: "#FF6B35",
+    textIcon: "MC",
+    website: "https://mimo.mi.com",
+    noAuth: true,
+    hasFree: true,
+    serviceKinds: ["llm"],
+    freeNote:
+      "Free — Xiaomi MiMo models via bootstrap JWT auth. No API key required. Supports streaming.",
+    authHint:
+      "No API key required. The executor auto-generates JWT tokens via device fingerprint bootstrap.",
+    notice: {
+      text: "MiMoCode uses Xiaomi's public free AI endpoint with bootstrap-based JWT authentication. No signup needed. Rate limits apply.",
+    },
+  },
+};
diff --git a/src/shared/constants/providers/oauth.ts b/src/shared/constants/providers/oauth.ts
new file mode 100644
index 0000000000..e7d16b42d4
--- /dev/null
+++ b/src/shared/constants/providers/oauth.ts
@@ -0,0 +1,215 @@
+/**
+ * Provider catalog data — extracted from providers.ts (god-file decomposition).
+ * Pure data literal; re-exported by the providers.ts barrel. No behavior change.
+ */
+export const OAUTH_PROVIDERS = {
+  qoder: {
+    id: "qoder",
+    alias: "if",
+    name: "Qoder",
+    icon: "water_drop",
+    color: "#6366F1",
+    subscriptionRisk: true,
+    riskNoticeVariant: "oauth",
+    hasFree: true,
+  },
+  qwen: {
+    id: "qwen",
+    alias: "qw",
+    name: "Qwen Code",
+    icon: "psychology",
+    color: "#10B981",
+    subscriptionRisk: true,
+    riskNoticeVariant: "deprecated",
+    deprecated: true,
+    deprecationReason:
+      "Qwen OAuth free tier was discontinued on 2026-04-15. Use 'bailian-coding-plan', 'alibaba', 'alibaba-cn', or 'openrouter' provider with API key instead.",
+  },
+  "gemini-cli": {
+    id: "gemini-cli",
+    alias: "gemini-cli",
+    name: "Gemini CLI",
+    icon: "terminal",
+    color: "#4285F4",
+    subscriptionRisk: true,
+    riskNoticeVariant: "deprecated",
+    hasFree: true,
+    authHint:
+      "Uses Gemini CLI OAuth / Cloud Code credentials. Pro models require an eligible Google account or paid plan.",
+  },
+  agy: {
+    id: "agy",
+    alias: "agy",
+    name: "Antigravity CLI",
+    icon: "terminal",
+    color: "#F59E0B",
+    textIcon: "AGY",
+    website: "https://antigravity.google",
+    subscriptionRisk: true,
+    riskNoticeVariant: "oauth",
+    hasFree: true,
+    authHint:
+      "Import your Antigravity CLI (`agy`) login (paste/upload its token file), auto-detect a local CLI login, or sign in with Google. Shares the Antigravity backend (incl. Claude models).",
+  },
+  kiro: {
+    id: "kiro",
+    alias: "kr",
+    name: "Kiro AI",
+    icon: "psychology_alt",
+    color: "#FF6B35",
+    subscriptionRisk: true,
+    riskNoticeVariant: "deprecated",
+    hasFree: true,
+    freeNote:
+      "Free tier: 50 credits/month (~25K–100K tokens). ⚠️ Kiro ToS prohibits third-party proxy/harness use.",
+  },
+  "amazon-q": {
+    id: "amazon-q",
+    alias: "aq",
+    name: "Amazon Q",
+    icon: "cloud",
+    color: "#FF9900",
+    textIcon: "AQ",
+    website: "https://aws.amazon.com/q/developer/",
+    hasFree: true,
+    authHint:
+      "Uses the same AWS Builder ID or imported refresh-token flow as Kiro, but keeps Amazon Q connections separate.",
+  },
+  claude: {
+    id: "claude",
+    alias: "cc",
+    name: "Claude Code",
+    icon: "smart_toy",
+    color: "#D97757",
+    subscriptionRisk: true,
+    riskNoticeVariant: "oauth",
+  },
+  antigravity: {
+    id: "antigravity",
+    alias: undefined,
+    name: "Antigravity",
+    icon: "rocket_launch",
+    color: "#F59E0B",
+    subscriptionRisk: true,
+    riskNoticeVariant: "oauth",
+  },
+  codex: {
+    id: "codex",
+    alias: "cx",
+    name: "OpenAI Codex",
+    icon: "code",
+    color: "#3B82F6",
+    subscriptionRisk: true,
+    riskNoticeVariant: "oauth",
+  },
+  github: { id: "github", alias: "gh", name: "GitHub Copilot", icon: "code", color: "#333333" },
+  "gitlab-duo": {
+    id: "gitlab-duo",
+    alias: "gitlab-duo",
+    name: "GitLab Duo",
+    icon: "hub",
+    color: "#FC6D26",
+    textIcon: "GL",
+    website: "https://docs.gitlab.com/user/duo_agent_platform/code_suggestions/",
+    authHint:
+      "OAuth application with ai_features + read_user scopes. Configure GITLAB_DUO_OAUTH_CLIENT_ID and optionally GITLAB_DUO_OAUTH_CLIENT_SECRET on this OmniRoute instance.",
+  },
+  cursor: {
+    id: "cursor",
+    alias: "cu",
+    name: "Cursor IDE",
+    icon: "edit_note",
+    color: "#00D4AA",
+    subscriptionRisk: true,
+    riskNoticeVariant: "oauth",
+  },
+  zed: {
+    id: "zed",
+    alias: "zd",
+    name: "Zed IDE",
+    icon: "code",
+    color: "#084CCF",
+    textIcon: "ZD",
+    website: "https://zed.dev",
+    authHint:
+      "Zed stores LLM provider credentials (OpenAI, Anthropic, Google, Mistral, xAI) in the OS keychain. Use the Import button below to discover and import them automatically.",
+  },
+  trae: {
+    id: "trae",
+    alias: "tr",
+    name: "Trae",
+    icon: "edit_square",
+    color: "#FF7849",
+    textIcon: "TR",
+    website: "https://trae.ai",
+    authHint:
+      "Trae is an AI-native IDE by ByteDance (SOLO remote agent). Authorize via trae.ai in the popup, or sign in at solo.trae.ai and paste the Cloud-IDE-JWT (sent as 'Authorization: Cloud-IDE-JWT <token>', ~14-day lifetime) as the access token; web_id/biz_user_id/user_unique_id/scope/tenant/region propagate via providerSpecificData. No headless refresh for pasted tokens — re-paste on expiry.",
+  },
+  "kimi-coding": {
+    id: "kimi-coding",
+    alias: "kmc",
+    name: "Kimi Coding",
+    icon: "psychology",
+    color: "#1E40AF",
+    textIcon: "KC",
+    subscriptionRisk: true,
+    riskNoticeVariant: "oauth",
+  },
+  kilocode: {
+    id: "kilocode",
+    alias: "kc",
+    name: "Kilo Code",
+    icon: "code",
+    color: "#FF6B35",
+    textIcon: "KC",
+    subscriptionRisk: true,
+    riskNoticeVariant: "oauth",
+  },
+  cline: {
+    id: "cline",
+    alias: "cl",
+    name: "Cline",
+    icon: "smart_toy",
+    color: "#5B9BD5",
+    textIcon: "CL",
+    subscriptionRisk: true,
+    riskNoticeVariant: "oauth",
+  },
+  windsurf: {
+    id: "windsurf",
+    alias: "ws",
+    name: "Windsurf (Devin CLI)",
+    icon: "air",
+    color: "#00C5A0",
+    textIcon: "WS",
+    subscriptionRisk: true,
+    riskNoticeVariant: "oauth",
+    authHint:
+      'In the Windsurf / VS Code IDE, open the command palette and run `Windsurf: Provide Auth Token` (or click the Jupyter "Get Windsurf Authentication Token" button), then copy the shown token and paste it here. Note: opening windsurf.com/show-auth-token directly only renders a "Redirecting" page — the IDE must initiate the flow (it adds a `?state=...` param) for the token to appear.',
+    website: "https://windsurf.com",
+  },
+  "devin-cli": {
+    id: "devin-cli",
+    alias: "dv",
+    name: "Devin CLI (Official)",
+    icon: "terminal",
+    color: "#6366F1",
+    textIcon: "DV",
+    authHint:
+      "Requires the Devin CLI binary. Run `devin auth login` to authenticate, or provide your WINDSURF_API_KEY. Install: https://cli.devin.ai",
+    website: "https://cli.devin.ai",
+  },
+  "codebuddy-cn": {
+    id: "codebuddy-cn",
+    alias: "cbcn",
+    name: "CodeBuddy CN",
+    icon: "smart_toy",
+    color: "#006EFF",
+    textIcon: "CB",
+    website: "https://copilot.tencent.com",
+    subscriptionRisk: true,
+    riskNoticeVariant: "oauth",
+    authHint:
+      "Tencent CodeBuddy CN (copilot.tencent.com). Sign in via the official CLI device-code flow, or paste a direct API key (sent as Authorization: Bearer). Catalog: GLM / Kimi / MiniMax / DeepSeek / Hunyuan.",
+  },
+};
diff --git a/src/shared/constants/providers/search.ts b/src/shared/constants/providers/search.ts
new file mode 100644
index 0000000000..fce8fb8c2e
--- /dev/null
+++ b/src/shared/constants/providers/search.ts
@@ -0,0 +1,125 @@
+/**
+ * Provider catalog data — extracted from providers.ts (god-file decomposition).
+ * Pure data literal; re-exported by the providers.ts barrel. No behavior change.
+ */
+export const SEARCH_PROVIDERS = {
+  "perplexity-search": {
+    id: "perplexity-search",
+    alias: "pplx-search",
+    name: "Perplexity Search",
+    icon: "search",
+    color: "#20808D",
+    textIcon: "PS",
+    website: "https://docs.perplexity.ai/guides/search-quickstart",
+    authHint: "Same API key as Perplexity (pplx-...)",
+  },
+  "serper-search": {
+    id: "serper-search",
+    alias: "serper-search",
+    name: "Serper Search",
+    icon: "search",
+    color: "#4285F4",
+    textIcon: "SP",
+    website: "https://serper.dev",
+    hasFree: true,
+    authHint: "API key from serper.dev dashboard",
+    serviceKinds: ["webSearch"],
+  },
+  "brave-search": {
+    id: "brave-search",
+    alias: "brave-search",
+    name: "Brave Search",
+    icon: "travel_explore",
+    color: "#FB542B",
+    textIcon: "BR",
+    website: "https://brave.com/search/api",
+    hasFree: true,
+    authHint: "Subscription token from Brave Search API dashboard",
+  },
+  "exa-search": {
+    id: "exa-search",
+    alias: "exa-search",
+    name: "Exa Search",
+    icon: "neurology",
+    color: "#1E40AF",
+    textIcon: "EX",
+    website: "https://exa.ai",
+    hasFree: true,
+    authHint: "API key from dashboard.exa.ai",
+    serviceKinds: ["webSearch", "webFetch"],
+  },
+  "tavily-search": {
+    id: "tavily-search",
+    alias: "tavily-search",
+    name: "Tavily Search",
+    icon: "manage_search",
+    color: "#5B4FDB",
+    textIcon: "TV",
+    website: "https://tavily.com",
+    hasFree: true,
+    authHint: "API key from app.tavily.com (format: tvly-...)",
+    serviceKinds: ["webSearch", "webFetch"],
+  },
+  "google-pse-search": {
+    id: "google-pse-search",
+    alias: "google-pse",
+    name: "Google Programmable Search",
+    icon: "travel_explore",
+    color: "#4285F4",
+    textIcon: "GP",
+    website: "https://developers.google.com/custom-search/v1/overview",
+    authHint: "Requires a Google API key and your Programmable Search Engine ID (cx)",
+  },
+  "linkup-search": {
+    id: "linkup-search",
+    alias: "linkup",
+    name: "Linkup Search",
+    icon: "public",
+    color: "#0F766E",
+    textIcon: "LU",
+    website: "https://docs.linkup.so",
+    authHint: "Bearer API key from the Linkup dashboard",
+  },
+  "searchapi-search": {
+    id: "searchapi-search",
+    alias: "searchapi",
+    name: "SearchAPI",
+    icon: "manage_search",
+    color: "#2563EB",
+    textIcon: "SA",
+    website: "https://www.searchapi.io/docs",
+    authHint: "API key from SearchAPI (query param or Bearer auth)",
+  },
+  "youcom-search": {
+    id: "youcom-search",
+    alias: "youcom-search",
+    name: "You.com Search",
+    icon: "travel_explore",
+    color: "#2563EB",
+    textIcon: "YOU",
+    website: "https://you.com/docs/search/overview",
+    authHint: "X-API-Key from the You.com platform dashboard",
+  },
+  "searxng-search": {
+    id: "searxng-search",
+    alias: "searxng",
+    name: "SearXNG Search",
+    icon: "search",
+    color: "#1A237E",
+    textIcon: "SX",
+    website: "https://docs.searxng.org",
+    hasFree: true,
+    authHint:
+      "API key is optional. Set your SearXNG base URL. Some instances may require a bearer token for access.",
+  },
+  "ollama-search": {
+    id: "ollama-search",
+    alias: "ollama-search",
+    name: "Ollama Search",
+    icon: "search",
+    color: "#58A6FF",
+    textIcon: "OS",
+    website: "https://ollama.com/settings/api-keys",
+    authHint: "Same API key as Ollama Cloud (from ollama.com/settings/api-keys)",
+  },
+};
diff --git a/src/shared/constants/providers/system.ts b/src/shared/constants/providers/system.ts
new file mode 100644
index 0000000000..0500dc6cfa
--- /dev/null
+++ b/src/shared/constants/providers/system.ts
@@ -0,0 +1,16 @@
+/**
+ * Provider catalog data — extracted from providers.ts (god-file decomposition).
+ * Pure data literal; re-exported by the providers.ts barrel. No behavior change.
+ */
+export const SYSTEM_PROVIDERS = {
+  auto: {
+    id: "auto",
+    alias: "auto",
+    name: "Auto (Zero-Config)",
+    icon: "auto_awesome",
+    color: "#6366F1",
+    textIcon: "Auto",
+    systemOnly: true,
+    description: "Zero-config auto-routing with LKGP across all connected providers",
+  },
+};
diff --git a/src/shared/constants/providers/upstream-proxy.ts b/src/shared/constants/providers/upstream-proxy.ts
new file mode 100644
index 0000000000..691b447624
--- /dev/null
+++ b/src/shared/constants/providers/upstream-proxy.ts
@@ -0,0 +1,36 @@
+/**
+ * Provider catalog data — extracted from providers.ts (god-file decomposition).
+ * Pure data literal; re-exported by the providers.ts barrel. No behavior change.
+ */
+export const UPSTREAM_PROXY_PROVIDERS = {
+  cliproxyapi: {
+    id: "cliproxyapi",
+    alias: "cpa",
+    name: "CLIProxyAPI",
+    icon: "proxy",
+    color: "#6366F1",
+    textIcon: "CPA",
+    website: "https://github.com/router-for-me/CLIProxyAPI",
+    defaultPort: 8317,
+    healthEndpoint: "/v1/models",
+    managementPrefix: "/v0/management",
+    configDir: "~/.cli-proxy-api",
+    binaryName: "cli-proxy-api",
+    githubRepo: "router-for-me/CLIProxyAPI",
+  },
+  "9router": {
+    id: "9router",
+    alias: "nr",
+    name: "9router",
+    icon: "router",
+    color: "#0EA5E9",
+    textIcon: "9R",
+    website: "https://www.npmjs.com/package/9router",
+    defaultPort: 20130,
+    healthEndpoint: "/api/health",
+    npmPackage: "9router",
+    embedded: true,
+    isEmbeddedService: true,
+    riskNoticeVariant: "embedded-service" as const,
+  },
+};
diff --git a/src/shared/constants/providers/web-cookie.ts b/src/shared/constants/providers/web-cookie.ts
new file mode 100644
index 0000000000..1e9ed99eed
--- /dev/null
+++ b/src/shared/constants/providers/web-cookie.ts
@@ -0,0 +1,296 @@
+/**
+ * Provider catalog data — extracted from providers.ts (god-file decomposition).
+ * Pure data literal; re-exported by the providers.ts barrel. No behavior change.
+ */
+export const WEB_COOKIE_PROVIDERS = {
+  "chatgpt-web": {
+    id: "chatgpt-web",
+    alias: "cgpt-web",
+    name: "ChatGPT Web (Plus/Pro)",
+    icon: "auto_awesome",
+    color: "#10A37F",
+    textIcon: "CG",
+    website: "https://chatgpt.com",
+    authHint: "Paste your __Secure-next-auth.session-token cookie value from chatgpt.com",
+    subscriptionRisk: true,
+    riskNoticeVariant: "webCookie",
+  },
+  "grok-web": {
+    id: "grok-web",
+    alias: "gw",
+    name: "Grok Web (Subscription)",
+    icon: "auto_awesome",
+    color: "#1DA1F2",
+    textIcon: "GW",
+    website: "https://grok.com",
+    authHint:
+      "Paste the full grok.com cookie line from DevTools → Application → Cookies. Include both `sso` and `sso-rw` (e.g. `sso=...; sso-rw=...`) — Grok's anti-bot rejects `sso` on its own.",
+    subscriptionRisk: true,
+    riskNoticeVariant: "webCookie",
+  },
+  "gemini-web": {
+    id: "gemini-web",
+    alias: "gweb",
+    name: "Gemini Web (Free)",
+    icon: "auto_awesome",
+    color: "#4285F4",
+    textIcon: "GWeb",
+    website: "https://gemini.google.com",
+    authHint:
+      "Paste your __Secure-1PSID cookie value from gemini.google.com. Optionally add __Secure-1PSIDTS separated by semicolon.",
+    subscriptionRisk: true,
+    riskNoticeVariant: "webCookie",
+  },
+  "perplexity-web": {
+    id: "perplexity-web",
+    alias: "pplx-web",
+    name: "Perplexity Web (Pro/Max)",
+    icon: "search",
+    color: "#20808D",
+    textIcon: "PW",
+    website: "https://www.perplexity.ai",
+    authHint: "Paste your __Secure-next-auth.session-token cookie value from perplexity.ai",
+    subscriptionRisk: true,
+    riskNoticeVariant: "webCookie",
+  },
+  "blackbox-web": {
+    id: "blackbox-web",
+    alias: "bb-web",
+    name: "Blackbox Web (Subscription)",
+    icon: "view_in_ar",
+    color: "#1A1A2E",
+    textIcon: "BW",
+    website: "https://app.blackbox.ai",
+    authHint:
+      "Paste your __Secure-authjs.session-token value or full cookie header from app.blackbox.ai",
+    subscriptionRisk: true,
+    riskNoticeVariant: "webCookie",
+  },
+  "muse-spark-web": {
+    id: "muse-spark-web",
+    alias: "ms-web",
+    name: "Muse Spark Web (Meta AI)",
+    icon: "auto_awesome",
+    color: "#0866FF",
+    textIcon: "MS",
+    website: "https://www.meta.ai",
+    hasFree: true,
+    freeNote: "Free with login — Meta AI platform with Llama models.",
+    authHint: "Paste your abra_sess value or full cookie header from meta.ai",
+  },
+  "claude-web": {
+    id: "claude-web",
+    alias: "cw",
+    name: "Claude Web",
+    icon: "auto_awesome",
+    color: "#D97757",
+    textIcon: "CW",
+    website: "https://claude.ai",
+    authHint: "Paste your session cookie from claude.ai",
+    subscriptionRisk: true,
+    riskNoticeVariant: "webCookie",
+  },
+  "deepseek-web": {
+    id: "deepseek-web",
+    alias: "ds-web",
+    name: "DeepSeek Web",
+    icon: "auto_awesome",
+    color: "#4D6BFE",
+    textIcon: "DS",
+    website: "https://chat.deepseek.com",
+    authHint:
+      "Paste your userToken from chat.deepseek.com — DevTools → Application → Local Storage → userToken",
+    subscriptionRisk: true,
+    riskNoticeVariant: "webCookie",
+  },
+  "copilot-web": {
+    id: "copilot-web",
+    alias: "copilot",
+    name: "Microsoft Copilot Web",
+    icon: "auto_awesome",
+    color: "#0078D4",
+    textIcon: "CP",
+    website: "https://copilot.microsoft.com",
+    authHint:
+      "Paste your access_token from copilot.microsoft.com (or export a .har file from DevTools while logged in)",
+    subscriptionRisk: true,
+    riskNoticeVariant: "webCookie",
+  },
+  "t3-web": {
+    id: "t3-web",
+    alias: "t3chat",
+    name: "t3.chat (Pro/Free)",
+    icon: "auto_awesome",
+    color: "#7C3AED",
+    textIcon: "T3",
+    website: "https://t3.chat",
+    hasFree: true,
+    freeNote: "Free tier gives limited model access. Pro ($8/month) unlocks 50+ models.",
+    authHint:
+      "Open t3.chat in your browser, log in, then open DevTools → Application → Local Storage → https://t3.chat. " +
+      "Copy the value of 'convex-session-id'. Also open DevTools → Network, copy the Cookie header from any request. " +
+      "Paste both values here. See provider setup docs for a step-by-step guide.",
+  },
+  "inner-ai": {
+    id: "inner-ai",
+    alias: "in-ai",
+    name: "Inner.ai (Subscription)",
+    icon: "auto_awesome",
+    color: "#1A56DB",
+    textIcon: "IA",
+    website: "https://app.innerai.com",
+    subscriptionRisk: true,
+    riskNoticeVariant: "webCookie",
+    authHint:
+      "Paste your token cookie and email separated by a space: open DevTools → Application → Cookies → .innerai.com, copy the token value, then append a space and your Inner.ai login email. Example: eyJhbG... user@example.com",
+  },
+  "adapta-web": {
+    id: "adapta-web",
+    alias: "adp-web",
+    name: "Adapta.org (Adapta One Web)",
+    icon: "auto_awesome",
+    color: "#6E3AD3",
+    textIcon: "AW",
+    website: "https://agent.adapta.one",
+    subscriptionRisk: true,
+    riskNoticeVariant: "webCookie",
+    authHint:
+      "Paste your __client cookie value from .clerk.agent.adapta.one (DevTools → Application → Cookies)",
+  },
+  lmarena: {
+    id: "lmarena",
+    alias: "lma",
+    name: "LMArena (Free)",
+    icon: "auto_awesome",
+    color: "#FF6B6B",
+    textIcon: "LMA",
+    website: "https://lmarena.ai",
+    hasFree: true,
+    freeNote:
+      "Free model comparison platform — 40+ models (GPT, Claude, Gemini, Llama). No subscription required.",
+    authHint:
+      "Paste the full Cookie header from lmarena.ai (DevTools → Network → request → Cookie). The session is now split across arena-auth-prod-v1.0, .1, … — copy the whole header. Optional — works with free tier for basic comparisons.",
+    riskNoticeVariant: "webCookie",
+  },
+  huggingchat: {
+    id: "huggingchat",
+    // "hc" belongs to the hackclub provider; huggingchat uses its own id as alias.
+    alias: "huggingchat",
+    name: "HuggingChat (Free)",
+    icon: "auto_awesome",
+    color: "#FFD21E",
+    textIcon: "HC",
+    website: "https://huggingface.co/chat",
+    hasFree: true,
+    freeNote: "Free LLM chat — no subscription required. Rate limits apply.",
+    authHint:
+      "Paste your hf-chat cookie value from huggingface.co/chat (DevTools → Application → Cookies → hf-chat). Optional — works without auth for basic use.",
+    riskNoticeVariant: "webCookie",
+  },
+  phind: {
+    id: "phind",
+    alias: "ph",
+    name: "Phind (Free)",
+    icon: "auto_awesome",
+    color: "#000000",
+    textIcon: "PH",
+    website: "https://www.phind.com",
+    hasFree: false,
+    freeNote: "Discontinued 2026 — phind.com shut down (2026-01); no free tier.",
+    authHint:
+      "Paste your session cookie from phind.com (DevTools → Application → Cookies). Optional — works with free tier.",
+    subscriptionRisk: true,
+    riskNoticeVariant: "deprecated",
+    deprecated: true,
+    deprecationReason:
+      "Phind shut down its API (2026-01); the /api/chat endpoint no longer serves (sweep 2026-06-19).",
+  },
+  "poe-web": {
+    id: "poe-web",
+    alias: "poe",
+    name: "Poe Web (Subscription)",
+    icon: "auto_awesome",
+    color: "#6C3AED",
+    textIcon: "PW",
+    website: "https://poe.com",
+    authHint: "Paste your p-b cookie value from poe.com (DevTools → Application → Cookies → p-b)",
+    subscriptionRisk: true,
+    riskNoticeVariant: "webCookie",
+  },
+  "venice-web": {
+    id: "venice-web",
+    alias: "ven",
+    name: "Venice Web (Privacy)",
+    icon: "auto_awesome",
+    color: "#22C55E",
+    textIcon: "VW",
+    website: "https://venice.ai",
+    authHint: "Paste your session cookie from venice.ai (DevTools → Application → Cookies)",
+    riskNoticeVariant: "webCookie",
+  },
+  "v0-vercel-web": {
+    id: "v0-vercel-web",
+    alias: "v0",
+    name: "v0 Vercel Web (Code Gen)",
+    icon: "auto_awesome",
+    color: "#000000",
+    textIcon: "V0",
+    website: "https://v0.dev",
+    authHint: "Paste your session cookie from v0.dev (DevTools → Application → Cookies)",
+    riskNoticeVariant: "webCookie",
+  },
+  "kimi-web": {
+    id: "kimi-web",
+    // Primary "kimi" provider keeps the short alias; web variant uses its own id.
+    alias: "kimi-web",
+    name: "Kimi Web (Moonshot AI)",
+    icon: "auto_awesome",
+    color: "#2563EB",
+    textIcon: "KW",
+    website: "https://kimi.moonshot.cn",
+    authHint: "Paste your session cookie from kimi.moonshot.cn (DevTools → Application → Cookies)",
+    subscriptionRisk: true,
+    riskNoticeVariant: "webCookie",
+  },
+  "doubao-web": {
+    id: "doubao-web",
+    alias: "db",
+    name: "Doubao Web (ByteDance)",
+    icon: "auto_awesome",
+    color: "#3B82F6",
+    textIcon: "DW",
+    website: "https://www.doubao.com",
+    authHint: "Paste your session cookie from doubao.com (DevTools → Application → Cookies)",
+    subscriptionRisk: true,
+    riskNoticeVariant: "webCookie",
+  },
+  "qwen-web": {
+    id: "qwen-web",
+    // Primary "qwen" provider keeps the short alias; web variant uses its own id.
+    alias: "qwen-web",
+    name: "Qwen Web (Free)",
+    icon: "auto_awesome",
+    color: "#10B981",
+    textIcon: "QW",
+    website: "https://chat.qwen.ai",
+    hasFree: true,
+    freeNote: "Free — Qwen models via chat.qwen.ai with login token. No subscription required.",
+    authHint:
+      "Open chat.qwen.ai, log in, then open DevTools → Application → Local Storage → " +
+      'copy the "token" value (or use tongyi_sso_ticket cookie as Bearer token).',
+  },
+  "gemini-business": {
+    id: "gemini-business",
+    alias: "gembiz",
+    name: "Gemini Business (Enterprise)",
+    icon: "business_center",
+    color: "#4285F4",
+    textIcon: "GB",
+    website: "https://business.gemini.google",
+    hasFree: true,
+    freeNote:
+      "Free for Google Workspace enterprise accounts — enterprise Gemini models (Pro, Flash, image, video) via direct StreamGenerate HTTP API. No subscription required, just enterprise SSO.",
+    authHint:
+      "From your enterprise account: open business.gemini.google/home/cid/{your-cid}, then copy __Secure-1PSID and __Secure-1PSIDTS cookies from DevTools → Application → Cookies. Paste as a cookie header below.",
+  },
+};
diff --git a/src/shared/constants/routingStrategies.ts b/src/shared/constants/routingStrategies.ts
index 18e35e3d4c..736e4a7c07 100644
--- a/src/shared/constants/routingStrategies.ts
+++ b/src/shared/constants/routingStrategies.ts
@@ -10,14 +10,29 @@ export const ROUTING_STRATEGY_VALUES = [
   "cost-optimized",
   "reset-aware",
   "reset-window",
+  "headroom",
   "strict-random",
   "auto",
   "lkgp",
   "context-optimized",
+  "fusion",
 ] as const;
 
 export type RoutingStrategyValue = (typeof ROUTING_STRATEGY_VALUES)[number];
 
+/**
+ * Internal-only routing strategy values. These are used by system-generated
+ * combos (e.g. the auto-minted quota-share `qtSd/` combos) and are NEVER exposed
+ * in the UI or user-facing API — deliberately kept OUT of ROUTING_STRATEGY_VALUES
+ * and ROUTING_STRATEGIES so they never appear as a selectable option.
+ */
+export const INTERNAL_ROUTING_STRATEGY_VALUES = ["quota-share"] as const;
+
+export type InternalRoutingStrategyValue = (typeof INTERNAL_ROUTING_STRATEGY_VALUES)[number];
+
+/** Any routing strategy value, including internal ones. Used for combo dispatch. */
+export type AnyRoutingStrategyValue = RoutingStrategyValue | InternalRoutingStrategyValue;
+
 export const AUTO_ROUTING_STRATEGY_VALUES = [
   "rules",
   "cost",
@@ -45,12 +60,16 @@ export const ACCOUNT_FALLBACK_STRATEGY_VALUES = [
 
 export type AccountFallbackStrategyValue = (typeof ACCOUNT_FALLBACK_STRATEGY_VALUES)[number];
 
-export function normalizeRoutingStrategy(value: unknown): RoutingStrategyValue {
+export function normalizeRoutingStrategy(value: unknown): AnyRoutingStrategyValue {
   if (typeof value !== "string") return "priority";
   const normalized = value.trim().toLowerCase();
   if (normalized === "usage") return "least-used";
   if (normalized === "context") return "context-optimized";
   if (normalized === "weekly-reset" || normalized === "reset-window-order") return "reset-window";
+  // Internal strategies (e.g. quota-share) are preserved verbatim, never stripped
+  // to "priority", so system-minted combos resolve to their dedicated dispatch.
+  if ((INTERNAL_ROUTING_STRATEGY_VALUES as readonly string[]).includes(normalized))
+    return normalized as InternalRoutingStrategyValue;
   return (ROUTING_STRATEGY_VALUES as readonly string[]).includes(normalized)
     ? (normalized as RoutingStrategyValue)
     : "priority";
@@ -142,6 +161,13 @@ export const ROUTING_STRATEGIES: RoutingStrategyOption[] = [
     settingsDescKey: "resetWindowDesc",
     icon: "schedule",
   },
+  {
+    value: "headroom",
+    labelKey: "headroom",
+    combosDescKey: "headroomDesc",
+    settingsDescKey: "headroomDesc",
+    icon: "battery_charging_full",
+  },
   {
     value: "strict-random",
     labelKey: "strictRandom",
@@ -170,6 +196,13 @@ export const ROUTING_STRATEGIES: RoutingStrategyOption[] = [
     settingsDescKey: "contextOptDesc",
     icon: "text_snippet",
   },
+  {
+    value: "fusion",
+    labelKey: "fusion",
+    combosDescKey: "fusionDesc",
+    settingsDescKey: "fusionDesc",
+    icon: "hub",
+  },
 ];
 
 export const SETTINGS_FALLBACK_STRATEGY_VALUES = ACCOUNT_FALLBACK_STRATEGY_VALUES;
diff --git a/src/shared/network/remoteImageFetch.ts b/src/shared/network/remoteImageFetch.ts
index 15d553ce8b..eaa778dff2 100644
--- a/src/shared/network/remoteImageFetch.ts
+++ b/src/shared/network/remoteImageFetch.ts
@@ -1,6 +1,9 @@
+import { isIP } from "node:net";
+import dns from "node:dns";
 import {
   type OutboundUrlGuardMode,
   getProviderOutboundGuard,
+  isPrivateHost,
   parseAndValidatePublicUrl,
   parseOutboundUrl,
 } from "@/shared/network/outboundUrlGuard";
@@ -9,6 +12,15 @@ const DEFAULT_MAX_REMOTE_IMAGE_BYTES = 20 * 1024 * 1024;
 const DEFAULT_MAX_REDIRECTS = 3;
 const DEFAULT_TIMEOUT_MS = 15000;
 
+/**
+ * Minimal DNS lookup contract — matches the shape returned by
+ * `node:dns/promises`.lookup(host, { all: true }). Exposed as an option so
+ * tests can inject a fake resolver without touching real DNS.
+ */
+export type RemoteImageLookup = (
+  hostname: string
+) => Promise<Array<{ address: string; family: number }>>;
+
 export interface RemoteImageFetchOptions {
   fetchImpl?: typeof fetch;
   guard?: OutboundUrlGuardMode;
@@ -16,6 +28,11 @@ export interface RemoteImageFetchOptions {
   maxRedirects?: number;
   signal?: AbortSignal;
   timeoutMs?: number;
+  /**
+   * DNS resolver used for the rebinding guard. Defaults to
+   * `dns.promises.lookup(host, { all: true })`. Tests can pass a fake.
+   */
+  lookup?: RemoteImageLookup;
 }
 
 export interface RemoteImageFetchResult {
@@ -28,6 +45,49 @@ function validateRemoteImageUrl(input: string | URL, guard: OutboundUrlGuardMode
   return guard === "public-only" ? parseAndValidatePublicUrl(input) : parseOutboundUrl(input);
 }
 
+const defaultLookup: RemoteImageLookup = (hostname) =>
+  dns.promises.lookup(hostname, { all: true });
+
+/**
+ * Defence against DNS-rebinding SSRF (GHSA-cmhj-wh2f-9cgx). The
+ * `parseAndValidatePublicUrl` guard only inspects the hostname *string*, so a
+ * public-looking host that resolves to a private/loopback/link-local /
+ * cloud-metadata address would otherwise be fetched. Resolve the host up-front
+ * and reject if ANY answer is private (defeats the multi-A trick). IP literals
+ * are skipped — they're already covered by the URL guard. This narrows but
+ * does not fully close the TOCTOU window with fetch's own DNS resolution;
+ * pinning the connection to the validated IP via undici would close it for
+ * good, but is deferred to a follow-up so this fix stays surgical and
+ * dependency-free.
+ */
+async function assertHostnameResolvesPublic(
+  url: URL,
+  guard: OutboundUrlGuardMode,
+  lookup: RemoteImageLookup
+): Promise<void> {
+  if (guard !== "public-only") return; // private-allowing modes skip this guard
+  const hostname = url.hostname;
+  const bare =
+    hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+  if (!bare) return;
+  if (isIP(bare)) return; // IP literal — already validated by the URL guard.
+
+  let resolved: Array<{ address: string; family: number }>;
+  try {
+    resolved = await lookup(bare);
+  } catch {
+    throw new Error("Remote image host could not be resolved (blocked)");
+  }
+  if (!resolved.length) {
+    throw new Error("Remote image host could not be resolved (blocked)");
+  }
+  for (const { address } of resolved) {
+    if (isPrivateHost(address)) {
+      throw new Error("Remote image host resolves to a blocked private address (DNS rebinding)");
+    }
+  }
+}
+
 function combineSignals(signal: AbortSignal | undefined, timeoutMs: number) {
   const timeoutSignal = AbortSignal.timeout(timeoutMs);
   if (!signal) return timeoutSignal;
@@ -82,9 +142,13 @@ export async function fetchRemoteImage(
   const maxBytes = options.maxBytes ?? DEFAULT_MAX_REMOTE_IMAGE_BYTES;
   const maxRedirects = options.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
   const signal = combineSignals(options.signal, options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+  const lookup = options.lookup ?? defaultLookup;
 
   let currentUrl = validateRemoteImageUrl(input, guard);
   for (let redirectCount = 0; redirectCount <= maxRedirects; redirectCount++) {
+    // DNS-rebinding guard: validate every hop's hostname against its resolved
+    // IPs before issuing the request (GHSA-cmhj-wh2f-9cgx).
+    await assertHostnameResolvesPublic(currentUrl, guard, lookup);
     const response = await fetchImpl(currentUrl.toString(), {
       method: "GET",
       redirect: "manual",
diff --git a/src/shared/utils/modelCatalogSearch.ts b/src/shared/utils/modelCatalogSearch.ts
index 7ab5459da2..e107b1bebd 100644
--- a/src/shared/utils/modelCatalogSearch.ts
+++ b/src/shared/utils/modelCatalogSearch.ts
@@ -1,4 +1,4 @@
-export type ModelCatalogSource = "system" | "custom" | "imported" | "fallback" | "alias";
+export type ModelCatalogSource = "system" | "custom" | "imported" | "fallback" | "alias" | "auto";
 
 type ModelCatalogTarget = {
   modelId?: string | null;
@@ -24,6 +24,8 @@ export function normalizeModelCatalogSource(source?: string | null): ModelCatalo
   }
   if (normalized === "fallback") return "fallback";
   if (normalized === "alias") return "alias";
+  // Models discovered live from a custom provider's upstream `/models` endpoint.
+  if (normalized === "auto") return "auto";
   if (normalized === "custom" || normalized === "manual") {
     return "custom";
   }
@@ -41,6 +43,8 @@ export function getModelCatalogSourceLabel(source?: string | null): string {
       return "Fallback";
     case "alias":
       return "Alias";
+    case "auto":
+      return "Auto";
     case "system":
     default:
       return "Built-in";
@@ -57,6 +61,8 @@ function getModelCatalogSourceSearchText(source?: string | null): string {
       return "fallback compatible";
     case "alias":
       return "alias shortcut";
+    case "auto":
+      return "auto fetched discovered upstream";
     case "system":
     default:
       return "built-in builtin official catalog";
diff --git a/src/shared/utils/rateLimiter.ts b/src/shared/utils/rateLimiter.ts
index 75b1d6722e..a4da29cf88 100644
--- a/src/shared/utils/rateLimiter.ts
+++ b/src/shared/utils/rateLimiter.ts
@@ -13,6 +13,36 @@ export function isRedisConfigured(): boolean {
   return REDIS_URL.length > 0;
 }
 
+/**
+ * State-change-gated log throttle for the Redis error handler.
+ *
+ * #4878: when REDIS_URL points at a non-running server, ioredis retries on a
+ * backoff and fires the "error" event on every attempt, flooding the logs with
+ * identical "[REDIS] Error:" lines. We only want to log when the error STATE
+ * actually changes (first occurrence, or a different error message), not on
+ * every retry of the same failure.
+ */
+export function createRedisLogThrottle() {
+  let lastLogged: string | null = null;
+  return {
+    shouldLog(message: string): boolean {
+      if (message === lastLogged) return false;
+      lastLogged = message;
+      return true;
+    },
+    reset(): void {
+      lastLogged = null;
+    },
+  };
+}
+
+const redisLogThrottle = createRedisLogThrottle();
+
+// Exposed for unit tests — returns a fresh, isolated throttle instance.
+export function _createRedisLogThrottleForTests() {
+  return createRedisLogThrottle();
+}
+
 export function getRedisClient() {
   if (!isRedisConfigured()) {
     throw new Error("Redis is not configured");
@@ -26,7 +56,14 @@ export function getRedisClient() {
         return Math.min(times * 50, 2000); // Exponential backoff
       },
     });
-    redisClient.on("error", (err) => console.error("[REDIS] Error:", err.message));
+    redisClient.on("error", (err) => {
+      // Throttle: log once per error-state change instead of on every retry (#4878).
+      if (redisLogThrottle.shouldLog(err.message)) {
+        console.error("[REDIS] Error:", err.message);
+      }
+    });
+    // A successful connection resets the throttle so the next failure logs again.
+    redisClient.on("ready", () => redisLogThrottle.reset());
   }
   return redisClient;
 }
@@ -87,6 +124,43 @@ const TEST_MEMORY_STORE = new Map<string, number>();
 const FALLBACK_MEMORY_STORE = new Map<string, number>();
 let explicitTestMode = false;
 
+// Minimum store size before we bother sweeping (avoids O(n) cost on tiny stores)
+const EVICTION_THRESHOLD = 50;
+
+/**
+ * Evict all in-memory rate-limit window keys whose window has already ended.
+ *
+ * Key format: `rl:api_key:{id}:{windowSize}:{windowNumber}`
+ * A key expires at epoch-second `(windowNumber + 1) * windowSize`.
+ *
+ * Exported so tests can exercise it directly and so callers can invoke it
+ * with any store (TEST_MEMORY_STORE or FALLBACK_MEMORY_STORE).
+ *
+ * Fixes: #4041 — FALLBACK_MEMORY_STORE accumulated indefinitely → OOM (#4771).
+ */
+export function evictStaleRateLimitWindows(store: Map<string, number>, nowSeconds: number): void {
+  for (const key of store.keys()) {
+    // Format: rl:api_key:{id}:{windowSize}:{windowNumber}
+    // Split only on the last two colons to handle ids that contain colons.
+    const lastColon = key.lastIndexOf(":");
+    if (lastColon === -1) continue;
+    const secondLastColon = key.lastIndexOf(":", lastColon - 1);
+    if (secondLastColon === -1) continue;
+
+    const windowNumber = Number(key.slice(lastColon + 1));
+    const windowSize = Number(key.slice(secondLastColon + 1, lastColon));
+
+    if (!Number.isFinite(windowNumber) || !Number.isFinite(windowSize) || windowSize <= 0) {
+      continue;
+    }
+
+    const windowEnd = (windowNumber + 1) * windowSize;
+    if (windowEnd <= nowSeconds) {
+      store.delete(key);
+    }
+  }
+}
+
 export function setRateLimiterTestMode(enabled: boolean) {
   explicitTestMode = enabled;
   if (enabled) TEST_MEMORY_STORE.clear();
@@ -98,6 +172,12 @@ function checkInMemoryRateLimit(
   rules: RateLimitRule[]
 ): RateLimitResult {
   const now = Math.floor(Date.now() / 1000);
+
+  // Opportunistic eviction: sweep stale windows when the store has grown past
+  // the threshold. Bounded O(n) sweep — no timer, no background work.
+  if (store.size > EVICTION_THRESHOLD) {
+    evictStaleRateLimitWindows(store, now);
+  }
   for (const rule of rules) {
     const currentWindow = Math.floor(now / rule.window);
     const windowKey = `rl:api_key:${keyId}:${rule.window}:${currentWindow}`;
diff --git a/src/shared/validation/freeProxySchemas.ts b/src/shared/validation/freeProxySchemas.ts
index e9c5c5a9c0..ab91b72810 100644
--- a/src/shared/validation/freeProxySchemas.ts
+++ b/src/shared/validation/freeProxySchemas.ts
@@ -31,6 +31,34 @@ export const freeProxyBulkAddSchema = z.object({
   ids: z.array(z.string().uuid()).min(1).max(100),
 });
 
+export const denoDeploySchema = z.object({
+  // Deno Deploy Organization Tokens are prefixed `ddo_` followed by an opaque
+  // base-58/64-ish blob. Reject obviously-malformed inputs early so users get
+  // clearer feedback than a Deno 401 (and so accidentally pasting an
+  // OpenAI/Anthropic key is caught at the boundary).
+  denoToken: z
+    .string()
+    .min(20, "Deno Deploy token looks too short")
+    .max(200)
+    .regex(
+      /^[A-Za-z0-9_-]+$/,
+      "Deno Deploy token must contain only alphanumeric, underscore, or hyphen"
+    ),
+  orgDomain: z
+    .string()
+    .min(3)
+    .max(253)
+    // org domain looks like "<slug>.deno.net" — accept any DNS-shaped host so
+    // we don't have to chase Deno renames; the runtime fetch is the real gate.
+    .regex(/^[a-z0-9.-]+$/i, "Organization domain must be a DNS-shaped hostname"),
+  projectName: z
+    .string()
+    .min(3)
+    .max(52)
+    .regex(/^[a-z0-9-]+$/, "Project name must be lowercase alphanumeric with hyphens")
+    .default("omniroute-deno-relay"),
+});
+
 export const vercelDeploySchema = z.object({
   // Vercel personal access tokens are not strictly versioned but follow a
   // base-64-ish alphanumeric format. Reject obviously-malformed inputs early
@@ -51,3 +79,33 @@ export const vercelDeploySchema = z.object({
     .regex(/^[a-z0-9-]+$/, "Project name must be lowercase alphanumeric with hyphens")
     .default("omniroute-relay"),
 });
+
+export const cloudflareDeploySchema = z.object({
+  // Cloudflare Account ID is a 32-char lowercase hex string. Reject anything
+  // obviously malformed so users get clearer feedback than a Cloudflare 401/404.
+  accountId: z
+    .string()
+    .min(8, "Cloudflare Account ID looks too short")
+    .max(64)
+    .regex(
+      /^[a-f0-9]+$/,
+      "Cloudflare Account ID must be lowercase hex"
+    ),
+  // Cloudflare API tokens are opaque alphanumeric (40+ chars) — same alphabet
+  // we accept for Vercel tokens; constrain length to catch paste accidents.
+  apiToken: z
+    .string()
+    .min(20, "Cloudflare API token looks too short")
+    .max(200)
+    .regex(
+      /^[A-Za-z0-9_-]+$/,
+      "Cloudflare API token must contain only alphanumeric, underscore, or hyphen"
+    ),
+  projectName: z
+    .string()
+    .min(3)
+    .max(52)
+    .regex(/^[a-z0-9-]+$/, "Worker name must be lowercase alphanumeric with hyphens")
+    .default("omniroute-relay"),
+});
+
diff --git a/src/shared/validation/schemas/combo.ts b/src/shared/validation/schemas/combo.ts
index 64874daa3b..8590ff9ebf 100644
--- a/src/shared/validation/schemas/combo.ts
+++ b/src/shared/validation/schemas/combo.ts
@@ -220,6 +220,7 @@ export const comboNameSchema = z
 
 export const createComboSchema = z.object({
   name: comboNameSchema,
+  description: z.string().max(2000).optional(),
   models: z.array(comboModelEntry).optional().default([]),
   strategy: comboStrategySchema.optional().default("priority"),
   config: comboRuntimeConfigSchema.optional(),
@@ -266,6 +267,7 @@ export const updateComboDefaultsSchema = z
 export const updateComboSchema = z
   .object({
     name: comboNameSchema.optional(),
+    description: z.string().max(2000).optional().nullable(),
     models: z.array(comboModelEntry).optional(),
     strategy: comboStrategySchema.optional(),
     config: comboRuntimeConfigSchema.optional(),
@@ -280,6 +282,7 @@ export const updateComboSchema = z
   .superRefine((value, ctx) => {
     if (
       value.name === undefined &&
+      value.description === undefined &&
       value.models === undefined &&
       value.strategy === undefined &&
       value.config === undefined &&
diff --git a/src/shared/validation/schemas/settings.ts b/src/shared/validation/schemas/settings.ts
index 75e813c93b..21a30fb3a7 100644
--- a/src/shared/validation/schemas/settings.ts
+++ b/src/shared/validation/schemas/settings.ts
@@ -95,6 +95,26 @@ export const waitForCooldownSettingsSchema = z
   })
   .strict();
 
+// Quota-share combo cooldown-aware retry (Variante A). Bounds mirror
+// normalizeComboCooldownWaitSettings: a single wait <= 30s, <= 10 attempts.
+export const comboCooldownWaitSettingsSchema = z
+  .object({
+    enabled: z.boolean().optional(),
+    maxWaitMs: z.number().int().min(0).max(30000).optional(),
+    maxAttempts: z.number().int().min(0).max(10).optional(),
+    budgetMs: z.number().int().min(0).max(300000).optional(),
+  })
+  .strict();
+
+// FASE 2.1: kill-switch for the per-connection quota-share concurrency limit.
+// The cap itself comes from each connection's max_concurrent, so only `enabled`
+// is configurable here.
+export const quotaShareConcurrencyLimitSettingsSchema = z
+  .object({
+    enabled: z.boolean().optional(),
+  })
+  .strict();
+
 export const providerCooldownSettingsSchema = z
   .object({
     enabled: z.boolean().optional(),
@@ -134,6 +154,8 @@ export const updateResilienceSchema = z
       .strict()
       .optional(),
     waitForCooldown: waitForCooldownSettingsSchema.optional(),
+    comboCooldownWait: comboCooldownWaitSettingsSchema.optional(),
+    quotaShareConcurrencyLimit: quotaShareConcurrencyLimitSettingsSchema.optional(),
     providerCooldown: providerCooldownSettingsSchema.optional(),
     profiles: z
       .object({
@@ -151,6 +173,8 @@ export const updateResilienceSchema = z
       !value.connectionCooldown &&
       !value.providerBreaker &&
       !value.waitForCooldown &&
+      !value.comboCooldownWait &&
+      !value.quotaShareConcurrencyLimit &&
       !value.providerCooldown &&
       !value.profiles &&
       !value.defaults
diff --git a/src/shared/validation/settingsSchemas.ts b/src/shared/validation/settingsSchemas.ts
index 9a8888bacd..6c69834894 100644
--- a/src/shared/validation/settingsSchemas.ts
+++ b/src/shared/validation/settingsSchemas.ts
@@ -400,7 +400,7 @@ export const databaseSettingsSchema = z
         .or(z.literal("monthly")),
       vacuumHour: z.number().int().min(0).max(23),
       pageSize: z.number().multipleOf(512).min(512).max(65536),
-      cacheSize: z.number().int().min(-1000000).max(1000000),
+      cacheSize: z.number().int().positive().max(1000000),
       optimizeOnStartup: z.boolean(),
     }),
 
diff --git a/src/sse/handlers/chat.ts b/src/sse/handlers/chat.ts
index 802734ef0d..d52a9fab00 100644
--- a/src/sse/handlers/chat.ts
+++ b/src/sse/handlers/chat.ts
@@ -1,5 +1,6 @@
 import { randomUUID } from "crypto";
 import { resolveChatRequestBody } from "./requestBody";
+import { resolveRoutingModel } from "./resolveRoutingModel";
 import {
   getProviderCredentialsWithQuotaPreflight,
   markAccountUnavailable,
@@ -254,7 +255,10 @@ export async function handleChat(
     log.debug("NO_THINKING", `Resolved no-thinking alias → ${noThinking.realModel}`);
   }
 
-  let modelStr = body.model;
+  // X-Route-Model header overrides body.model for routing purposes (see
+  // resolveRoutingModel). The resolved model still passes through
+  // enforceApiKeyPolicy below, so it cannot bypass per-key allowlists.
+  let modelStr = resolveRoutingModel(request, body);
 
   // Count messages (support both messages[] and input[] formats)
   const msgCount = body.messages?.length || body.input?.length || 0;
@@ -1013,7 +1017,7 @@ async function handleSingleModelChat(
             );
       preselectedCredentials = null;
 
-      if (!credentials || "allRateLimited" in credentials) {
+      if (!credentials || "allRateLimited" in credentials || !credentials.connectionId) {
         if (credentials?.allRateLimited) {
           const retryDecision = getCooldownAwareRetryDecision({
             retryAfter: credentials.retryAfter,
@@ -1055,7 +1059,7 @@ async function handleSingleModelChat(
           breaker._onFailure();
         }
 
-        return handleNoCredentials(
+        const noCredsRes = handleNoCredentials(
           credentials,
           excludedConnectionIds.size > 0 ? Array.from(excludedConnectionIds)[0] : null,
           provider,
@@ -1063,6 +1067,11 @@ async function handleSingleModelChat(
           lastError,
           lastStatus
         );
+        const lastFailedConnectionId =
+          excludedConnectionIds.size > 0
+            ? Array.from(excludedConnectionIds)[excludedConnectionIds.size - 1]
+            : null;
+        return withSelectedConnectionHeader(noCredsRes, lastFailedConnectionId);
       }
 
       const accountId = credentials.connectionId.slice(0, 8);
diff --git a/src/sse/handlers/resolveRoutingModel.ts b/src/sse/handlers/resolveRoutingModel.ts
new file mode 100644
index 0000000000..c4c466b88e
--- /dev/null
+++ b/src/sse/handlers/resolveRoutingModel.ts
@@ -0,0 +1,17 @@
+// Resolve the model used for routing. The `X-Route-Model` header, when present,
+// overrides `body.model` — letting a caller/proxy force a specific combo/alias/model
+// regardless of what the client CLI sent. This is useful when a CLI hardcodes
+// `body.model` to a fixed provider/model (bypassing combo routing): an upstream
+// proxy can send `X-Route-Model` to restore routing control without mutating the
+// request body. The resolved value still flows through `enforceApiKeyPolicy`, so
+// it cannot bypass per-key model/combo allowlists. See PR #4863.
+
+type HeaderCarrier = { headers: { get(name: string): string | null } };
+
+export function resolveRoutingModel(
+  request: HeaderCarrier,
+  body: { model?: string | null }
+): string | null | undefined {
+  const headerModel = request.headers.get("x-route-model")?.trim();
+  return headerModel || body.model;
+}
diff --git a/src/sse/services/auth.ts b/src/sse/services/auth.ts
index ea23f0c95d..f11681a23b 100644
--- a/src/sse/services/auth.ts
+++ b/src/sse/services/auth.ts
@@ -781,14 +781,14 @@ type AnonymousFallbackProviderDefinition = {
   noAuth?: boolean;
 };
 
-function buildSyntheticNoAuthCredentials(): {
+function buildSyntheticNoAuthCredentials(providerSpecificData: JsonRecord = {}): {
   apiKey: null;
   accessToken: null;
   refreshToken: null;
   expiresAt: null;
   projectId: null;
   copilotToken: null;
-  providerSpecificData: Record<string, never>;
+  providerSpecificData: JsonRecord;
   connectionId: typeof SYNTHETIC_NOAUTH_CONNECTION_ID;
   testStatus: "active";
   lastError: null;
@@ -809,7 +809,7 @@ function buildSyntheticNoAuthCredentials(): {
     expiresAt: null,
     projectId: null,
     copilotToken: null,
-    providerSpecificData: {},
+    providerSpecificData,
     connectionId: SYNTHETIC_NOAUTH_CONNECTION_ID,
     testStatus: "active",
     lastError: null,
@@ -821,6 +821,39 @@ function buildSyntheticNoAuthCredentials(): {
   };
 }
 
+/**
+ * #4954 — A no-auth provider ("OpenCode Free", MiMoCode, …) has no DB-backed
+ * credential, but its NoAuthAccountCard DOES persist a real connection row whose
+ * `providerSpecificData` carries the per-account proxy/rotation config
+ * (`fingerprints` + `accountProxies`). The synthetic credentials returned above
+ * default to an empty `providerSpecificData`, so without hydration the executor
+ * never sees those proxies and every request egresses direct. Pull just the
+ * rotation-relevant fields off the active connection so the executor can honor
+ * them. Best-effort: any read failure falls back to empty (historical behavior).
+ */
+async function loadNoAuthProviderSpecificData(providerId: string): Promise<JsonRecord> {
+  try {
+    const connectionsRaw = await getProviderConnections({ provider: providerId });
+    const connections = (Array.isArray(connectionsRaw) ? connectionsRaw : []).map(
+      toProviderConnection
+    );
+    const hydrated: JsonRecord = {};
+    for (const conn of connections) {
+      const psd = conn.providerSpecificData;
+      if (!psd || typeof psd !== "object") continue;
+      if (Array.isArray(psd.fingerprints) && !Array.isArray(hydrated.fingerprints)) {
+        hydrated.fingerprints = psd.fingerprints;
+      }
+      if (Array.isArray(psd.accountProxies) && !Array.isArray(hydrated.accountProxies)) {
+        hydrated.accountProxies = psd.accountProxies;
+      }
+    }
+    return hydrated;
+  } catch {
+    return {};
+  }
+}
+
 function providerCanUseSyntheticNoAuthFallback(providerId: string): boolean {
   const providerDef = getProviderById(providerId) as
     | AnonymousFallbackProviderDefinition
@@ -838,10 +871,16 @@ function providerCanUseSyntheticNoAuthFallback(providerId: string): boolean {
   );
 }
 
-function maybeSyntheticNoAuthFallback(providerId: string, excludedConnectionIds: Set<string>) {
+async function maybeSyntheticNoAuthFallback(
+  providerId: string,
+  excludedConnectionIds: Set<string>
+) {
   if (!providerCanUseSyntheticNoAuthFallback(providerId)) return null;
   if (excludedConnectionIds.has(SYNTHETIC_NOAUTH_CONNECTION_ID)) return null;
-  return buildSyntheticNoAuthCredentials();
+  // #4954: hydrate per-account proxy/rotation config off the connection row so
+  // no-auth executors (opencode, mimocode) actually honor configured proxies.
+  const providerSpecificData = await loadNoAuthProviderSpecificData(providerId);
+  return buildSyntheticNoAuthCredentials(providerSpecificData);
 }
 
 function normalizeExcludedConnectionIds(
@@ -1021,7 +1060,7 @@ export async function getProviderCredentials(
         excludeConnectionId,
         options.excludeConnectionIds
       );
-      return maybeSyntheticNoAuthFallback(resolvedId, excludedForNoAuth);
+      return await maybeSyntheticNoAuthFallback(resolvedId, excludedForNoAuth);
     }
 
     const allowSuppressedConnections = options.allowSuppressedConnections === true;
@@ -1106,7 +1145,7 @@ export async function getProviderCredentials(
         // the dashboard sees a misleading "bad_request" code.
         const terminalConnections = allConnections.filter(isTerminalConnectionStatus);
         if (terminalConnections.length === allConnections.length) {
-          const syntheticFallback = maybeSyntheticNoAuthFallback(resolvedId, excludedConnectionIds);
+          const syntheticFallback = await maybeSyntheticNoAuthFallback(resolvedId, excludedConnectionIds);
           if (syntheticFallback) return syntheticFallback;
 
           const statusCounts = new Map<string, number>();
@@ -1123,7 +1162,7 @@ export async function getProviderCredentials(
           };
         }
       }
-      const syntheticFallback = maybeSyntheticNoAuthFallback(resolvedId, excludedConnectionIds);
+      const syntheticFallback = await maybeSyntheticNoAuthFallback(resolvedId, excludedConnectionIds);
       if (syntheticFallback) return syntheticFallback;
       log.warn("AUTH", `No credentials for ${provider}`);
       return null;
@@ -1294,7 +1333,7 @@ export async function getProviderCredentials(
           cooldownModel: allBlockedByModelCooldown ? requestedModel : null,
         };
       }
-      const syntheticFallback = maybeSyntheticNoAuthFallback(resolvedId, excludedConnectionIds);
+      const syntheticFallback = await maybeSyntheticNoAuthFallback(resolvedId, excludedConnectionIds);
       if (syntheticFallback) return syntheticFallback;
       log.warn("AUTH", `${provider} | all ${connections.length} accounts unavailable`);
       return null;
diff --git a/src/sse/services/model.ts b/src/sse/services/model.ts
index 0bb3588906..651694281f 100644
--- a/src/sse/services/model.ts
+++ b/src/sse/services/model.ts
@@ -7,9 +7,30 @@ import {
   resolveModelAliasFromMap,
   getModelInfoCore,
 } from "@omniroute/open-sse/services/model.ts";
+import { REGISTRY } from "@omniroute/open-sse/config/providerRegistry.ts";
 
 export { parseModel };
 
+/**
+ * Reserved provider prefixes — built-in provider ids + aliases. User-defined
+ * compatible-node prefixes must not be allowed to shadow these, otherwise a
+ * node with prefix="cf" would hijack cloudflare-ai requests (and similar for
+ * every built-in provider). Ported from upstream 9router 047fdc89.
+ *
+ * Built lazily so the registry is only walked once per process.
+ */
+let _reservedProviderPrefixes: Set<string> | null = null;
+function getReservedProviderPrefixes(): Set<string> {
+  if (_reservedProviderPrefixes) return _reservedProviderPrefixes;
+  const reserved = new Set<string>();
+  for (const entry of Object.values(REGISTRY)) {
+    if (entry?.id) reserved.add(entry.id);
+    if (entry?.alias) reserved.add(entry.alias);
+  }
+  _reservedProviderPrefixes = reserved;
+  return reserved;
+}
+
 /**
  * Build a combined model alias map that merges both alias stores:
  * 1. DB-namespace aliases (key_value WHERE namespace='modelAliases') — set via
@@ -98,45 +119,58 @@ export async function getModelInfo(modelStr) {
     // Ensure prefixToCheck is always a concise identifier, not a full model string
     const prefixToCheck = parsed.providerAlias || parsed.provider;
 
-    // Check OpenAI Compatible nodes
-    // Match by node.prefix (user-defined alias) OR node.id (internal UUID id stored by
-    // combo steps), so that combo targets using the internal node id still resolve
-    // correctly (#2778).
-    const openaiNodes = await getProviderNodes({ type: "openai-compatible" });
-    const matchedOpenAI = openaiNodes.find(
-      (node) => node.prefix === prefixToCheck || node.id === prefixToCheck
-    );
-    if (matchedOpenAI) {
-      const { apiFormat, targetFormat } = await lookupCustomModelMeta(
-        matchedOpenAI.id as string,
-        parsed.model as string
-      );
-      return {
-        provider: matchedOpenAI.id,
-        model: parsed.model,
-        extendedContext,
-        ...(apiFormat && { apiFormat }),
-        ...(targetFormat && { targetFormat }),
-      };
-    }
+    // Compatible-node prefixes are user-defined. They must not be allowed to
+    // shadow built-in provider ids/aliases (e.g. `cf` → cloudflare-ai). When
+    // prefixToCheck matches a built-in registry id/alias, skip the compatible-
+    // node prefix lookup so the request still routes to the built-in provider.
+    // Internal UUID-prefixed node ids (e.g. "openai-compatible-responses-...")
+    // are never in the reserved set, so the #2778 combo path still works.
+    // Ported from upstream 9router 047fdc89.
+    const reserved = getReservedProviderPrefixes();
+    const isReservedPrefix =
+      typeof prefixToCheck === "string" && reserved.has(prefixToCheck);
 
-    // Check Anthropic Compatible nodes
-    const anthropicNodes = await getProviderNodes({ type: "anthropic-compatible" });
-    const matchedAnthropic = anthropicNodes.find(
-      (node) => node.prefix === prefixToCheck || node.id === prefixToCheck
-    );
-    if (matchedAnthropic) {
-      const { apiFormat, targetFormat } = await lookupCustomModelMeta(
-        matchedAnthropic.id as string,
-        parsed.model as string
+    if (!isReservedPrefix) {
+      // Check OpenAI Compatible nodes
+      // Match by node.prefix (user-defined alias) OR node.id (internal UUID id stored by
+      // combo steps), so that combo targets using the internal node id still resolve
+      // correctly (#2778).
+      const openaiNodes = await getProviderNodes({ type: "openai-compatible" });
+      const matchedOpenAI = openaiNodes.find(
+        (node) => node.prefix === prefixToCheck || node.id === prefixToCheck
       );
-      return {
-        provider: matchedAnthropic.id,
-        model: parsed.model,
-        extendedContext,
-        ...(apiFormat && { apiFormat }),
-        ...(targetFormat && { targetFormat }),
-      };
+      if (matchedOpenAI) {
+        const { apiFormat, targetFormat } = await lookupCustomModelMeta(
+          matchedOpenAI.id as string,
+          parsed.model as string
+        );
+        return {
+          provider: matchedOpenAI.id,
+          model: parsed.model,
+          extendedContext,
+          ...(apiFormat && { apiFormat }),
+          ...(targetFormat && { targetFormat }),
+        };
+      }
+
+      // Check Anthropic Compatible nodes
+      const anthropicNodes = await getProviderNodes({ type: "anthropic-compatible" });
+      const matchedAnthropic = anthropicNodes.find(
+        (node) => node.prefix === prefixToCheck || node.id === prefixToCheck
+      );
+      if (matchedAnthropic) {
+        const { apiFormat, targetFormat } = await lookupCustomModelMeta(
+          matchedAnthropic.id as string,
+          parsed.model as string
+        );
+        return {
+          provider: matchedAnthropic.id,
+          model: parsed.model,
+          extendedContext,
+          ...(apiFormat && { apiFormat }),
+          ...(targetFormat && { targetFormat }),
+        };
+      }
     }
 
     // stripModelPrefix: if enabled, strip provider prefix and re-resolve
diff --git a/src/types/databaseSettings.ts b/src/types/databaseSettings.ts
index 18cf3e119f..e07f068244 100644
--- a/src/types/databaseSettings.ts
+++ b/src/types/databaseSettings.ts
@@ -118,7 +118,7 @@ export const DEFAULT_DATABASE_SETTINGS: Omit<DatabaseSettings, "location" | "sta
     scheduledVacuum: "weekly",
     vacuumHour: 2,
     pageSize: 4096,
-    cacheSize: -2000,
+    cacheSize: 16384,
     optimizeOnStartup: true,
   },
 };
diff --git a/tests/integration/chat-pipeline.test.ts b/tests/integration/chat-pipeline.test.ts
index 7627108d30..001d03e8e6 100644
--- a/tests/integration/chat-pipeline.test.ts
+++ b/tests/integration/chat-pipeline.test.ts
@@ -700,7 +700,7 @@ test("chat pipeline applies Codex CLI fingerprint to OAuth responses requests",
   assert.equal(call.headers.Version, getCodexClientVersion());
   assert.equal(call.headers["Openai-Beta"], "responses=experimental");
   assert.equal(call.headers["X-Codex-Beta-Features"], "responses_websockets");
-  assert.equal(call.headers["User-Agent"], "codex-cli/0.132.0 (Windows 10.0.26200; x64)");
+  assert.equal(call.headers["User-Agent"], "codex-cli/0.142.0 (Windows 10.0.26200; x64)");
   assert.equal(call.headers["x-codex-window-id"], "conv_codex_fingerprint:0");
   assert.ok(call.headers["x-client-request-id"], "expected Codex request id header");
   assert.ok(call.headers["x-codex-turn-metadata"], "expected Codex turn metadata header");
diff --git a/tests/unit/accountfallback-ratelimit-400-4976.test.ts b/tests/unit/accountfallback-ratelimit-400-4976.test.ts
new file mode 100644
index 0000000000..e1de7b6f8c
--- /dev/null
+++ b/tests/unit/accountfallback-ratelimit-400-4976.test.ts
@@ -0,0 +1,44 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+// #4976 — A 400 response whose body carries rate-limit semantics (e.g. MiMoCode's
+// "Detected high-frequency non-compliant requests from you.") was misclassified as a
+// non-fallbackable generic 400, so MiMo-auto combo never failed over and the raw
+// failure surfaced to Cline as `[502]: fetch failed`. checkFallbackError must now
+// detect rate-limit text on a 400 and treat it as fallback-worthy
+// (RATE_LIMIT_EXCEEDED, connection-cooldown scope) WITHOUT regressing the #2101
+// malformed-400 infinite-loop guard.
+
+const { checkFallbackError } = await import("../../open-sse/services/accountFallback.ts");
+const { RateLimitReason } = await import("../../open-sse/config/constants.ts");
+
+test("#4976 400 with rate-limit text (MiMoCode) → fallback with RATE_LIMIT_EXCEEDED", () => {
+  const res = checkFallbackError(
+    400,
+    "Detected high-frequency non-compliant requests from you.",
+    0,
+    null,
+    "mimocode"
+  );
+  assert.equal(res.shouldFallback, true);
+  assert.equal(res.reason, RateLimitReason.RATE_LIMIT_EXCEEDED);
+});
+
+test("#4976 400 with Chinese rate-limit text → fallback with RATE_LIMIT_EXCEEDED", () => {
+  const res = checkFallbackError(400, "检测到您的请求频率过高，请稍后再试", 0, null, "mimocode");
+  assert.equal(res.shouldFallback, true);
+  assert.equal(res.reason, RateLimitReason.RATE_LIMIT_EXCEEDED);
+});
+
+test("#4976 regression: a generic non-rate-limit 400 still does NOT fall over (#2101 guard)", () => {
+  const res = checkFallbackError(400, "Invalid JSON: unexpected token at position 12");
+  assert.equal(res.shouldFallback, false);
+});
+
+test("#4976 regression: a malformed 400 stays MODEL_CAPACITY, not reclassified as rate-limit", () => {
+  // Malformed-request detection must win over the new rate-limit text check so the
+  // #2101 infinite-loop guard (zero-cooldown MODEL_CAPACITY) is preserved.
+  const res = checkFallbackError(400, "messages must alternate between user and assistant");
+  assert.equal(res.shouldFallback, true);
+  assert.equal(res.reason, RateLimitReason.MODEL_CAPACITY);
+});
diff --git a/tests/unit/anthropic-compat-validation-v1-messages.test.ts b/tests/unit/anthropic-compat-validation-v1-messages.test.ts
new file mode 100644
index 0000000000..2ef51cf726
--- /dev/null
+++ b/tests/unit/anthropic-compat-validation-v1-messages.test.ts
@@ -0,0 +1,80 @@
+// Regression test for the anthropic-compatible connection validator.
+//
+// Upstream fix: GET /models is not part of the Anthropic API spec; many
+// compatible proxies either 404, 401, or 403 on /models even with a valid
+// API key. The connection test must therefore not reject the credentials
+// solely on a 401/403 from /models — it must fall back to POST /v1/messages
+// (the canonical Anthropic auth probe) and treat any non-401/403 messages
+// response as proof that the key was accepted.
+//
+// Ported from decolua/9router 584cf66a (Co-author: Rehan Choirul).
+
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { validateProviderApiKey } = await import("../../src/lib/providers/validation.ts");
+
+const originalFetch = globalThis.fetch;
+
+test.afterEach(() => {
+  globalThis.fetch = originalFetch;
+});
+
+test(
+  "anthropic-compatible validation falls back to /messages when /models returns 403",
+  async () => {
+    const calls: { url: string; method: string }[] = [];
+    globalThis.fetch = async (url: any, init: any = {}) => {
+      const u = String(url);
+      const method = String(init?.method || "GET").toUpperCase();
+      calls.push({ url: u, method });
+      if (u.endsWith("/models")) {
+        return new Response(JSON.stringify({ error: "forbidden on models" }), { status: 403 });
+      }
+      // /messages: upstream accepts the key but rejects the toy payload with 400.
+      return new Response(JSON.stringify({ error: "bad request" }), { status: 400 });
+    };
+
+    const result = await validateProviderApiKey({
+      provider: "anthropic-compatible-403-on-models",
+      apiKey: "sk-test",
+      providerSpecificData: { baseUrl: "https://proxy.example.com/v1/messages" },
+    });
+
+    // BEFORE the fix this returned { valid: false, error: "Invalid API key" }
+    // because validateAnthropicCompatibleProvider short-circuited on the 403
+    // from GET /models without ever probing POST /v1/messages.
+    assert.equal(result.valid, true, "403 on /models alone must NOT mark the key invalid");
+    assert.equal(result.error, null);
+
+    // The validator must actually exercise the messages endpoint.
+    const messagesCall = calls.find(
+      (call) => call.url.endsWith("/messages") && call.method === "POST"
+    );
+    assert.ok(messagesCall, "expected a POST /messages probe after /models 403");
+  }
+);
+
+test(
+  "anthropic-compatible validation still rejects when /messages itself returns 401",
+  async () => {
+    // Symmetry guard: the fix must NOT make every 403/401 pass. Only the
+    // messages probe is authoritative — if it also rejects auth, the key is bad.
+    globalThis.fetch = async (url: any) => {
+      const u = String(url);
+      if (u.endsWith("/models")) {
+        return new Response(JSON.stringify({ error: "no models endpoint" }), { status: 403 });
+      }
+      return new Response(JSON.stringify({ error: "invalid_api_key" }), { status: 401 });
+    };
+
+    const result = await validateProviderApiKey({
+      provider: "anthropic-compatible-truly-bad-key",
+      apiKey: "sk-bad",
+      providerSpecificData: { baseUrl: "https://proxy.example.com/v1/messages" },
+    });
+
+    assert.equal(result.valid, false);
+    assert.equal(result.error, "Invalid API key");
+  }
+);
diff --git a/tests/unit/anthropic-stream-thinking-close-marker.test.ts b/tests/unit/anthropic-stream-thinking-close-marker.test.ts
new file mode 100644
index 0000000000..8b8e5e4e48
--- /dev/null
+++ b/tests/unit/anthropic-stream-thinking-close-marker.test.ts
@@ -0,0 +1,109 @@
+// Regression test for the Anthropic-compatible stream "thinking block never closes" bug.
+//
+// When clients consume the OpenAI-compatible stream that OmniRoute synthesises from
+// Claude-native SSE, they need an explicit signal that the thinking/reasoning section
+// has ended; otherwise the UI stays stuck on the "thinking" indicator even after the
+// upstream stream has cleanly completed.
+//
+// Inspired by upstream decolua/9router PR #454.
+//
+// Before the fix, the `content_block_stop` event for a thinking block emitted NO
+// terminating chunk at all (a previous drift had emitted `reasoning_content: ""`,
+// which is semantically a no-op and does not signal "thinking complete" to clients
+// such as Claude Code).
+//
+// The fix emits a `content: "</think>"` chunk on close — matching the convention
+// already used throughout OmniRoute (see openai-responses.ts / responsesTransformer.ts
+// which split on `</think>` to separate reasoning from final content).
+
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { claudeToOpenAIResponse } = await import(
+  "../../open-sse/translator/response/claude-to-openai.ts"
+);
+
+function newState() {
+  return {
+    toolCalls: new Map(),
+    toolNameMap: new Map(),
+    messageId: "msg_test",
+    model: "claude-3-7-sonnet",
+    toolCallIndex: 0,
+  };
+}
+
+test("claudeToOpenAIResponse emits </think> close marker on thinking content_block_stop", () => {
+  const state = newState();
+
+  // Open thinking block.
+  claudeToOpenAIResponse(
+    {
+      type: "content_block_start",
+      index: 0,
+      content_block: { type: "thinking", thinking: "" },
+    },
+    state
+  );
+
+  // Stream reasoning delta.
+  claudeToOpenAIResponse(
+    {
+      type: "content_block_delta",
+      index: 0,
+      delta: { type: "thinking_delta", thinking: "Plan first." },
+    },
+    state
+  );
+
+  // Close the thinking block.
+  const closeChunks = claudeToOpenAIResponse(
+    { type: "content_block_stop", index: 0 },
+    state
+  );
+
+  assert.ok(Array.isArray(closeChunks), "stop event must return an array of chunks");
+  assert.ok(
+    closeChunks.length >= 1,
+    "stop event for thinking block must emit at least one close-marker chunk"
+  );
+
+  const hasCloseMarker = closeChunks.some(
+    (chunk) => chunk?.choices?.[0]?.delta?.content === "</think>"
+  );
+  assert.ok(
+    hasCloseMarker,
+    `expected a chunk with delta.content === "</think>"; got ${JSON.stringify(closeChunks)}`
+  );
+
+  // After close, state flag must be cleared so subsequent thinking blocks are tracked correctly.
+  assert.equal(state.inThinkingBlock, false);
+});
+
+test("claudeToOpenAIResponse does not emit </think> on stop of non-thinking blocks", () => {
+  const state = newState();
+
+  // Open + immediately close a text block — must NOT inject </think>.
+  claudeToOpenAIResponse(
+    {
+      type: "content_block_start",
+      index: 0,
+      content_block: { type: "text", text: "" },
+    },
+    state
+  );
+  const closeChunks = claudeToOpenAIResponse(
+    { type: "content_block_stop", index: 0 },
+    state
+  );
+
+  const arr = Array.isArray(closeChunks) ? closeChunks : [];
+  const hasCloseMarker = arr.some(
+    (chunk) => chunk?.choices?.[0]?.delta?.content === "</think>"
+  );
+  assert.equal(
+    hasCloseMarker,
+    false,
+    "text-block close must not emit </think> sentinel"
+  );
+});
diff --git a/tests/unit/antigravity-429-quota-cooldown.test.ts b/tests/unit/antigravity-429-quota-cooldown.test.ts
index 3791e4ff2a..f0776c9694 100644
--- a/tests/unit/antigravity-429-quota-cooldown.test.ts
+++ b/tests/unit/antigravity-429-quota-cooldown.test.ts
@@ -55,6 +55,17 @@ test("classify429: AG 'Individual quota reached' message → quota_exhausted", (
   assert.equal(classify429(msg), "quota_exhausted");
 });
 
+test("classify429: standard Gemini rate limit 'resource has been exhausted' -> rate_limited or unknown, not quota_exhausted", () => {
+  const msg =
+    "RESOURCE_EXHAUSTED: Resource has been exhausted (e.g. queries per minute limit was reached).";
+  const result = classify429(msg);
+  assert.notEqual(
+    result,
+    "quota_exhausted",
+    "RESOURCE_EXHAUSTED rate limit should not be classified as quota_exhausted"
+  );
+});
+
 // ── DB persistence (the missing wire — Bug #2) ───────────────────────────────
 
 test("markConnectionQuotaExhausted persists 24h cooldown; isConnectionRateLimited returns true", async () => {
diff --git a/tests/unit/antigravity-model-aliases.test.ts b/tests/unit/antigravity-model-aliases.test.ts
index cb16ab8764..e79fdc38d6 100644
--- a/tests/unit/antigravity-model-aliases.test.ts
+++ b/tests/unit/antigravity-model-aliases.test.ts
@@ -20,7 +20,10 @@ function getPublicModel(id: string) {
 // source of truth here (was duplicated as an inline if-ladder in usage.ts). It operates on
 // the UPSTREAM quota namespace, where `gemini-3.5-flash-low` is the Medium tier's bucket.
 test("toClientAntigravityQuotaModelId maps upstream quota buckets to client tiers", () => {
-  assert.equal(toClientAntigravityQuotaModelId("gemini-3.5-flash-extra-low"), "gemini-3.5-flash-low");
+  assert.equal(
+    toClientAntigravityQuotaModelId("gemini-3.5-flash-extra-low"),
+    "gemini-3.5-flash-low"
+  );
   // Dual-meaning id: in the quota namespace this bucket is the Medium tier.
   assert.equal(toClientAntigravityQuotaModelId("gemini-3.5-flash-low"), "gemini-3.5-flash-medium");
   assert.equal(toClientAntigravityQuotaModelId("gemini-3-flash-agent"), "gemini-3.5-flash-high");
@@ -189,9 +192,7 @@ test("AntigravityExecutor.transformRequest maps Gemini 3.5 Flash tiers to live u
   // executor never sets those fields, so they were vacuously true and gave false
   // confidence. #3821-review LEDGER-10.)
   assert.equal(result.model, "gemini-3-flash-agent");
-  assert.deepEqual(result.request.contents, [
-    { role: "user", parts: [{ text: "Hello" }] },
-  ]);
+  assert.deepEqual(result.request.contents, [{ role: "user", parts: [{ text: "Hello" }] }]);
 });
 
 test("AntigravityExecutor.transformRequest sends Claude through Gemini-compatible Cloud Code schema", async () => {
@@ -220,7 +221,10 @@ test("AntigravityExecutor.transformRequest sends Claude through Gemini-compatibl
   if (result instanceof Response) throw new Error("Unexpected Response from transformRequest");
   const request = result.request as any;
   assert.deepEqual(request.contents, [{ role: "user", parts: [{ text: "Hello" }] }]);
-  assert.equal(request.generationConfig.maxOutputTokens, 32769);
+  // Capped to MAX_ANTIGRAVITY_OUTPUT_TOKENS (16384) by the executor (#4636) to avoid
+  // the Antigravity Cloud Code 400 on maxOutputTokens > 16384, overriding the
+  // thinkingBudget+1 bump (which would otherwise be 32769).
+  assert.equal(request.generationConfig.maxOutputTokens, 16384);
   assert.equal(request.generationConfig.temperature, 0.5);
   assert.equal(request.generationConfig.topK, 40);
   assert.equal(request.generationConfig.topP, 1);
diff --git a/tests/unit/antigravity-safetysettings-5003.test.ts b/tests/unit/antigravity-safetysettings-5003.test.ts
new file mode 100644
index 0000000000..152a5eb3ff
--- /dev/null
+++ b/tests/unit/antigravity-safetysettings-5003.test.ts
@@ -0,0 +1,60 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+import { AntigravityExecutor } from "../../open-sse/executors/antigravity.ts";
+import { DEFAULT_SAFETY_SETTINGS } from "../../open-sse/translator/helpers/geminiHelper.ts";
+
+// Regression for #5003: the Antigravity (Google Cloud Code) request builder explicitly set
+// `safetySettings: undefined`, which `JSON.stringify` drops entirely. With no safetySettings
+// reaching Cloud Code, Google applies its server-side safety defaults that false-flag benign
+// technical prompts as `prohibited_content` (HTTP 200 with a blocked body that combo failover
+// treats as terminal). The native Gemini paths all default to all-OFF
+// (DEFAULT_SAFETY_SETTINGS); Antigravity must match for parity.
+
+test("transformRequest defaults safetySettings to all-OFF when none supplied (#5003)", async () => {
+  const executor = new AntigravityExecutor();
+  const body = {
+    request: {
+      contents: [{ role: "user", parts: [{ text: "hi" }] }],
+      generationConfig: {},
+    },
+  };
+
+  const result = await executor.transformRequest("antigravity/claude-sonnet-4-6", body, true, {
+    projectId: "project-1",
+  });
+
+  if (result instanceof Response) throw new Error("Unexpected Response from transformRequest");
+  const innerRequest = result.request as Record<string, unknown>;
+  assert.deepEqual(
+    innerRequest.safetySettings,
+    DEFAULT_SAFETY_SETTINGS,
+    "safetySettings must default to all-OFF for parity with native Gemini paths"
+  );
+});
+
+test("transformRequest honors a caller-supplied safetySettings (#5003)", async () => {
+  const executor = new AntigravityExecutor();
+  const callerSafety = [
+    { category: "HARM_CATEGORY_HATE_SPEECH", threshold: "BLOCK_MEDIUM_AND_ABOVE" },
+  ];
+  const body = {
+    request: {
+      contents: [{ role: "user", parts: [{ text: "hi" }] }],
+      generationConfig: {},
+      safetySettings: callerSafety,
+    },
+  };
+
+  const result = await executor.transformRequest("antigravity/claude-sonnet-4-6", body, true, {
+    projectId: "project-1",
+  });
+
+  if (result instanceof Response) throw new Error("Unexpected Response from transformRequest");
+  const innerRequest = result.request as Record<string, unknown>;
+  assert.deepEqual(
+    innerRequest.safetySettings,
+    callerSafety,
+    "a caller-supplied safetySettings must not be clobbered"
+  );
+});
diff --git a/tests/unit/api/combo-error-response.test.ts b/tests/unit/api/combo-error-response.test.ts
new file mode 100644
index 0000000000..76bb0c341e
--- /dev/null
+++ b/tests/unit/api/combo-error-response.test.ts
@@ -0,0 +1,116 @@
+/**
+ * Unit tests for the standardized combo error response helper.
+ *
+ * Bug #3 from `plans/2026-06-23-omniroute-v3.8.34-deep-audit.md`:
+ * every 4xx response from `/api/combos/{id}` must include a stable
+ * machine-readable `code` token, an `error.message`, optional
+ * `error.details`, and `requestId` correlation. These tests assert the
+ * shape and HTTP status for every branch the route uses.
+ *
+ * Runner: node:test (the runner that collects tests/unit/api/**), not vitest —
+ * the original vitest import crashed under the node:test runner that the
+ * package.json glob also feeds it to (check:test-discovery).
+ */
+
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { buildComboErrorBody, comboErrorResponse } from "@/lib/api/comboErrorResponse";
+import { ERROR_CODES } from "@/shared/constants/errorCodes";
+
+describe("buildComboErrorBody", () => {
+  it("emits the canonical { error: { code, message, category } } envelope", () => {
+    const body = buildComboErrorBody("COMBO_001");
+    assert.equal(body.error.code, "COMBO_001");
+    assert.equal(body.error.message, "Request body is not valid JSON");
+    assert.equal(body.error.category, "COMBO");
+  });
+
+  it("includes details when provided", () => {
+    const body = buildComboErrorBody("COMBO_002", {
+      issues: [{ path: ["name"], message: "Required" }],
+    });
+    assert.equal(body.error.code, "COMBO_002");
+    assert.deepEqual(body.error.details, {
+      issues: [{ path: ["name"], message: "Required" }],
+    });
+  });
+
+  it("omits details when undefined", () => {
+    const body = buildComboErrorBody("COMBO_007");
+    assert.ok(!("details" in body.error));
+  });
+
+  it("falls back to INTERNAL_001 for an unknown code", () => {
+    const body = buildComboErrorBody(
+      "COMBO_999" as unknown as Parameters<typeof buildComboErrorBody>[0]
+    );
+    // An unknown code falls through to INTERNAL_001 from the catalog.
+    assert.equal(body.error.code, "INTERNAL_001");
+  });
+});
+
+describe("comboErrorResponse", () => {
+  it("returns the catalog httpStatus when no override is given", async () => {
+    const res = comboErrorResponse("COMBO_001");
+    assert.equal(res.status, ERROR_CODES.COMBO_001.httpStatus);
+    assert.equal(res.status, 400);
+    const body = await res.json();
+    assert.equal(body.error.code, "COMBO_001");
+  });
+
+  it("respects an explicit status override", async () => {
+    const res = comboErrorResponse("COMBO_006", 409, { name: "qs:foo" });
+    assert.equal(res.status, 409);
+    const body = await res.json();
+    assert.equal(body.error.code, "COMBO_006");
+    assert.deepEqual(body.error.details, { name: "qs:foo" });
+  });
+
+  it("attaches x-request-id when a Request is supplied", async () => {
+    const req = new Request("https://example.com/api/combos/abc", {
+      headers: { "x-request-id": "test-corr-id-1234" },
+    });
+    const res = comboErrorResponse("COMBO_004", 400, undefined, req);
+    assert.ok(res.headers.get("x-request-id"));
+  });
+
+  it("does NOT leak internal combo names in DAG errors (sanitized reason tag)", async () => {
+    // The route should translate a thrown `Error("cycle detected: combo-A")`
+    // into `{ reason: "cycle-detected" }` — never the raw message.
+    const reason = /cycle/i.test("cycle detected: combo-A") ? "cycle-detected" : "invalid-graph";
+    const res = comboErrorResponse("COMBO_005", 400, {
+      comboName: "user-facing-only",
+      reason,
+    });
+    assert.equal(res.status, 400);
+    const body = await res.json();
+    assert.equal(body.error.code, "COMBO_005");
+    assert.equal(body.error.details.reason, "cycle-detected");
+    // Crucial: the raw "combo-A" string must NOT appear in the response body.
+    const text = JSON.stringify(body);
+    assert.ok(!text.includes("combo-A"));
+  });
+});
+
+describe("all five route 4xx branches have a defined COMBO_* code", () => {
+  // The route uses these codes; this is a regression test against accidental
+  // removal of a code from the catalog (would break clients parsing `code`).
+  const expectedCodes = [
+    "COMBO_001", // JSON parse failure (route.ts L49-58)
+    "COMBO_002", // zod schema failure (route.ts L65)
+    "COMBO_003", // composite tier config (route.ts L117)
+    "COMBO_004", // name collision (route.ts L124)
+    "COMBO_005", // DAG validation (route.ts L139)
+    "COMBO_006", // quota-share conflict 409 (route.ts L71-78)
+    "COMBO_007", // not found 404 (route.ts L31)
+  ] as const;
+
+  for (const code of expectedCodes) {
+    it(`${code} is registered with httpStatus 400 or 409 or 404`, () => {
+      const def = ERROR_CODES[code];
+      assert.notEqual(def, undefined);
+      assert.ok([400, 404, 409].includes(def.httpStatus));
+      assert.equal(def.category, "COMBO");
+    });
+  }
+});
diff --git a/tests/unit/apikeys-model-permissions-split.test.ts b/tests/unit/apikeys-model-permissions-split.test.ts
new file mode 100644
index 0000000000..52f83886e8
--- /dev/null
+++ b/tests/unit/apikeys-model-permissions-split.test.ts
@@ -0,0 +1,42 @@
+// Characterization of the db/apiKeys.ts model-permission split (god-file decomposition): the pure
+// permission-matching logic (Claude-Code alias/prefix resolution + wildcard/glob matching) moved into
+// db/apiKeys/modelPermissions.ts. Behavior-preserving move — these functions decide whether a model is
+// allowed for a key, so the locks here exercise the wildcard semantics directly. The DB-backed
+// isModelAllowedForKey flow stays covered by api-key-policy / combo-provider-wildcard.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+const M = await import("../../src/lib/db/apiKeys/modelPermissions.ts");
+
+test("module exposes the matching helpers + Claude-Code alias sets", () => {
+  for (const name of [
+    "modelPatternMatches",
+    "matchesWildcardPattern",
+    "segmentMatchesWildcard",
+    "hasClaudeCodeWildcardPermission",
+    "isPotentialUnprefixedClaudeCodeModel",
+    "addModelCandidate",
+    "stripExtendedContextSuffix",
+  ]) {
+    assert.equal(typeof (M as Record<string, unknown>)[name], "function", `missing ${name}`);
+  }
+  assert.ok((M.CLAUDE_CODE_PROVIDER_PREFIXES as Set<string>).has("cc"));
+  assert.ok((M.CLAUDE_CODE_SHORT_ALIASES as Set<string>).has("sonnet"));
+});
+
+test("matchesWildcardPattern honors segment globs and exact matches", () => {
+  assert.equal(M.matchesWildcardPattern("openai/*", "openai/gpt-4o"), true);
+  assert.equal(M.matchesWildcardPattern("openai/*", "anthropic/claude"), false);
+  assert.equal(M.matchesWildcardPattern("gpt-4o", "gpt-4o"), true);
+});
+
+test("modelPatternMatches matches a candidate against an exact or wildcard pattern", () => {
+  assert.equal(M.modelPatternMatches("openai/*", ["openai/gpt-4o"]), true);
+  assert.equal(M.modelPatternMatches("gpt-4o", ["gpt-4o"]), true);
+  assert.equal(M.modelPatternMatches("gpt-4o", ["gpt-4o-mini"]), false);
+});
+
+test("stripExtendedContextSuffix removes the extended-context marker", () => {
+  const out = M.stripExtendedContextSuffix("claude-sonnet-4-5[1m]");
+  assert.equal(out.includes("[1m]"), false);
+});
diff --git a/tests/unit/apikeys-row-parsers-split.test.ts b/tests/unit/apikeys-row-parsers-split.test.ts
new file mode 100644
index 0000000000..3788f220be
--- /dev/null
+++ b/tests/unit/apikeys-row-parsers-split.test.ts
@@ -0,0 +1,90 @@
+// Characterization of the db/apiKeys.ts row-parsers split (god-file decomposition): the pure column
+// parsers that coerce raw SQLite values into typed shapes moved into db/apiKeys/rowParsers.ts, and the
+// two shared row types (AccessSchedule / RateLimitRule) into db/apiKeys/types.ts. Behavior-preserving
+// move — these locks pin the coercion semantics (JSON lists, 0/1 flags, nullable timestamps, schedule
+// validation) and that the host still re-exports the two public types. DB-backed hydration stays
+// covered by api-key-policy / combo-provider-wildcard.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+const P = await import("../../src/lib/db/apiKeys/rowParsers.ts");
+
+test("module exposes all fifteen parsers", () => {
+  for (const name of [
+    "parseAllowedModels",
+    "parseAllowedCombos",
+    "parseNoLog",
+    "parseAutoResolve",
+    "parseDisableNonPublicModels",
+    "parseAllowUsageCommand",
+    "parseIsActive",
+    "parseAccessSchedule",
+    "parseRateLimits",
+    "parseAllowedConnections",
+    "parseAllowedQuotas",
+    "parseStringList",
+    "parseNullableTimestamp",
+    "parseIsBanned",
+    "parseStreamDefaultMode",
+  ]) {
+    assert.equal(typeof (P as Record<string, unknown>)[name], "function", `missing ${name}`);
+  }
+});
+
+test("parseAllowedModels keeps only string entries, tolerates junk", () => {
+  assert.deepEqual(P.parseAllowedModels('["a","b",1,null]'), ["a", "b"]);
+  assert.deepEqual(P.parseAllowedModels(""), []);
+  assert.deepEqual(P.parseAllowedModels("not json"), []);
+  assert.deepEqual(P.parseAllowedModels(null), []);
+});
+
+test("flag parsers honor the 0/1/true/false matrix", () => {
+  assert.equal(P.parseNoLog(1), true);
+  assert.equal(P.parseNoLog("1"), true);
+  assert.equal(P.parseNoLog(0), false);
+  // isActive defaults to active unless explicitly falsy
+  assert.equal(P.parseIsActive(undefined), true);
+  assert.equal(P.parseIsActive(0), false);
+  assert.equal(P.parseIsActive("0"), false);
+  assert.equal(P.parseIsBanned(1), true);
+  assert.equal(P.parseIsBanned(0), false);
+});
+
+test("parseStreamDefaultMode collapses to legacy unless json", () => {
+  assert.equal(P.parseStreamDefaultMode("json"), "json");
+  assert.equal(P.parseStreamDefaultMode("legacy"), "legacy");
+  assert.equal(P.parseStreamDefaultMode("anything"), "legacy");
+});
+
+test("parseNullableTimestamp trims and nulls empties", () => {
+  assert.equal(P.parseNullableTimestamp("  2026-01-01  "), "2026-01-01");
+  assert.equal(P.parseNullableTimestamp("   "), null);
+  assert.equal(P.parseNullableTimestamp(42), null);
+});
+
+test("parseAccessSchedule validates shape + clamps days, else null", () => {
+  const ok = P.parseAccessSchedule(
+    JSON.stringify({ enabled: true, from: "08:00", until: "18:00", days: [0, 3, 9], tz: "UTC" })
+  );
+  assert.ok(ok);
+  assert.deepEqual(ok?.days, [0, 3]); // 9 dropped (out of 0..6)
+  assert.equal(P.parseAccessSchedule('{"enabled":true}'), null);
+  assert.equal(P.parseAccessSchedule("[]"), null);
+  assert.equal(P.parseAccessSchedule(""), null);
+});
+
+test("parseRateLimits keeps well-formed numeric rules only", () => {
+  const out = P.parseRateLimits(
+    JSON.stringify([{ limit: 10, window: 60 }, { limit: "x", window: 1 }, null])
+  );
+  assert.deepEqual(out, [{ limit: 10, window: 60 }]);
+  assert.equal(P.parseRateLimits("not array"), null);
+  assert.equal(P.parseRateLimits(""), null);
+});
+
+test("host re-exports the two public row types (compile-time) and the parsers stay wired", async () => {
+  // type-only re-export can't be probed at runtime; assert the host module still loads + exposes its API
+  const HOST = await import("../../src/lib/db/apiKeys.ts");
+  assert.equal(typeof (HOST as Record<string, unknown>).getApiKeys, "function");
+  assert.equal(typeof (HOST as Record<string, unknown>).isModelAllowedForKey, "function");
+});
diff --git a/tests/unit/base-executor-sanitize-effort.test.ts b/tests/unit/base-executor-sanitize-effort.test.ts
index fea0f6ffda..cfa6297201 100644
--- a/tests/unit/base-executor-sanitize-effort.test.ts
+++ b/tests/unit/base-executor-sanitize-effort.test.ts
@@ -88,6 +88,31 @@ test("sanitizeReasoningEffortForProvider: xiaomi-mimo normalizes max → xhigh b
   );
 });
 
+test("sanitizeReasoningEffortForProvider: Ollama Cloud preserves max", () => {
+  const log = makeLog();
+  const body = {
+    model: "glm-5.2",
+    reasoning_effort: "max",
+    messages: [{ role: "user", content: "hi" }],
+  };
+  const result = sanitizeReasoningEffortForProvider(body, "ollama-cloud", "glm-5.2", log);
+  assert.equal(result, body, "Ollama Cloud accepts max literally");
+  assert.equal((result as any).reasoning_effort, "max");
+  assert.equal(log.messages.length, 0);
+});
+
+test("sanitizeReasoningEffortForProvider: Ollama Cloud preserves nested max", () => {
+  const body = {
+    model: "glm-5.2",
+    reasoning: { effort: "max", summary: "auto" },
+    input: [],
+  };
+  const result = sanitizeReasoningEffortForProvider(body, "ollama-cloud", "glm-5.2", null);
+  assert.equal(result, body, "Ollama Cloud accepts max literally");
+  assert.equal((result as any).reasoning.effort, "max");
+  assert.equal((result as any).reasoning.summary, "auto");
+});
+
 test("sanitizeReasoningEffortForProvider: OpenRouter DeepSeek normalizes max → xhigh", () => {
   const log = makeLog();
   const body = {
diff --git a/tests/unit/build/check-test-runner-api.test.ts b/tests/unit/build/check-test-runner-api.test.ts
new file mode 100644
index 0000000000..8de6f9ffde
--- /dev/null
+++ b/tests/unit/build/check-test-runner-api.test.ts
@@ -0,0 +1,35 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { findRunnerMismatches } from "../../../scripts/check/check-test-runner-api.mjs";
+
+function tmpRepo() {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "runner-api-"));
+  fs.mkdirSync(path.join(root, "tests/unit/autoCombo"), { recursive: true });
+  return root;
+}
+
+test("flags a vitest-only-dir test that imports node:test", () => {
+  const root = tmpRepo();
+  fs.writeFileSync(
+    path.join(root, "tests/unit/autoCombo/bad.test.ts"),
+    `import { describe, it } from "node:test";\ndescribe("x", () => it("y", () => {}));\n`
+  );
+  const bad = findRunnerMismatches(root);
+  assert.equal(bad.length, 1);
+  assert.match(bad[0].file, /autoCombo\/bad\.test\.ts$/);
+  assert.match(bad[0].reason, /vitest-only/);
+  fs.rmSync(root, { recursive: true, force: true });
+});
+
+test("accepts a vitest-only-dir test that imports vitest", () => {
+  const root = tmpRepo();
+  fs.writeFileSync(
+    path.join(root, "tests/unit/autoCombo/good.test.ts"),
+    `import { describe, it } from "vitest";\ndescribe("x", () => it("y", () => {}));\n`
+  );
+  assert.equal(findRunnerMismatches(root).length, 0);
+  fs.rmSync(root, { recursive: true, force: true });
+});
diff --git a/tests/unit/build/optional-transformers-dependency.test.ts b/tests/unit/build/optional-transformers-dependency.test.ts
new file mode 100644
index 0000000000..7ebd121e07
--- /dev/null
+++ b/tests/unit/build/optional-transformers-dependency.test.ts
@@ -0,0 +1,45 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+const repoRoot = process.cwd();
+
+function readJson<T = Record<string, unknown>>(relPath: string): T {
+  return JSON.parse(readFileSync(join(repoRoot, relPath), "utf8")) as T;
+}
+
+test("@huggingface/transformers is optional so onnxruntime CUDA install failures cannot abort OmniRoute install", () => {
+  const pkg = readJson<{
+    dependencies?: Record<string, string>;
+    optionalDependencies?: Record<string, string>;
+  }>("package.json");
+
+  assert.equal(
+    pkg.dependencies?.["@huggingface/transformers"],
+    undefined,
+    "transformers must not be a regular dependency because it pulls onnxruntime-node install scripts"
+  );
+  assert.equal(pkg.optionalDependencies?.["@huggingface/transformers"], "3.5.2");
+});
+
+test("package-lock marks transformers and its onnxruntime runtime as optional", () => {
+  const lock = readJson<{
+    packages: Record<string, { optional?: boolean; dependencies?: Record<string, string>; optionalDependencies?: Record<string, string> }>;
+  }>("package-lock.json");
+
+  assert.equal(
+    lock.packages[""]?.dependencies?.["@huggingface/transformers"],
+    undefined,
+    "root lock dependencies must not keep transformers as mandatory"
+  );
+  assert.equal(lock.packages[""]?.optionalDependencies?.["@huggingface/transformers"], "3.5.2");
+
+  for (const packagePath of [
+    "node_modules/@huggingface/transformers",
+    "node_modules/onnxruntime-node",
+    "node_modules/onnxruntime-common",
+  ]) {
+    assert.equal(lock.packages[packagePath]?.optional, true, `${packagePath} should be optional`);
+  }
+});
diff --git a/tests/unit/build/sync-changelog-i18n.test.ts b/tests/unit/build/sync-changelog-i18n.test.ts
new file mode 100644
index 0000000000..14eb8247b0
--- /dev/null
+++ b/tests/unit/build/sync-changelog-i18n.test.ts
@@ -0,0 +1,47 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { syncChangelogSection } from "../../../scripts/release/sync-changelog-i18n.mjs";
+
+function repo() {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "cl-i18n-"));
+  fs.writeFileSync(
+    path.join(root, "CHANGELOG.md"),
+    "# Changelog\n\n## [Unreleased]\n\n---\n\n## [9.9.9] — 2026-01-01\n\n- **feat:** big new thing\n- **fix:** another\n\n---\n\n## [9.9.8] — 2025-12-01\n\n- old\n"
+  );
+  for (const loc of ["fr", "de"]) {
+    fs.mkdirSync(path.join(root, "docs/i18n", loc), { recursive: true });
+    fs.writeFileSync(
+      path.join(root, "docs/i18n", loc, "CHANGELOG.md"),
+      "# Changelog\n\n---\n\n## [9.9.9] — TBD\n\n_stub_\n\n---\n\n## [9.9.8] — 2025-12-01\n\n- old\n"
+    );
+  }
+  return root;
+}
+
+test("replaces the version section in every mirror with the root section", () => {
+  const root = repo();
+  const n = syncChangelogSection(root, "9.9.9", "9.9.8");
+  assert.equal(n, 2);
+  const fr = fs.readFileSync(path.join(root, "docs/i18n/fr/CHANGELOG.md"), "utf8");
+  assert.match(fr, /big new thing/);
+  assert.doesNotMatch(fr, /_stub_/);
+  fs.rmSync(root, { recursive: true, force: true });
+});
+
+test("inserts the section when a mirror lacks it", () => {
+  const root = repo();
+  // remove the 9.9.9 section from the fr mirror entirely
+  fs.writeFileSync(
+    path.join(root, "docs/i18n/fr/CHANGELOG.md"),
+    "# Changelog\n\n---\n\n## [9.9.8] — 2025-12-01\n\n- old\n"
+  );
+  const n = syncChangelogSection(root, "9.9.9", "9.9.8");
+  assert.equal(n, 2);
+  const fr = fs.readFileSync(path.join(root, "docs/i18n/fr/CHANGELOG.md"), "utf8");
+  assert.match(fr, /## \[9\.9\.9\]/);
+  assert.match(fr, /big new thing/);
+  fs.rmSync(root, { recursive: true, force: true });
+});
diff --git a/tests/unit/chatcore-client-usage-buffer.test.ts b/tests/unit/chatcore-client-usage-buffer.test.ts
new file mode 100644
index 0000000000..ab58ab4fd2
--- /dev/null
+++ b/tests/unit/chatcore-client-usage-buffer.test.ts
@@ -0,0 +1,78 @@
+// Characterization of applyClientUsageBuffer — the non-streaming usage buffer/estimate block
+// extracted from handleChatCore (chatCore god-file decomposition, #3501). Deps are injected so the
+// buffer-vs-estimate branch and the in-place mutation of translatedResponse.usage are observable.
+// Locks: usage present → buffer+filter; usage absent → estimate from content length; empty content
+// (length 2 from JSON.stringify("")) still estimates; the mutation target is translatedResponse.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+const { applyClientUsageBuffer } = await import(
+  "../../open-sse/handlers/chatCore/clientUsageBuffer.ts"
+);
+
+function makeDeps(overrides: Record<string, unknown> = {}) {
+  const calls = { buffer: [] as unknown[], estimate: [] as unknown[], filter: [] as unknown[] };
+  const deps = {
+    addBufferToUsage: (u: unknown) => {
+      calls.buffer.push(u);
+      return { ...(u as object), _buffered: true };
+    },
+    estimateUsage: (...a: unknown[]) => {
+      calls.estimate.push(a);
+      return { _estimated: true };
+    },
+    filterUsageForFormat: (u: unknown, _fmt: unknown) => {
+      calls.filter.push(u);
+      return { ...(u as object), _filtered: true };
+    },
+    ...overrides,
+  } as Parameters<typeof applyClientUsageBuffer>[3];
+  return { deps, calls };
+}
+
+test("usage present → buffer then filter, mutates in place", () => {
+  const { deps, calls } = makeDeps();
+  const resp: Record<string, unknown> = { usage: { prompt_tokens: 5 } };
+  applyClientUsageBuffer(resp, { messages: [] }, "openai", deps);
+  assert.equal(calls.buffer.length, 1);
+  assert.equal(calls.estimate.length, 0);
+  assert.equal((resp.usage as Record<string, unknown>)._buffered, true);
+  assert.equal((resp.usage as Record<string, unknown>)._filtered, true);
+});
+
+test("no usage but content present → estimate then filter", () => {
+  const { deps, calls } = makeDeps();
+  const resp: Record<string, unknown> = {
+    choices: [{ message: { content: "hello world" } }],
+  };
+  applyClientUsageBuffer(resp, { messages: [] }, "openai", deps);
+  assert.equal(calls.buffer.length, 0);
+  assert.equal(calls.estimate.length, 1);
+  assert.equal((resp.usage as Record<string, unknown>)._estimated, true);
+  assert.equal((resp.usage as Record<string, unknown>)._filtered, true);
+  // estimateUsage receives (body, contentLength, format)
+  const args = calls.estimate[0] as unknown[];
+  assert.equal(args[2], "openai");
+  assert.equal(typeof args[1], "number");
+});
+
+test("empty content → JSON.stringify('') length 2 > 0 still estimates", () => {
+  const { deps, calls } = makeDeps();
+  const resp: Record<string, unknown> = {};
+  applyClientUsageBuffer(resp, {}, "claude", deps);
+  // content "" → JSON.stringify("") = '""' length 2 → contentLength 2 > 0
+  assert.equal(calls.estimate.length, 1);
+  const args = calls.estimate[0] as unknown[];
+  assert.equal(args[1], 2);
+});
+
+test("content length is computed from choices[0].message.content", () => {
+  const { deps, calls } = makeDeps();
+  const resp: Record<string, unknown> = {
+    choices: [{ message: { content: "abc" } }],
+  };
+  applyClientUsageBuffer(resp, {}, "openai", deps);
+  // JSON.stringify("abc") = '"abc"' → length 5
+  const args = calls.estimate[0] as unknown[];
+  assert.equal(args[1], 5);
+});
diff --git a/tests/unit/chatcore-compression-analytics-write.test.ts b/tests/unit/chatcore-compression-analytics-write.test.ts
new file mode 100644
index 0000000000..15768b22e1
--- /dev/null
+++ b/tests/unit/chatcore-compression-analytics-write.test.ts
@@ -0,0 +1,129 @@
+// Characterization of writeCompressionAnalytics — the full compression analytics write extracted
+// from handleChatCore's request-setup compression path (chatCore god-file decomposition, #3501).
+// Returns the write promise; uses a real temp DB. Locks: the analytics row mapping (tokens, engine,
+// validation_fallback, output_mode), the per-engine breakdown insert, and fail-open.
+import { test, before, after } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const testDataDir = fs.mkdtempSync(path.join(os.tmpdir(), "omni-comp-analytics-test-"));
+process.env.DATA_DIR = testDataDir;
+
+const coreDb = await import("../../src/lib/db/core.ts");
+const { writeCompressionAnalytics } = await import(
+  "../../open-sse/handlers/chatCore/compressionAnalyticsWrite.ts"
+);
+
+type Stats = Parameters<typeof writeCompressionAnalytics>[0]["stats"];
+
+function makeStats(overrides: Record<string, unknown> = {}): Stats {
+  return {
+    originalTokens: 200,
+    compressedTokens: 80,
+    fallbackApplied: false,
+    engine: "rtk",
+    compressionComboId: null,
+    durationMs: 12,
+    rtkRawOutputPointers: [],
+    engineBreakdown: [],
+    ...overrides,
+  } as unknown as Stats;
+}
+
+function analyticsRow(requestId: string): Record<string, unknown> | undefined {
+  try {
+    return coreDb
+      .getDbInstance()
+      .prepare(
+        "SELECT mode, engine, original_tokens AS orig, compressed_tokens AS comp, tokens_saved AS saved, validation_fallback AS vf FROM compression_analytics WHERE request_id = ?"
+      )
+      .get(requestId) as Record<string, unknown> | undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function breakdownCount(requestId: string): number {
+  try {
+    const row = coreDb
+      .getDbInstance()
+      .prepare("SELECT COUNT(*) AS n FROM compression_engine_breakdown WHERE request_id = ?")
+      .get(requestId) as { n: number } | undefined;
+    return row?.n ?? 0;
+  } catch {
+    return 0;
+  }
+}
+
+async function waitFor(pred: () => boolean, timeoutMs = 3000) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline && !pred()) {
+    await new Promise((r) => setTimeout(r, 25));
+  }
+}
+
+function baseOpts(requestId: string, statsOverrides = {}) {
+  return {
+    stats: makeStats(statsOverrides),
+    provider: "openai",
+    effectiveModel: "gpt-x",
+    effectiveServiceTier: "standard",
+    comboName: null,
+    mode: "rtk",
+    compressionComboId: null,
+    skillRequestId: requestId,
+    cavemanOutputModeApplied: false,
+    cavemanOutputModeIntensity: null,
+  } as Parameters<typeof writeCompressionAnalytics>[0];
+}
+
+before(async () => {
+  await coreDb.ensureDbInitialized();
+});
+
+after(() => {
+  coreDb.resetDbInstance();
+  try {
+    fs.rmSync(testDataDir, { recursive: true, force: true });
+  } catch {
+    // best-effort cleanup
+  }
+});
+
+test("writes the analytics row with mapped tokens/engine and resolves", async () => {
+  await writeCompressionAnalytics(baseOpts("ca-req-1"));
+  const row = analyticsRow("ca-req-1");
+  assert.ok(row, "expected a compression_analytics row");
+  assert.equal(row!.engine, "rtk");
+  assert.equal(row!.orig, 200);
+  assert.equal(row!.comp, 80);
+  assert.equal(row!.saved, 120);
+  assert.equal(row!.vf, 0);
+});
+
+test("validation_fallback is 1 when the stats flagged a fallback", async () => {
+  await writeCompressionAnalytics(baseOpts("ca-req-2", { fallbackApplied: true }));
+  const row = analyticsRow("ca-req-2");
+  assert.equal(row!.vf, 1);
+});
+
+test("inserts a per-engine breakdown when present", async () => {
+  await writeCompressionAnalytics(
+    baseOpts("ca-req-3", {
+      engineBreakdown: [
+        { engine: "rtk", originalTokens: 200, compressedTokens: 120, durationMs: 5 },
+        { engine: "caveman", originalTokens: 120, compressedTokens: 80, durationMs: 4 },
+      ],
+    })
+  );
+  await waitFor(() => breakdownCount("ca-req-3") >= 2);
+  assert.equal(breakdownCount("ca-req-3"), 2);
+});
+
+test("never rejects even on a bad write (fail-open)", async () => {
+  coreDb.resetDbInstance();
+  await assert.doesNotReject(writeCompressionAnalytics(baseOpts("ca-req-4")));
+  await coreDb.ensureDbInitialized();
+});
diff --git a/tests/unit/chatcore-compression-combo-predicates.test.ts b/tests/unit/chatcore-compression-combo-predicates.test.ts
new file mode 100644
index 0000000000..34fb88761d
--- /dev/null
+++ b/tests/unit/chatcore-compression-combo-predicates.test.ts
@@ -0,0 +1,64 @@
+// Characterization of the pure compression-combo predicates extracted from handleChatCore's
+// compression setup (chatCore god-file decomposition, #3501). No DB, no handler state.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+const { isBuiltinStackedPipeline, isStackedCompressionCombo } = await import(
+  "../../open-sse/handlers/chatCore/compressionComboPredicates.ts"
+);
+
+test("isBuiltinStackedPipeline true only for the rtk(standard)→caveman(full) shape", () => {
+  assert.equal(
+    isBuiltinStackedPipeline([{ engine: "rtk" }, { engine: "caveman" }] as never),
+    true
+  );
+  assert.equal(
+    isBuiltinStackedPipeline([
+      { engine: "rtk", intensity: "standard" },
+      { engine: "caveman", intensity: "full" },
+    ] as never),
+    true
+  );
+});
+
+test("isBuiltinStackedPipeline false for wrong length / engines / intensities / config", () => {
+  assert.equal(isBuiltinStackedPipeline(undefined), false);
+  assert.equal(isBuiltinStackedPipeline([] as never), false);
+  assert.equal(isBuiltinStackedPipeline([{ engine: "rtk" }] as never), false);
+  assert.equal(
+    isBuiltinStackedPipeline([{ engine: "caveman" }, { engine: "rtk" }] as never),
+    false
+  );
+  assert.equal(
+    isBuiltinStackedPipeline([
+      { engine: "rtk", intensity: "aggressive" },
+      { engine: "caveman", intensity: "full" },
+    ] as never),
+    false
+  );
+  assert.equal(
+    isBuiltinStackedPipeline([
+      { engine: "rtk", config: { x: 1 } },
+      { engine: "caveman" },
+    ] as never),
+    false
+  );
+});
+
+test("isStackedCompressionCombo true when the combo has >= 1 pipeline layer", () => {
+  assert.equal(isStackedCompressionCombo(null), false);
+  assert.equal(
+    isStackedCompressionCombo({ id: "c", pipeline: [], languagePacks: [], outputMode: false, outputModeIntensity: "full" } as never),
+    false
+  );
+  assert.equal(
+    isStackedCompressionCombo({
+      id: "c",
+      pipeline: [{ engine: "rtk" }],
+      languagePacks: [],
+      outputMode: false,
+      outputModeIntensity: "full",
+    } as never),
+    true
+  );
+});
diff --git a/tests/unit/chatcore-compression-settings.test.ts b/tests/unit/chatcore-compression-settings.test.ts
new file mode 100644
index 0000000000..8ec9af0bd1
--- /dev/null
+++ b/tests/unit/chatcore-compression-settings.test.ts
@@ -0,0 +1,44 @@
+// Characterization of resolveCompressionSettings — the compression settings read extracted from
+// handleChatCore's Proactive Context Compression setup (chatCore god-file decomposition, #3501).
+// Uses a real temp DB (getCompressionSettings reads/seeds the settings row). Locks: the derived
+// enabled / contextEditingEnabled flags and the disabled fallback shape.
+import { test, before, after } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const testDataDir = fs.mkdtempSync(path.join(os.tmpdir(), "omni-comp-settings-test-"));
+process.env.DATA_DIR = testDataDir;
+
+const coreDb = await import("../../src/lib/db/core.ts");
+const { resolveCompressionSettings } = await import(
+  "../../open-sse/handlers/chatCore/compressionSettings.ts"
+);
+
+before(async () => {
+  await coreDb.ensureDbInitialized();
+});
+
+after(() => {
+  coreDb.resetDbInstance();
+  try {
+    fs.rmSync(testDataDir, { recursive: true, force: true });
+  } catch {
+    // best-effort cleanup
+  }
+});
+
+test("returns the settings object from the DB", async () => {
+  const result = await resolveCompressionSettings();
+  assert.ok(result.settings, "expected a settings object from the seeded DB");
+});
+
+test("derives enabled and contextEditingEnabled from the settings", async () => {
+  const result = await resolveCompressionSettings();
+  // `enabled` mirrors settings.enabled exactly
+  assert.equal(result.enabled, result.settings!.enabled);
+  // `contextEditingEnabled` is the strict === true derivation of the nested flag
+  assert.equal(result.contextEditingEnabled, result.settings!.contextEditing?.enabled === true);
+  assert.equal(typeof result.contextEditingEnabled, "boolean");
+});
diff --git a/tests/unit/chatcore-json-body-to-sse.test.ts b/tests/unit/chatcore-json-body-to-sse.test.ts
new file mode 100644
index 0000000000..ed778e5fec
--- /dev/null
+++ b/tests/unit/chatcore-json-body-to-sse.test.ts
@@ -0,0 +1,73 @@
+// Characterization of maybeConvertJsonBodyToSse — the #3089 non-SSE JSON → SSE conversion
+// extracted from handleChatCore's streaming entry (chatCore god-file decomposition, #3501). Real
+// Response objects + injected deps make the content-type gate, the synthesize-or-rebuild branch,
+// and the header rewrites observable. Locks: pass-through for SSE/ndjson/no-body, conversion to
+// text/event-stream when synthesizable, and rebuild-with-consumed-body otherwise.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+const { maybeConvertJsonBodyToSse } = await import(
+  "../../open-sse/handlers/chatCore/jsonBodyToSse.ts"
+);
+
+const ctx = { log: undefined, provider: "openai", model: "gpt-x" };
+
+function makeDeps(synth: (s: string) => string | null) {
+  return {
+    withBodyTimeout: async <T>(p: Promise<T>) => p,
+    synthesizeOpenAiSseFromJson: synth,
+  } as Parameters<typeof maybeConvertJsonBodyToSse>[2];
+}
+
+test("already text/event-stream → returned unchanged (same reference)", async () => {
+  const resp = new Response("data: {}\n\n", {
+    headers: { "content-type": "text/event-stream" },
+  });
+  const out = await maybeConvertJsonBodyToSse(resp, ctx, makeDeps(() => "X"));
+  assert.equal(out, resp);
+});
+
+test("application/x-ndjson → returned unchanged", async () => {
+  const resp = new Response('{"a":1}\n', { headers: { "content-type": "application/x-ndjson" } });
+  const out = await maybeConvertJsonBodyToSse(resp, ctx, makeDeps(() => "X"));
+  assert.equal(out, resp);
+});
+
+test("no body → returned unchanged", async () => {
+  const resp = new Response(null, { headers: { "content-type": "application/json" } });
+  const out = await maybeConvertJsonBodyToSse(resp, ctx, makeDeps(() => "X"));
+  assert.equal(out, resp);
+});
+
+test("application/json + synthesizable → SSE response with text/event-stream, no content-length", async () => {
+  const resp = new Response('{"choices":[]}', {
+    headers: { "content-type": "application/json", "content-length": "14" },
+  });
+  const out = await maybeConvertJsonBodyToSse(resp, ctx, makeDeps(() => "data: synth\n\n"));
+  assert.notEqual(out, resp);
+  assert.equal(out.headers.get("content-type"), "text/event-stream");
+  assert.equal(out.headers.get("content-length"), null);
+  assert.equal(await out.text(), "data: synth\n\n");
+});
+
+test("application/json + not synthesizable → rebuilt with consumed body, content-type unchanged", async () => {
+  const resp = new Response('{"not":"chat"}', {
+    headers: { "content-type": "application/json" },
+  });
+  const out = await maybeConvertJsonBodyToSse(resp, ctx, makeDeps(() => null));
+  assert.notEqual(out, resp);
+  // not converted → content-type stays application/json (rebuilt headers)
+  assert.equal(out.headers.get("content-type"), "application/json");
+  assert.equal(await out.text(), '{"not":"chat"}');
+});
+
+test("status and statusText are preserved on conversion", async () => {
+  const resp = new Response('{"choices":[]}', {
+    status: 201,
+    statusText: "Created",
+    headers: { "content-type": "application/json" },
+  });
+  const out = await maybeConvertJsonBodyToSse(resp, ctx, makeDeps(() => "data: x\n\n"));
+  assert.equal(out.status, 201);
+  assert.equal(out.statusText, "Created");
+});
diff --git a/tests/unit/chatcore-nonstreaming-response-headers.test.ts b/tests/unit/chatcore-nonstreaming-response-headers.test.ts
new file mode 100644
index 0000000000..d5a7a74044
--- /dev/null
+++ b/tests/unit/chatcore-nonstreaming-response-headers.test.ts
@@ -0,0 +1,73 @@
+// Characterization of buildNonStreamingResponseHeaders — the cache-MISS response header builder
+// extracted from handleChatCore's non-streaming success path (chatCore god-file decomposition,
+// #3501). attachOmniRouteMetaHeaders + now are injected so the static headers, the meta payload,
+// and the optional compression header are observable. Locks: Content-Type + cache MISS, latencyMs =
+// now - startTime, and the compression header only when meta is present.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+const { buildNonStreamingResponseHeaders } = await import(
+  "../../open-sse/handlers/chatCore/nonStreamingResponseHeaders.ts"
+);
+
+function makeDeps(now = 1000) {
+  const metaCalls: Array<{ headers: Record<string, string>; meta: Record<string, unknown> }> = [];
+  const deps = {
+    attachOmniRouteMetaHeaders: (headers: Record<string, string>, meta: Record<string, unknown>) => {
+      metaCalls.push({ headers, meta });
+      headers["x-omniroute-meta"] = "attached";
+    },
+    now: () => now,
+  } as Parameters<typeof buildNonStreamingResponseHeaders>[1];
+  return { deps, metaCalls };
+}
+
+function baseArgs(overrides: Record<string, unknown> = {}) {
+  return {
+    provider: "openai",
+    model: "gpt-x",
+    startTime: 600,
+    responseUsage: { prompt_tokens: 5 },
+    estimatedCost: 0.0012,
+    requestId: "req-1",
+    compressionResponseMeta: undefined,
+    ...overrides,
+  } as Parameters<typeof buildNonStreamingResponseHeaders>[0];
+}
+
+test("static headers: Content-Type json + cache MISS", () => {
+  const { deps } = makeDeps();
+  const h = buildNonStreamingResponseHeaders(baseArgs(), deps);
+  assert.equal(h["Content-Type"], "application/json");
+  // cache marker key/value
+  assert.ok(Object.values(h).includes("MISS"));
+});
+
+test("meta receives provider/model/cacheHit false/latency/usage/cost/requestId", () => {
+  const { deps, metaCalls } = makeDeps(1000);
+  buildNonStreamingResponseHeaders(baseArgs({ startTime: 600 }), deps);
+  assert.equal(metaCalls.length, 1);
+  const meta = metaCalls[0].meta;
+  assert.equal(meta.provider, "openai");
+  assert.equal(meta.model, "gpt-x");
+  assert.equal(meta.cacheHit, false);
+  assert.equal(meta.latencyMs, 400); // now 1000 - startTime 600
+  assert.deepEqual(meta.usage, { prompt_tokens: 5 });
+  assert.equal(meta.costUsd, 0.0012);
+  assert.equal(meta.requestId, "req-1");
+});
+
+test("no compression meta → no compression header", () => {
+  const { deps } = makeDeps();
+  const h = buildNonStreamingResponseHeaders(baseArgs({ compressionResponseMeta: undefined }), deps);
+  assert.ok(!Object.values(h).includes("engine:x"));
+});
+
+test("compression meta present → compression header set to that value", () => {
+  const { deps } = makeDeps();
+  const h = buildNonStreamingResponseHeaders(
+    baseArgs({ compressionResponseMeta: "engine:x; source=header" }),
+    deps
+  );
+  assert.ok(Object.values(h).includes("engine:x; source=header"));
+});
diff --git a/tests/unit/chatcore-output-style-telemetry.test.ts b/tests/unit/chatcore-output-style-telemetry.test.ts
new file mode 100644
index 0000000000..d91b3e0910
--- /dev/null
+++ b/tests/unit/chatcore-output-style-telemetry.test.ts
@@ -0,0 +1,102 @@
+// Characterization of emitOutputStyleTelemetry — the output-style run-telemetry hook extracted from
+// handleChatCore's request-setup compression path (chatCore god-file decomposition, #3501).
+// Fire-and-forget; uses a real temp DB and polls compression_run_telemetry. Locks: the null guard
+// (no-op), and that an applied output-style result records a run-telemetry row with the resolved
+// request id / model / provider / source.
+import { test, before, after } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const testDataDir = fs.mkdtempSync(path.join(os.tmpdir(), "omni-os-telemetry-test-"));
+process.env.DATA_DIR = testDataDir;
+
+const coreDb = await import("../../src/lib/db/core.ts");
+const { emitOutputStyleTelemetry } = await import(
+  "../../open-sse/handlers/chatCore/outputStyleTelemetry.ts"
+);
+
+function rowFor(requestId: string): Record<string, unknown> | undefined {
+  try {
+    return coreDb
+      .getDbInstance()
+      .prepare(
+        "SELECT request_id, model, provider, source FROM compression_run_telemetry WHERE request_id = ?"
+      )
+      .get(requestId) as Record<string, unknown> | undefined;
+  } catch {
+    // table is created lazily by the first fire-and-forget insert; treat "no such table" as "no row"
+    return undefined;
+  }
+}
+
+async function waitForRow(requestId: string, timeoutMs = 3000) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (rowFor(requestId)) break;
+    await new Promise((r) => setTimeout(r, 25));
+  }
+  return rowFor(requestId);
+}
+
+before(async () => {
+  await coreDb.ensureDbInitialized();
+});
+
+after(() => {
+  coreDb.resetDbInstance();
+  try {
+    fs.rmSync(testDataDir, { recursive: true, force: true });
+  } catch {
+    // best-effort cleanup
+  }
+});
+
+test("null outputStyleResult is a no-op (returns synchronously, no throw)", async () => {
+  assert.doesNotThrow(() =>
+    emitOutputStyleTelemetry({
+      outputStyleResult: null,
+      skillRequestId: "os-noop",
+      traceId: "t",
+      effectiveModel: "gpt-x",
+      provider: "openai",
+      compressionComboId: null,
+      estimatedTokens: 100,
+    })
+  );
+  await new Promise((r) => setTimeout(r, 80));
+  assert.equal(rowFor("os-noop"), undefined);
+});
+
+test("applied output-style result records a run-telemetry row (source=active-profile when combo id set)", async () => {
+  emitOutputStyleTelemetry({
+    outputStyleResult: { body: {} as never, applied: true, appliedStyles: [], skippedReason: undefined },
+    skillRequestId: "os-req-1",
+    traceId: "trace-1",
+    effectiveModel: "gpt-os",
+    provider: "openai",
+    compressionComboId: "combo-9",
+    estimatedTokens: 250,
+  });
+  const row = await waitForRow("os-req-1");
+  assert.ok(row, "expected a compression_run_telemetry row");
+  assert.equal(row!.model, "gpt-os");
+  assert.equal(row!.provider, "openai");
+  assert.equal(row!.source, "active-profile");
+});
+
+test("falls back to traceId for request id and source=default without a combo id", async () => {
+  emitOutputStyleTelemetry({
+    outputStyleResult: { body: {} as never, applied: true, appliedStyles: [] },
+    skillRequestId: null,
+    traceId: "os-trace-2",
+    effectiveModel: "gpt-x",
+    provider: "anthropic",
+    compressionComboId: null,
+    estimatedTokens: 10,
+  });
+  const row = await waitForRow("os-trace-2");
+  assert.ok(row, "expected the row keyed by the traceId fallback");
+  assert.equal(row!.source, "default");
+});
diff --git a/tests/unit/chatcore-plugin-onrequest.test.ts b/tests/unit/chatcore-plugin-onrequest.test.ts
new file mode 100644
index 0000000000..ed343e006a
--- /dev/null
+++ b/tests/unit/chatcore-plugin-onrequest.test.ts
@@ -0,0 +1,73 @@
+// Characterization of runPluginOnRequestHook — the plugin onRequest gate extracted from
+// handleChatCore's request entry (chatCore god-file decomposition, #3501). Hooks are in-memory.
+// Locks: the discriminated result — blocked (403 Response) vs body-rewrite vs pass-through — and
+// fail-open on a throwing hook.
+import { test, afterEach } from "node:test";
+import assert from "node:assert/strict";
+
+const { registerHook, unregisterHook } = await import("../../src/lib/plugins/hooks.ts");
+const { runPluginOnRequestHook } = await import(
+  "../../open-sse/handlers/chatCore/pluginOnRequest.ts"
+);
+
+const PLUGIN = "test-onrequest-plugin";
+
+afterEach(() => {
+  unregisterHook("onRequest", PLUGIN);
+});
+
+function baseArgs(overrides: Record<string, unknown> = {}) {
+  return {
+    requestId: "req-1",
+    body: { messages: [{ role: "user", content: "hi" }] },
+    model: "gpt-x",
+    provider: "openai",
+    apiKeyInfo: null,
+    ...overrides,
+  } as Parameters<typeof runPluginOnRequestHook>[0];
+}
+
+test("no registered hooks → pass-through (blocked:false, no body)", async () => {
+  const gate = await runPluginOnRequestHook(baseArgs());
+  assert.equal(gate.blocked, false);
+});
+
+test("a blocking hook → blocked:true with a 403 JSON Response", async () => {
+  registerHook("onRequest", PLUGIN, async () => ({
+    blocked: true,
+    response: { error: "nope" },
+  }));
+  const gate = await runPluginOnRequestHook(baseArgs());
+  assert.equal(gate.blocked, true);
+  if (!gate.blocked) return;
+  assert.equal(gate.response.status, 403);
+  const payload = await gate.response.json();
+  assert.deepEqual(payload, { error: "nope" });
+});
+
+test("a blocking hook without a response → generic plugin_block 403", async () => {
+  registerHook("onRequest", PLUGIN, async () => ({ blocked: true }));
+  const gate = await runPluginOnRequestHook(baseArgs());
+  assert.equal(gate.blocked, true);
+  if (!gate.blocked) return;
+  assert.equal(gate.response.status, 403);
+  const payload = (await gate.response.json()) as { error?: { type?: string } };
+  assert.equal(payload.error?.type, "plugin_block");
+});
+
+test("a body-rewriting hook → blocked:false with the new body", async () => {
+  const rewritten = { messages: [{ role: "user", content: "rewritten" }] };
+  registerHook("onRequest", PLUGIN, async () => ({ body: rewritten }));
+  const gate = await runPluginOnRequestHook(baseArgs());
+  assert.equal(gate.blocked, false);
+  if (gate.blocked) return;
+  assert.deepEqual(gate.body, rewritten);
+});
+
+test("a throwing hook → fail-open pass-through (blocked:false)", async () => {
+  registerHook("onRequest", PLUGIN, async () => {
+    throw new Error("boom");
+  });
+  const gate = await runPluginOnRequestHook(baseArgs());
+  assert.equal(gate.blocked, false);
+});
diff --git a/tests/unit/chatcore-postcall-guardrail-context.test.ts b/tests/unit/chatcore-postcall-guardrail-context.test.ts
new file mode 100644
index 0000000000..c539e7e1ea
--- /dev/null
+++ b/tests/unit/chatcore-postcall-guardrail-context.test.ts
@@ -0,0 +1,72 @@
+// Characterization of buildPostCallGuardrailContext — the context object passed to
+// guardrailRegistry.runPostCallHooks, extracted from handleChatCore (chatCore god-file
+// decomposition, #3501). resolveDisabledGuardrails is injected so the mapping is observable in
+// isolation. Locks: the field mapping (sourceFormat/targetFormat), the constants (method "POST",
+// stream false), endpoint/headers null-coalescing, and that disabled-resolution gets apiKeyInfo/
+// body/headers.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+const { buildPostCallGuardrailContext } = await import(
+  "../../open-sse/handlers/chatCore/postCallGuardrailContext.ts"
+);
+
+function baseArgs(overrides: Record<string, unknown> = {}) {
+  return {
+    apiKeyInfo: { id: "key-1" },
+    body: { messages: [] },
+    clientRawRequest: { headers: { "x-test": "1" }, endpoint: "/v1/chat/completions" },
+    log: { tag: "log" },
+    model: "gpt-x",
+    provider: "openai",
+    responsePayloadFormat: "openai",
+    clientResponseFormat: "claude",
+    ...overrides,
+  } as Parameters<typeof buildPostCallGuardrailContext>[0];
+}
+
+test("maps fields, constants, and source/target formats", () => {
+  const seen: unknown[] = [];
+  const ctx = buildPostCallGuardrailContext(baseArgs(), (arg: unknown) => {
+    seen.push(arg);
+    return ["g1"];
+  });
+  assert.equal(ctx.method, "POST");
+  assert.equal(ctx.stream, false);
+  assert.equal(ctx.model, "gpt-x");
+  assert.equal(ctx.provider, "openai");
+  assert.equal(ctx.sourceFormat, "openai");
+  assert.equal(ctx.targetFormat, "claude");
+  assert.equal(ctx.endpoint, "/v1/chat/completions");
+  assert.deepEqual(ctx.disabledGuardrails, ["g1"]);
+  // resolveDisabledGuardrails received apiKeyInfo/body/headers
+  assert.deepEqual(seen[0], {
+    apiKeyInfo: { id: "key-1" },
+    body: { messages: [] },
+    headers: { "x-test": "1" },
+  });
+});
+
+test("null clientRawRequest → endpoint/headers null", () => {
+  const ctx = buildPostCallGuardrailContext(baseArgs({ clientRawRequest: null }), () => []);
+  assert.equal(ctx.endpoint, null);
+  assert.equal(ctx.headers, null);
+});
+
+test("missing endpoint → null (|| null), headers passes through", () => {
+  const ctx = buildPostCallGuardrailContext(
+    baseArgs({ clientRawRequest: { headers: { a: "b" } } }),
+    () => []
+  );
+  assert.equal(ctx.endpoint, null);
+  assert.deepEqual(ctx.headers, { a: "b" });
+});
+
+test("null apiKeyInfo coalesces to null for resolveDisabledGuardrails", () => {
+  let received: { apiKeyInfo?: unknown } = {};
+  buildPostCallGuardrailContext(baseArgs({ apiKeyInfo: null }), (arg: { apiKeyInfo?: unknown }) => {
+    received = arg;
+    return [];
+  });
+  assert.equal(received.apiKeyInfo, null);
+});
diff --git a/tests/unit/chatcore-semantic-cache-store.test.ts b/tests/unit/chatcore-semantic-cache-store.test.ts
new file mode 100644
index 0000000000..068b2d28cc
--- /dev/null
+++ b/tests/unit/chatcore-semantic-cache-store.test.ts
@@ -0,0 +1,109 @@
+// Characterization of storeSemanticCacheResponse — the Phase 9.1 non-streaming semantic-cache
+// store extracted from handleChatCore (chatCore god-file decomposition, #3501). Deps are injected
+// so the gating logic + signature derivation are observable without the real cache backend.
+// Locks: the 3-way gate (enabled + cacheable-for-write + small-enough), the signature args
+// (messages ?? input, temperature, top_p, apiKeyId), and the `prompt + completion || 0` token count.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+const { storeSemanticCacheResponse } = await import(
+  "../../open-sse/handlers/chatCore/semanticCacheStore.ts"
+);
+
+type Stored = { sig: unknown; model: string; response: unknown; tokens: number };
+
+function makeDeps(overrides: Record<string, unknown> = {}) {
+  const stored: Stored[] = [];
+  const calls = { cacheable: 0, small: 0, signature: 0 };
+  const deps = {
+    isCacheableForWrite: (..._a: unknown[]) => {
+      calls.cacheable++;
+      return true;
+    },
+    isSmallEnoughForSemanticCache: (..._a: unknown[]) => {
+      calls.small++;
+      return true;
+    },
+    generateSignature: (...a: unknown[]) => {
+      calls.signature++;
+      return `sig:${JSON.stringify(a)}`;
+    },
+    setCachedResponse: (sig: unknown, model: string, response: unknown, tokens: number) => {
+      stored.push({ sig, model, response, tokens });
+    },
+    ...overrides,
+  } as Parameters<typeof storeSemanticCacheResponse>[1];
+  return { deps, stored, calls };
+}
+
+function baseArgs(overrides: Record<string, unknown> = {}) {
+  return {
+    enabled: true,
+    body: { messages: [{ role: "user", content: "hi" }], temperature: 0, top_p: 1 },
+    headers: undefined,
+    translatedResponse: { id: "resp-1" },
+    model: "gpt-x",
+    apiKeyId: "key-1",
+    usage: { prompt_tokens: 10, completion_tokens: 5 },
+    log: undefined,
+    ...overrides,
+  } as Parameters<typeof storeSemanticCacheResponse>[0];
+}
+
+test("happy path → stores under a signature, tokensSaved = prompt + completion", () => {
+  const { deps, stored } = makeDeps();
+  storeSemanticCacheResponse(baseArgs(), deps);
+  assert.equal(stored.length, 1);
+  assert.equal(stored[0].model, "gpt-x");
+  assert.deepEqual(stored[0].response, { id: "resp-1" });
+  assert.equal(stored[0].tokens, 15);
+});
+
+test("disabled → no store, no gate calls past enabled", () => {
+  const { deps, stored, calls } = makeDeps();
+  storeSemanticCacheResponse(baseArgs({ enabled: false }), deps);
+  assert.equal(stored.length, 0);
+  assert.equal(calls.cacheable, 0);
+});
+
+test("not cacheable-for-write → no store", () => {
+  const { deps, stored } = makeDeps({ isCacheableForWrite: () => false });
+  storeSemanticCacheResponse(baseArgs(), deps);
+  assert.equal(stored.length, 0);
+});
+
+test("too large → no store", () => {
+  const { deps, stored } = makeDeps({ isSmallEnoughForSemanticCache: () => false });
+  storeSemanticCacheResponse(baseArgs(), deps);
+  assert.equal(stored.length, 0);
+});
+
+test("signature uses messages when present, with model/temperature/top_p/apiKeyId", () => {
+  const { deps, stored } = makeDeps();
+  storeSemanticCacheResponse(baseArgs(), deps);
+  const sig = stored[0].sig as string;
+  assert.ok(sig.includes("gpt-x"));
+  assert.ok(sig.includes("key-1"));
+});
+
+test("falls back to body.input when messages absent", () => {
+  let captured: unknown[] = [];
+  const { deps } = makeDeps({
+    generateSignature: (...a: unknown[]) => {
+      captured = a;
+      return "sig";
+    },
+  });
+  storeSemanticCacheResponse(
+    baseArgs({ body: { input: "the-input", temperature: 0, top_p: 1 } }),
+    deps
+  );
+  // args: (model, messages ?? input, temperature, top_p, apiKeyId)
+  assert.equal(captured[1], "the-input");
+});
+
+test("missing usage → tokensSaved coerces to 0 (NaN || 0)", () => {
+  const { deps, stored } = makeDeps();
+  storeSemanticCacheResponse(baseArgs({ usage: undefined }), deps);
+  assert.equal(stored[0].tokens, 0);
+});
diff --git a/tests/unit/chatcore-streaming-cache-store.test.ts b/tests/unit/chatcore-streaming-cache-store.test.ts
new file mode 100644
index 0000000000..8ee5fb264c
--- /dev/null
+++ b/tests/unit/chatcore-streaming-cache-store.test.ts
@@ -0,0 +1,96 @@
+// Characterization of storeStreamingSemanticCacheResponse — the streaming Phase 9.1 cache store
+// extracted from handleChatCore's onStreamComplete (chatCore god-file decomposition, #3501). Deps
+// are injected so the gate + `_streamed` strip + signature + token accounting are observable
+// without the real cache backend. Locks: the 4-way gate (enabled + status 200 + body + cacheable),
+// the `_streamed` strip, skip-on-too-large, `Number(...) || 0` tokens, and fail-open on throw.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+const { storeStreamingSemanticCacheResponse } = await import(
+  "../../open-sse/handlers/chatCore/streamingSemanticCacheStore.ts"
+);
+
+type Stored = { sig: unknown; model: string; body: Record<string, unknown>; tokens: number };
+
+function makeDeps(overrides: Record<string, unknown> = {}) {
+  const stored: Stored[] = [];
+  const deps = {
+    isCacheableForWrite: () => true,
+    isSmallEnoughForSemanticCache: () => true,
+    generateSignature: (...a: unknown[]) => `sig:${JSON.stringify(a)}`,
+    setCachedResponse: (sig: unknown, model: string, body: Record<string, unknown>, tokens: number) =>
+      stored.push({ sig, model, body, tokens }),
+    ...overrides,
+  } as Parameters<typeof storeStreamingSemanticCacheResponse>[1];
+  return { deps, stored };
+}
+
+function baseArgs(overrides: Record<string, unknown> = {}) {
+  return {
+    enabled: true,
+    streamStatus: 200,
+    streamResponseBody: { id: "resp-1", _streamed: true },
+    body: { messages: [{ role: "user", content: "hi" }], temperature: 0, top_p: 1 },
+    headers: undefined,
+    model: "gpt-x",
+    apiKeyId: "key-1",
+    streamUsage: { prompt_tokens: 12, completion_tokens: 8 },
+    log: undefined,
+    ...overrides,
+  } as Parameters<typeof storeStreamingSemanticCacheResponse>[0];
+}
+
+test("happy path → stores cleaned body (no _streamed), tokens = prompt + completion", () => {
+  const { deps, stored } = makeDeps();
+  storeStreamingSemanticCacheResponse(baseArgs(), deps);
+  assert.equal(stored.length, 1);
+  assert.equal(stored[0].model, "gpt-x");
+  assert.equal(stored[0].tokens, 20);
+  assert.equal("_streamed" in stored[0].body, false);
+  assert.equal(stored[0].body.id, "resp-1");
+});
+
+test("non-200 stream status → no store", () => {
+  const { deps, stored } = makeDeps();
+  storeStreamingSemanticCacheResponse(baseArgs({ streamStatus: 500 }), deps);
+  assert.equal(stored.length, 0);
+});
+
+test("disabled → no store", () => {
+  const { deps, stored } = makeDeps();
+  storeStreamingSemanticCacheResponse(baseArgs({ enabled: false }), deps);
+  assert.equal(stored.length, 0);
+});
+
+test("missing response body → no store", () => {
+  const { deps, stored } = makeDeps();
+  storeStreamingSemanticCacheResponse(baseArgs({ streamResponseBody: null }), deps);
+  assert.equal(stored.length, 0);
+});
+
+test("not cacheable-for-write → no store", () => {
+  const { deps, stored } = makeDeps({ isCacheableForWrite: () => false });
+  storeStreamingSemanticCacheResponse(baseArgs(), deps);
+  assert.equal(stored.length, 0);
+});
+
+test("too large → no store (early return inside try)", () => {
+  const { deps, stored } = makeDeps({ isSmallEnoughForSemanticCache: () => false });
+  storeStreamingSemanticCacheResponse(baseArgs(), deps);
+  assert.equal(stored.length, 0);
+});
+
+test("missing usage → tokens coerce to 0", () => {
+  const { deps, stored } = makeDeps();
+  storeStreamingSemanticCacheResponse(baseArgs({ streamUsage: null }), deps);
+  assert.equal(stored[0].tokens, 0);
+});
+
+test("a throwing dep is swallowed (fail-open, non-critical)", () => {
+  const { deps } = makeDeps({
+    setCachedResponse: () => {
+      throw new Error("cache write boom");
+    },
+  });
+  assert.doesNotThrow(() => storeStreamingSemanticCacheResponse(baseArgs(), deps));
+});
diff --git a/tests/unit/chatcore-streaming-pipeline.test.ts b/tests/unit/chatcore-streaming-pipeline.test.ts
new file mode 100644
index 0000000000..c112ff6d21
--- /dev/null
+++ b/tests/unit/chatcore-streaming-pipeline.test.ts
@@ -0,0 +1,102 @@
+// Characterization of assembleStreamingPipeline — the streaming transform-chain assembly extracted
+// from handleChatCore's streaming success path (chatCore god-file decomposition, #3501). All
+// transform factories are injected; a fake "stream" records each pipeThrough so the exact chain
+// order and the branch conditions (PII explicit vs feature-flag, progress, echo) are observable
+// without real ReadableStreams. Locks: transform order, the progress header side-effect, and the
+// PII branch precedence (explicit createPiiTransform wins over the feature flag).
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+const { assembleStreamingPipeline } = await import(
+  "../../open-sse/handlers/chatCore/streamingPipeline.ts"
+);
+
+// A fake stream: each pipeThrough appends the transform's tag and returns a new fake stream.
+function fakeStream(tag: string, log: string[]) {
+  return {
+    tag,
+    pipeThrough(t: { __tag: string }) {
+      log.push(t.__tag);
+      return fakeStream(t.__tag, log);
+    },
+  };
+}
+
+function makeDeps(over: Record<string, unknown> = {}) {
+  const log: string[] = [];
+  const deps = {
+    wantsProgress: () => false,
+    pipeWithDisconnect: (..._a: unknown[]) => fakeStream("pii-base", log),
+    isFeatureFlagEnabled: () => false,
+    createPiiSseTransform: () => ({ __tag: "pii-flag" }),
+    createProgressTransform: () => ({ __tag: "progress" }),
+    createSseHeartbeatTransform: () => ({ __tag: "heartbeat" }),
+    shapeForClientFormat: (f: unknown) => f,
+    createModelEchoTransform: () => ({ __tag: "echo" }),
+    ...over,
+  } as Parameters<typeof assembleStreamingPipeline>[1];
+  return { deps, log };
+}
+
+function baseArgs(over: Record<string, unknown> = {}) {
+  return {
+    providerResponse: {},
+    transformStream: {},
+    streamController: { signal: {} as AbortSignal },
+    createPiiTransform: undefined,
+    clientRawRequestHeaders: null,
+    clientResponseFormat: "openai",
+    echoModel: null,
+    responseHeaders: {} as Record<string, string>,
+    ...over,
+  } as Parameters<typeof assembleStreamingPipeline>[0];
+}
+
+test("baseline (no pii, no progress, no echo) → only heartbeat in the chain", () => {
+  const { deps, log } = makeDeps();
+  assembleStreamingPipeline(baseArgs(), deps);
+  assert.deepEqual(log, ["heartbeat"]);
+});
+
+test("feature-flag PII → pii-flag transform applied before heartbeat", () => {
+  const { deps, log } = makeDeps({ isFeatureFlagEnabled: () => true });
+  assembleStreamingPipeline(baseArgs(), deps);
+  assert.deepEqual(log, ["pii-flag", "heartbeat"]);
+});
+
+test("explicit createPiiTransform wins over the feature flag", () => {
+  const { deps, log } = makeDeps({ isFeatureFlagEnabled: () => true });
+  const explicit = () => ({ __tag: "pii-explicit" });
+  assembleStreamingPipeline(baseArgs({ createPiiTransform: explicit }), deps);
+  assert.deepEqual(log, ["pii-explicit", "heartbeat"]);
+});
+
+test("progress enabled → progress transform + progress header set", () => {
+  const { deps, log } = makeDeps({ wantsProgress: () => true });
+  const args = baseArgs();
+  assembleStreamingPipeline(args, deps);
+  assert.deepEqual(log, ["progress", "heartbeat"]);
+  assert.ok(Object.values(args.responseHeaders).includes("enabled"));
+});
+
+test("progress disabled → no progress header", () => {
+  const { deps } = makeDeps({ wantsProgress: () => false });
+  const args = baseArgs();
+  assembleStreamingPipeline(args, deps);
+  assert.deepEqual(args.responseHeaders, {});
+});
+
+test("echoModel set → echo transform applied last", () => {
+  const { deps, log } = makeDeps();
+  assembleStreamingPipeline(baseArgs({ echoModel: "alias-x" }), deps);
+  assert.deepEqual(log, ["heartbeat", "echo"]);
+});
+
+test("full chain order: pii → progress → heartbeat → echo", () => {
+  const { deps, log } = makeDeps({
+    isFeatureFlagEnabled: () => true,
+    wantsProgress: () => true,
+  });
+  assembleStreamingPipeline(baseArgs({ echoModel: "alias-x" }), deps);
+  assert.deepEqual(log, ["pii-flag", "progress", "heartbeat", "echo"]);
+});
diff --git a/tests/unit/chatcore-streaming-response-headers.test.ts b/tests/unit/chatcore-streaming-response-headers.test.ts
new file mode 100644
index 0000000000..8b714ca4eb
--- /dev/null
+++ b/tests/unit/chatcore-streaming-response-headers.test.ts
@@ -0,0 +1,65 @@
+// Characterization of assembleStreamingResponseHeaders — the streaming response header builder
+// extracted from handleChatCore's streaming success path (chatCore god-file decomposition, #3501).
+// buildStreamingResponseHeaders is injected so the merge of upstream headers + request-id + the
+// optional compression header is observable. Locks: zeroed latency/usage/cost at stream start, the
+// x-omniroute-request-id, and the compression header only when meta is present.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+const { assembleStreamingResponseHeaders } = await import(
+  "../../open-sse/handlers/chatCore/streamingResponseHeaders.ts"
+);
+
+function makeBuild() {
+  const calls: Array<{ headers: unknown; meta: Record<string, unknown> }> = [];
+  const build = (headers: unknown, meta: Record<string, unknown>) => {
+    calls.push({ headers, meta });
+    return { "x-upstream": "kept" };
+  };
+  return { build: build as Parameters<typeof assembleStreamingResponseHeaders>[1], calls };
+}
+
+function baseArgs(overrides: Record<string, unknown> = {}) {
+  return {
+    providerHeaders: new Headers({ "content-type": "text/event-stream" }),
+    provider: "openai",
+    model: "gpt-x",
+    pendingRequestId: "preq-1",
+    compressionResponseMeta: undefined,
+    ...overrides,
+  } as Parameters<typeof assembleStreamingResponseHeaders>[0];
+}
+
+test("merges upstream headers and sets x-omniroute-request-id", () => {
+  const { build } = makeBuild();
+  const h = assembleStreamingResponseHeaders(baseArgs(), build);
+  assert.equal(h["x-upstream"], "kept");
+  assert.equal(h["x-omniroute-request-id"], "preq-1");
+});
+
+test("buildStreamingResponseHeaders receives zeroed latency/usage/cost and cacheHit false", () => {
+  const { build, calls } = makeBuild();
+  assembleStreamingResponseHeaders(baseArgs(), build);
+  assert.equal(calls.length, 1);
+  assert.equal(calls[0].meta.cacheHit, false);
+  assert.equal(calls[0].meta.latencyMs, 0);
+  assert.equal(calls[0].meta.usage, null);
+  assert.equal(calls[0].meta.costUsd, 0);
+  assert.equal(calls[0].meta.provider, "openai");
+  assert.equal(calls[0].meta.model, "gpt-x");
+});
+
+test("no compression meta → no compression header", () => {
+  const { build } = makeBuild();
+  const h = assembleStreamingResponseHeaders(baseArgs({ compressionResponseMeta: undefined }), build);
+  assert.ok(!Object.values(h).includes("engine:z"));
+});
+
+test("compression meta present → compression header set", () => {
+  const { build } = makeBuild();
+  const h = assembleStreamingResponseHeaders(
+    baseArgs({ compressionResponseMeta: "engine:z; source=routing" }),
+    build
+  );
+  assert.ok(Object.values(h).includes("engine:z; source=routing"));
+});
diff --git a/tests/unit/chatgpt-web.test.ts b/tests/unit/chatgpt-web.test.ts
index b1766c7069..a0547d6589 100644
--- a/tests/unit/chatgpt-web.test.ts
+++ b/tests/unit/chatgpt-web.test.ts
@@ -1119,6 +1119,13 @@ test("Executor MODEL_MAP: dot-form OmniRoute IDs translate to dash-form ChatGPT
       ["gpt-5.4-thinking-mini", "gpt-5-4-t-mini"],
       ["gpt-5.2-thinking", "gpt-5-2-thinking"],
       ["o3", "o3"],
+      // Regression #4665: these advertised catalog ids were missing from
+      // MODEL_MAP and fell through as their dot-form slug verbatim, which the
+      // ChatGPT backend-api silently rejects → served the default Plus model.
+      ["gpt-5.5", "gpt-5-5"],
+      ["gpt-5.5-pro", "gpt-5-5-pro"],
+      ["gpt-5.4-pro", "gpt-5-4-pro"],
+      ["gpt-5.2-pro", "gpt-5-2-pro"],
     ];
     for (const [omniId, expectedSlug] of cases) {
       m.calls.urls.length = 0;
@@ -1141,6 +1148,45 @@ test("Executor MODEL_MAP: dot-form OmniRoute IDs translate to dash-form ChatGPT
   }
 });
 
+test("MODEL_MAP drift guard: every advertised dot-form catalog id resolves to a dash-form backend slug (no verbatim fall-through) (#4665)", async () => {
+  reset();
+  const { getRegistryEntry } = await import("../../open-sse/config/providerRegistry.ts");
+  const ids = (getRegistryEntry("chatgpt-web")?.models || []).map((m) => m.id);
+  // Dot-form ids must never reach the ChatGPT backend verbatim — the backend
+  // only accepts dash-form slugs. (Ids that are already dash-form, e.g.
+  // "gpt-4-5", legitimately pass through unchanged and are exempt.)
+  const dotFormIds = ids.filter((id) => id.includes("."));
+  const m = installMockFetch();
+  try {
+    for (const omniId of dotFormIds) {
+      m.calls.urls.length = 0;
+      m.calls.bodies.length = 0;
+      const executor = new ChatGptWebExecutor();
+      await executor.execute({
+        model: omniId,
+        body: { messages: [{ role: "user", content: "hi" }] },
+        stream: false,
+        credentials: { apiKey: "test" },
+        signal: AbortSignal.timeout(10_000),
+        log: null,
+      });
+      const convIdx = m.calls.urls.findIndex((u) => u.endsWith("/backend-api/f/conversation"));
+      const body = JSON.parse(m.calls.bodies[convIdx]);
+      assert.ok(
+        !body.model.includes("."),
+        `${omniId} reached the backend as "${body.model}" (still dot-form) — missing MODEL_MAP entry causes silent model substitution`,
+      );
+      assert.notEqual(
+        body.model,
+        omniId,
+        `${omniId} fell through MODEL_MAP verbatim — add a dash-form mapping`,
+      );
+    }
+  } finally {
+    m.restore();
+  }
+});
+
 // ─── thinking_effort PATCH user_last_used_model_config ─────────────────────
 
 test("thinking_effort: high → PATCH user_last_used_model_config with extended", async () => {
diff --git a/tests/unit/check-db-rules-classification.test.ts b/tests/unit/check-db-rules-classification.test.ts
index 0124a7480c..2c131bc18d 100644
--- a/tests/unit/check-db-rules-classification.test.ts
+++ b/tests/unit/check-db-rules-classification.test.ts
@@ -121,12 +121,13 @@ test("INTENTIONALLY_INTERNAL is exported from check-db-rules.mjs", () => {
   assert.ok(INTENTIONALLY_INTERNAL.size > 0, "INTENTIONALLY_INTERNAL must not be empty");
 });
 
-test("INTENTIONALLY_INTERNAL contains the expected 29 audited modules", () => {
+test("INTENTIONALLY_INTERNAL contains the expected 32 audited modules", () => {
   const expected = [
     "_rowTypes",
     "accessTokens",
     "apiKeyColumnFallbacks",
     "apiKeyUsageLimitFields",
+    "caseMapping",
     "cleanup",
     "cliToolState",
     "comboForecast",
@@ -141,11 +142,13 @@ test("INTENTIONALLY_INTERNAL contains the expected 29 audited modules", () => {
     "migrationRunner",
     "notion",
     "obsidian",
+    "optimizationSettings",
     "pluginMetrics",
     "prompts",
     "providerNodeSelect",
     "providerStats",
     "recovery",
+    "schemaColumns",
     "secrets",
     "serviceModels",
     "stateReset",
diff --git a/tests/unit/check-public-creds.test.ts b/tests/unit/check-public-creds.test.ts
index 413e60272b..2e3acbbcce 100644
--- a/tests/unit/check-public-creds.test.ts
+++ b/tests/unit/check-public-creds.test.ts
@@ -23,10 +23,9 @@ test("flags a clientId behind a process.env fallback (env || literal)", () => {
 });
 
 test("flags clientSecret and apiKey literals too", () => {
-  const src = [
-    `clientSecret: "GOCSPX-secret-literal",`,
-    `apiKey: "AIzaSyLeakedFirebaseKey",`,
-  ].join("\n");
+  const src = [`clientSecret: "GOCSPX-secret-literal",`, `apiKey: "AIzaSyLeakedFirebaseKey",`].join(
+    "\n"
+  );
   const v = findLiteralCreds(src, new Set(), "x.ts");
   assert.equal(v.length, 2);
 });
@@ -41,7 +40,7 @@ test("does NOT flag resolvePublicCredMulti() with literal env-name args", () =>
   assert.deepEqual(findLiteralCreds(src, new Set(), "x.ts"), []);
 });
 
-test("does NOT flag empty-string fallback (process.env || \"\")", () => {
+test('does NOT flag empty-string fallback (process.env || "")', () => {
   const src = `clientIdDefault: process.env.GITLAB_OAUTH_CLIENT_ID || "",`;
   assert.deepEqual(findLiteralCreds(src, new Set(), "x.ts"), []);
 });
@@ -75,10 +74,7 @@ test("a NEW literal is still flagged even with the real frozen allowlist", () =>
 });
 
 test("real scanned files produce ZERO violations with the frozen allowlist (gate exits 0)", () => {
-  const scanned = [
-    "open-sse/config/providerRegistry.ts",
-    "src/lib/oauth/constants/oauth.ts",
-  ];
+  const scanned = ["open-sse/config/providerRegistry.ts", "src/lib/oauth/constants/oauth.ts"];
   for (const rel of scanned) {
     const src = fs.readFileSync(path.join(repoRoot, rel), "utf8") as string;
     const v = findLiteralCreds(src, KNOWN_LITERAL_CREDS, rel);
@@ -91,10 +87,7 @@ test("every frozen literal is actually present in a scanned file (no dead allowl
   // per-provider plugins (#3993), so providerRegistry.ts is now a re-export barrel;
   // entries keyed by an explicit `file:line:value` are checked against the file named
   // in the key (which is where the literal actually lives), not this anchor blob.
-  const anchorFiles = [
-    "open-sse/config/providerRegistry.ts",
-    "src/lib/oauth/constants/oauth.ts",
-  ];
+  const anchorFiles = ["open-sse/config/providerRegistry.ts", "src/lib/oauth/constants/oauth.ts"];
   const anchorBlob = anchorFiles
     .map((rel) => fs.readFileSync(path.join(repoRoot, rel), "utf8") as string)
     .join("\n");
@@ -107,9 +100,15 @@ test("every frozen literal is actually present in a scanned file (no dead allowl
       // match on file content rather than the exact line number.
       const file = entry.replace(/:\d+:.*$/, "");
       const src = fs.readFileSync(path.join(repoRoot, file), "utf8") as string;
-      assert.ok(src.includes(value), `frozen literal not found in its source file ${file}: ${value}`);
+      assert.ok(
+        src.includes(value),
+        `frozen literal not found in its source file ${file}: ${value}`
+      );
     } else {
-      assert.ok(anchorBlob.includes(value), `frozen literal not found in any anchor file: ${value}`);
+      assert.ok(
+        anchorBlob.includes(value),
+        `frozen literal not found in any anchor file: ${value}`
+      );
     }
   }
 });
@@ -127,8 +126,16 @@ test("with an empty allowlist the real scanned files surface zero violations (al
   ) as string;
   const regViolations = findLiteralCreds(reg, new Set(), "providerRegistry.ts");
   const oauthViolations = findLiteralCreds(oauth, new Set(), "oauth.ts");
-  assert.equal(regViolations.length, 0, `providerRegistry.ts should be clean, got: ${regViolations.join(", ")}`);
-  assert.equal(oauthViolations.length, 0, `oauth.ts should be clean, got: ${oauthViolations.join(", ")}`);
+  assert.equal(
+    regViolations.length,
+    0,
+    `providerRegistry.ts should be clean, got: ${regViolations.join(", ")}`
+  );
+  assert.equal(
+    oauthViolations.length,
+    0,
+    `oauth.ts should be clean, got: ${oauthViolations.join(", ")}`
+  );
 });
 
 // --- 6A.8: expanded scope (open-sse/** and src/lib/oauth/**) ---
@@ -164,21 +171,33 @@ test("6A.8 stale: known literal that was removed from the codebase is detected a
   const liveViolations = findLiteralCreds(src, new Set(), "file.ts");
   // The allowlist has an entry "old-literal" but it's not in live violations.
   const stale = (reportStale as (a: Set<string>, b: string[], c: string) => string[])(
-    new Set(["old-literal"]), liveViolations, "check-public-creds"
+    new Set(["old-literal"]),
+    liveViolations,
+    "check-public-creds"
   );
   assert.deepEqual(stale, ["old-literal"]);
 });
 
 test("6A.8: open-sse/services/usage.ts FP — function-signature apiKey is suppressed by allowlist", () => {
-  // open-sse/services/usage.ts L543: `getMiniMaxUsage(apiKey: string, provider: "minimax" | "minimax-cn")`
+  // open-sse/services/usage/minimax.ts L213: `getMiniMaxUsage(apiKey: string, provider: "minimax" | "minimax-cn")`
   // The CRED_KEY_RE matches `apiKey:` in the TypeScript function-parameter type annotation.
   // "minimax" and "minimax-cn" are provider-name strings in the type, NOT credentials.
-  // Frozen in KNOWN_LITERAL_CREDS as FPs by file:line:value key.
-  const realSrc = fs.readFileSync(path.join(repoRoot, "open-sse/services/usage.ts"), "utf8") as string;
+  // Frozen in KNOWN_LITERAL_CREDS as FPs by file:line:value key. The MiniMax family was
+  // extracted from services/usage.ts into services/usage/minimax.ts (god-file decomposition),
+  // so the FP moved with the getMiniMaxUsage signature.
+  const minimaxPath = "open-sse/services/usage/minimax.ts";
+  const realSrc = fs.readFileSync(path.join(repoRoot, minimaxPath), "utf8") as string;
   // With empty allowlist the FP shows up (it IS flagged by the regex).
-  const vWithEmpty = findLiteralCreds(realSrc, new Set(), "open-sse/services/usage.ts");
-  assert.ok(vWithEmpty.some((v) => v.includes("minimax")), `expected FP 'minimax' violations with empty allowlist, got: ${vWithEmpty.join(", ")}`);
+  const vWithEmpty = findLiteralCreds(realSrc, new Set(), minimaxPath);
+  assert.ok(
+    vWithEmpty.some((v) => v.includes("minimax")),
+    `expected FP 'minimax' violations with empty allowlist, got: ${vWithEmpty.join(", ")}`
+  );
   // With KNOWN_LITERAL_CREDS the FPs are suppressed.
-  const vWithAllowlist = findLiteralCreds(realSrc, KNOWN_LITERAL_CREDS, "open-sse/services/usage.ts");
-  assert.deepEqual(vWithAllowlist, [], `FP violations should be suppressed, got: ${vWithAllowlist.join(", ")}`);
+  const vWithAllowlist = findLiteralCreds(realSrc, KNOWN_LITERAL_CREDS, minimaxPath);
+  assert.deepEqual(
+    vWithAllowlist,
+    [],
+    `FP violations should be suppressed, got: ${vWithAllowlist.join(", ")}`
+  );
 });
diff --git a/tests/unit/claude-codex-identity-version-sync.test.ts b/tests/unit/claude-codex-identity-version-sync.test.ts
new file mode 100644
index 0000000000..695e45f8f3
--- /dev/null
+++ b/tests/unit/claude-codex-identity-version-sync.test.ts
@@ -0,0 +1,47 @@
+/**
+ * tests/unit/claude-codex-identity-version-sync.test.ts
+ *
+ * Guards the pinned CLI identity versions against drift. The Claude Code version
+ * lives in FOUR places (claudeIdentity, anthropicHeaders, claudeCodeCompatible,
+ * ccBridgeTransforms) and MUST stay in lockstep — a partial bump produces an
+ * inconsistent wire fingerprint. The Codex client version lives in codexClient.
+ *
+ * When you capture a newer claude-cli / codex release, bump ALL constants and
+ * update the pinned values below in the same change.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const id = await import("../../open-sse/executors/claudeIdentity.ts");
+const hdr = await import("../../open-sse/config/anthropicHeaders.ts");
+const compat = await import("../../open-sse/services/claudeCodeCompatible.ts");
+const bridge = await import("../../open-sse/services/ccBridgeTransforms.ts");
+const codexCfg = await import("../../open-sse/config/codexClient.ts");
+
+test("Claude CLI version constants are in lockstep across all 4 sources", () => {
+  const V = id.CLAUDE_CODE_VERSION;
+  assert.equal(hdr.CLAUDE_CLI_VERSION, V, "anthropicHeaders.CLAUDE_CLI_VERSION drift");
+  assert.equal(compat.CLAUDE_CODE_COMPATIBLE_VERSION, V, "claudeCodeCompatible version drift");
+  assert.equal(bridge.DEFAULT_CLAUDE_CODE_VERSION, V, "ccBridgeTransforms version drift");
+  assert.equal(
+    hdr.CLAUDE_CLI_USER_AGENT,
+    `claude-cli/${V} (external, cli)`,
+    "CLAUDE_CLI_USER_AGENT drift"
+  );
+  assert.equal(
+    compat.CLAUDE_CODE_COMPATIBLE_USER_AGENT,
+    `claude-cli/${V} (external, sdk-cli)`,
+    "CLAUDE_CODE_COMPATIBLE_USER_AGENT drift"
+  );
+});
+
+test("Claude CLI is pinned to the captured 2.1.187 release", () => {
+  assert.equal(id.CLAUDE_CODE_VERSION, "2.1.187");
+});
+
+test("Codex client is pinned to the captured 0.142.0 release", () => {
+  assert.equal(codexCfg.getCodexClientVersion(), "0.142.0");
+  assert.equal(codexCfg.getCodexUserAgent(), "codex-cli/0.142.0 (Windows 10.0.26200; x64)");
+  assert.equal(codexCfg.getCodexDefaultHeaders().Version, "0.142.0");
+});
diff --git a/tests/unit/claude-haiku-no-adaptive-thinking.test.ts b/tests/unit/claude-haiku-no-adaptive-thinking.test.ts
new file mode 100644
index 0000000000..56c7b6bc33
--- /dev/null
+++ b/tests/unit/claude-haiku-no-adaptive-thinking.test.ts
@@ -0,0 +1,99 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+
+import { normalizeClaudeHaikuConstraints } from "@omniroute/open-sse/services/claudeHaikuConstraints.ts";
+
+// Claude Haiku 4.5 (and other haiku-tier models) reject:
+//   1. `thinking.type:"adaptive"` (only Sonnet/Opus support adaptive thinking)
+//   2. `output_config.effort` (also Sonnet/Opus only)
+// Several OmniRoute paths can still emit these on Haiku targets:
+//   - Native Claude passthrough from newer Claude Code / Cowork clients
+//   - OpenAI→Claude translator buckets when reasoning_effort is "max"/"xhigh"
+//   - Per-model thinking defaults from the request flow
+// This normalizer is the final, provider-agnostic guard keyed on the resolved
+// upstream model. Mirrors upstream 9router 401d93bd5 (`claude.js`).
+
+describe("normalizeClaudeHaikuConstraints", () => {
+  it("converts thinking.type:'adaptive' to a manual 'enabled' shape on haiku", () => {
+    const input = {
+      model: "claude-haiku-4-5-20251001",
+      thinking: { type: "adaptive" },
+    };
+    const out = normalizeClaudeHaikuConstraints(input, input.model);
+    assert.deepEqual(out.thinking, { type: "enabled", budget_tokens: 10000 });
+  });
+
+  it("strips output_config.effort on haiku and keeps other output_config fields", () => {
+    const input = {
+      model: "claude-haiku-4.5",
+      output_config: { effort: "high", other_field: "keep-me" },
+    };
+    const out = normalizeClaudeHaikuConstraints(input, input.model);
+    assert.deepEqual(out.output_config, { other_field: "keep-me" });
+  });
+
+  it("removes output_config entirely when stripping effort leaves it empty", () => {
+    const input = {
+      model: "claude-haiku-4-5-20251001",
+      output_config: { effort: "max" },
+    };
+    const out = normalizeClaudeHaikuConstraints(input, input.model);
+    assert.equal((out as Record<string, unknown>).output_config, undefined);
+  });
+
+  it("applies BOTH transforms when the body carries adaptive thinking + effort", () => {
+    const input = {
+      model: "claude-haiku-4.5",
+      thinking: { type: "adaptive" },
+      output_config: { effort: "xhigh" },
+    };
+    const out = normalizeClaudeHaikuConstraints(input, input.model);
+    assert.deepEqual(out.thinking, { type: "enabled", budget_tokens: 10000 });
+    assert.equal((out as Record<string, unknown>).output_config, undefined);
+  });
+
+  it("is a no-op for Sonnet (adaptive is valid there)", () => {
+    const input = {
+      model: "claude-sonnet-4-5",
+      thinking: { type: "adaptive" },
+      output_config: { effort: "high" },
+    };
+    const out = normalizeClaudeHaikuConstraints(input, input.model);
+    assert.strictEqual(out, input);
+  });
+
+  it("is a no-op for Opus (adaptive is valid there)", () => {
+    const input = {
+      model: "claude-opus-4-7",
+      thinking: { type: "adaptive" },
+      output_config: { effort: "max" },
+    };
+    const out = normalizeClaudeHaikuConstraints(input, input.model);
+    assert.strictEqual(out, input);
+  });
+
+  it("leaves haiku bodies that have no adaptive thinking or effort untouched", () => {
+    const input = {
+      model: "claude-haiku-4-5-20251001",
+      thinking: { type: "enabled", budget_tokens: 4096 },
+      messages: [{ role: "user", content: "hi" }],
+    };
+    const out = normalizeClaudeHaikuConstraints(input, input.model);
+    assert.strictEqual(out, input);
+  });
+
+  it("returns the body untouched when model is null/undefined", () => {
+    const input = { thinking: { type: "adaptive" }, output_config: { effort: "high" } };
+    assert.strictEqual(normalizeClaudeHaikuConstraints(input, null), input);
+    assert.strictEqual(normalizeClaudeHaikuConstraints(input, undefined), input);
+  });
+
+  it("matches case-insensitively (any model id containing 'haiku')", () => {
+    const input = {
+      model: "claude-3-5-Haiku-latest",
+      thinking: { type: "adaptive" },
+    };
+    const out = normalizeClaudeHaikuConstraints(input, input.model);
+    assert.deepEqual(out.thinking, { type: "enabled", budget_tokens: 10000 });
+  });
+});
diff --git a/tests/unit/claude-oauth-tool-cloak.test.ts b/tests/unit/claude-oauth-tool-cloak.test.ts
index 5d8caadd1f..46bffc1d90 100644
--- a/tests/unit/claude-oauth-tool-cloak.test.ts
+++ b/tests/unit/claude-oauth-tool-cloak.test.ts
@@ -13,6 +13,7 @@ import assert from "node:assert/strict";
 import {
   cloakThirdPartyToolNames,
   needsThirdPartyCloak,
+  isAnthropicServerToolType,
 } from "../../open-sse/services/claudeCodeToolRemapper.ts";
 import {
   sanitizeClaudeToolSchema,
@@ -107,6 +108,48 @@ describe("cloakThirdPartyToolNames", () => {
     assert.equal(needsThirdPartyCloak("read_file"), true);
     assert.equal(needsThirdPartyCloak("mixture_of_agents"), true);
   });
+
+  it("needsThirdPartyCloak leaves mcp__ namespace untouched (#4861)", () => {
+    // Genuine Claude Code MCP names Anthropic accepts natively; cloaking them
+    // caused round-trip "Tool reference 'mcp__…' not found" 400s on claude OAuth.
+    assert.equal(needsThirdPartyCloak("mcp__filesystem__read_file"), false);
+    assert.equal(needsThirdPartyCloak("mcp__github__create_issue"), false);
+    assert.equal(needsThirdPartyCloak("mcp__server"), false);
+  });
+
+  it("preserves the reserved name of a versioned Anthropic server tool", () => {
+    const body: AnyRecord = {
+      tools: [{ type: "web_search_20250305", name: "web_search", max_uses: 5 }],
+    };
+    cloakThirdPartyToolNames(body);
+    // Anthropic requires tools.N.web_search_20250305.name === "web_search".
+    assert.equal((body.tools as AnyRecord[])[0].name, "web_search");
+    // No reverse-map entry needed because nothing was cloaked.
+    assert.equal((body._toolNameMap as Map<string, string> | undefined)?.has("WebSearch") ?? false, false);
+  });
+
+  it("still cloaks a genuine third-party tool sitting next to a server tool", () => {
+    const body: AnyRecord = {
+      tools: [
+        { type: "web_search_20250305", name: "web_search" },
+        { name: "mixture_of_agents" },
+      ],
+    };
+    cloakThirdPartyToolNames(body);
+    assert.equal((body.tools as AnyRecord[])[0].name, "web_search");
+    assert.equal((body.tools as AnyRecord[])[1].name, "MixtureOfAgents");
+  });
+
+  it("isAnthropicServerToolType detects versioned + non-versioned server tools", () => {
+    assert.equal(isAnthropicServerToolType("web_search_20250305"), true);
+    assert.equal(isAnthropicServerToolType("code_execution_20250522"), true);
+    assert.equal(isAnthropicServerToolType("web_search"), true);
+    assert.equal(isAnthropicServerToolType("web_search_preview"), true);
+    // Not server tools — must remain cloakable.
+    assert.equal(isAnthropicServerToolType("mixture_of_agents"), false);
+    assert.equal(isAnthropicServerToolType("Bash"), false);
+    assert.equal(isAnthropicServerToolType(undefined), false);
+  });
 });
 
 describe("sanitizeClaudeToolSchemas — boolean schema preservation", () => {
diff --git a/tests/unit/claude-oauth-usage-429-backoff.test.ts b/tests/unit/claude-oauth-usage-429-backoff.test.ts
new file mode 100644
index 0000000000..3406421a8b
--- /dev/null
+++ b/tests/unit/claude-oauth-usage-429-backoff.test.ts
@@ -0,0 +1,66 @@
+import { describe, it, beforeEach } from "node:test";
+import { strict as assert } from "node:assert";
+
+import {
+  OAUTH_USAGE_429_COOLDOWN_MS,
+  _resetClaudeOauthUsageCooldown,
+  isClaudeOauthUsageCoolingDown,
+  markClaudeOauthUsage429,
+} from "../../open-sse/services/claudeUsageCooldown.ts";
+
+describe("claude OAuth usage 429 backoff", () => {
+  beforeEach(() => {
+    _resetClaudeOauthUsageCooldown();
+  });
+
+  it("starts uncooled for any token", () => {
+    assert.equal(isClaudeOauthUsageCoolingDown("tok-a"), false);
+    assert.equal(isClaudeOauthUsageCoolingDown(undefined), false);
+  });
+
+  it("treats a single 429 as entering cooldown for that token only", () => {
+    const t0 = 1_000_000;
+    markClaudeOauthUsage429("tok-a", t0);
+    assert.equal(isClaudeOauthUsageCoolingDown("tok-a", t0 + 1), true);
+    // A different token is unaffected — cooldown is per-token, not global.
+    assert.equal(isClaudeOauthUsageCoolingDown("tok-b", t0 + 1), false);
+  });
+
+  it("repeated 429s on the same token do NOT spam: stays cooling once entered", () => {
+    const t0 = 2_000_000;
+    markClaudeOauthUsage429("tok-a", t0);
+    // Simulate the scheduler hitting 429 again 10s, 30s, 60s later
+    for (const dt of [10_000, 30_000, 60_000]) {
+      markClaudeOauthUsage429("tok-a", t0 + dt);
+      assert.equal(
+        isClaudeOauthUsageCoolingDown("tok-a", t0 + dt),
+        true,
+        `still cooling at +${dt}ms`
+      );
+    }
+  });
+
+  it("cooldown expires after OAUTH_USAGE_429_COOLDOWN_MS and the token becomes eligible again", () => {
+    const t0 = 3_000_000;
+    markClaudeOauthUsage429("tok-a", t0);
+    assert.equal(
+      isClaudeOauthUsageCoolingDown("tok-a", t0 + OAUTH_USAGE_429_COOLDOWN_MS - 1),
+      true
+    );
+    assert.equal(
+      isClaudeOauthUsageCoolingDown("tok-a", t0 + OAUTH_USAGE_429_COOLDOWN_MS + 1),
+      false,
+      "should be eligible again after cooldown window"
+    );
+  });
+
+  it("undefined/missing access token is a no-op (does not poison the map)", () => {
+    const t0 = 4_000_000;
+    markClaudeOauthUsage429(undefined, t0);
+    assert.equal(isClaudeOauthUsageCoolingDown(undefined, t0 + 1), false);
+  });
+
+  it("cooldown defaults to 3 minutes (matches upstream OAUTH_429_COOLDOWN_MS)", () => {
+    assert.equal(OAUTH_USAGE_429_COOLDOWN_MS, 180_000);
+  });
+});
diff --git a/tests/unit/cli-tools-settings-jsonc.test.ts b/tests/unit/cli-tools-settings-jsonc.test.ts
new file mode 100644
index 0000000000..c259397ec4
--- /dev/null
+++ b/tests/unit/cli-tools-settings-jsonc.test.ts
@@ -0,0 +1,127 @@
+/**
+ * Regression test for the JSONC-tolerant config reader used by every
+ * cli-tools settings route.
+ *
+ * Ported from upstream `decolua/9router@6c10edf8`:
+ * "fix(cli-tools): tolerate JSONC configs in CLI tool settings routes".
+ *
+ * Before the fix, `readSettings`/`readConfig` helpers only caught `ENOENT` and
+ * re-threw on any other error — so a config file with a single trailing
+ * comma (valid JSONC, emitted by tools like opencode) crashed the GET route
+ * with a 500 and the dashboard misread the response as "tool not installed".
+ *
+ * After the fix:
+ *  - trailing commas are stripped before parsing (JSONC tolerated);
+ *  - any other parse error returns `null` (or the caller's fallback) so the
+ *    dashboard renders "installed but not configured".
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import { promises as fs } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const { parseJsoncOrNull, readJsoncConfig } = await import(
+  "../../src/app/api/cli-tools/_lib/jsoncConfig.ts"
+);
+
+test("parseJsoncOrNull tolerates trailing commas in objects", () => {
+  const jsonc = `{
+    "model": "gpt-5",
+    "tools": ["a", "b",],
+    "nested": { "x": 1, },
+  }`;
+  const parsed = parseJsoncOrNull<{ model: string; tools: string[] }>(jsonc);
+  assert.ok(parsed, "parser must accept JSONC with trailing commas");
+  assert.equal(parsed.model, "gpt-5");
+  assert.deepEqual(parsed.tools, ["a", "b"]);
+});
+
+test("parseJsoncOrNull returns null on truly malformed JSON", () => {
+  assert.equal(parseJsoncOrNull("{ not json at all"), null);
+});
+
+test("readJsoncConfig returns fallback when file is missing", async () => {
+  const missing = path.join(os.tmpdir(), `cli-tools-jsonc-missing-${Date.now()}.json`);
+  assert.equal(await readJsoncConfig(missing), null);
+  assert.deepEqual(await readJsoncConfig(missing, {}), {});
+});
+
+test("readJsoncConfig parses a JSONC file with trailing commas (regression)", async () => {
+  const dir = await fs.mkdtemp(path.join(os.tmpdir(), "cli-tools-jsonc-"));
+  const file = path.join(dir, "settings.json");
+  await fs.writeFile(
+    file,
+    `{
+  "apiKey": "sk-test",
+  "model": "claude-sonnet-4-5",
+}
+`,
+    "utf-8"
+  );
+  try {
+    const parsed = await readJsoncConfig<{ apiKey: string; model: string }>(file);
+    assert.ok(parsed, "JSONC file with trailing comma must NOT crash the reader");
+    assert.equal(parsed.apiKey, "sk-test");
+    assert.equal(parsed.model, "claude-sonnet-4-5");
+  } finally {
+    await fs.rm(dir, { recursive: true, force: true });
+  }
+});
+
+test("readJsoncConfig returns fallback on corrupted config instead of throwing", async () => {
+  const dir = await fs.mkdtemp(path.join(os.tmpdir(), "cli-tools-jsonc-bad-"));
+  const file = path.join(dir, "settings.json");
+  await fs.writeFile(file, "{ this is not valid json at all !!! ", "utf-8");
+  try {
+    // Must NOT throw — the dashboard renders "installed but not configured"
+    // when this returns null, instead of "not installed" on a 500.
+    assert.equal(await readJsoncConfig(file), null);
+    assert.deepEqual(await readJsoncConfig(file, {}), {});
+  } finally {
+    await fs.rm(dir, { recursive: true, force: true });
+  }
+});
+
+/**
+ * Source-guard: every cli-tools settings route's read helper must go through
+ * the JSONC-tolerant reader. A regression to raw `JSON.parse(content)` inside
+ * a `readSettings` / `readConfig` helper would re-introduce the original
+ * 500-on-JSONC bug, so we assert the routes do not contain that pattern.
+ *
+ * Same source-guard pattern as `tests/unit/source-guard-*.test.ts`.
+ */
+test("cli-tools settings routes use the JSONC-tolerant reader (source-guard)", async () => {
+  // For each route, look for the GET-read helper region (top of file, up to
+  // the first `export async function GET`) and assert it imports + uses the
+  // JSONC-tolerant reader instead of raw `JSON.parse(content)`.
+  const routes = [
+    "claude-settings",
+    "cline-settings",
+    "droid-settings",
+    "kilo-settings",
+    "openclaw-settings",
+  ];
+  const repoRoot = path.resolve(import.meta.dirname ?? ".", "..", "..");
+  for (const r of routes) {
+    const src = await fs.readFile(
+      path.join(repoRoot, "src", "app", "api", "cli-tools", r, "route.ts"),
+      "utf-8"
+    );
+    const getIdx = src.indexOf("export async function GET");
+    assert.ok(getIdx > 0, `${r}: expected an exported GET handler`);
+    const head = src.slice(0, getIdx);
+    assert.ok(
+      /from\s+["']\.\.\/_lib\/jsoncConfig["']/.test(src),
+      `${r}: must import readJsoncConfig from ../_lib/jsoncConfig`
+    );
+    assert.ok(
+      !/JSON\.parse\(\s*content\s*\)/.test(head),
+      `${r}: read helper still calls raw JSON.parse(content) — port the JSONC fix`
+    );
+    assert.ok(
+      /readJsoncConfig\s*[<(]/.test(head),
+      `${r}: read helper must invoke readJsoncConfig`
+    );
+  }
+});
diff --git a/tests/unit/cli-tools.test.ts b/tests/unit/cli-tools.test.ts
index dc5a4f2676..7886d51448 100644
--- a/tests/unit/cli-tools.test.ts
+++ b/tests/unit/cli-tools.test.ts
@@ -87,12 +87,12 @@ test("CLI fingerprint preserves Codex executor User-Agent and maps legacy Copilo
     "codex",
     {
       Authorization: "Bearer token",
-      "User-Agent": "codex-cli/0.132.0 (Windows 10.0.26200; x64)",
+      "User-Agent": "codex-cli/0.142.0 (Windows 10.0.26200; x64)",
     },
     { model: "gpt-5.5", messages: [], stream: true }
   );
 
-  assert.equal(codex.headers["User-Agent"], "codex-cli/0.132.0 (Windows 10.0.26200; x64)");
+  assert.equal(codex.headers["User-Agent"], "codex-cli/0.142.0 (Windows 10.0.26200; x64)");
   assert.deepEqual(Object.keys(JSON.parse(codex.bodyString)), ["model", "stream", "messages"]);
 
   const copilot = applyFingerprint(
diff --git a/tests/unit/cli-tray-systray2.test.ts b/tests/unit/cli-tray-systray2.test.ts
new file mode 100644
index 0000000000..931e926bb8
--- /dev/null
+++ b/tests/unit/cli-tray-systray2.test.ts
@@ -0,0 +1,75 @@
+// Regression coverage for the systray2 runtime swap (port of upstream PR #1080).
+// The bug upstream: the bundled Go binary in node_modules/systray2/traybin
+// sometimes ships without the executable bit on macOS/Linux, causing the tray
+// to spawn() with EACCES and the icon never to appear.
+//
+// We can't load the real native binary in unit tests, but we can verify the
+// pure helpers that drive the swap: the package + version pin and the
+// chmod helper's behavior on a synthetic binary tree.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync, statSync, chmodSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  SYSTRAY_PACKAGE,
+  SYSTRAY_VERSION,
+  chmodSystrayBinAt,
+  resolveSystrayBinName,
+} from "../../bin/cli/runtime/trayRuntime.ts";
+
+test("systray2 is pinned to a 2.x version (PR #1080 fix)", () => {
+  assert.equal(SYSTRAY_PACKAGE, "systray2");
+  // The original systray@1.0.5 binary is incompatible with modern macOS dyld;
+  // upstream PR #1080 moved to the systray2 2.x line. Pin must stay ≥ 2.x.
+  assert.match(SYSTRAY_VERSION, /^2\./, `expected systray2@2.x, got ${SYSTRAY_VERSION}`);
+});
+
+test("resolveSystrayBinName returns null on win32 and a *_release name elsewhere", () => {
+  assert.equal(resolveSystrayBinName("win32"), null);
+  assert.equal(resolveSystrayBinName("darwin"), "tray_darwin_release");
+  assert.equal(resolveSystrayBinName("linux"), "tray_linux_release");
+});
+
+test("chmodSystrayBinAt sets +x on the bundled tray binary when present", () => {
+  const root = mkdtempSync(join(tmpdir(), "omniroute-systray-bin-"));
+  try {
+    const platform = process.platform === "win32" ? "linux" : process.platform;
+    const binName = resolveSystrayBinName(platform)!;
+    const binDir = join(root, "node_modules", "systray2", "traybin");
+    mkdirSync(binDir, { recursive: true });
+    const binPath = join(binDir, binName);
+    writeFileSync(binPath, "#!/bin/sh\nexit 0\n", { mode: 0o644 });
+    chmodSync(binPath, 0o644); // explicit: not executable
+    const result = chmodSystrayBinAt(root, platform);
+    assert.equal(result.changed, true, "expected chmodSystrayBinAt to chmod the bin");
+    // 0o111 covers the three execute bits — assert at least one is set.
+    const mode = statSync(binPath).mode & 0o777;
+    assert.ok((mode & 0o111) !== 0, `expected exec bits on bin, got mode=${mode.toString(8)}`);
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test("chmodSystrayBinAt is a no-op when the binary doesn't exist", () => {
+  const root = mkdtempSync(join(tmpdir(), "omniroute-systray-bin-"));
+  try {
+    const result = chmodSystrayBinAt(root, "linux");
+    assert.equal(result.changed, false);
+    assert.equal(result.reason, "missing");
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test("chmodSystrayBinAt skips win32 (uses PowerShell tray, no Go binary)", () => {
+  const root = mkdtempSync(join(tmpdir(), "omniroute-systray-bin-"));
+  try {
+    const result = chmodSystrayBinAt(root, "win32");
+    assert.equal(result.changed, false);
+    assert.equal(result.reason, "win32-skip");
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
diff --git a/tests/unit/codebuddy-cn-provider.test.ts b/tests/unit/codebuddy-cn-provider.test.ts
new file mode 100644
index 0000000000..77759d348e
--- /dev/null
+++ b/tests/unit/codebuddy-cn-provider.test.ts
@@ -0,0 +1,262 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  AI_PROVIDERS,
+  USAGE_SUPPORTED_PROVIDERS,
+  FREE_APIKEY_PROVIDER_IDS,
+} from "../../src/shared/constants/providers.ts";
+import { REGISTRY } from "../../open-sse/config/providerRegistry.ts";
+import { getExecutor } from "../../open-sse/executors/index.ts";
+import { CodeBuddyCnExecutor } from "../../open-sse/executors/codebuddy-cn.ts";
+import {
+  PROVIDERS as OAUTH_PROVIDER_IDS,
+  CODEBUDDY_CN_CONFIG,
+} from "../../src/lib/oauth/constants/oauth.ts";
+import PROVIDERS_MAP from "../../src/lib/oauth/providers/index.ts";
+import { supportsTokenRefresh } from "../../open-sse/services/tokenRefresh.ts";
+
+test("codebuddy-cn is registered as an OAuth provider in the UI catalog", () => {
+  const p = AI_PROVIDERS["codebuddy-cn"];
+  assert.ok(p, "AI_PROVIDERS['codebuddy-cn'] must exist");
+  assert.equal(p.id, "codebuddy-cn");
+  assert.equal(p.alias, "cbcn");
+  assert.equal(p.name, "CodeBuddy CN");
+});
+
+test("codebuddy-cn registry entry has expected shape", () => {
+  const r = REGISTRY["codebuddy-cn"];
+  assert.ok(r, "REGISTRY['codebuddy-cn'] must exist");
+  assert.equal(r.alias, "cbcn");
+  assert.equal(r.executor, "codebuddy-cn");
+  assert.equal(r.baseUrl, "https://copilot.tencent.com/v2/chat/completions");
+  assert.equal(r.authHeader, "bearer");
+  // Headers carry the Tencent CodeBuddy CLI fingerprint
+  assert.equal(r.headers?.["X-Product"], "SaaS");
+  assert.equal(r.headers?.["X-IDE-Type"], "CLI");
+  assert.equal(r.headers?.["X-IDE-Name"], "CLI");
+  assert.equal(r.headers?.["x-requested-with"], "XMLHttpRequest");
+  assert.equal(r.headers?.["x-codebuddy-request"], "1");
+  // 15 models from the upstream catalog
+  const ids = r.models.map((m) => m.id);
+  for (const expected of [
+    "glm-5.2",
+    "glm-5.1",
+    "glm-5.0",
+    "glm-5.0-turbo",
+    "glm-5v-turbo",
+    "glm-4.7",
+    "minimax-m3",
+    "minimax-m2.7",
+    "kimi-k2.7",
+    "kimi-k2.6",
+    "kimi-k2.5",
+    "hy3-preview",
+    "deepseek-v4-pro",
+    "deepseek-v4-flash",
+    "deepseek-v3-2-volc",
+  ]) {
+    assert.ok(ids.includes(expected), `model ${expected} must be registered`);
+  }
+  assert.equal(r.models.length, 15);
+});
+
+test("codebuddy-cn glm-5.2 carries 1M context and openai-style reasoning that cannot be disabled", () => {
+  const r = REGISTRY["codebuddy-cn"];
+  const m = r.models.find((x) => x.id === "glm-5.2");
+  assert.ok(m, "glm-5.2 must exist");
+  // contextLength is the OmniRoute analogue of upstream's contextWindow
+  assert.equal(m.contextLength, 1000000);
+  assert.equal(m.supportsReasoning, true);
+});
+
+test("codebuddy-cn vision flag is set on the visual models", () => {
+  const r = REGISTRY["codebuddy-cn"];
+  for (const id of ["glm-5v-turbo", "minimax-m3", "kimi-k2.7", "deepseek-v4-pro"]) {
+    const m = r.models.find((x) => x.id === id);
+    assert.ok(m, `${id} must exist`);
+    assert.equal(m.supportsVision, true, `${id} should have vision`);
+  }
+});
+
+test("getExecutor returns the CodeBuddyCnExecutor for 'codebuddy-cn' and the 'cbcn' alias", () => {
+  const e = getExecutor("codebuddy-cn");
+  assert.ok(e instanceof CodeBuddyCnExecutor, "executor must be CodeBuddyCnExecutor");
+  const aliasExec = getExecutor("cbcn");
+  assert.ok(aliasExec instanceof CodeBuddyCnExecutor, "alias 'cbcn' must resolve to same executor");
+});
+
+test("CodeBuddyCnExecutor.transformRequest forces stream:true and adds OpenAI-style reasoning_summary", () => {
+  const e = new CodeBuddyCnExecutor();
+  const out = e.transformRequest(
+    "glm-5.2",
+    { model: "glm-5.2", messages: [{ role: "user", content: "hi" }], stream: false },
+    false,
+    {} as unknown as Parameters<typeof e.transformRequest>[3]
+  );
+  assert.ok(out && typeof out === "object" && !Array.isArray(out));
+  const body = out as Record<string, unknown>;
+  assert.equal(body.stream, true, "stream must be forced to true");
+  assert.equal(body.reasoning_effort, "medium", "default reasoning_effort must be 'medium'");
+  assert.equal(body.reasoning_summary, "auto", "reasoning_summary must be 'auto'");
+});
+
+test("CodeBuddyCnExecutor preserves explicit reasoning_effort", () => {
+  const e = new CodeBuddyCnExecutor();
+  const out = e.transformRequest(
+    "glm-5.2",
+    { model: "glm-5.2", messages: [], reasoning_effort: "high" },
+    true,
+    {} as unknown as Parameters<typeof e.transformRequest>[3]
+  );
+  const body = out as Record<string, unknown>;
+  assert.equal(body.reasoning_effort, "high");
+  assert.equal(body.reasoning_summary, "auto");
+});
+
+test("CodeBuddyCnExecutor strips reasoning_effort when caller asks for none/off", () => {
+  const e = new CodeBuddyCnExecutor();
+  for (const effort of ["none", "off"]) {
+    const out = e.transformRequest(
+      "glm-5.2",
+      { model: "glm-5.2", messages: [], reasoning_effort: effort },
+      true,
+      {} as unknown as Parameters<typeof e.transformRequest>[3]
+    );
+    const body = out as Record<string, unknown>;
+    assert.equal(
+      Object.prototype.hasOwnProperty.call(body, "reasoning_effort"),
+      false,
+      `reasoning_effort must be omitted for ${effort}`
+    );
+    assert.notEqual(body.reasoning_summary, "auto", `reasoning_summary must not be auto for ${effort}`);
+  }
+});
+
+test("codebuddy-cn OAuth provider is wired with device_code flow and GET-poll on state", async () => {
+  assert.equal(OAUTH_PROVIDER_IDS.CODEBUDDY_CN, "codebuddy-cn");
+  const map = (PROVIDERS_MAP as Record<string, any>);
+  const cb = map["codebuddy-cn"];
+  assert.ok(cb, "PROVIDERS map must include 'codebuddy-cn'");
+  assert.equal(cb.flowType, "device_code");
+  assert.equal(typeof cb.requestDeviceCode, "function");
+  assert.equal(typeof cb.pollToken, "function");
+
+  // Drive pollToken with a stubbed fetch and assert it hits the token URL via GET
+  // with the state as a query param (upstream's distinguishing detail).
+  const origFetch = globalThis.fetch;
+  const calls: { url: string; init?: RequestInit }[] = [];
+  globalThis.fetch = async (url: any, init?: RequestInit) => {
+    calls.push({ url: String(url), init });
+    return new Response(
+      JSON.stringify({
+        code: 0,
+        data: {
+          accessToken: "AT",
+          refreshToken: "RT",
+          tokenType: "Bearer",
+          expiresIn: 3600,
+        },
+      }),
+      { status: 200, headers: { "Content-Type": "application/json" } }
+    ) as unknown as Response;
+  };
+  try {
+    const result = await cb.pollToken(CODEBUDDY_CN_CONFIG, "STATE-123");
+    assert.ok(result?.ok, "successful poll should be ok:true");
+    assert.equal(result?.data?.access_token, "AT");
+    const got = calls.at(-1);
+    assert.ok(got, "fetch must have been called");
+    assert.equal(got.init?.method, "GET", "poll method must be GET");
+    assert.match(got.url, /\?state=STATE-123$/, "state must appear as ?state= query param");
+  } finally {
+    globalThis.fetch = origFetch;
+  }
+});
+
+test("codebuddy-cn token refresh handler is wired in tokenRefresh.ts", () => {
+  assert.equal(supportsTokenRefresh("codebuddy-cn"), true);
+});
+
+test("codebuddy-cn is in USAGE_SUPPORTED_PROVIDERS and quota handler parses Tencent accounts", async () => {
+  assert.ok(USAGE_SUPPORTED_PROVIDERS.includes("codebuddy-cn"));
+  const { getCodeBuddyCnUsage } = await import(
+    "../../open-sse/services/usage/codebuddy-cn.ts"
+  );
+
+  const origFetch = globalThis.fetch;
+  // Compose a mixed payload: one refill (CycleEndTime << DeductionEndTime) and
+  // two bonus packs (CycleEndTime == DeductionEndTime), out of expiry order.
+  const cycleEnd = "2026-08-01T00:00:00Z";
+  const deductionEnd = 32503680000; // very far future (seconds)
+  const bonus1End = "2026-07-01T00:00:00Z";
+  const bonus2End = "2026-06-25T00:00:00Z";
+  globalThis.fetch = async () => {
+    return new Response(
+      JSON.stringify({
+        code: 0,
+        data: {
+          Response: {
+            Data: {
+              Accounts: [
+                {
+                  PackageName: "Refill Pack",
+                  CycleStartTime: "2026-07-01T00:00:00Z",
+                  CycleEndTime: cycleEnd,
+                  DeductionEndTime: deductionEnd,
+                  CycleCapacitySize: 500,
+                  CycleCapacityUsed: 12.34,
+                },
+                {
+                  PackageName: "Bonus A",
+                  CycleStartTime: "2026-05-01T00:00:00Z",
+                  CycleEndTime: bonus1End,
+                  DeductionEndTime: new Date(bonus1End).getTime() / 1000,
+                  CapacitySize: 50,
+                  CapacityUsed: 1,
+                },
+                {
+                  PackageName: "Bonus B",
+                  CycleStartTime: "2026-05-01T00:00:00Z",
+                  CycleEndTime: bonus2End,
+                  DeductionEndTime: new Date(bonus2End).getTime() / 1000,
+                  CapacitySize: 25,
+                  CapacityUsed: 5,
+                },
+              ],
+            },
+          },
+        },
+      }),
+      { status: 200, headers: { "Content-Type": "application/json" } }
+    ) as unknown as Response;
+  };
+
+  try {
+    const result = await getCodeBuddyCnUsage("ACCESS_TOKEN", undefined, undefined);
+    assert.ok(result && typeof result === "object");
+    const r = result as Record<string, any>;
+    assert.equal(r.plan, "Refill Pack");
+    assert.ok(r.quotas);
+    // Refill (Monthly) uses CycleCapacity*; Bonus packs use plain Capacity*; soonest-expiring first.
+    assert.ok(r.quotas.Monthly, "Monthly refill quota must be present");
+    assert.equal(r.quotas.Monthly.total, 500);
+    assert.equal(r.quotas.Monthly.used, 12.34);
+    assert.ok(r.quotas["Bonus Pack 1"], "first bonus must be present");
+    assert.ok(r.quotas["Bonus Pack 2"], "second bonus must be present");
+    // Soonest-expiring first: Bonus B (Jun 25) before Bonus A (Jul 1).
+    assert.equal(r.quotas["Bonus Pack 1"].total, 25, "Bonus Pack 1 should be the soonest (B)");
+    assert.equal(r.quotas["Bonus Pack 2"].total, 50, "Bonus Pack 2 should be the later (A)");
+  } finally {
+    globalThis.fetch = origFetch;
+  }
+});
+
+test("codebuddy-cn is treated as a managed dual-auth provider (oauth + apikey accepted by POST /api/providers)", async () => {
+  // The provider creation gate trusts FREE_APIKEY_PROVIDER_IDS to admit
+  // OAuth-category providers that also accept a direct API key (like qoder).
+  assert.ok(
+    FREE_APIKEY_PROVIDER_IDS.has("codebuddy-cn"),
+    "codebuddy-cn must be admitted by the dual-auth gate"
+  );
+});
diff --git a/tests/unit/codex-drop-nonstandard-events.test.ts b/tests/unit/codex-drop-nonstandard-events.test.ts
new file mode 100644
index 0000000000..8db3190f6e
--- /dev/null
+++ b/tests/unit/codex-drop-nonstandard-events.test.ts
@@ -0,0 +1,51 @@
+// Regression guard for #4715: the Codex HTTP transport forwards the upstream SSE
+// stream verbatim, including the non-standard `event: codex.rate_limits` frame
+// (no `data:` line). That frame breaks the OpenAI SDK's responses.stream() with
+// HTTP 502 "Controller is already closed". filterNonstandardCodexSse() strips
+// every `codex.*` event block from the byte stream while preserving standard ones.
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { filterNonstandardCodexSse } from "../../open-sse/executors/codex.ts";
+
+function sseResponse(body: string): Response {
+  return new Response(body, {
+    status: 200,
+    headers: { "content-type": "text/event-stream" },
+  });
+}
+
+async function readAll(res: Response): Promise<string> {
+  return await res.text();
+}
+
+describe("filterNonstandardCodexSse (#4715)", () => {
+  it("drops codex.* event blocks but keeps standard response.* events", async () => {
+    const stream =
+      "event: response.created\ndata: {\"type\":\"response.created\"}\n\n" +
+      "event: codex.rate_limits\n\n" +
+      "event: response.output_text.delta\ndata: {\"delta\":\"hi\"}\n\n" +
+      "event: response.completed\ndata: {\"type\":\"response.completed\"}\n\n";
+    const out = await readAll(filterNonstandardCodexSse(sseResponse(stream)));
+    assert.ok(!out.includes("codex.rate_limits"), "codex.* frame must be stripped");
+    assert.ok(out.includes("response.created"), "standard events preserved");
+    assert.ok(out.includes("response.output_text.delta"), "standard delta preserved");
+    assert.ok(out.includes("response.completed"), "terminal event preserved");
+  });
+
+  it("passes through non-SSE responses untouched", async () => {
+    const json = new Response("{\"ok\":true}", {
+      status: 200,
+      headers: { "content-type": "application/json" },
+    });
+    const out = filterNonstandardCodexSse(json);
+    assert.equal(await out.text(), "{\"ok\":true}");
+  });
+
+  it("drops a trailing codex.* block with no double-newline terminator (flush path)", async () => {
+    const stream =
+      "event: response.created\ndata: {}\n\n" + "event: codex.token_count\ndata: {}";
+    const out = await readAll(filterNonstandardCodexSse(sseResponse(stream)));
+    assert.ok(out.includes("response.created"));
+    assert.ok(!out.includes("codex.token_count"));
+  });
+});
diff --git a/tests/unit/combo-cooldown-retry.test.ts b/tests/unit/combo-cooldown-retry.test.ts
new file mode 100644
index 0000000000..91d0339b1b
--- /dev/null
+++ b/tests/unit/combo-cooldown-retry.test.ts
@@ -0,0 +1,271 @@
+/**
+ * TDD — shouldWaitForComboCooldown (pure decision helper for the quota-share
+ * combo cooldown-aware retry, Variante A).
+ *
+ * The helper decides whether a quota-share (qtSd/) combo that would otherwise
+ * crystallize a 429 `model_cooldown` should instead WAIT for a short transient
+ * cooldown and re-dispatch. It is pure (no I/O, no clock) so every branch is
+ * exhaustively covered here:
+ *   - happy path (short transient cooldown within budget → wait)
+ *   - reason === "quota_exhausted" EXCLUDED (would otherwise wait until midnight)
+ *   - reason in the extra non-retryable set (auth_error/not_found/...) EXCLUDED
+ *   - waitMs above the configured ceiling → no wait
+ *   - waitMs <= 0 → no wait
+ *   - attempt >= maxAttempts → no wait
+ *   - budget insufficient (budgetLeftMs < waitMs) → no wait
+ *   - settings.enabled === false → no wait
+ *
+ * Security note (auth.ts:533 isRetryableModelLockoutReason): `quota_exhausted`
+ * is classified RETRYABLE there, so the helper MUST exclude it explicitly or a
+ * combo would wait until midnight. This file pins that exclusion.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { shouldWaitForComboCooldown, resolveComboCooldownWaitDecision, COMBO_COOLDOWN_WAIT_MARGIN_MS } =
+  await import("../../open-sse/services/combo/comboCooldownRetry.ts");
+
+function baseSettings(overrides: Partial<Record<string, unknown>> = {}) {
+  return {
+    enabled: true,
+    maxWaitMs: 5000,
+    maxAttempts: 2,
+    budgetMs: 8000,
+    ...overrides,
+  };
+}
+
+function baseInput(overrides: Record<string, unknown> = {}) {
+  return {
+    reason: "rate_limit",
+    waitMs: 3000,
+    attempt: 0,
+    budgetLeftMs: 8000,
+    settings: baseSettings(),
+    ...overrides,
+  };
+}
+
+test("happy path: short transient cooldown within budget → wait=true", () => {
+  const r = shouldWaitForComboCooldown(baseInput() as never);
+  assert.equal(r.wait, true);
+  assert.equal(r.waitMs, 3000);
+});
+
+test("reason quota_exhausted is EXCLUDED even though it is otherwise 'retryable'", () => {
+  const r = shouldWaitForComboCooldown(baseInput({ reason: "quota_exhausted" }) as never);
+  assert.equal(r.wait, false);
+});
+
+test("reason auth_error is EXCLUDED (non-retryable safety set)", () => {
+  const r = shouldWaitForComboCooldown(baseInput({ reason: "auth_error" }) as never);
+  assert.equal(r.wait, false);
+});
+
+test("reason not_found is EXCLUDED", () => {
+  const r = shouldWaitForComboCooldown(baseInput({ reason: "not_found" }) as never);
+  assert.equal(r.wait, false);
+});
+
+test("reason not_found_local is EXCLUDED", () => {
+  const r = shouldWaitForComboCooldown(baseInput({ reason: "not_found_local" }) as never);
+  assert.equal(r.wait, false);
+});
+
+test("missing/unknown reason (null) → no wait (only an explicit transient reason qualifies)", () => {
+  const r = shouldWaitForComboCooldown(baseInput({ reason: null }) as never);
+  assert.equal(r.wait, false);
+});
+
+test("waitMs above the configured ceiling → no wait", () => {
+  const r = shouldWaitForComboCooldown(
+    baseInput({ waitMs: 5001, settings: baseSettings({ maxWaitMs: 5000 }) }) as never
+  );
+  assert.equal(r.wait, false);
+  // waitMs is still surfaced for logging even when we decline to wait.
+  assert.equal(r.waitMs, 5001);
+});
+
+test("waitMs exactly at the ceiling → wait (inclusive bound)", () => {
+  const r = shouldWaitForComboCooldown(
+    baseInput({ waitMs: 5000, settings: baseSettings({ maxWaitMs: 5000 }) }) as never
+  );
+  assert.equal(r.wait, true);
+});
+
+test("waitMs <= 0 → no wait", () => {
+  assert.equal(shouldWaitForComboCooldown(baseInput({ waitMs: 0 }) as never).wait, false);
+  assert.equal(shouldWaitForComboCooldown(baseInput({ waitMs: -10 }) as never).wait, false);
+});
+
+test("attempt >= maxAttempts → no wait", () => {
+  const r = shouldWaitForComboCooldown(
+    baseInput({ attempt: 2, settings: baseSettings({ maxAttempts: 2 }) }) as never
+  );
+  assert.equal(r.wait, false);
+});
+
+test("attempt below maxAttempts (last allowed) → wait", () => {
+  const r = shouldWaitForComboCooldown(
+    baseInput({ attempt: 1, settings: baseSettings({ maxAttempts: 2 }) }) as never
+  );
+  assert.equal(r.wait, true);
+});
+
+test("budget insufficient (budgetLeftMs < waitMs) → no wait", () => {
+  const r = shouldWaitForComboCooldown(baseInput({ waitMs: 3000, budgetLeftMs: 2999 }) as never);
+  assert.equal(r.wait, false);
+});
+
+test("budget exactly equal to waitMs → wait (inclusive bound)", () => {
+  const r = shouldWaitForComboCooldown(baseInput({ waitMs: 3000, budgetLeftMs: 3000 }) as never);
+  assert.equal(r.wait, true);
+});
+
+test("settings.enabled === false → no wait", () => {
+  const r = shouldWaitForComboCooldown(
+    baseInput({ settings: baseSettings({ enabled: false }) }) as never
+  );
+  assert.equal(r.wait, false);
+});
+
+test("non-finite / garbage waitMs → no wait (defensive)", () => {
+  assert.equal(shouldWaitForComboCooldown(baseInput({ waitMs: Number.NaN }) as never).wait, false);
+  assert.equal(
+    shouldWaitForComboCooldown(baseInput({ waitMs: Number.POSITIVE_INFINITY }) as never).wait,
+    false
+  );
+});
+
+test("returned waitMs is clamped to a finite number (0 when input invalid)", () => {
+  const r = shouldWaitForComboCooldown(baseInput({ waitMs: Number.NaN }) as never);
+  assert.equal(Number.isFinite(r.waitMs), true);
+  assert.equal(r.waitMs, 0);
+});
+
+// ── resolveComboCooldownWaitDecision (target resolution + hint/fallback) ──────
+
+const M = COMBO_COOLDOWN_WAIT_MARGIN_MS;
+
+function decisionInput(overrides: Record<string, unknown> = {}) {
+  return {
+    targets: [{ provider: "openai", connectionId: "conn-1" }],
+    earliestRetryAfter: new Date(Date.now() + 2000).toISOString(),
+    attempt: 0,
+    budgetLeftMs: 8000,
+    settings: baseSettings(),
+    lookupLock: (_p: string, _c: string) => ({ reason: "rate_limit", remainingMs: 2000 }),
+    computeWaitMs: (_r: unknown) => 2000,
+    ...overrides,
+  };
+}
+
+test("resolve: locked target with transient reason within budget → wait", () => {
+  const r = resolveComboCooldownWaitDecision(decisionInput() as never);
+  assert.equal(r.wait, true);
+  // wait = max(lock remaining, hint) + margin so the lock reliably clears.
+  assert.equal(r.waitMs, 2000 + M);
+  assert.equal(r.reason, "rate_limit");
+});
+
+test("resolve: quota_exhausted lock → no wait (the critical security guard)", () => {
+  const r = resolveComboCooldownWaitDecision(
+    decisionInput({
+      lookupLock: () => ({ reason: "quota_exhausted", remainingMs: 3000 }),
+    }) as never
+  );
+  assert.equal(r.wait, false);
+});
+
+test("resolve: settings.enabled false short-circuits before any lookup", () => {
+  let lookups = 0;
+  const r = resolveComboCooldownWaitDecision(
+    decisionInput({
+      settings: baseSettings({ enabled: false }),
+      lookupLock: () => {
+        lookups += 1;
+        return { reason: "rate_limit", remainingMs: 3000 };
+      },
+    }) as never
+  );
+  assert.equal(r.wait, false);
+  assert.equal(lookups, 0);
+});
+
+test("resolve: no locked target → no wait", () => {
+  const r = resolveComboCooldownWaitDecision(decisionInput({ lookupLock: () => null }) as never);
+  assert.equal(r.wait, false);
+  assert.equal(r.reason, null);
+});
+
+test("resolve: expired lock (remainingMs <= 0) is ignored → no wait", () => {
+  const r = resolveComboCooldownWaitDecision(
+    decisionInput({ lookupLock: () => ({ reason: "rate_limit", remainingMs: 0 }) }) as never
+  );
+  assert.equal(r.wait, false);
+});
+
+test("resolve: picks the soonest-to-recover locked target across many", () => {
+  const r = resolveComboCooldownWaitDecision(
+    decisionInput({
+      targets: [
+        { provider: "openai", connectionId: "a" },
+        { provider: "openai", connectionId: "b" },
+      ],
+      // 'a' recovers in 3s, 'b' in 2s → 'b' wins; both rate_limit so 'b' (2s)
+      // drives the wait. No usable hint → wait = lock remaining + margin.
+      lookupLock: (_p: string, c: string) =>
+        c === "b"
+          ? { reason: "rate_limit", remainingMs: 2000 }
+          : { reason: "rate_limit", remainingMs: 3000 },
+      computeWaitMs: () => null,
+    }) as never
+  );
+  assert.equal(r.wait, true);
+  assert.equal(r.waitMs, 2000 + M);
+});
+
+test("resolve: uses lock remainingMs (+margin) when the retry-after hint yields nothing", () => {
+  const r = resolveComboCooldownWaitDecision(
+    decisionInput({
+      computeWaitMs: () => null,
+      lookupLock: () => ({ reason: "rate_limit", remainingMs: 1500 }),
+    }) as never
+  );
+  assert.equal(r.wait, true);
+  assert.equal(r.waitMs, 1500 + M);
+});
+
+test("resolve: honors a LONGER upstream hint over the lock remaining (still capped)", () => {
+  // lock says 1s left but upstream hint says 3s → wait the longer 3s (+margin).
+  const r = resolveComboCooldownWaitDecision(
+    decisionInput({
+      computeWaitMs: () => 3000,
+      lookupLock: () => ({ reason: "rate_limit", remainingMs: 1000 }),
+    }) as never
+  );
+  assert.equal(r.wait, true);
+  assert.equal(r.waitMs, 3000 + M);
+});
+
+test("resolve: hint above the ceiling → no wait even if lock remaining is short", () => {
+  const r = resolveComboCooldownWaitDecision(
+    decisionInput({
+      settings: baseSettings({ maxWaitMs: 5000 }),
+      computeWaitMs: () => 6000,
+      lookupLock: () => ({ reason: "rate_limit", remainingMs: 1000 }),
+    }) as never
+  );
+  assert.equal(r.wait, false);
+});
+
+test("resolve: lock remaining above the ceiling → no wait (not a SHORT cooldown)", () => {
+  const r = resolveComboCooldownWaitDecision(
+    decisionInput({
+      settings: baseSettings({ maxWaitMs: 5000 }),
+      computeWaitMs: () => null,
+      lookupLock: () => ({ reason: "rate_limit", remainingMs: 6000 }),
+    }) as never
+  );
+  assert.equal(r.wait, false);
+});
diff --git a/tests/unit/combo-description-5005.test.ts b/tests/unit/combo-description-5005.test.ts
new file mode 100644
index 0000000000..c77a6a9185
--- /dev/null
+++ b/tests/unit/combo-description-5005.test.ts
@@ -0,0 +1,91 @@
+/**
+ * #5005 — Per-combo editable `description` field.
+ *
+ * The routing-combo API historically had NO `description` field: the Zod
+ * `createComboSchema` / `updateComboSchema` stripped any `description` on save.
+ * This proves the schema now ACCEPTS and PRESERVES `description`, and that the
+ * value round-trips through the DB layer (persisted in the `data` JSON blob and
+ * surfaced back by GET-style reads), with no new DB column.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-combo-desc-5005-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const { createComboSchema, updateComboSchema } = await import(
+  "../../src/shared/validation/schemas.ts"
+);
+const core = await import("../../src/lib/db/core.ts");
+const combosDb = await import("../../src/lib/db/combos.ts");
+
+async function resetStorage() {
+  core.resetDbInstance();
+  if (fs.existsSync(TEST_DATA_DIR)) {
+    fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  }
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+test.beforeEach(async () => {
+  await resetStorage();
+});
+
+test.after(async () => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+test("createComboSchema preserves description instead of stripping it", () => {
+  const parsed = createComboSchema.parse({
+    name: "Described Combo",
+    models: [{ provider: "openai", model: "gpt-4.1" }],
+    description: "Routes premium traffic to GPT-4.1",
+  });
+  assert.equal(parsed.description, "Routes premium traffic to GPT-4.1");
+});
+
+test("updateComboSchema preserves description instead of stripping it", () => {
+  const parsed = updateComboSchema.parse({
+    description: "Updated description text",
+  });
+  assert.equal(parsed.description, "Updated description text");
+});
+
+test("description round-trips through createCombo and getComboById/getComboByName", async () => {
+  const created = await combosDb.createCombo({
+    name: "Desc Combo",
+    models: [{ provider: "openai", model: "gpt-4.1" }],
+    description: "My human-friendly note",
+  });
+  assert.equal(created.description, "My human-friendly note");
+
+  const byId = await combosDb.getComboById(created.id as string);
+  assert.ok(byId, "combo should be retrievable by id");
+  assert.equal(byId!.description, "My human-friendly note");
+
+  const byName = await combosDb.getComboByName("Desc Combo");
+  assert.ok(byName, "combo should be retrievable by name");
+  assert.equal(byName!.description, "My human-friendly note");
+});
+
+test("description survives an updateCombo and is listed by getCombos", async () => {
+  const created = await combosDb.createCombo({
+    name: "Update Desc Combo",
+    models: [{ provider: "openai", model: "gpt-4.1" }],
+  });
+
+  const updated = await combosDb.updateCombo(created.id as string, {
+    description: "Added later via PUT",
+  });
+  assert.ok(updated);
+  assert.equal(updated!.description, "Added later via PUT");
+
+  const all = await combosDb.getCombos();
+  const found = all.find((c) => c.id === created.id);
+  assert.ok(found, "updated combo should appear in getCombos");
+  assert.equal(found!.description, "Added later via PUT");
+});
diff --git a/tests/unit/combo-fusion-strategy.test.ts b/tests/unit/combo-fusion-strategy.test.ts
new file mode 100644
index 0000000000..775baef70f
--- /dev/null
+++ b/tests/unit/combo-fusion-strategy.test.ts
@@ -0,0 +1,209 @@
+/**
+ * Fusion combo strategy — parallel panel + judge synthesis.
+ *
+ * Ported from upstream decolua/9router (Daniil Schovkunov). Adds Fusion as the 16th
+ * combo strategy: fan the prompt out to every panel model in parallel, then a judge
+ * model synthesizes one final answer from all panel responses.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-combo-fusion-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.API_KEY_SECRET = process.env.API_KEY_SECRET || "combo-fusion-test-secret";
+
+const { handleComboChat } = await import("../../open-sse/services/combo.ts");
+
+const noop = () => {};
+const log = { info: noop, warn: noop, debug: noop, error: noop };
+
+type Body = Record<string, unknown>;
+
+// Minimal OpenAI-chat Response-shaped object compatible with the engine's .ok + .clone().json() surface.
+function okResponse(content: string, { delayMs = 0 } = {}): Response | Promise<Response> {
+  const body = JSON.stringify({ choices: [{ message: { role: "assistant", content } }] });
+  const make = () =>
+    new Response(body, { status: 200, headers: { "Content-Type": "application/json" } });
+  return delayMs > 0 ? new Promise((r) => setTimeout(() => r(make()), delayMs)) : make();
+}
+
+function errResponse(status = 500): Response {
+  return new Response(JSON.stringify({ error: { message: "boom" } }), {
+    status,
+    headers: { "Content-Type": "application/json" },
+  });
+}
+
+function fusionCombo(models: string[], extra: Record<string, unknown> = {}) {
+  return {
+    name: "test-fusion-combo",
+    strategy: "fusion",
+    models: models.map((m) => ({ model: m })),
+    config: extra,
+  };
+}
+
+test("fusion: single-model panel answers directly (nothing to fuse)", async () => {
+  const calls: string[] = [];
+  const handleSingleModel = async (_b: Body, m: string) => {
+    calls.push(m);
+    return okResponse("solo");
+  };
+  const res = await handleComboChat({
+    body: { messages: [{ role: "user", content: "hi" }] },
+    combo: fusionCombo(["p/only"]),
+    handleSingleModel,
+    log,
+    settings: {},
+    allCombos: [],
+  });
+  assert.equal(calls.length, 1);
+  assert.equal(calls[0], "p/only");
+  assert.equal(res.status, 200);
+});
+
+test("fusion: fans out to the panel then routes a synthesis turn to the judge", async () => {
+  const seen: string[] = [];
+  const seenBodies: Body[] = [];
+  const handleSingleModel = async (b: Body, m: string) => {
+    seen.push(m);
+    seenBodies.push(b);
+    if (m === "p/judge") return okResponse("FINAL");
+    return okResponse(`ans-${m}`);
+  };
+
+  const res = await handleComboChat({
+    body: {
+      messages: [{ role: "user", content: "Q" }],
+      stream: true,
+      tools: [{ name: "x" }],
+    },
+    combo: fusionCombo(["p/a", "p/b", "p/c"], { judgeModel: "p/judge" }),
+    handleSingleModel,
+    log,
+    settings: {},
+    allCombos: [],
+  });
+
+  // 3 panel calls + 1 judge call.
+  assert.equal(seen.length, 4);
+  assert.deepEqual(seen.slice(0, 3).sort(), ["p/a", "p/b", "p/c"]);
+  assert.equal(seen[3], "p/judge");
+
+  // Panel calls are non-streaming with tools stripped.
+  for (let i = 0; i < 3; i++) {
+    const b = seenBodies[i];
+    assert.equal(b.stream, false, "panel call should be non-streaming");
+    assert.equal(b.tools, undefined, "panel call should have tools stripped");
+  }
+
+  // Judge call carries every panel answer + keeps the client's stream flag.
+  const judgeBody = seenBodies[3];
+  const judgeMsgs = judgeBody.messages as Array<{ role: string; content: string }>;
+  const judgeText = judgeMsgs[judgeMsgs.length - 1].content;
+  assert.match(judgeText, /ans-p\/a/);
+  assert.match(judgeText, /ans-p\/b/);
+  assert.match(judgeText, /ans-p\/c/);
+  assert.match(judgeText, /Source 1/);
+  assert.equal(judgeBody.stream, true);
+
+  assert.equal(res.status, 200);
+});
+
+test("fusion: defaults the judge to the first panel model when none is set", async () => {
+  const seen: string[] = [];
+  const handleSingleModel = async (_b: Body, m: string) => {
+    seen.push(m);
+    return okResponse(`ans-${m}`);
+  };
+  await handleComboChat({
+    body: { messages: [{ role: "user", content: "Q" }] },
+    combo: fusionCombo(["p/first", "p/second"]),
+    handleSingleModel,
+    log,
+    settings: {},
+    allCombos: [],
+  });
+  // Last call is the judge; defaults to panel[0].
+  assert.equal(seen[seen.length - 1], "p/first");
+});
+
+test("fusion: proceeds on quorum without waiting for a straggler (grace window)", async () => {
+  const handleSingleModel = async (_b: Body, m: string) => {
+    if (m === "p/slow") return okResponse("slow", { delayMs: 5000 });
+    if (m === "p/judge") return okResponse("FINAL");
+    return okResponse(`fast-${m}`);
+  };
+
+  const t0 = Date.now();
+  const seenBodies: Body[] = [];
+  const wrapped = async (b: Body, m: string) => {
+    seenBodies.push(b);
+    return handleSingleModel(b, m);
+  };
+  await handleComboChat({
+    body: { messages: [{ role: "user", content: "Q" }] },
+    combo: fusionCombo(["p/x", "p/y", "p/slow"], {
+      judgeModel: "p/judge",
+      fusionTuning: { minPanel: 2, stragglerGraceMs: 50, panelHardTimeoutMs: 10000 },
+    }),
+    handleSingleModel: wrapped,
+    log,
+    settings: {},
+    allCombos: [],
+  });
+  const elapsed = Date.now() - t0;
+
+  // Two fast answers reach quorum; grace is 50ms, so we never wait ~5s for p/slow.
+  assert.ok(elapsed < 2000, `should not wait for straggler (took ${elapsed}ms)`);
+
+  const judgeBody = seenBodies[seenBodies.length - 1];
+  const judgeMsgs = judgeBody.messages as Array<{ role: string; content: string }>;
+  const judgeText = judgeMsgs[judgeMsgs.length - 1].content;
+  assert.match(judgeText, /fast-p\/x/);
+  assert.match(judgeText, /fast-p\/y/);
+  assert.ok(!/slow/.test(judgeText), "straggler answer should not appear in the judge prompt");
+});
+
+test("fusion: returns the lone survivor directly when only one panel model succeeds", async () => {
+  const seen: string[] = [];
+  const handleSingleModel = async (_b: Body, m: string) => {
+    seen.push(m);
+    if (m === "p/ok") return okResponse("lone");
+    return errResponse(500);
+  };
+  await handleComboChat({
+    body: { messages: [{ role: "user", content: "Q" }] },
+    combo: fusionCombo(["p/ok", "p/bad"], {
+      judgeModel: "p/judge",
+      fusionTuning: { minPanel: 2, stragglerGraceMs: 50, panelHardTimeoutMs: 5000 },
+    }),
+    handleSingleModel,
+    log,
+    settings: {},
+    allCombos: [],
+  });
+  // No judge call — single answer means there is nothing to fuse.
+  assert.ok(
+    !seen.includes("p/judge"),
+    "judge should not be invoked when only one panel model survives"
+  );
+});
+
+test("fusion: returns 503 when the whole panel fails", async () => {
+  const handleSingleModel = async () => errResponse(500);
+  const res = await handleComboChat({
+    body: { messages: [{ role: "user", content: "Q" }] },
+    combo: fusionCombo(["p/a", "p/b"], {
+      fusionTuning: { minPanel: 2, stragglerGraceMs: 50, panelHardTimeoutMs: 5000 },
+    }),
+    handleSingleModel,
+    log,
+    settings: {},
+    allCombos: [],
+  });
+  assert.equal(res.status, 503);
+});
diff --git a/tests/unit/combo-headroom-ranking.test.ts b/tests/unit/combo-headroom-ranking.test.ts
new file mode 100644
index 0000000000..ac64ec9330
--- /dev/null
+++ b/tests/unit/combo-headroom-ranking.test.ts
@@ -0,0 +1,132 @@
+/**
+ * tests/unit/combo-headroom-ranking.test.ts
+ *
+ * Coverage for the PURE headroom-ranking helper
+ * (open-sse/services/combo/headroomRanking.ts).
+ *
+ * headroom = 1 − max(util_5h, util_7d). Candidates with MORE free capacity
+ * (higher headroom) rank first. Saturation is INJECTED (no network), so the
+ * helper is fully deterministic / unit-testable. Ties preserve input order
+ * (stable sort).
+ *
+ * Technique borrowed from the `dario` project: prefer the connection with the
+ * most headroom instead of reactively filling one until it 429s.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const mod = await import("../../open-sse/services/combo/headroomRanking.ts");
+const { computeHeadroom, rankByHeadroom } = mod;
+
+// ─── computeHeadroom (scalar) ────────────────────────────────────────────────
+
+test("computeHeadroom: 1 − max(util5h, util7d)", () => {
+  // weekly is the binding (higher util) dimension here
+  assert.equal(computeHeadroom({ util5h: 0.2, util7d: 0.7 }), 1 - 0.7);
+  // 5h is the binding dimension here
+  assert.equal(computeHeadroom({ util5h: 0.9, util7d: 0.1 }), 1 - 0.9);
+});
+
+test("computeHeadroom: clamps utilization into [0,1] and never returns <0 or >1", () => {
+  // over-saturated upstream (util > 1) → headroom floored at 0
+  assert.equal(computeHeadroom({ util5h: 1.4, util7d: 0 }), 0);
+  // negative noise → treated as 0 util → full headroom
+  assert.equal(computeHeadroom({ util5h: -0.3, util7d: -0.1 }), 1);
+});
+
+test("computeHeadroom: missing / non-finite dimensions are treated as 0 util (generous)", () => {
+  // fail-open: unknown saturation must not penalize a connection
+  assert.equal(computeHeadroom({}), 1);
+  assert.equal(computeHeadroom({ util5h: Number.NaN, util7d: undefined }), 1);
+  assert.equal(computeHeadroom({ util5h: 0.5 }), 0.5);
+});
+
+// ─── rankByHeadroom (ordering) ───────────────────────────────────────────────
+
+const keyOf = (c: { id: string }) => c.id;
+
+test("rankByHeadroom: higher headroom (more free) first — A busy(0.8) vs B free(0.2)", () => {
+  const candidates = [{ id: "A" }, { id: "B" }];
+  const sat = new Map([
+    ["A", { util5h: 0.8, util7d: 0.1 }],
+    ["B", { util5h: 0.2, util7d: 0.1 }],
+  ]);
+  const ranked = rankByHeadroom(candidates, sat, keyOf);
+  assert.deepEqual(
+    ranked.map((c) => c.id),
+    ["B", "A"]
+  );
+});
+
+test("rankByHeadroom: uses max(5h,7d) — B's high weekly sinks it below A", () => {
+  const candidates = [{ id: "A" }, { id: "B" }];
+  const sat = new Map([
+    ["A", { util5h: 0.5, util7d: 0.5 }], // headroom 0.5
+    ["B", { util5h: 0.1, util7d: 0.95 }], // headroom 0.05 (weekly binds)
+  ]);
+  const ranked = rankByHeadroom(candidates, sat, keyOf);
+  assert.deepEqual(
+    ranked.map((c) => c.id),
+    ["A", "B"]
+  );
+});
+
+test("rankByHeadroom: tie → stable (preserves original input order)", () => {
+  const candidates = [{ id: "X" }, { id: "Y" }, { id: "Z" }];
+  const sat = new Map([
+    ["X", { util5h: 0.3, util7d: 0.3 }],
+    ["Y", { util5h: 0.3, util7d: 0.3 }],
+    ["Z", { util5h: 0.3, util7d: 0.3 }],
+  ]);
+  const ranked = rankByHeadroom(candidates, sat, keyOf);
+  assert.deepEqual(
+    ranked.map((c) => c.id),
+    ["X", "Y", "Z"]
+  );
+});
+
+test("rankByHeadroom: partial tie keeps stable order within the tied band", () => {
+  // A and C both headroom 0.7; B headroom 0.2. Expect A, C (input order), then B.
+  const candidates = [{ id: "A" }, { id: "B" }, { id: "C" }];
+  const sat = new Map([
+    ["A", { util5h: 0.3, util7d: 0.0 }], // 0.7
+    ["B", { util5h: 0.8, util7d: 0.0 }], // 0.2
+    ["C", { util5h: 0.3, util7d: 0.0 }], // 0.7
+  ]);
+  const ranked = rankByHeadroom(candidates, sat, keyOf);
+  assert.deepEqual(
+    ranked.map((c) => c.id),
+    ["A", "C", "B"]
+  );
+});
+
+test("rankByHeadroom: missing saturation entry → treated as full headroom (fail-open, ranks first)", () => {
+  const candidates = [{ id: "known" }, { id: "unknown" }];
+  const sat = new Map([
+    ["known", { util5h: 0.6, util7d: 0.6 }], // headroom 0.4
+    // "unknown" absent → headroom 1.0 → should rank first
+  ]);
+  const ranked = rankByHeadroom(candidates, sat, keyOf);
+  assert.deepEqual(
+    ranked.map((c) => c.id),
+    ["unknown", "known"]
+  );
+});
+
+test("rankByHeadroom: does not mutate the input array", () => {
+  const candidates = [{ id: "A" }, { id: "B" }];
+  const original = [...candidates];
+  const sat = new Map([
+    ["A", { util5h: 0.9, util7d: 0.9 }],
+    ["B", { util5h: 0.1, util7d: 0.1 }],
+  ]);
+  rankByHeadroom(candidates, sat, keyOf);
+  assert.deepEqual(candidates, original, "input array order must be unchanged");
+});
+
+test("rankByHeadroom: empty / single candidate is a no-op", () => {
+  assert.deepEqual(rankByHeadroom([], new Map(), keyOf), []);
+  const one = [{ id: "solo" }];
+  assert.deepEqual(rankByHeadroom(one, new Map(), keyOf), one);
+});
diff --git a/tests/unit/combo-headroom-strategy.test.ts b/tests/unit/combo-headroom-strategy.test.ts
new file mode 100644
index 0000000000..1e7a8a441f
--- /dev/null
+++ b/tests/unit/combo-headroom-strategy.test.ts
@@ -0,0 +1,147 @@
+/**
+ * tests/unit/combo-headroom-strategy.test.ts
+ *
+ * Integration coverage for orderTargetsByHeadroom
+ * (open-sse/services/combo/quotaStrategies.ts) — the async orderer that wires
+ * per-connection saturation into the pure rankByHeadroom helper.
+ *
+ * Isolated from DB/network: targets carry explicit connectionIds and use a
+ * provider with NO registered quota fetcher, so getQuotaAwareConnectionsForTarget
+ * short-circuits (no getProviderConnections call). The getSaturation signal is
+ * injected via __setHeadroomSaturationFetcherForTests.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const mod = await import("../../open-sse/services/combo/quotaStrategies.ts");
+const { orderTargetsByHeadroom, __setHeadroomSaturationFetcherForTests } = mod;
+
+const silentLog = { warn: () => {} };
+
+function target(connectionId: string, modelStr = "testprov/model-a") {
+  return {
+    kind: "model" as const,
+    stepId: connectionId,
+    executionKey: `key-${connectionId}`,
+    modelStr,
+    provider: "testprov",
+    providerId: "testprov",
+    connectionId,
+    weight: 1,
+    label: null,
+  };
+}
+
+test.afterEach(() => {
+  __setHeadroomSaturationFetcherForTests(null);
+});
+
+test("orderTargetsByHeadroom: prefers the connection with the most free capacity", async () => {
+  // conn-busy is at 0.8 util (5h), conn-free at 0.2 → free should come first.
+  __setHeadroomSaturationFetcherForTests(async (connectionId, _provider, dim) => {
+    const table: Record<string, { "5h": number; weekly: number }> = {
+      "conn-busy": { "5h": 0.8, weekly: 0.1 },
+      "conn-free": { "5h": 0.2, weekly: 0.1 },
+    };
+    return table[connectionId]?.[dim.window as "5h" | "weekly"] ?? 0;
+  });
+
+  const ordered = await orderTargetsByHeadroom(
+    [target("conn-busy"), target("conn-free")],
+    "combo-x",
+    silentLog
+  );
+  assert.deepEqual(
+    ordered.map((t) => t.connectionId),
+    ["conn-free", "conn-busy"]
+  );
+});
+
+test("orderTargetsByHeadroom: weekly window can bind even when 5h is low", async () => {
+  // conn-a: balanced 0.5/0.5 → headroom 0.5
+  // conn-b: 5h great (0.1) but weekly nearly exhausted (0.95) → headroom 0.05
+  __setHeadroomSaturationFetcherForTests(async (connectionId, _provider, dim) => {
+    const table: Record<string, { "5h": number; weekly: number }> = {
+      "conn-a": { "5h": 0.5, weekly: 0.5 },
+      "conn-b": { "5h": 0.1, weekly: 0.95 },
+    };
+    return table[connectionId]?.[dim.window as "5h" | "weekly"] ?? 0;
+  });
+
+  const ordered = await orderTargetsByHeadroom(
+    [target("conn-a"), target("conn-b")],
+    "combo-x",
+    silentLog
+  );
+  assert.deepEqual(
+    ordered.map((t) => t.connectionId),
+    ["conn-a", "conn-b"]
+  );
+});
+
+test("orderTargetsByHeadroom: equal saturation preserves priority order (stable)", async () => {
+  __setHeadroomSaturationFetcherForTests(async () => 0.3);
+  const ordered = await orderTargetsByHeadroom(
+    [target("c1"), target("c2"), target("c3")],
+    "combo-x",
+    silentLog
+  );
+  assert.deepEqual(
+    ordered.map((t) => t.connectionId),
+    ["c1", "c2", "c3"]
+  );
+});
+
+test("orderTargetsByHeadroom: saturation fetcher throwing fails open (keeps order)", async () => {
+  __setHeadroomSaturationFetcherForTests(async () => {
+    throw new Error("boom");
+  });
+  const ordered = await orderTargetsByHeadroom(
+    [target("c1"), target("c2")],
+    "combo-x",
+    silentLog
+  );
+  // Fail-open: the orderer catches and returns the original target order.
+  assert.deepEqual(
+    ordered.map((t) => t.connectionId),
+    ["c1", "c2"]
+  );
+});
+
+test("orderTargetsByHeadroom: single / empty target is a no-op without calling the fetcher", async () => {
+  let called = 0;
+  __setHeadroomSaturationFetcherForTests(async () => {
+    called++;
+    return 0;
+  });
+  assert.deepEqual(await orderTargetsByHeadroom([], "combo-x", silentLog), []);
+  const one = [target("solo")];
+  const orderedOne = await orderTargetsByHeadroom(one, "combo-x", silentLog);
+  assert.deepEqual(
+    orderedOne.map((t) => t.connectionId),
+    ["solo"]
+  );
+  assert.equal(called, 0, "fetcher must not be called for <=1 target");
+});
+
+test("orderTargetsByHeadroom: fetches each unique connection's saturation once (5h+weekly)", async () => {
+  const calls: string[] = [];
+  __setHeadroomSaturationFetcherForTests(async (connectionId, _provider, dim) => {
+    calls.push(`${connectionId}:${dim.window}`);
+    return connectionId === "hot" ? 0.9 : 0.1;
+  });
+
+  const ordered = await orderTargetsByHeadroom(
+    [target("hot"), target("cool")],
+    "combo-x",
+    silentLog
+  );
+  assert.deepEqual(
+    ordered.map((t) => t.connectionId),
+    ["cool", "hot"]
+  );
+  // Exactly one 5h + one weekly probe per unique connection (2 conns → 4 calls).
+  calls.sort();
+  assert.deepEqual(calls, ["cool:5h", "cool:weekly", "hot:5h", "hot:weekly"]);
+});
diff --git a/tests/unit/combo-pin-health-gate.test.ts b/tests/unit/combo-pin-health-gate.test.ts
new file mode 100644
index 0000000000..ad02650975
--- /dev/null
+++ b/tests/unit/combo-pin-health-gate.test.ts
@@ -0,0 +1,77 @@
+/**
+ * ccp pin health gate — drop a context-cache pin when its provider is DURABLY
+ * down so the session fails over instead of pounding a dead account, while
+ * tolerating transient cooldowns so an unstable provider does not churn the pin.
+ *
+ * Incident 2026-06-22: a session pinned to a throttled/credits-exhausted account
+ * stayed pinned forever (strategy bypassed, no failover) because the pin was only
+ * dropped when the model LEFT the combo, never on connection health.
+ */
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { pinIsDurablyUnhealthy } from "../../open-sse/services/combo.ts";
+
+const NOW = 1_900_000_000_000;
+const opts = { backoffLevel: 2, graceMs: 20_000 };
+const healthy = { testStatus: "active", backoffLevel: 0, rateLimitedUntil: null };
+
+test("keeps pin when a healthy connection exists", () => {
+  assert.equal(pinIsDurablyUnhealthy("CLOSED", [healthy], NOW, opts), false);
+});
+
+test("drops pin when circuit is OPEN", () => {
+  assert.equal(pinIsDurablyUnhealthy("OPEN", [healthy], NOW, opts), true);
+});
+
+test("drops pin when there are no active connections", () => {
+  assert.equal(pinIsDurablyUnhealthy("CLOSED", [], NOW, opts), true);
+});
+
+test("drops pin when the only connection has credits exhausted (terminal)", () => {
+  const conn = { testStatus: "credits_exhausted", backoffLevel: 0, rateLimitedUntil: null };
+  assert.equal(pinIsDurablyUnhealthy("CLOSED", [conn], NOW, opts), true);
+});
+
+test("drops pin on banned/expired terminal status", () => {
+  assert.equal(
+    pinIsDurablyUnhealthy("CLOSED", [{ testStatus: "banned", backoffLevel: 0 }], NOW, opts),
+    true
+  );
+  assert.equal(
+    pinIsDurablyUnhealthy("CLOSED", [{ testStatus: "expired", backoffLevel: 0 }], NOW, opts),
+    true
+  );
+});
+
+test("drops pin once backoffLevel reaches the threshold (repeated failures)", () => {
+  assert.equal(
+    pinIsDurablyUnhealthy("CLOSED", [{ testStatus: "active", backoffLevel: 2 }], NOW, opts),
+    true
+  );
+});
+
+test("anti-flap: keeps pin on a brief transient cooldown (low backoff, short rate-limit)", () => {
+  const conn = {
+    testStatus: "active",
+    backoffLevel: 1,
+    rateLimitedUntil: new Date(NOW + 4_000).toISOString(), // 4s out — within grace
+  };
+  assert.equal(pinIsDurablyUnhealthy("CLOSED", [conn], NOW, opts), false);
+});
+
+test("drops pin on a long rate-limit window (beyond grace)", () => {
+  const conn = {
+    testStatus: "active",
+    backoffLevel: 0,
+    rateLimitedUntil: new Date(NOW + 60_000).toISOString(), // 60s out — durable
+  };
+  assert.equal(pinIsDurablyUnhealthy("CLOSED", [conn], NOW, opts), true);
+});
+
+test("keeps pin if ANY connection is usable (terminal + healthy mix)", () => {
+  const conns = [
+    { testStatus: "credits_exhausted", backoffLevel: 0 },
+    healthy,
+  ];
+  assert.equal(pinIsDurablyUnhealthy("CLOSED", conns, NOW, opts), false);
+});
diff --git a/tests/unit/combo-quota-share-cooldown-wait.test.ts b/tests/unit/combo-quota-share-cooldown-wait.test.ts
new file mode 100644
index 0000000000..f699759a6e
--- /dev/null
+++ b/tests/unit/combo-quota-share-cooldown-wait.test.ts
@@ -0,0 +1,234 @@
+/**
+ * TDD (integration) — quota-share combo cooldown-aware retry (Variante A),
+ * exercised through handleComboChat.
+ *
+ * Scenarios (modelled on model-lockout-max-cooldown.test.ts):
+ *  1. strategy="quota-share", single connection, model hits a 429 with a SHORT
+ *     retry-after → the combo WAITS out the cooldown and re-dispatches; the 2nd
+ *     pass (lock expired) returns 200 instead of propagating the 429.
+ *  2. A 403 (quota_exhausted, locked until midnight) → NO wait, the 403/429 is
+ *     propagated immediately (the helper's critical exclusion).
+ *  3. Client abort DURING the wait → 499 "Request aborted".
+ *  4. strategy="priority" (non quota-share) → unchanged: the 429 is propagated
+ *     immediately with NO wait.
+ *  5. comboCooldownWait disabled in settings → unchanged: 429 propagated, no wait.
+ *
+ * The waits use a real (short) cooldown so the real setTimeout in
+ * waitForCooldownAwareRetry elapses fast and the model lock expires naturally.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omr-combo-cooldown-wait-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.API_KEY_SECRET = "test-combo-cooldown-wait-secret";
+
+const core = await import("../../src/lib/db/core.ts");
+const { handleComboChat } = await import("../../open-sse/services/combo.ts");
+const { clearAllModelLockouts } = await import("../../open-sse/services/accountFallback.ts");
+
+function createLog() {
+  return { info: () => {}, warn: () => {}, error: () => {}, debug: () => {} };
+}
+
+// A short transient cooldown so the real wait is fast but the lock genuinely
+// expires between passes. The 429 carries a retry-after hint slightly LONGER
+// than baseCooldownMs so waiting it out guarantees the lock has cleared.
+const BASE_COOLDOWN_MS = 150;
+const RETRY_AFTER_MS = 250;
+
+function shortModelLockoutSettings() {
+  return {
+    modelLockout: {
+      enabled: true,
+      errorCodes: [403, 429],
+      baseCooldownMs: BASE_COOLDOWN_MS,
+      maxCooldownMs: 5000,
+      maxBackoffSteps: 0,
+      useExponentialBackoff: false,
+    },
+  };
+}
+
+function jsonResponse(status: number, body: Record<string, unknown>) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json" },
+  });
+}
+
+function okResponse() {
+  return jsonResponse(200, { id: "ok", choices: [{ message: { content: "recovered" } }] });
+}
+
+function rateLimitResponse(status: number) {
+  return jsonResponse(status, {
+    error: { message: `rate limited (${status})` },
+    // string ISO retry-after → computeClosestRetryAfter yields ~RETRY_AFTER_MS
+    retryAfter: new Date(Date.now() + RETRY_AFTER_MS).toISOString(),
+  });
+}
+
+function comboOf(strategy: string) {
+  return {
+    name: `qtSd/${strategy}-${Math.random().toString(16).slice(2, 8)}`,
+    strategy,
+    models: ["openai/gpt-4"],
+    config: { maxRetries: 0, retryDelayMs: 0, fallbackDelayMs: 0, maxSetRetries: 0 },
+  };
+}
+
+async function resetStorage() {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+test.beforeEach(async () => {
+  clearAllModelLockouts();
+  await resetStorage();
+});
+
+test.after(async () => {
+  clearAllModelLockouts();
+  try {
+    core.resetDbInstance();
+    fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  } catch {
+    /* best effort */
+  }
+});
+
+test("quota-share: short 429 cooldown → waits and re-dispatches (2nd pass 200)", async () => {
+  let calls = 0;
+  const handleSingleModel = async () => {
+    calls += 1;
+    // 1st dispatch: transient 429 (records a rate_limit lock). 2nd dispatch
+    // (after the wait, lock expired): success.
+    return calls === 1 ? rateLimitResponse(429) : okResponse();
+  };
+
+  const startedAt = Date.now();
+  const res = await handleComboChat({
+    body: { model: "openai/gpt-4" },
+    combo: comboOf("quota-share"),
+    handleSingleModel,
+    isModelAvailable: async () => true,
+    log: createLog() as never,
+    settings: shortModelLockoutSettings(),
+    allCombos: null,
+  });
+  const elapsed = Date.now() - startedAt;
+
+  assert.equal(res.status, 200, "expected the retried dispatch to succeed with 200");
+  assert.equal(calls, 2, "expected exactly one wait+redispatch (2 upstream calls)");
+  assert.ok(
+    elapsed >= BASE_COOLDOWN_MS,
+    `expected to have waited out the cooldown, only ${elapsed}ms elapsed`
+  );
+});
+
+test("quota-share: 403 quota_exhausted → NO wait, error propagated immediately", async () => {
+  let calls = 0;
+  const handleSingleModel = async () => {
+    calls += 1;
+    return rateLimitResponse(403);
+  };
+
+  const startedAt = Date.now();
+  const res = await handleComboChat({
+    body: { model: "openai/gpt-4" },
+    combo: comboOf("quota-share"),
+    handleSingleModel,
+    isModelAvailable: async () => true,
+    log: createLog() as never,
+    settings: shortModelLockoutSettings(),
+    allCombos: null,
+  });
+  const elapsed = Date.now() - startedAt;
+
+  assert.notEqual(res.status, 200, "quota_exhausted must not be retried into a success");
+  // The real signal that the cooldown wait did NOT fire: a single upstream
+  // dispatch (no redispatch). The 403 lock cooldown is multi-second, so the
+  // wait — had it fired — would dominate the elapsed time; assert we stayed far
+  // below that (loose bound; the first combo dispatch pays DB/import overhead).
+  assert.equal(calls, 1, "quota_exhausted must NOT trigger a wait+redispatch");
+  assert.ok(elapsed < 1500, `quota_exhausted must not wait out a cooldown, but ${elapsed}ms elapsed`);
+});
+
+test("quota-share: client abort during the wait → 499", async () => {
+  const controller = new AbortController();
+  let calls = 0;
+  const handleSingleModel = async () => {
+    calls += 1;
+    // Always 429 so the loop reaches the wait; abort fires during the wait.
+    return rateLimitResponse(429);
+  };
+
+  // Abort shortly after the request starts — within the cooldown wait window.
+  setTimeout(() => controller.abort(), 50);
+
+  const res = await handleComboChat({
+    body: { model: "openai/gpt-4" },
+    combo: comboOf("quota-share"),
+    handleSingleModel,
+    isModelAvailable: async () => true,
+    log: createLog() as never,
+    settings: shortModelLockoutSettings(),
+    allCombos: null,
+    signal: controller.signal,
+  });
+
+  assert.equal(res.status, 499, "abort during the cooldown wait must return 499");
+});
+
+test("non quota-share (priority): 429 propagated immediately, NO wait", async () => {
+  let calls = 0;
+  const handleSingleModel = async () => {
+    calls += 1;
+    return rateLimitResponse(429);
+  };
+
+  const startedAt = Date.now();
+  const res = await handleComboChat({
+    body: { model: "openai/gpt-4" },
+    combo: { ...comboOf("priority"), name: "priority-combo" },
+    handleSingleModel,
+    isModelAvailable: async () => true,
+    log: createLog() as never,
+    settings: shortModelLockoutSettings(),
+    allCombos: null,
+  });
+  const elapsed = Date.now() - startedAt;
+
+  assert.equal(res.status, 429, "priority combo must propagate the 429 unchanged");
+  assert.equal(calls, 1, "priority combo must NOT wait+redispatch");
+  assert.ok(elapsed < 1500, `priority combo must not wait out a cooldown, but ${elapsed}ms elapsed`);
+});
+
+test("quota-share with comboCooldownWait disabled → 429 propagated, NO wait", async () => {
+  let calls = 0;
+  const handleSingleModel = async () => {
+    calls += 1;
+    return rateLimitResponse(429);
+  };
+
+  const res = await handleComboChat({
+    body: { model: "openai/gpt-4" },
+    combo: comboOf("quota-share"),
+    handleSingleModel,
+    isModelAvailable: async () => true,
+    log: createLog() as never,
+    settings: {
+      ...shortModelLockoutSettings(),
+      resilienceSettings: { comboCooldownWait: { enabled: false } },
+    },
+    allCombos: null,
+  });
+
+  assert.equal(res.status, 429, "disabled feature must propagate the 429 unchanged");
+  assert.equal(calls, 1, "disabled feature must NOT wait+redispatch");
+});
diff --git a/tests/unit/combo-routes-composite-tiers.test.ts b/tests/unit/combo-routes-composite-tiers.test.ts
index 40493faae1..2abda3e5ab 100644
--- a/tests/unit/combo-routes-composite-tiers.test.ts
+++ b/tests/unit/combo-routes-composite-tiers.test.ts
@@ -154,13 +154,18 @@ test("POST /api/combos rejects composite tiers that point to unknown steps", asy
   assert.equal(response.status, 400);
   assert.deepEqual(body, {
     error: {
-      message: "Invalid composite tiers",
-      details: [
-        {
-          field: "config.compositeTiers.tiers.primary.stepId",
-          message: 'stepId "step-missing" does not exist in combo.models',
-        },
-      ],
+      code: "COMBO_003",
+      message: "Composite tier configuration is invalid",
+      category: "COMBO",
+      details: {
+        reason: "Invalid composite tiers",
+        details: [
+          {
+            field: "config.compositeTiers.tiers.primary.stepId",
+            message: 'stepId "step-missing" does not exist in combo.models',
+          },
+        ],
+      },
     },
   });
 });
@@ -222,13 +227,18 @@ test("PUT /api/combos rejects updates that orphan an existing composite tier ste
   assert.equal(response.status, 400);
   assert.deepEqual(body, {
     error: {
-      message: "Invalid composite tiers",
-      details: [
-        {
-          field: "config.compositeTiers.tiers.primary.stepId",
-          message: 'stepId "step-primary" does not exist in combo.models',
-        },
-      ],
+      code: "COMBO_003",
+      message: "Composite tier configuration is invalid",
+      category: "COMBO",
+      details: {
+        reason: "Invalid composite tiers",
+        details: [
+          {
+            field: "config.compositeTiers.tiers.primary.stepId",
+            message: 'stepId "step-primary" does not exist in combo.models',
+          },
+        ],
+      },
     },
   });
 });
diff --git a/tests/unit/combo-session-stickiness.test.ts b/tests/unit/combo-session-stickiness.test.ts
new file mode 100644
index 0000000000..ede8def020
--- /dev/null
+++ b/tests/unit/combo-session-stickiness.test.ts
@@ -0,0 +1,322 @@
+/**
+ * tests/unit/combo-session-stickiness.test.ts
+ *
+ * Unit tests for open-sse/services/combo/sessionStickiness.ts
+ *
+ * Design: saturation is injected via __setStickinessHeadroomFetcherForTests —
+ * no network, no DB, fully deterministic.
+ *
+ * Coverage:
+ * - deriveMessageHash: stable key derivation from first user message
+ * - applySessionStickiness: same hash → same connection while healthy
+ * - applySessionStickiness: saturated connection → rebind (clear + fall through)
+ * - applySessionStickiness: no user message → normal ordering, no crash
+ * - applySessionStickiness: different hashes → can map to different connections
+ * - applySessionStickiness: saturation fetch error → fail-open
+ * - recordStickyBinding / clearStickyBinding lifecycle
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import type { HeadroomSaturation } from "../../open-sse/services/combo/headroomRanking.ts";
+
+const mod = await import("../../open-sse/services/combo/sessionStickiness.ts");
+const {
+  deriveMessageHash,
+  applySessionStickiness,
+  recordStickyBinding,
+  clearStickyBinding,
+  clearAllStickyBindings,
+  __setStickinessHeadroomFetcherForTests,
+  STICKINESS_HEADROOM_THRESHOLD,
+} = mod;
+
+// ─── helpers ─────────────────────────────────────────────────────────────────
+
+function makeTarget(connectionId: string): import("../../open-sse/services/combo/types.ts").ResolvedComboTarget {
+  return {
+    kind: "model",
+    stepId: `step-${connectionId}`,
+    executionKey: `key-${connectionId}`,
+    modelStr: `gpt-4/${connectionId}`,
+    provider: "openai",
+    providerId: null,
+    connectionId,
+    weight: 1,
+    label: null,
+  };
+}
+
+function injectSat(sat: HeadroomSaturation | undefined): void {
+  __setStickinessHeadroomFetcherForTests(async (_id: string) => sat);
+}
+
+// ─── Test lifecycle ───────────────────────────────────────────────────────────
+
+test.beforeEach(() => {
+  clearAllStickyBindings();
+  // Default: healthy connection (headroom = 0.5)
+  injectSat({ util5h: 0.3, util7d: 0.2 });
+});
+
+test.after(() => {
+  __setStickinessHeadroomFetcherForTests(null);
+});
+
+// ─── deriveMessageHash ───────────────────────────────────────────────────────
+
+test("deriveMessageHash: returns 16-char hex for a plain user message", () => {
+  const hash = deriveMessageHash([{ role: "user", content: "Hello world" }]);
+  assert.ok(hash !== null, "hash should not be null");
+  assert.match(hash!, /^[a-f0-9]{16}$/);
+});
+
+test("deriveMessageHash: same content → same hash (stable)", () => {
+  const msgs = [{ role: "user", content: "How are you?" }];
+  assert.equal(deriveMessageHash(msgs), deriveMessageHash(msgs));
+});
+
+test("deriveMessageHash: different first messages → different hashes", () => {
+  const h1 = deriveMessageHash([{ role: "user", content: "AAA" }]);
+  const h2 = deriveMessageHash([{ role: "user", content: "BBB" }]);
+  assert.notEqual(h1, h2);
+});
+
+test("deriveMessageHash: skips assistant messages, uses first user", () => {
+  const msgs = [
+    { role: "assistant", content: "Hi" },
+    { role: "user", content: "My real first message" },
+  ];
+  const direct = [{ role: "user", content: "My real first message" }];
+  assert.equal(deriveMessageHash(msgs), deriveMessageHash(direct));
+});
+
+test("deriveMessageHash: multi-part content array is hashed on text parts", () => {
+  const msgs = [
+    {
+      role: "user",
+      content: [
+        { type: "text", text: "Hello" },
+        { type: "image_url", url: "http://example.com/img.png" },
+      ],
+    },
+  ];
+  const hash = deriveMessageHash(msgs);
+  assert.ok(hash !== null);
+  assert.match(hash!, /^[a-f0-9]{16}$/);
+  // Stability
+  assert.equal(deriveMessageHash(msgs), hash);
+});
+
+test("deriveMessageHash: null/empty → null (fail-open)", () => {
+  assert.equal(deriveMessageHash(null), null);
+  assert.equal(deriveMessageHash([]), null);
+  assert.equal(deriveMessageHash(undefined), null);
+  // No user message
+  assert.equal(deriveMessageHash([{ role: "assistant", content: "Hi" }]), null);
+});
+
+// ─── applySessionStickiness — main scenarios ──────────────────────────────────
+
+test("same message hash → same connection in repeated calls while healthy", async () => {
+  const targets = [makeTarget("conn-A"), makeTarget("conn-B"), makeTarget("conn-C")];
+  const messages = [{ role: "user", content: "First turn of conversation" }];
+
+  const hash = deriveMessageHash(messages)!;
+  assert.ok(hash, "hash must be derivable");
+
+  // Simulate first successful request: record sticky to conn-B
+  recordStickyBinding(hash, "conn-B");
+
+  // Call 1
+  const r1 = await applySessionStickiness(targets, messages);
+  assert.ok(r1.stuck, "should be stuck on first call");
+  assert.equal(r1.targets[0].connectionId, "conn-B", "conn-B should be first");
+
+  // Call 2 (same conversation)
+  const r2 = await applySessionStickiness(targets, messages);
+  assert.ok(r2.stuck, "should remain stuck on second call");
+  assert.equal(r2.targets[0].connectionId, "conn-B");
+});
+
+test("saturated connection → rebind (clear sticky, return normal ordering)", async () => {
+  injectSat({ util5h: 0.9, util7d: 0.9 }); // headroom = 0.1, below threshold
+  const targets = [makeTarget("conn-A"), makeTarget("conn-B")];
+  const messages = [{ role: "user", content: "Saturation test" }];
+  const hash = deriveMessageHash(messages)!;
+
+  recordStickyBinding(hash, "conn-A");
+
+  const result = await applySessionStickiness(targets, messages);
+
+  assert.equal(result.stuck, false, "should NOT be stuck when saturated");
+  // Normal order preserved (conn-A stays at index 0 — just not "stuck")
+  assert.equal(result.targets[0].connectionId, "conn-A");
+
+  // Binding must have been cleared — subsequent call also returns not stuck
+  // (even with healthy fetcher since the binding is gone)
+  injectSat({ util5h: 0.1, util7d: 0.1 }); // now healthy
+  const result2 = await applySessionStickiness(targets, messages);
+  assert.equal(result2.stuck, false, "binding was cleared, no stickiness on follow-up");
+});
+
+test("no user message in body → normal ordering, no crash", async () => {
+  const targets = [makeTarget("conn-A"), makeTarget("conn-B")];
+
+  const r1 = await applySessionStickiness(targets, null);
+  assert.equal(r1.stuck, false);
+  assert.deepEqual(
+    r1.targets.map((t) => t.connectionId),
+    ["conn-A", "conn-B"]
+  );
+
+  const r2 = await applySessionStickiness(targets, []);
+  assert.equal(r2.stuck, false);
+
+  const r3 = await applySessionStickiness(targets, undefined);
+  assert.equal(r3.stuck, false);
+});
+
+test("different message hashes can map to different connections", async () => {
+  injectSat({ util5h: 0.0, util7d: 0.0 }); // full headroom
+  const targets = [makeTarget("conn-X"), makeTarget("conn-Y")];
+
+  const msgs1 = [{ role: "user", content: "Conversation Alpha" }];
+  const msgs2 = [{ role: "user", content: "Conversation Beta" }];
+
+  const hash1 = deriveMessageHash(msgs1)!;
+  const hash2 = deriveMessageHash(msgs2)!;
+  assert.notEqual(hash1, hash2, "hashes must differ");
+
+  recordStickyBinding(hash1, "conn-X");
+  recordStickyBinding(hash2, "conn-Y");
+
+  const r1 = await applySessionStickiness(targets, msgs1);
+  const r2 = await applySessionStickiness(targets, msgs2);
+
+  assert.ok(r1.stuck);
+  assert.ok(r2.stuck);
+  assert.equal(r1.targets[0].connectionId, "conn-X");
+  assert.equal(r2.targets[0].connectionId, "conn-Y");
+});
+
+test("saturation fetch error → fail-open (original order, no crash)", async () => {
+  __setStickinessHeadroomFetcherForTests(async (_id: string) => {
+    throw new Error("network failure");
+  });
+
+  const targets = [makeTarget("conn-A"), makeTarget("conn-B")];
+  const messages = [{ role: "user", content: "Error path" }];
+  const hash = deriveMessageHash(messages)!;
+  recordStickyBinding(hash, "conn-A");
+
+  const result = await applySessionStickiness(targets, messages);
+  assert.equal(result.stuck, false, "must not crash on fetcher error");
+  assert.deepEqual(
+    result.targets.map((t) => t.connectionId),
+    ["conn-A", "conn-B"],
+    "original order preserved"
+  );
+});
+
+test("single target list → no-op, no sticky lookup performed", async () => {
+  const targets = [makeTarget("conn-solo")];
+  const messages = [{ role: "user", content: "Only one target" }];
+  const hash = deriveMessageHash(messages)!;
+  recordStickyBinding(hash, "conn-solo");
+
+  const result = await applySessionStickiness(targets, messages);
+  assert.equal(result.stuck, false, "no stickiness applied for single target");
+  assert.deepEqual(result.targets, targets);
+});
+
+test("STICKINESS_HEADROOM_THRESHOLD: connection below threshold is NOT reused", async () => {
+  // headroom = 1 − 0.9 = 0.1, clearly below threshold 0.15
+  injectSat({ util5h: 0.9, util7d: 0.0 });
+  const targets = [makeTarget("conn-A"), makeTarget("conn-B")];
+  const messages = [{ role: "user", content: "Below threshold" }];
+  const hash = deriveMessageHash(messages)!;
+  recordStickyBinding(hash, "conn-A");
+
+  const result = await applySessionStickiness(targets, messages);
+  assert.equal(result.stuck, false, "connection below threshold must not be reused");
+});
+
+test("connection just above threshold IS reused", async () => {
+  // headroom = 1 − 0.84 = 0.16 > 0.15
+  injectSat({ util5h: 0.84, util7d: 0.0 });
+  const targets = [makeTarget("conn-A"), makeTarget("conn-B")];
+  const messages = [{ role: "user", content: "Above threshold" }];
+  const hash = deriveMessageHash(messages)!;
+  recordStickyBinding(hash, "conn-A");
+
+  const result = await applySessionStickiness(targets, messages);
+  assert.ok(result.stuck, "connection just above threshold should be reused");
+  assert.equal(result.targets[0].connectionId, "conn-A");
+});
+
+test("sticky connection no longer in target list → clear binding, normal order", async () => {
+  const targets = [makeTarget("conn-X"), makeTarget("conn-Y")];
+  const messages = [{ role: "user", content: "Removed connection" }];
+  const hash = deriveMessageHash(messages)!;
+
+  // Sticky to conn-GONE which is NOT in targets
+  recordStickyBinding(hash, "conn-GONE");
+
+  const result = await applySessionStickiness(targets, messages);
+  assert.equal(result.stuck, false, "should not be stuck when connection is gone");
+  assert.deepEqual(
+    result.targets.map((t) => t.connectionId),
+    ["conn-X", "conn-Y"]
+  );
+});
+
+// ─── recordStickyBinding / clearStickyBinding lifecycle ──────────────────────
+
+test("recordStickyBinding: creates a new binding and stickiness is applied", async () => {
+  const targets = [makeTarget("conn-1"), makeTarget("conn-2")];
+  const messages = [{ role: "user", content: "Lifecycle test" }];
+  const hash = deriveMessageHash(messages)!;
+
+  recordStickyBinding(hash, "conn-1");
+
+  const r = await applySessionStickiness(targets, messages);
+  assert.ok(r.stuck);
+  assert.equal(r.targets[0].connectionId, "conn-1");
+});
+
+test("clearStickyBinding: removes the binding so next call is normal ordering", async () => {
+  const targets = [makeTarget("conn-A"), makeTarget("conn-B")];
+  const messages = [{ role: "user", content: "Clear test" }];
+  const hash = deriveMessageHash(messages)!;
+
+  recordStickyBinding(hash, "conn-B");
+  clearStickyBinding(hash);
+
+  const r = await applySessionStickiness(targets, messages);
+  assert.equal(r.stuck, false, "binding was cleared, no stickiness");
+});
+
+test("recordStickyBinding: updating to a new connectionId rebinds correctly", async () => {
+  const targets = [makeTarget("conn-OLD"), makeTarget("conn-NEW")];
+  const messages = [{ role: "user", content: "Rebind test" }];
+  const hash = deriveMessageHash(messages)!;
+
+  recordStickyBinding(hash, "conn-OLD");
+  // Rebind to conn-NEW
+  recordStickyBinding(hash, "conn-NEW");
+
+  const r = await applySessionStickiness(targets, messages);
+  assert.ok(r.stuck);
+  assert.equal(r.targets[0].connectionId, "conn-NEW");
+});
+
+test("messageHash is returned in result even when no binding exists", async () => {
+  const targets = [makeTarget("conn-A"), makeTarget("conn-B")];
+  const messages = [{ role: "user", content: "No binding yet" }];
+
+  const r = await applySessionStickiness(targets, messages);
+  assert.equal(r.stuck, false);
+  assert.ok(r.messageHash !== null, "hash should be derivable and returned");
+  assert.match(r.messageHash!, /^[a-f0-9]{16}$/);
+});
diff --git a/tests/unit/combo-strategies.test.ts b/tests/unit/combo-strategies.test.ts
index f5d5c9a26f..173d0cd68e 100644
--- a/tests/unit/combo-strategies.test.ts
+++ b/tests/unit/combo-strategies.test.ts
@@ -12,6 +12,8 @@ process.env.DATA_DIR = TEST_DATA_DIR;
 
 const dbCore = await import("../../src/lib/db/core.ts");
 const { handleComboChat } = await import("../../open-sse/services/combo.ts");
+const { clearAllStickyBindings } =
+  await import("../../open-sse/services/combo/sessionStickiness.ts");
 const { invalidateCodexQuotaCache, registerCodexConnection, registerCodexQuotaFetcher } =
   await import("../../open-sse/services/codexQuotaFetcher.ts");
 const { registerQuotaFetcher } = await import("../../open-sse/services/quotaPreflight.ts");
@@ -171,6 +173,10 @@ async function selectedConnectionFor(
   combo: Record<string, unknown>,
   options: { apiKeyAllowedConnections?: string[] | null } = {}
 ) {
+  // Isolate strategy/round-robin assertions from session stickiness (#5): this helper
+  // reuses the same body, so a sticky binding from a prior call would pin the connection
+  // and break tie-break rotation. Stickiness has its own suite (combo-session-stickiness).
+  clearAllStickyBindings();
   const calls: Array<string | null> = [];
   const response = await handleComboChat({
     body: reqBodyTextArray,
diff --git a/tests/unit/combo-task-aware.test.ts b/tests/unit/combo-task-aware.test.ts
new file mode 100644
index 0000000000..b8a9887c7b
--- /dev/null
+++ b/tests/unit/combo-task-aware.test.ts
@@ -0,0 +1,429 @@
+/**
+ * Tests for task-aware combo routing (port of upstream PR #2045).
+ *
+ * Coverage:
+ *   - classifyTask: light / standard / heavy / critical levels
+ *   - reorderByTaskWeight: floats higher-power models for heavy tasks
+ *   - getConversationCacheKey: stable per conversation, distinct per thread
+ *   - getOrSetConversationAffinityIndex: affinity pin + TTL behaviour
+ *   - isTaskRoutingStrategy: gate for task-aware strategies
+ *   - Guard: non-task-aware strategies are unaffected (identity path)
+ */
+
+import { describe, it, before, after } from "node:test";
+import assert from "node:assert/strict";
+import {
+  classifyTask,
+  getConversationCacheKey,
+  getOrSetConversationAffinityIndex,
+  isTaskRoutingStrategy,
+  reorderByTaskWeight,
+  scoreModelForTask,
+  TASK_LEVEL_WEIGHT,
+  comboConversationAffinity,
+  clearConversationAffinity,
+} from "../../open-sse/services/taskAwareRouting.ts";
+import type { ResolvedComboTarget } from "../../open-sse/services/combo/types.ts";
+
+// ── Helpers ───────────────────────────────────────────────────────────────────
+
+function makeTarget(modelStr: string, idx = 0): ResolvedComboTarget {
+  const [provider = "", model = modelStr] = modelStr.includes("/")
+    ? modelStr.split("/")
+    : ["", modelStr];
+  return {
+    kind: "model" as const,
+    stepId: `step-${idx}`,
+    executionKey: `exec-${idx}`,
+    modelStr,
+    provider,
+    providerId: null,
+    connectionId: null,
+    weight: 1,
+    label: null,
+  };
+}
+
+function makeBody(overrides: Record<string, unknown> = {}): Record<string, unknown> {
+  return { messages: [{ role: "user", content: "Hello" }], ...overrides };
+}
+
+// ── classifyTask ──────────────────────────────────────────────────────────────
+
+describe("classifyTask", () => {
+  it("classifies empty body as light (all signals tiny → default-light path)", () => {
+    const t = classifyTask({});
+    // Empty body: 0 chars, 0 messages, 0 tools, 0 output tokens → light
+    assert.equal(t.level, "light");
+    assert.equal(t.weight, TASK_LEVEL_WEIGHT.light);
+  });
+
+  it("classifies a simple short greeting as light", () => {
+    const t = classifyTask({ messages: [{ role: "user", content: "hi there" }], max_tokens: 100 });
+    assert.equal(t.level, "light");
+    assert.equal(t.weight, TASK_LEVEL_WEIGHT.light);
+  });
+
+  it("classifies a translate request as light", () => {
+    const t = classifyTask({
+      messages: [{ role: "user", content: "translate this short sentence" }],
+      max_tokens: 256,
+    });
+    assert.equal(t.level, "light");
+  });
+
+  it("classifies a quick rewrite request as light", () => {
+    const t = classifyTask({
+      messages: [{ role: "user", content: "quick rewrite this sentence to be more concise" }],
+      max_tokens: 300,
+    });
+    assert.equal(t.level, "light");
+  });
+
+  it("classifies long conversation + big prompt as heavy (two signals)", () => {
+    // 20 messages (1 signal) + prompt >= 24000 chars (1 signal) = 2 → heavy
+    const bigContent = "context ".repeat(3500); // ~28000 chars
+    const messages = [
+      { role: "user", content: bigContent },
+      ...Array.from({ length: 20 }, (_, i) => ({
+        role: i % 2 === 0 ? "assistant" : "user",
+        content: "turn " + i,
+      })),
+    ];
+    const t = classifyTask({ messages });
+    assert.equal(t.level, "heavy");
+    assert.equal(t.weight, TASK_LEVEL_WEIGHT.heavy);
+  });
+
+  it("classifies high reasoning effort as heavy", () => {
+    const t = classifyTask({
+      messages: [{ role: "user", content: "analyze this code" }],
+      reasoning_effort: "high",
+    });
+    assert.equal(t.level, "heavy");
+  });
+
+  it("classifies huge context (>= 100k chars) as critical", () => {
+    const t = classifyTask({
+      messages: [{ role: "user", content: "x".repeat(120_000) }],
+    });
+    assert.equal(t.level, "critical");
+    assert.equal(t.weight, TASK_LEVEL_WEIGHT.critical);
+  });
+
+  it("classifies huge output request (>= 32768 tokens) as critical", () => {
+    const t = classifyTask({
+      messages: [{ role: "user", content: "write a comprehensive report" }],
+      max_tokens: 40_000,
+    });
+    assert.equal(t.level, "critical");
+  });
+
+  it("classifies security+tools+effort as critical", () => {
+    const t = classifyTask({
+      messages: [
+        {
+          role: "user",
+          content: `Find a critical bug bounty attack chain for RCE or supply chain impact.\n${"context ".repeat(2000)}`,
+        },
+      ],
+      tools: [{ name: "read" }, { name: "grep" }, { name: "web" }, { name: "bash" }],
+      reasoning_effort: "high",
+      max_tokens: 12_000,
+    });
+    assert.equal(t.level, "critical");
+  });
+
+  it("classifies moderate prompt without signals as standard (must exceed light thresholds)", () => {
+    // To be classified standard (not light), prompt must either: be > 4000 chars,
+    // have > 3 messages, tools, or not match a light keyword — "explain briefly" would be light.
+    // A prompt with "analyze" keyword + 5000 chars crosses into standard.
+    const t = classifyTask({
+      messages: [
+        {
+          role: "user",
+          content: "Please analyze how TCP works in detail.\n" + "context ".repeat(500),
+        },
+        { role: "assistant", content: "TCP uses..." },
+        { role: "user", content: "And what about UDP?" },
+        { role: "assistant", content: "UDP is..." },
+      ],
+    });
+    assert.equal(t.level, "standard");
+  });
+
+  it("returns reasons array for each classification", () => {
+    const t = classifyTask({
+      messages: [{ role: "user", content: "x".repeat(120_000) }],
+    });
+    assert.ok(Array.isArray(t.reasons), "reasons should be an array");
+    assert.ok(t.reasons.length > 0, "critical task should have at least one reason");
+  });
+});
+
+// ── reorderByTaskWeight ───────────────────────────────────────────────────────
+
+describe("reorderByTaskWeight", () => {
+  it("returns same reference for single-target list", () => {
+    const targets = [makeTarget("anthropic/claude-haiku-4.5", 0)];
+    const task = classifyTask({ messages: [{ role: "user", content: "hello" }] });
+    const out = reorderByTaskWeight(targets, task, new Set());
+    assert.strictEqual(out, targets);
+  });
+
+  it("returns same reference for empty list", () => {
+    const targets: ResolvedComboTarget[] = [];
+    const task = classifyTask({});
+    const out = reorderByTaskWeight(targets, task, new Set());
+    assert.strictEqual(out, targets);
+  });
+
+  it("routes light tasks to lighter models (haiku before opus)", () => {
+    const targets = [
+      makeTarget("anthropic/claude-opus-4.6", 0),
+      makeTarget("anthropic/claude-haiku-4.5", 1),
+    ];
+    const task = classifyTask({
+      messages: [{ role: "user", content: "quick rewrite this sentence" }],
+      max_tokens: 300,
+    });
+    const out = reorderByTaskWeight(targets, task, new Set());
+    assert.equal(out[0].modelStr, "anthropic/claude-haiku-4.5");
+  });
+
+  it("routes critical tasks to stronger models (opus before haiku)", () => {
+    const targets = [
+      makeTarget("anthropic/claude-haiku-4.5", 0),
+      makeTarget("anthropic/claude-opus-4.6", 1),
+    ];
+    const task = classifyTask({
+      messages: [
+        {
+          role: "user",
+          content: `Security review for account takeover and cross-tenant RCE impact.\n${"code ".repeat(3000)}`,
+        },
+      ],
+      tools: [{ name: "read" }, { name: "grep" }, { name: "bash" }, { name: "web" }],
+      reasoning_effort: "high",
+    });
+    const required = new Set(["reasoning"]);
+    const out = reorderByTaskWeight(targets, task, required);
+    assert.equal(out[0].modelStr, "anthropic/claude-opus-4.6");
+    assert.ok(
+      scoreModelForTask(out[0].modelStr, task, required) >=
+        scoreModelForTask(out[1].modelStr, task, required),
+      "first model should score >= second"
+    );
+  });
+
+  it("keeps hard-cap vision model first even for light tasks", () => {
+    // anthropic/claude-haiku-4.5 has vision; deepseek-chat does not
+    const targets = [
+      makeTarget("deepseek/deepseek-chat", 0),
+      makeTarget("anthropic/claude-haiku-4.5", 1),
+    ];
+    const task = classifyTask({ messages: [{ role: "user", content: "what is in this image?" }] });
+    const out = reorderByTaskWeight(targets, task, new Set(["vision"]));
+    assert.equal(out[0].modelStr, "anthropic/claude-haiku-4.5");
+  });
+
+  it("never drops any targets", () => {
+    const targets = [
+      makeTarget("anthropic/claude-opus-4.6", 0),
+      makeTarget("anthropic/claude-haiku-4.5", 1),
+      makeTarget("deepseek/deepseek-chat", 2),
+    ];
+    const task = classifyTask({ messages: [{ role: "user", content: "x".repeat(120_000) }] });
+    const out = reorderByTaskWeight(targets, task, new Set());
+    assert.equal(out.length, 3);
+  });
+
+  it("is stable: ties preserve original order", () => {
+    // Two identical models should not swap positions
+    const targets = [
+      makeTarget("anthropic/claude-haiku-4.5", 0),
+      makeTarget("anthropic/claude-haiku-4.5", 1),
+    ];
+    const task = classifyTask({});
+    const out = reorderByTaskWeight(targets, task, new Set());
+    assert.equal(out[0].stepId, "step-0");
+    assert.equal(out[1].stepId, "step-1");
+  });
+});
+
+// ── isTaskRoutingStrategy ─────────────────────────────────────────────────────
+
+describe("isTaskRoutingStrategy", () => {
+  it("returns true for task-aware strategy names", () => {
+    for (const name of ["smart", "task", "task-aware", "task_aware", "auto"]) {
+      assert.ok(isTaskRoutingStrategy(name), `Expected ${name} to be task-routing`);
+    }
+  });
+
+  it("is case-insensitive", () => {
+    assert.ok(isTaskRoutingStrategy("SMART"));
+    assert.ok(isTaskRoutingStrategy("Task-Aware"));
+  });
+
+  it("returns false for standard strategy names", () => {
+    for (const name of [
+      "priority",
+      "fallback",
+      "round-robin",
+      "weighted",
+      "random",
+      "fill-first",
+      "p2c",
+      "least-used",
+      "cost-optimized",
+      "reset-aware",
+      "reset-window",
+      "context-optimized",
+      "headroom",
+      "lkgp",
+      "context-relay",
+    ]) {
+      assert.ok(!isTaskRoutingStrategy(name), `Expected ${name} to NOT be task-routing`);
+    }
+  });
+
+  it("returns false for null/undefined/empty", () => {
+    assert.ok(!isTaskRoutingStrategy(null));
+    assert.ok(!isTaskRoutingStrategy(undefined));
+    assert.ok(!isTaskRoutingStrategy(""));
+  });
+});
+
+// ── getConversationCacheKey ───────────────────────────────────────────────────
+
+describe("getConversationCacheKey", () => {
+  it("returns null for null input", () => {
+    assert.equal(getConversationCacheKey(null as unknown as Record<string, unknown>), null);
+  });
+
+  it("returns a string for a body with messages", () => {
+    const key = getConversationCacheKey({
+      messages: [
+        { role: "system", content: "You are helpful" },
+        { role: "user", content: "hi" },
+      ],
+    });
+    assert.equal(typeof key, "string");
+    assert.ok((key as string).length > 0);
+  });
+
+  it("is stable across calls for the same conversation start", () => {
+    const body = {
+      messages: [
+        { role: "system", content: "You are a helpful assistant" },
+        { role: "user", content: "Hello, how are you?" },
+      ],
+    };
+    const k1 = getConversationCacheKey(body);
+    const k2 = getConversationCacheKey(body);
+    assert.equal(k1, k2);
+  });
+
+  it("differs for different first messages", () => {
+    const k1 = getConversationCacheKey({
+      messages: [{ role: "user", content: "Explain TCP" }],
+    });
+    const k2 = getConversationCacheKey({
+      messages: [{ role: "user", content: "Explain UDP" }],
+    });
+    assert.notEqual(k1, k2);
+  });
+
+  it("same key even when later messages are appended (conversation affinity)", () => {
+    const systemMsg = { role: "system", content: "You are a coding assistant" };
+    const firstUser = { role: "user", content: "What is a pointer?" };
+    const k1 = getConversationCacheKey({ messages: [systemMsg, firstUser] });
+    const k2 = getConversationCacheKey({
+      messages: [
+        systemMsg,
+        firstUser,
+        { role: "assistant", content: "A pointer stores an address..." },
+        { role: "user", content: "Can you give an example?" },
+      ],
+    });
+    assert.equal(k1, k2);
+  });
+
+  it("prefers explicit conversation_id when present", () => {
+    const k1 = getConversationCacheKey({
+      conversation_id: "thread-abc-123",
+      messages: [{ role: "user", content: "hello" }],
+    });
+    const k2 = getConversationCacheKey({ conversation_id: "thread-abc-123" });
+    assert.equal(k1, k2);
+    assert.notEqual(k1, null);
+  });
+
+  it("different conversation_ids produce different keys", () => {
+    const k1 = getConversationCacheKey({ conversation_id: "thread-1" });
+    const k2 = getConversationCacheKey({ conversation_id: "thread-2" });
+    assert.notEqual(k1, k2);
+  });
+});
+
+// ── Conversation affinity (getOrSetConversationAffinityIndex) ─────────────────
+
+describe("conversation affinity", () => {
+  before(() => clearConversationAffinity());
+  after(() => clearConversationAffinity());
+
+  it("returns currentIndex for a new conversation key", () => {
+    const idx = getOrSetConversationAffinityIndex("combo-x", "conv-aaa", 2);
+    assert.equal(idx, 2);
+  });
+
+  it("returns the pinned index for the same conversation key", () => {
+    clearConversationAffinity();
+    getOrSetConversationAffinityIndex("combo-y", "conv-bbb", 0);
+    // Second call should return the pinned index (0), not a new currentIndex (1)
+    const idx = getOrSetConversationAffinityIndex("combo-y", "conv-bbb", 1);
+    assert.equal(idx, 0);
+  });
+
+  it("different conversation keys get independent pins", () => {
+    clearConversationAffinity();
+    const i1 = getOrSetConversationAffinityIndex("combo-z", "conv-c1", 0);
+    const i2 = getOrSetConversationAffinityIndex("combo-z", "conv-c2", 1);
+    assert.equal(i1, 0);
+    assert.equal(i2, 1);
+    // Both pins should stay
+    assert.equal(getOrSetConversationAffinityIndex("combo-z", "conv-c1", 99), 0);
+    assert.equal(getOrSetConversationAffinityIndex("combo-z", "conv-c2", 99), 1);
+  });
+
+  it("clearConversationAffinity clears only the named combo prefix", () => {
+    clearConversationAffinity();
+    getOrSetConversationAffinityIndex("combo-a", "conv-1", 0);
+    getOrSetConversationAffinityIndex("combo-b", "conv-1", 1);
+    clearConversationAffinity("combo-a");
+    // combo-a entry should be gone
+    const sizeAfter = comboConversationAffinity.size;
+    assert.equal(sizeAfter, 1);
+  });
+});
+
+// ── Guard: non-task-aware strategy leaves targets unchanged ───────────────────
+
+describe("non-task-aware strategy guard", () => {
+  it("reorderByTaskWeight is still safe to call externally but only wired for task strategies", () => {
+    // The function itself is pure — what matters is that combo.ts only calls it
+    // when isTaskRoutingStrategy() is true. Verify that explicitly.
+    const nonTaskStrategies = ["priority", "fallback", "round-robin", "cost-optimized"];
+    for (const strategy of nonTaskStrategies) {
+      assert.ok(!isTaskRoutingStrategy(strategy), `${strategy} should not trigger task routing`);
+    }
+  });
+
+  it("reorderByTaskWeight on standard task with equal-power models returns same reference", () => {
+    // If all scores are equal, no reordering → returns same array reference
+    const targets = [makeTarget("anthropic/claude-haiku-4.5", 0)];
+    const task = classifyTask({});
+    const out = reorderByTaskWeight(targets, task, new Set());
+    assert.strictEqual(out, targets);
+  });
+});
diff --git a/tests/unit/combo/auto-status-penalty-4540.test.ts b/tests/unit/combo/auto-status-penalty-4540.test.ts
new file mode 100644
index 0000000000..715ae8ca88
--- /dev/null
+++ b/tests/unit/combo/auto-status-penalty-4540.test.ts
@@ -0,0 +1,101 @@
+// tests/unit/combo/auto-status-penalty-4540.test.ts
+// Regression for #4540: an exhausted provider connection (e.g. credits_exhausted /
+// rate_limited with no numeric quota fetcher) used to score IDENTICALLY to a healthy
+// one — quotaRemaining defaulted to 100 and testStatus never entered scoring — so auto
+// routing kept picking dead providers. With the quota-preflight hard cutoff DISABLED
+// (the default), we must NOT hard-block such a candidate (that would surface a misleading
+// "below quota cutoff" 429); instead a SOFT status penalty must rank it strictly BELOW
+// an otherwise-identical healthy candidate.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { scoreAutoTargets } from "../../../open-sse/services/combo/autoStrategy.ts";
+import type {
+  AutoProviderCandidate,
+  ResolvedComboTarget,
+} from "../../../open-sse/services/combo/types.ts";
+import type { ScoringWeights } from "../../../open-sse/services/autoCombo/scoring.ts";
+
+// Quota-weighted only so the two candidates would otherwise tie at quotaRemaining=100.
+const quotaOnlyWeights: ScoringWeights = {
+  quota: 1,
+  health: 0,
+  costInv: 0,
+  latencyInv: 0,
+  taskFit: 0,
+  stability: 0,
+  tierPriority: 0,
+  tierAffinity: 0,
+  specificityMatch: 0,
+  contextAffinity: 0,
+  resetWindowAffinity: 0,
+  connectionDensity: 0,
+};
+
+function target(provider: string, model: string, connectionId: string): ResolvedComboTarget {
+  return {
+    kind: "model",
+    stepId: `${provider}-${model}-${connectionId}`,
+    executionKey: `${provider}/${model}@${connectionId}`,
+    modelStr: `${provider}/${model}`,
+    provider,
+    providerId: null,
+    connectionId,
+  } as ResolvedComboTarget;
+}
+
+function candidate(
+  provider: string,
+  model: string,
+  connectionId: string,
+  overrides: Partial<AutoProviderCandidate> = {}
+): AutoProviderCandidate {
+  return {
+    provider,
+    model,
+    stepId: `${provider}-${model}-${connectionId}`,
+    executionKey: `${provider}/${model}@${connectionId}`,
+    modelStr: `${provider}/${model}`,
+    connectionId,
+    quotaRemaining: 100,
+    quotaTotal: 100,
+    circuitBreakerState: "CLOSED",
+    costPer1MTokens: 1,
+    p95LatencyMs: 1000,
+    latencyStdDev: 10,
+    errorRate: 0,
+    resetWindowAffinity: 0.5,
+    connectionPoolSize: 1,
+    ...overrides,
+  } as AutoProviderCandidate;
+}
+
+test("#4540: exhausted (statusPenalty) candidate scores strictly BELOW an identical healthy one without being hard-blocked", () => {
+  const targets = [target("dead", "m", "dead-conn"), target("healthy", "m", "healthy-conn")];
+  const ranked = scoreAutoTargets(
+    targets,
+    [
+      // Exhausted connection with no numeric quota fetcher: quotaRemaining stays 100,
+      // but the connection terminal status flags a soft penalty (NOT a hard block).
+      candidate("dead", "m", "dead-conn", { statusPenalty: true }),
+      candidate("healthy", "m", "healthy-conn"),
+    ],
+    "coding",
+    quotaOnlyWeights
+  );
+
+  // Soft penalty: NOT hard-blocked — both candidates are still in the pool.
+  assert.equal(ranked.length, 2, "soft penalty must not drop the exhausted candidate");
+
+  const dead = ranked.find((e) => e.target.provider === "dead");
+  const healthy = ranked.find((e) => e.target.provider === "healthy");
+  assert.ok(dead && healthy, "both candidates present");
+
+  // The fix: exhausted scores STRICTLY less than the identical healthy one (was a tie).
+  assert.ok(
+    (dead!.score as number) < (healthy!.score as number),
+    `exhausted score (${dead!.score}) must be strictly < healthy score (${healthy!.score})`
+  );
+
+  // And ranking puts healthy first.
+  assert.equal(ranked[0]?.target.provider, "healthy");
+});
diff --git a/tests/unit/combo/effective-max-concurrency.test.ts b/tests/unit/combo/effective-max-concurrency.test.ts
new file mode 100644
index 0000000000..80f3b09a8f
--- /dev/null
+++ b/tests/unit/combo/effective-max-concurrency.test.ts
@@ -0,0 +1,46 @@
+// tests/unit/combo/effective-max-concurrency.test.ts
+// Unit test for effectiveMaxConcurrency — the pure resolver that turns a
+// connection's per-account concurrency cap (provider_connections.max_concurrent)
+// into the semaphore's maxConcurrency for a round-robin combo target, falling
+// back to the combo-level default when the connection has no positive cap.
+//
+// Runner: node:test + assert/strict (matches the sibling combo predicate tests).
+import { test, describe } from "node:test";
+import assert from "node:assert/strict";
+import { effectiveMaxConcurrency } from "../../../open-sse/services/combo/comboPredicates.ts";
+
+describe("effectiveMaxConcurrency", () => {
+  test("a positive per-connection cap wins over the fallback", () => {
+    assert.equal(effectiveMaxConcurrency(1, 3), 1, "GLM/MiniMax-style cap of 1 must be honored");
+    assert.equal(effectiveMaxConcurrency(5, 3), 5, "a cap higher than the default is still used");
+  });
+
+  test("null cap → fallback (no per-connection limit configured)", () => {
+    assert.equal(effectiveMaxConcurrency(null, 3), 3);
+  });
+
+  test("undefined cap → fallback", () => {
+    assert.equal(effectiveMaxConcurrency(undefined, 7), 7);
+  });
+
+  test("zero cap → fallback (0 means 'no limit', not 'block everything')", () => {
+    assert.equal(effectiveMaxConcurrency(0, 3), 3);
+  });
+
+  test("negative cap → fallback (defensive)", () => {
+    assert.equal(effectiveMaxConcurrency(-2, 4), 4);
+  });
+
+  test("non-finite cap → fallback (defensive)", () => {
+    assert.equal(effectiveMaxConcurrency(Number.NaN, 4), 4);
+    assert.equal(effectiveMaxConcurrency(Number.POSITIVE_INFINITY, 4), 4);
+  });
+
+  test("a non-integer positive cap is floored to a whole slot count", () => {
+    assert.equal(
+      effectiveMaxConcurrency(2.9, 3),
+      2,
+      "fractional caps floor to whole concurrency slots"
+    );
+  });
+});
diff --git a/tests/unit/combo/quota-share-concurrency.test.ts b/tests/unit/combo/quota-share-concurrency.test.ts
new file mode 100644
index 0000000000..6cc7210d11
--- /dev/null
+++ b/tests/unit/combo/quota-share-concurrency.test.ts
@@ -0,0 +1,132 @@
+/**
+ * tests/unit/combo/quota-share-concurrency.test.ts
+ *
+ * FASE 2.1: the per-connection concurrency slot for quota-share combos. These
+ * tests pin the contract of acquireQuotaShareConcurrencySlot against the real
+ * semaphore module: no limit when there is no cap, a stable connection-scoped
+ * key, genuine serialization (a second request WAITS until the first releases),
+ * and fail-open behavior when the queue is saturated.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import * as semaphore from "../../../open-sse/services/rateLimitSemaphore.ts";
+import {
+  quotaShareConcurrencyKey,
+  acquireQuotaShareConcurrencySlot,
+} from "../../../open-sse/services/combo/quotaShareConcurrency.ts";
+
+const noopLog = { warn: () => {} };
+
+function target(connectionId: string) {
+  return {
+    connectionId,
+    modelStr: "p/m",
+    executionKey: "p/m",
+    provider: "p",
+    stepId: "s",
+    label: "p/m",
+  } as never;
+}
+
+const wait = (ms: number) => new Promise((r) => setTimeout(r, ms));
+
+test("quotaShareConcurrencyKey is stable and connection-scoped", () => {
+  assert.equal(quotaShareConcurrencyKey("abc"), "qsconn:abc");
+  assert.equal(quotaShareConcurrencyKey("abc"), quotaShareConcurrencyKey("abc"));
+  assert.notEqual(quotaShareConcurrencyKey("a"), quotaShareConcurrencyKey("b"));
+});
+
+test("no slot when cap is null (no per-connection limit → unchanged behavior)", async () => {
+  semaphore.resetAll();
+  const release = await acquireQuotaShareConcurrencySlot(
+    target("c1"),
+    null,
+    { queueTimeoutMs: 50, maxQueueSize: 10 },
+    noopLog
+  );
+  assert.equal(release, null);
+});
+
+test("no slot when cap <= 0", async () => {
+  semaphore.resetAll();
+  assert.equal(
+    await acquireQuotaShareConcurrencySlot(
+      target("c1"),
+      0,
+      { queueTimeoutMs: 50, maxQueueSize: 10 },
+      noopLog
+    ),
+    null
+  );
+});
+
+test("no slot when connectionId is empty", async () => {
+  semaphore.resetAll();
+  const release = await acquireQuotaShareConcurrencySlot(
+    target(""),
+    1,
+    { queueTimeoutMs: 50, maxQueueSize: 10 },
+    noopLog
+  );
+  assert.equal(release, null);
+});
+
+test("acquires a slot when a positive cap is set", async () => {
+  semaphore.resetAll();
+  const release = await acquireQuotaShareConcurrencySlot(
+    target("c1"),
+    1,
+    { queueTimeoutMs: 50, maxQueueSize: 10 },
+    noopLog
+  );
+  assert.equal(typeof release, "function");
+  release!();
+});
+
+test("cap=1 serializes: a second concurrent request WAITS until the first releases", async () => {
+  semaphore.resetAll();
+  const opts = { queueTimeoutMs: 1000, maxQueueSize: 10 };
+  const r1 = await acquireQuotaShareConcurrencySlot(target("c1"), 1, opts, noopLog);
+  assert.equal(typeof r1, "function", "first request acquires the only slot");
+
+  let secondResolved = false;
+  const p2 = acquireQuotaShareConcurrencySlot(target("c1"), 1, opts, noopLog).then((r) => {
+    secondResolved = true;
+    return r;
+  });
+
+  await wait(60);
+  assert.equal(
+    secondResolved,
+    false,
+    "second request is still queued while the first holds the slot"
+  );
+
+  r1!(); // release the first
+  const r2 = await p2;
+  assert.equal(secondResolved, true, "second request resolves only after the first releases");
+  assert.equal(typeof r2, "function", "second request then acquires the freed slot");
+  r2!();
+});
+
+test("fail-open: a saturated queue proceeds without a slot (null), never blocks", async () => {
+  semaphore.resetAll();
+  const opts = { queueTimeoutMs: 1000, maxQueueSize: 0 };
+  const r1 = await acquireQuotaShareConcurrencySlot(target("c1"), 1, opts, noopLog);
+  assert.equal(typeof r1, "function", "first request acquires");
+  const r2 = await acquireQuotaShareConcurrencySlot(target("c1"), 1, opts, noopLog);
+  assert.equal(r2, null, "queue full → fail-open null (availability never worsened)");
+  r1!();
+});
+
+test("different connections have independent gates (no cross-contention)", async () => {
+  semaphore.resetAll();
+  const opts = { queueTimeoutMs: 50, maxQueueSize: 0 };
+  const r1 = await acquireQuotaShareConcurrencySlot(target("c1"), 1, opts, noopLog);
+  const r2 = await acquireQuotaShareConcurrencySlot(target("c2"), 1, opts, noopLog);
+  assert.equal(typeof r1, "function");
+  assert.equal(typeof r2, "function", "a different connection has its own slot");
+  r1!();
+  r2!();
+});
diff --git a/tests/unit/compression-run-telemetry-auth.test.ts b/tests/unit/compression-run-telemetry-auth.test.ts
new file mode 100644
index 0000000000..cabfb66384
--- /dev/null
+++ b/tests/unit/compression-run-telemetry-auth.test.ts
@@ -0,0 +1,45 @@
+/**
+ * Security regression (#4694 sibling-path gate parity): the compression
+ * run-telemetry route MUST authenticate before disclosing telemetry, mirroring
+ * its sibling `settings/compression/route.ts`. A behavioral 401 test would need
+ * full DB/settings bootstrap (isAuthenticated reads settings), so this is a
+ * source guard that fails if the auth gate is removed or reordered after the
+ * data call — the same wiring-guard pattern used elsewhere in the suite.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const ROUTE = join(
+  __dirname,
+  "../../src/app/api/settings/compression/run-telemetry/route.ts"
+);
+
+test("run-telemetry GET imports isAuthenticated from the shared auth util", () => {
+  const src = readFileSync(ROUTE, "utf8");
+  assert.match(src, /import\s*\{[^}]*\bisAuthenticated\b[^}]*\}\s*from\s*["']@\/shared\/utils\/apiAuth["']/);
+});
+
+test("run-telemetry GET gates on auth and returns 401 before reading telemetry", () => {
+  const src = readFileSync(ROUTE, "utf8");
+
+  const authIdx = src.indexOf("isAuthenticated(request)");
+  const unauthorizedIdx = src.search(/status:\s*401/);
+  const dataIdx = src.indexOf("getCompressionRunTelemetrySummary(");
+
+  assert.ok(authIdx > 0, "must call isAuthenticated(request)");
+  assert.ok(unauthorizedIdx > 0, "must return a 401 on failed auth");
+  assert.ok(dataIdx > 0, "must call getCompressionRunTelemetrySummary");
+
+  // The auth check and its 401 must come BEFORE the telemetry read.
+  assert.ok(authIdx < dataIdx, "auth check must precede the telemetry read");
+  assert.ok(unauthorizedIdx < dataIdx, "401 response must precede the telemetry read");
+});
+
+test("run-telemetry GET receives the request object (so auth can read it)", () => {
+  const src = readFileSync(ROUTE, "utf8");
+  assert.match(src, /export\s+async\s+function\s+GET\s*\(\s*request\s*:/);
+});
diff --git a/tests/unit/compression/preservation-redos-4795.test.ts b/tests/unit/compression/preservation-redos-4795.test.ts
new file mode 100644
index 0000000000..c2164726ad
--- /dev/null
+++ b/tests/unit/compression/preservation-redos-4795.test.ts
@@ -0,0 +1,59 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import {
+  extractPreservedBlocks,
+  restorePreservedBlocks,
+} from "../../../open-sse/services/compression/preservation.ts";
+
+// Regression guard for #4795: a single unmatched `$` followed by a run of
+// consecutive backslashes (e.g. Windows paths pasted into a prompt) triggered
+// catastrophic backtracking in the `math_inline` built-in pattern, pinning one
+// CPU core at 100% and freezing the event loop. The alternation
+// `(?:\\.|[^$\n])` was ambiguous: a backslash could be consumed either by the
+// escape branch `\\.` or by the catch-all `[^$\n]`, so a run of N backslashes
+// could be tiled exponentially many ways before the trailing `$` anchor failed.
+describe("preservation ReDoS guard (#4795)", () => {
+  it("does not hang on a `$` followed by many consecutive backslashes (no closing `$`)", () => {
+    // Without the fix this blows up exponentially (N=38 already exceeds 8s).
+    const evil = "$x" + "\\".repeat(200) + "y";
+    const start = Date.now();
+    const { text } = extractPreservedBlocks(evil);
+    const elapsed = Date.now() - start;
+    assert.ok(
+      elapsed < 1000,
+      `extractPreservedBlocks must not backtrack catastrophically (took ${elapsed}ms)`
+    );
+    // The pathological input is not valid inline math, so it stays untouched.
+    assert.equal(text, evil, "non-math text must be returned unchanged");
+  });
+
+  it("does not hang on Windows-path-style payloads with backslashes after a `$`", () => {
+    const evil =
+      "$C:\\Users\\Alpha\\Net\\DESKTOP\\" + "sub\\".repeat(120) + "no-closing-dollar";
+    const start = Date.now();
+    extractPreservedBlocks(evil);
+    assert.ok(Date.now() - start < 1000, "Windows-path payload must resolve quickly");
+  });
+
+  it("still preserves legitimate inline math", () => {
+    const text = "The identity $E=mc^2$ and $\\alpha + \\beta$ are classics.";
+    const { text: extracted, blocks } = extractPreservedBlocks(text);
+    const mathBlocks = blocks.filter((b) => b.kind === "math_inline");
+    assert.equal(mathBlocks.length, 2, "both inline-math spans must be preserved");
+    assert.ok(!extracted.includes("E=mc^2"), "math content must be replaced by a placeholder");
+    assert.equal(
+      restorePreservedBlocks(extracted, blocks),
+      text,
+      "round-trip must reproduce the original text"
+    );
+  });
+
+  it("preserves inline math that contains an escaped dollar", () => {
+    const text = "Price math: $a \\$ b$ end.";
+    const { blocks } = extractPreservedBlocks(text);
+    assert.ok(
+      blocks.some((b) => b.kind === "math_inline" && b.content === "$a \\$ b$"),
+      "inline math with an escaped dollar must still be captured via the `\\.` branch"
+    );
+  });
+});
diff --git a/tests/unit/compression/rtk-file-read-no-truncate-4559.test.ts b/tests/unit/compression/rtk-file-read-no-truncate-4559.test.ts
new file mode 100644
index 0000000000..7996a510c7
--- /dev/null
+++ b/tests/unit/compression/rtk-file-read-no-truncate-4559.test.ts
@@ -0,0 +1,108 @@
+/**
+ * TDD regression for #4559: RTK compression over-truncates tool-result content.
+ *
+ * A user reported that when a tool returns a file's contents (e.g. a ~147-line
+ * text/code file via a Read tool), RTK's default caps (maxLinesPerResult: 120,
+ * maxCharsPerResult: 12000) drop the middle and most lines are silently
+ * suppressed. Disabling compression OR the RTK "tool results" toggle fixes it;
+ * OpenRouter (no OmniRoute) is unaffected.
+ *
+ * Root cause: the final `smartTruncate` hard-cap in processRtkText fires for ANY
+ * tool result over 120 lines — including document/file reads — even though RTK's
+ * intent is repetitive *command output* (npm install logs, make, docker logs),
+ * NOT prose/code file reads.
+ *
+ * Fix: when the content is NOT a recognized repetitive command/log output
+ * (detection.type === "unknown" with no detected command — i.e. a document-style
+ * read), RTK must NOT apply the line/char truncation that drops the middle.
+ * Genuine repetitive logs (which detect as a known command type) are unaffected,
+ * preserving RTK's value there.
+ */
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+
+import { processRtkText } from "../../../open-sse/services/compression/engines/rtk/index.ts";
+
+// A ~147-line mixed prose/code file read — every line is distinct content, NOT
+// repetitive log noise. No shell-command prefix, so RTK detects it as "unknown".
+function buildFileRead(): string {
+  const lines: string[] = [];
+  lines.push("# Module: payment processor");
+  lines.push("");
+  lines.push("This module reconciles charges against the ledger.");
+  lines.push("");
+  lines.push("import { Decimal } from './decimal';");
+  lines.push("import { Ledger } from './ledger';");
+  lines.push("");
+  for (let i = 0; i < 70; i++) {
+    lines.push(`export function step${i}(input: Input${i}): Result${i} {`);
+    lines.push(`  // reconcile bucket ${i} against the prior settlement window`);
+    lines.push(`  const value = computeBucket${i}(input.amount, input.currency);`);
+    lines.push(`  const settled = applyDiscount${i}(value, input.coupon);`);
+    lines.push(`  return { id: ${i}, value: settled, settledAt: input.timestamp${i} };`);
+    lines.push("}");
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+
+describe("RTK file-read tool result — #4559 no over-truncation", () => {
+  it("does not drop the middle of a 147-line document/file read", () => {
+    const fileRead = buildFileRead();
+    const totalLines = fileRead.split("\n").length;
+    assert.ok(totalLines > 120, `fixture should exceed default cap; got ${totalLines}`);
+
+    // Default RTK tool-result path (applyToToolResults defaults true; this is the
+    // text path the Anthropic/OpenAI tool_result blocks feed into).
+    const result = processRtkText(fileRead, {
+      config: { maxLinesPerResult: 120, maxCharsPerResult: 12000 },
+    });
+
+    // The hard-cap truncation must NOT have fired for a document/file read.
+    assert.ok(
+      !result.techniquesUsed.includes("rtk-truncate"),
+      `file-read content must not be hard-cap truncated; techniquesUsed: ${result.techniquesUsed.join(
+        ", "
+      )}`
+    );
+
+    // The truncation marker must be absent and the middle content retained.
+    assert.ok(
+      !result.text.includes("[rtk:truncated"),
+      "no truncation marker should be injected into a file read"
+    );
+
+    // Sample lines from the head, middle, and tail must all survive.
+    assert.ok(result.text.includes("step0("), "head content survives");
+    assert.ok(result.text.includes("step35("), "middle content survives");
+    assert.ok(result.text.includes("step69("), "tail content survives");
+
+    // Output retains the vast majority of the lines (not dropped below a
+    // reasonable threshold).
+    const outLines = result.text.split("\n").length;
+    assert.ok(
+      outLines >= totalLines * 0.9,
+      `expected to retain >=90% of lines; kept ${outLines}/${totalLines}`
+    );
+  });
+
+  it("still truncates genuine repetitive command output (RTK value preserved)", () => {
+    // npm install-style repetitive log lines, with a detected command so RTK
+    // recognizes it as repetitive output worth truncating.
+    const noise = Array.from(
+      { length: 300 },
+      (_, i) => `added package-${i}@1.0.0 to node_modules`
+    ).join("\n");
+    const input = `$ npm install\n${noise}`;
+
+    const result = processRtkText(input, {
+      command: "npm install",
+      config: { maxLinesPerResult: 120, maxCharsPerResult: 12000 },
+    });
+
+    assert.ok(
+      result.compressed,
+      "repetitive npm install output should still be compressed"
+    );
+  });
+});
diff --git a/tests/unit/copilot-agent-antigravity-parity.test.ts b/tests/unit/copilot-agent-antigravity-parity.test.ts
new file mode 100644
index 0000000000..2f16c8bd28
--- /dev/null
+++ b/tests/unit/copilot-agent-antigravity-parity.test.ts
@@ -0,0 +1,96 @@
+// Port of decolua/9router#779: GitHub Copilot Agent Mode & Antigravity "Invalid Argument" parity.
+//
+// Upstream symptom: VS Code GitHub Copilot Chat (in Agent mode) requests
+// `maxOutputTokens` values well above what the Antigravity Cloud Code backend
+// will accept — the backend rejects the call with HTTP 400 "Invalid Argument"
+// even though the request envelope is otherwise valid. The same trigger is
+// repeatedly observed in upstream issue reports and in OmniRoute connection
+// cooldowns spiking on Copilot traffic.
+//
+// Fix: hard-cap `generationConfig.maxOutputTokens` to MAX_ANTIGRAVITY_OUTPUT_TOKENS
+// (16384) so any oversized client request is silently shrunk to a value the
+// upstream accepts. Smaller values are left untouched, and the cap applies
+// independently of the thinkingBudget bump logic that already lives in
+// `applyAntigravityGenerationDefaults`.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  MAX_ANTIGRAVITY_OUTPUT_TOKENS,
+  __test_applyAntigravityGenerationDefaults as applyAntigravityGenerationDefaults,
+} from "../../open-sse/executors/antigravity.ts";
+
+test("MAX_ANTIGRAVITY_OUTPUT_TOKENS is fixed at 16384 (upstream-accepted ceiling)", () => {
+  assert.equal(MAX_ANTIGRAVITY_OUTPUT_TOKENS, 16384);
+});
+
+test("Copilot-style oversized maxOutputTokens is clamped to 16384 to avoid Antigravity 400 'Invalid Argument'", () => {
+  // Reproduces the upstream-rejected envelope: VS Code GitHub Copilot Chat in
+  // Agent mode commonly requests 32K–65K output tokens.
+  const request: Record<string, unknown> = {
+    generationConfig: {
+      maxOutputTokens: 65536,
+    },
+  };
+
+  applyAntigravityGenerationDefaults(request);
+
+  const gc = request.generationConfig as Record<string, unknown>;
+  assert.equal(gc.maxOutputTokens, MAX_ANTIGRAVITY_OUTPUT_TOKENS);
+});
+
+test("maxOutputTokens at or below the cap is left untouched", () => {
+  const request: Record<string, unknown> = {
+    generationConfig: {
+      maxOutputTokens: 8192,
+    },
+  };
+
+  applyAntigravityGenerationDefaults(request);
+
+  const gc = request.generationConfig as Record<string, unknown>;
+  assert.equal(gc.maxOutputTokens, 8192);
+});
+
+test("maxOutputTokens exactly at the cap is left untouched (boundary)", () => {
+  const request: Record<string, unknown> = {
+    generationConfig: {
+      maxOutputTokens: MAX_ANTIGRAVITY_OUTPUT_TOKENS,
+    },
+  };
+
+  applyAntigravityGenerationDefaults(request);
+
+  const gc = request.generationConfig as Record<string, unknown>;
+  assert.equal(gc.maxOutputTokens, MAX_ANTIGRAVITY_OUTPUT_TOKENS);
+});
+
+test("Cap is applied even when no generationConfig is provided initially", () => {
+  // The defaults helper synthesises generationConfig — the cap must not crash
+  // and must leave a well-formed object behind.
+  const request: Record<string, unknown> = {};
+  applyAntigravityGenerationDefaults(request);
+
+  const gc = request.generationConfig as Record<string, unknown>;
+  assert.equal(typeof gc, "object");
+  // No maxOutputTokens was requested — the cap must not invent one.
+  assert.equal(gc.maxOutputTokens, undefined);
+});
+
+test("Cap interacts safely with thinkingBudget bump: bump still wins when budget exceeds tokens, then the cap still clamps the bumped value", () => {
+  // thinkingBudget bumps maxOutputTokens to floor(budget)+1 when it exceeds
+  // the requested ceiling; if the bump itself overshoots the AG cap, the cap
+  // must still apply.
+  const request: Record<string, unknown> = {
+    generationConfig: {
+      maxOutputTokens: 1000,
+      thinkingConfig: { thinkingBudget: 20000 },
+    },
+  };
+
+  applyAntigravityGenerationDefaults(request);
+
+  const gc = request.generationConfig as Record<string, unknown>;
+  assert.equal(gc.maxOutputTokens, MAX_ANTIGRAVITY_OUTPUT_TOKENS);
+});
diff --git a/tests/unit/copilot-gemini-claude-route-no-responses.test.ts b/tests/unit/copilot-gemini-claude-route-no-responses.test.ts
new file mode 100644
index 0000000000..e4d9685d13
--- /dev/null
+++ b/tests/unit/copilot-gemini-claude-route-no-responses.test.ts
@@ -0,0 +1,93 @@
+/**
+ * Regression test ported from decolua/9router#1536 (follow-up to #663).
+ *
+ * GitHub Copilot's `/responses` endpoint only serves OpenAI (gpt/codex) models —
+ * Gemini and Claude models reject with HTTP 400
+ *   "[github/<model>] [400]: model <model> does not support Responses API."
+ * (unsupported_api_for_model). They must therefore never be routed to
+ * `/responses`, no matter what `targetFormat` a registry entry (or any future
+ * misconfiguration) declares for them.
+ *
+ * OmniRoute's GithubExecutor decides the endpoint inside `buildUrl()` purely
+ * from `getModelTargetFormat("gh", model)`. The registry today (`open-sse/
+ * config/providers/registry/github/index.ts`) correctly omits
+ * `targetFormat: "openai-responses"` on every Claude/Gemini entry — but that is
+ * a single-line away from regressing (the file's own comments on lines 60, 74,
+ * 80 warn against it). This test pins the defensive invariant: even if a
+ * Claude/Gemini variant ends up tagged `openai-responses`, the executor must
+ * still build the chat/completions URL.
+ */
+
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+
+import { GithubExecutor } from "../../open-sse/executors/github.ts";
+import { PROVIDER_MODELS } from "../../open-sse/config/providerModels.ts";
+
+const CHAT_URL = "https://api.githubcopilot.com/chat/completions";
+const RESPONSES_URL = "https://api.githubcopilot.com/responses";
+
+describe("GithubExecutor — Gemini/Claude must never hit /responses (port 9router#1536)", () => {
+  it("routes registered Claude/Gemini Copilot models to chat/completions", () => {
+    const exec = new GithubExecutor();
+    for (const id of [
+      "claude-haiku-4.5",
+      "claude-sonnet-4.5",
+      "claude-sonnet-4.6",
+      "claude-opus-4.6",
+      "claude-opus-4.7",
+      "claude-opus-4-5-20251101",
+      "gemini-3.1-pro-preview",
+      "gemini-3-flash-preview",
+    ]) {
+      assert.equal(exec.buildUrl(id, false), CHAT_URL, `${id} must route to chat/completions`);
+    }
+  });
+
+  it("still uses chat/completions if a Claude/Gemini model is wrongly tagged openai-responses", () => {
+    const exec = new GithubExecutor();
+    const ghModels = PROVIDER_MODELS["gh"];
+    assert.ok(Array.isArray(ghModels), "gh provider models registry must exist");
+
+    const claude = ghModels.find((m: any) => m.id === "claude-sonnet-4.6");
+    const gemini = ghModels.find((m: any) => m.id === "gemini-3.1-pro-preview");
+    assert.ok(claude && gemini, "claude-sonnet-4.6 and gemini-3.1-pro-preview must be registered");
+
+    const originalClaude = claude.targetFormat;
+    const originalGemini = gemini.targetFormat;
+    try {
+      // Simulate a future misconfiguration. The guard must still hold.
+      (claude as any).targetFormat = "openai-responses";
+      (gemini as any).targetFormat = "openai-responses";
+
+      assert.equal(exec.buildUrl("claude-sonnet-4.6", false), CHAT_URL);
+      assert.equal(exec.buildUrl("gemini-3.1-pro-preview", false), CHAT_URL);
+    } finally {
+      (claude as any).targetFormat = originalClaude;
+      (gemini as any).targetFormat = originalGemini;
+    }
+  });
+
+  it("still routes registered OpenAI/codex Copilot models to /responses", () => {
+    const exec = new GithubExecutor();
+    for (const id of ["gpt-5-mini", "gpt-5.3-codex", "gpt-5.4-mini", "gpt-5.4"]) {
+      assert.equal(exec.buildUrl(id, false), RESPONSES_URL, `${id} must route to /responses`);
+    }
+  });
+
+  it("is case-insensitive when guarding (defensive against upper/mixed-case ids)", () => {
+    const exec = new GithubExecutor();
+    const ghModels = PROVIDER_MODELS["gh"];
+    const claude = ghModels.find((m: any) => m.id === "claude-sonnet-4.6");
+    const original = claude.targetFormat;
+    try {
+      (claude as any).targetFormat = "openai-responses";
+      // Look up by the same id (registry is case-sensitive on lookup) but with a
+      // mixed-case path through the guard. We rebuild with the registered id;
+      // the guard normalizes before substring check, so it must still detect.
+      assert.equal(exec.buildUrl("claude-sonnet-4.6", false), CHAT_URL);
+    } finally {
+      (claude as any).targetFormat = original;
+    }
+  });
+});
diff --git a/tests/unit/copilot-runOmniRouteCli.test.ts b/tests/unit/copilot-runOmniRouteCli.test.ts
new file mode 100644
index 0000000000..2dfaf1041f
--- /dev/null
+++ b/tests/unit/copilot-runOmniRouteCli.test.ts
@@ -0,0 +1,29 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+test("runOmniRouteCli: missing command returns error", async () => {
+  const { getCopilotTool } = await import("../../src/lib/copilot/tools.ts");
+  const tool = getCopilotTool("runOmniRouteCli");
+  assert.ok(tool);
+  const result = await tool.handler({});
+  assert.equal(result, "Please provide a command to execute.");
+});
+
+test("runOmniRouteCli: empty command returns error", async () => {
+  const { getCopilotTool } = await import("../../src/lib/copilot/tools.ts");
+  const tool = getCopilotTool("runOmniRouteCli");
+  assert.ok(tool);
+  const result = await tool.handler({ command: "" });
+  assert.equal(result, "Please provide a command to execute.");
+});
+
+test("runOmniRouteCli: returns CLI-not-found when omniroute unavailable", async () => {
+  const { getCopilotTool } = await import("../../src/lib/copilot/tools.ts");
+  const tool = getCopilotTool("runOmniRouteCli");
+  assert.ok(tool);
+  const result = await tool.handler({ command: "health" });
+  assert.ok(
+    result.includes("omniroute CLI not found in PATH"),
+    `Expected CLI-not-found message, got: ${result}`
+  );
+});
diff --git a/tests/unit/custom-endpoint-system-prompt.test.ts b/tests/unit/custom-endpoint-system-prompt.test.ts
new file mode 100644
index 0000000000..f208c8f7cc
--- /dev/null
+++ b/tests/unit/custom-endpoint-system-prompt.test.ts
@@ -0,0 +1,156 @@
+/**
+ * TDD test for per-endpoint custom system prompt injection (port of upstream #2063).
+ *
+ * Validates that injectCustomSystemPrompt():
+ *  - Appends the custom prompt to an existing system message (string content)
+ *  - Appends the custom prompt to an existing system message (array content)
+ *  - Creates a new system message when none exists
+ *  - Injects into Claude-style `system` field (string)
+ *  - Injects into Claude-style `system` field (array)
+ *  - Does NOT inject when prompt is empty string
+ *  - Does NOT inject when body has _skipSystemPrompt flag
+ *  - Leaves body unchanged when prompt is falsy
+ *
+ * Also validates settings defaults include customSystemPromptEnabled / customSystemPrompt.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { injectCustomSystemPrompt } = await import(
+  "../../open-sse/services/systemPrompt.ts"
+);
+
+// ─── injectCustomSystemPrompt ────────────────────────────────────────────────
+
+test("injectCustomSystemPrompt: appends to existing string system message", () => {
+  const body = {
+    messages: [
+      { role: "system", content: "You are a helpful assistant." },
+      { role: "user", content: "Hello" },
+    ],
+  };
+  const result = injectCustomSystemPrompt(body, "Always respond formally.");
+  const sysMsg = result.messages.find((m) => m.role === "system");
+  assert.ok(sysMsg, "system message must exist");
+  assert.ok(
+    typeof sysMsg.content === "string" && sysMsg.content.includes("You are a helpful assistant."),
+    "original content preserved"
+  );
+  assert.ok(
+    typeof sysMsg.content === "string" && sysMsg.content.includes("Always respond formally."),
+    "custom prompt appended"
+  );
+});
+
+test("injectCustomSystemPrompt: appends to existing array-content system message", () => {
+  const body = {
+    messages: [
+      { role: "system", content: [{ type: "text", text: "Base instructions." }] },
+      { role: "user", content: "Hi" },
+    ],
+  };
+  const result = injectCustomSystemPrompt(body, "Speak like a pirate.");
+  const sysMsg = result.messages.find((m) => m.role === "system");
+  assert.ok(sysMsg, "system message must exist");
+  assert.ok(Array.isArray(sysMsg.content), "content must remain array");
+  const texts = (sysMsg.content as Array<{ type: string; text: string }>).map((c) => c.text);
+  assert.ok(texts.includes("Base instructions."), "original block preserved");
+  assert.ok(texts.includes("Speak like a pirate."), "custom prompt block appended");
+});
+
+test("injectCustomSystemPrompt: creates system message when none exists", () => {
+  const body = {
+    messages: [{ role: "user", content: "What is 2+2?" }],
+  };
+  const result = injectCustomSystemPrompt(body, "Think step by step.");
+  assert.equal(result.messages[0].role, "system", "system message prepended");
+  assert.equal(result.messages[0].content, "Think step by step.", "prompt is the content");
+  assert.equal(result.messages[1].role, "user", "user message preserved after system");
+});
+
+test("injectCustomSystemPrompt: injects into Claude-style string system field", () => {
+  const body = {
+    system: "You are Claude.",
+    messages: [{ role: "user", content: "Hello" }],
+  };
+  const result = injectCustomSystemPrompt(body, "Be concise.");
+  assert.ok(typeof result.system === "string", "system field still a string");
+  assert.ok(result.system.includes("You are Claude."), "original system preserved");
+  assert.ok(result.system.includes("Be concise."), "custom prompt appended to system");
+});
+
+test("injectCustomSystemPrompt: injects into Claude-style array system field", () => {
+  const body = {
+    system: [{ type: "text", text: "You are Claude." }],
+    messages: [{ role: "user", content: "Hello" }],
+  };
+  const result = injectCustomSystemPrompt(body, "Be concise.");
+  assert.ok(Array.isArray(result.system), "system field still an array");
+  const texts = (result.system as Array<{ type: string; text: string }>).map((c) => c.text);
+  assert.ok(texts.includes("You are Claude."), "original system block preserved");
+  assert.ok(texts.includes("Be concise."), "custom prompt block appended");
+});
+
+test("injectCustomSystemPrompt: no-op when prompt is empty string", () => {
+  const body = {
+    messages: [{ role: "user", content: "Hello" }],
+  };
+  const result = injectCustomSystemPrompt(body, "");
+  assert.deepEqual(result, body, "body unchanged when prompt is empty");
+});
+
+test("injectCustomSystemPrompt: no-op when body has _skipSystemPrompt flag", () => {
+  const body = {
+    _skipSystemPrompt: true,
+    messages: [{ role: "user", content: "Hello" }],
+  };
+  const result = injectCustomSystemPrompt(body as Record<string, unknown>, "Be formal.");
+  assert.deepEqual(result, body, "body unchanged when _skipSystemPrompt is set");
+});
+
+test("injectCustomSystemPrompt: does not mutate input body (immutable)", () => {
+  const body = {
+    messages: [
+      { role: "system", content: "Original." },
+      { role: "user", content: "Hi" },
+    ],
+  };
+  const original = JSON.stringify(body);
+  injectCustomSystemPrompt(body, "New instruction.");
+  assert.equal(JSON.stringify(body), original, "input body not mutated");
+});
+
+// ─── Settings defaults ───────────────────────────────────────────────────────
+// Verify that getSettings() returns the expected defaults for the new keys.
+// Uses an in-memory DB (DATA_DIR set to a temp path so no production DB is touched).
+
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { mkdirSync } from "node:fs";
+
+const tmpDir = join(tmpdir(), `omniroute-test-${Date.now()}`);
+mkdirSync(tmpDir, { recursive: true });
+process.env["DATA_DIR"] = tmpDir;
+
+test("settings defaults include customSystemPromptEnabled=false and customSystemPrompt=''", async (t) => {
+  // Dynamic import after setting DATA_DIR to avoid polluting other tests
+  const { resetDbInstance } = await import("../../src/lib/db/core.ts");
+  const { getSettings } = await import("../../src/lib/db/settings.ts");
+
+  const settings = await getSettings();
+  assert.equal(
+    settings.customSystemPromptEnabled,
+    false,
+    "customSystemPromptEnabled default is false"
+  );
+  assert.equal(
+    settings.customSystemPrompt,
+    "",
+    "customSystemPrompt default is empty string"
+  );
+
+  t.after(() => {
+    resetDbInstance();
+  });
+});
diff --git a/tests/unit/custom-provider-combo-models.test.ts b/tests/unit/custom-provider-combo-models.test.ts
new file mode 100644
index 0000000000..524fc26383
--- /dev/null
+++ b/tests/unit/custom-provider-combo-models.test.ts
@@ -0,0 +1,109 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { getModelCatalogSourceLabel, normalizeModelCatalogSource } = await import(
+  "../../src/shared/utils/modelCatalogSearch.ts"
+);
+
+// Ported from upstream PR decolua/9router#2018 (Hamsa_M):
+// custom (openai-/anthropic-compatible) providers in the combo model-select modal
+// now dynamically fetch their model catalog from the provider's upstream `/models`
+// endpoint, merge it with alias/fallback/custom models (deduped by id) and tag the
+// fetched entries with an "auto" source badge.
+
+test('the "auto" source normalizes to itself and renders the "Auto" badge', () => {
+  // Before the port the modal had no way to tag dynamically-fetched models, so an
+  // unknown source fell through to "system" / "Built-in", which is misleading.
+  assert.equal(normalizeModelCatalogSource("auto"), "auto");
+  assert.equal(getModelCatalogSourceLabel("auto"), "Auto");
+});
+
+test('"auto" must not collide with the "auto-sync" import alias', () => {
+  // `auto-sync` is an existing synced-import alias and must keep mapping to imported.
+  assert.equal(normalizeModelCatalogSource("auto-sync"), "imported");
+  assert.equal(getModelCatalogSourceLabel("auto-sync"), "Imported");
+});
+
+// Mirrors the modal's merge step: alias models win, fetched ("auto") models fill the
+// gaps, deduped by id against alias + fallback + custom entries.
+function mergeFetchedModels(
+  nodePrefix: string,
+  nodeModels: Array<{ id: string }>,
+  fallbackEntries: Array<{ id: string }>,
+  customEntries: Array<{ id: string }>,
+  fetched: Array<Record<string, string>>
+) {
+  const fetchedEntries = fetched
+    .map((m) => {
+      const id = m.id || m.slug || m.model || m.name;
+      return {
+        id,
+        name: m.name || m.displayName || id,
+        value: `${nodePrefix}/${id}`,
+        isFetched: true,
+        source: "auto",
+      };
+    })
+    .filter(
+      (fm) =>
+        fm.id &&
+        !nodeModels.some((nm) => nm.id === fm.id) &&
+        !fallbackEntries.some((fbm) => fbm.id === fm.id) &&
+        !customEntries.some((cm) => cm.id === fm.id)
+    );
+  return [...nodeModels, ...fallbackEntries, ...customEntries, ...fetchedEntries];
+}
+
+test("fetched models merge with alias models, deduping by id", () => {
+  const nodeModels = [{ id: "gpt-4", name: "GPT-4", value: "p/gpt-4" }];
+  const fetched = [
+    { id: "gpt-4", name: "GPT-4 Turbo" }, // duplicate of an alias → dropped
+    { id: "gpt-3.5", name: "GPT-3.5" }, // new → kept, tagged auto
+  ];
+
+  const merged = mergeFetchedModels("p", nodeModels, [], [], fetched) as Array<{
+    id: string;
+    source?: string;
+  }>;
+
+  assert.equal(merged.length, 2);
+  assert.deepEqual(
+    merged.map((m) => m.id).sort(),
+    ["gpt-3.5", "gpt-4"]
+  );
+  const auto = merged.find((m) => m.id === "gpt-3.5");
+  assert.equal(auto?.source, "auto");
+  // The pre-existing alias entry keeps its original (non-auto) identity.
+  assert.equal(merged.find((m) => m.id === "gpt-4")?.source, undefined);
+});
+
+test("fetched ids fall back across id/slug/model/name keys", () => {
+  const merged = mergeFetchedModels(
+    "p",
+    [],
+    [],
+    [],
+    [{ slug: "llama-3" }, { model: "mixtral" }, { name: "qwen" }]
+  ) as Array<{ id: string; value: string }>;
+  assert.deepEqual(
+    merged.map((m) => m.id).sort(),
+    ["llama-3", "mixtral", "qwen"]
+  );
+  assert.equal(merged.find((m) => m.id === "llama-3")?.value, "p/llama-3");
+});
+
+test("fetched entries are deduped against fallback and custom models too", () => {
+  const merged = mergeFetchedModels(
+    "p",
+    [],
+    [{ id: "fb-model" }],
+    [{ id: "custom-model" }],
+    [{ id: "fb-model" }, { id: "custom-model" }, { id: "brand-new" }]
+  ) as Array<{ id: string; source?: string }>;
+  // Only the genuinely-new model survives as an auto entry.
+  const autoEntries = merged.filter((m) => m.source === "auto");
+  assert.deepEqual(
+    autoEntries.map((m) => m.id),
+    ["brand-new"]
+  );
+});
diff --git a/tests/unit/database-settings-maintenance.test.ts b/tests/unit/database-settings-maintenance.test.ts
index b29ee88430..b8dbf20d6f 100644
--- a/tests/unit/database-settings-maintenance.test.ts
+++ b/tests/unit/database-settings-maintenance.test.ts
@@ -146,6 +146,81 @@ test("database log settings mirror the runtime pipeline toggle", async () => {
   assert.equal(databaseSettings.getUserDatabaseSettings().logs.callLogPipelineEnabled, true);
 });
 
+test("database optimization settings apply SQLite cache size immediately", () => {
+  const current = databaseSettings.getUserDatabaseSettings();
+
+  databaseSettings.updateDatabaseSettings({
+    optimization: {
+      ...current.optimization,
+      autoVacuumMode: core.getAutoVacuumMode(),
+      pageSize: 4096,
+      cacheSize: 16384,
+    },
+  });
+
+  const db = core.getDbInstance();
+  const stored = db
+    .prepare(
+      "SELECT value FROM key_value WHERE namespace = 'databaseSettings' AND key = 'optimization.cacheSize'"
+    )
+    .get() as { value: string } | undefined;
+
+  assert.equal(db.pragma("cache_size", { simple: true }), -16384);
+  assert.equal(JSON.parse(stored?.value ?? "null"), 16384);
+  assert.equal(databaseSettings.getUserDatabaseSettings().optimization.cacheSize, 16384);
+});
+
+test("database optimization settings apply SQLite page size immediately", () => {
+  const current = databaseSettings.getUserDatabaseSettings();
+
+  databaseSettings.updateDatabaseSettings({
+    optimization: {
+      ...current.optimization,
+      autoVacuumMode: core.getAutoVacuumMode(),
+      pageSize: 8192,
+      cacheSize: 16384,
+    },
+  });
+
+  assert.equal(core.getDbInstance().pragma("page_size", { simple: true }), 8192);
+  assert.equal(databaseSettings.getUserDatabaseSettings().optimization.pageSize, 8192);
+});
+
+test("database optimization cache size is applied when the DB is reopened", () => {
+  const db = core.getDbInstance();
+  db.prepare(
+    "INSERT OR REPLACE INTO key_value (namespace, key, value) VALUES ('databaseSettings', ?, ?)"
+  ).run("optimization.cacheSize", JSON.stringify(32768));
+
+  core.resetDbInstance();
+  const reopened = core.getDbInstance();
+
+  assert.equal(reopened.pragma("cache_size", { simple: true }), -32768);
+});
+
+test("database optimization rejects negative cache size through the API", async () => {
+  const current = databaseSettings.getUserDatabaseSettings();
+  const response = await databaseSettingsRoute.PATCH(
+    makeJsonRequest("PATCH", {
+      optimization: {
+        ...current.optimization,
+        cacheSize: -2000,
+      },
+    }) as never
+  );
+
+  assert.equal(response.status, 400);
+});
+
+test("database settings reader normalizes legacy negative cache size to the positive default", () => {
+  const db = core.getDbInstance();
+  db.prepare(
+    "INSERT OR REPLACE INTO key_value (namespace, key, value) VALUES ('databaseSettings', ?, ?)"
+  ).run("optimization.cacheSize", JSON.stringify(-2000));
+
+  assert.equal(databaseSettings.getUserDatabaseSettings().optimization.cacheSize, 16384);
+});
+
 test("purgeDetailedLogs deletes request_detail_logs", async () => {
   const db = core.getDbInstance();
   db.prepare("INSERT INTO request_detail_logs (id, timestamp, duration_ms) VALUES (?, ?, ?)").run(
diff --git a/tests/unit/db-case-mapping-split.test.ts b/tests/unit/db-case-mapping-split.test.ts
new file mode 100644
index 0000000000..4f453ac468
--- /dev/null
+++ b/tests/unit/db-case-mapping-split.test.ts
@@ -0,0 +1,70 @@
+// Characterization of the db/core.ts column-mapping split (god-file decomposition): the pure
+// snake_case ↔ camelCase row helpers moved into db/caseMapping.ts. Behavior-preserving move — these
+// locks pin the conversion semantics (boolean coercion for known flag columns, JSON parsing for
+// providerSpecificData + `_json` TEXT columns, null-stripping) and that core.ts still re-exports them
+// for the historical `from "./core"` import surface.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+const M = await import("../../src/lib/db/caseMapping.ts");
+const CORE = await import("../../src/lib/db/core.ts");
+
+test("module exposes the five mapping helpers", () => {
+  for (const name of ["toSnakeCase", "toCamelCase", "objToSnake", "rowToCamel", "cleanNulls"]) {
+    assert.equal(typeof (M as Record<string, unknown>)[name], "function", `missing ${name}`);
+  }
+});
+
+test("core.ts re-exports the same helpers (historical surface preserved)", () => {
+  for (const name of ["toSnakeCase", "toCamelCase", "objToSnake", "rowToCamel", "cleanNulls"]) {
+    assert.equal((CORE as Record<string, unknown>)[name], (M as Record<string, unknown>)[name]);
+  }
+});
+
+test("toSnakeCase / toCamelCase round-trip column names", () => {
+  assert.equal(M.toSnakeCase("maxRequestsPerDay"), "max_requests_per_day");
+  assert.equal(M.toCamelCase("max_requests_per_day"), "maxRequestsPerDay");
+});
+
+test("objToSnake converts keys, passes non-objects through", () => {
+  assert.deepEqual(M.objToSnake({ providerId: "x", isActive: 1 }), {
+    provider_id: "x",
+    is_active: 1,
+  });
+  assert.equal(M.objToSnake(null), null);
+  assert.equal(M.objToSnake("str"), "str");
+});
+
+test("rowToCamel coerces known boolean flags from 0/1", () => {
+  const out = M.rowToCamel({ is_active: 1, proxy_enabled: 0, per_key_proxy_enabled: 1 });
+  assert.equal(out?.isActive, true);
+  assert.equal(out?.proxyEnabled, false);
+  assert.equal(out?.perKeyProxyEnabled, true);
+  assert.equal(M.rowToCamel(null), null);
+});
+
+test("rowToCamel parses providerSpecificData JSON string", () => {
+  const out = M.rowToCamel({ provider_specific_data: '{"a":1}' });
+  assert.deepEqual(out?.providerSpecificData, { a: 1 });
+  // invalid JSON falls back to the raw string
+  const bad = M.rowToCamel({ provider_specific_data: "not json" });
+  assert.equal(bad?.providerSpecificData, "not json");
+});
+
+test("rowToCamel unwraps `_json` columns to the base key", () => {
+  const out = M.rowToCamel({ quota_window_thresholds_json: '{"hi":80}' });
+  assert.deepEqual(out?.quotaWindowThresholds, { hi: 80 });
+  assert.equal("quotaWindowThresholdsJson" in (out ?? {}), false);
+  // NULL `_json` column normalizes the base key to null
+  const nul = M.rowToCamel({ quota_window_thresholds_json: null });
+  assert.equal(nul?.quotaWindowThresholds, null);
+});
+
+test("cleanNulls drops null/undefined, keeps falsy-but-present values", () => {
+  assert.deepEqual(M.cleanNulls({ a: 0, b: "", c: null, d: undefined, e: false }), {
+    a: 0,
+    b: "",
+    e: false,
+  });
+  assert.deepEqual(M.cleanNulls(null), {});
+});
diff --git a/tests/unit/db-quota-pools.test.ts b/tests/unit/db-quota-pools.test.ts
index 12575f2e24..670ab67f8f 100644
--- a/tests/unit/db-quota-pools.test.ts
+++ b/tests/unit/db-quota-pools.test.ts
@@ -20,6 +20,7 @@ process.env.DATA_DIR = TEST_DATA_DIR;
 
 const core = await import("../../src/lib/db/core.ts");
 const poolsDb = await import("../../src/lib/db/quotaPools.ts");
+const { getDbInstance } = core;
 
 async function resetStorage() {
   core.resetDbInstance();
@@ -260,3 +261,61 @@ test("allocation stores optional capValue and capUnit correctly", () => {
   assert.equal(alloc.capValue, 1000);
   assert.equal(alloc.capUnit, "requests");
 });
+
+// ---------------------------------------------------------------------------
+// Guard A (issue #10): corrupted/unknown policy in the DB must be normalized to
+// the most restrictive policy ('hard') at the read boundary — never trusted via
+// `row.policy as Policy`. A garbage policy reaching the fair-share engine would
+// fall through every switch case and silently ALLOW (fail-OPEN).
+//
+// The schema has CHECK (policy IN ('hard','soft','burst')), so we bypass it with
+// PRAGMA ignore_check_constraints to simulate a legacy/corrupted row.
+// ---------------------------------------------------------------------------
+
+test("rowToAllocation normalizes an unknown DB policy to 'hard' (Guard A)", () => {
+  const pool = poolsDb.createPool({
+    connectionId: "c-guardA",
+    name: "Corrupt Policy Pool",
+    allocations: [{ apiKeyId: "k-corrupt", weight: 100, policy: "soft" }],
+  });
+
+  // Inject a corrupted policy directly, bypassing the CHECK constraint.
+  const db = getDbInstance() as unknown as {
+    pragma: (s: string) => unknown;
+    prepare: (sql: string) => { run: (...p: unknown[]) => unknown };
+  };
+  db.pragma("ignore_check_constraints = ON");
+  db.prepare("UPDATE quota_allocations SET policy = ? WHERE pool_id = ? AND api_key_id = ?").run(
+    "bogus-policy",
+    pool.id,
+    "k-corrupt"
+  );
+  db.pragma("ignore_check_constraints = OFF");
+
+  // Read through the domain module — the unknown policy must become 'hard'.
+  const found = poolsDb.getPool(pool.id)!;
+  const alloc = found.allocations.find((a) => a.apiKeyId === "k-corrupt")!;
+  assert.equal(alloc.policy, "hard", "unknown DB policy must be normalized to 'hard'");
+
+  // Same expectation via listAllocationsForApiKey (the other read path).
+  const list = poolsDb.listAllocationsForApiKey("k-corrupt");
+  assert.equal(list.length, 1);
+  assert.equal(list[0].allocation.policy, "hard");
+});
+
+test("rowToAllocation preserves valid policies unchanged (Guard A regression)", () => {
+  const pool = poolsDb.createPool({
+    connectionId: "c-guardA-valid",
+    name: "Valid Policy Pool",
+    allocations: [
+      { apiKeyId: "k-hard", weight: 34, policy: "hard" },
+      { apiKeyId: "k-soft", weight: 33, policy: "soft" },
+      { apiKeyId: "k-burst", weight: 33, policy: "burst" },
+    ],
+  });
+
+  const found = poolsDb.getPool(pool.id)!;
+  assert.equal(found.allocations.find((a) => a.apiKeyId === "k-hard")!.policy, "hard");
+  assert.equal(found.allocations.find((a) => a.apiKeyId === "k-soft")!.policy, "soft");
+  assert.equal(found.allocations.find((a) => a.apiKeyId === "k-burst")!.policy, "burst");
+});
diff --git a/tests/unit/db-schema-columns-split.test.ts b/tests/unit/db-schema-columns-split.test.ts
new file mode 100644
index 0000000000..f4f9643e9f
--- /dev/null
+++ b/tests/unit/db-schema-columns-split.test.ts
@@ -0,0 +1,65 @@
+// Characterization of the db/core.ts schema-column split (god-file decomposition): the idempotent
+// ALTER-TABLE column reconcilers + table introspection helpers moved into db/schemaColumns.ts. These
+// run an in-memory SQLite db through the helpers to lock the observable behavior: ensure* adds missing
+// columns and is safe to re-run; hasTable/hasColumn/getTableColumns/quoteIdentifier introspect.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { tryOpenSync } from "../../src/lib/db/adapters/driverFactory.ts";
+import {
+  ensureUsageHistoryColumns,
+  hasColumn,
+  hasTable,
+  quoteIdentifier,
+  getTableColumns,
+} from "../../src/lib/db/schemaColumns.ts";
+
+function openMemoryDb() {
+  // Synchronous in-memory adapter — no DATA_DIR / file handles to clean up.
+  const db = tryOpenSync(":memory:");
+  assert.ok(db, "expected a synchronous sqlite adapter for :memory:");
+  return db!;
+}
+
+test("quoteIdentifier escapes embedded double quotes", () => {
+  assert.equal(quoteIdentifier("plain"), '"plain"');
+  assert.equal(quoteIdentifier('we"ird'), '"we""ird"');
+});
+
+test("hasTable / hasColumn / getTableColumns introspect a live table", () => {
+  const db = openMemoryDb();
+  try {
+    db.exec("CREATE TABLE usage_history (id INTEGER PRIMARY KEY, model TEXT)");
+    assert.equal(hasTable(db, "usage_history"), true);
+    assert.equal(hasTable(db, "does_not_exist"), false);
+    assert.equal(hasColumn(db, "usage_history", "model"), true);
+    assert.equal(hasColumn(db, "usage_history", "nope"), false);
+    assert.deepEqual(getTableColumns(db, "usage_history").sort(), ["id", "model"]);
+  } finally {
+    db.close?.();
+  }
+});
+
+test("ensureUsageHistoryColumns adds missing columns and is idempotent", () => {
+  const db = openMemoryDb();
+  try {
+    db.exec("CREATE TABLE usage_history (id INTEGER PRIMARY KEY, model TEXT)");
+    assert.equal(hasColumn(db, "usage_history", "service_tier"), false);
+
+    ensureUsageHistoryColumns(db);
+    for (const col of [
+      "success",
+      "latency_ms",
+      "ttft_ms",
+      "error_code",
+      "service_tier",
+      "combo_strategy",
+    ]) {
+      assert.equal(hasColumn(db, "usage_history", col), true, `expected ${col} after ensure`);
+    }
+
+    // Re-running must not throw (columns already present) — idempotency.
+    assert.doesNotThrow(() => ensureUsageHistoryColumns(db));
+  } finally {
+    db.close?.();
+  }
+});
diff --git a/tests/unit/deno-deploy-relay-path-ssrf.test.ts b/tests/unit/deno-deploy-relay-path-ssrf.test.ts
new file mode 100644
index 0000000000..830fa51e44
--- /dev/null
+++ b/tests/unit/deno-deploy-relay-path-ssrf.test.ts
@@ -0,0 +1,104 @@
+// SSRF regression guard for the Deno Deploy relay worker (PR #4643 follow-up).
+//
+// The generated edge worker reads an attacker-controlled `x-relay-path` header
+// and previously appended it to the (validated) `x-relay-target` origin via
+// string concatenation: `fetch(target.replace(/\/$/, "") + relayPath)`. That
+// lets the caller smuggle a NEW host past the allow/SSRF check using userinfo
+// (`@`), a backslash, or a protocol-relative path:
+//   - x-relay-target: https://api.anthropic.com   (passes the host guard)
+//   - x-relay-path:   //evil.com/x                 → fetches https://evil.com/x
+//   - x-relay-path:   /x@evil.com                  → userinfo confusion
+//   - x-relay-path:   \evil.com                    → backslash host confusion
+//
+// The fix resolves the path against the validated target with `new URL()` and
+// re-checks that the resolved host/credentials still match the target. The
+// path-resolution decision is exported as the pure `resolveRelayTarget()` so it
+// can be unit-tested directly (the worker body — a Deno-runtime string — embeds
+// the SAME function source, asserted below by diffing the generated worker).
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import {
+  resolveRelayTarget,
+  __buildRelayWorkerForTest,
+} from "../../src/app/api/settings/proxy/deno-deploy/route";
+
+const TARGET = "https://api.anthropic.com";
+
+describe("resolveRelayTarget — SSRF-safe path join", () => {
+  it("accepts a legitimate absolute path and keeps the validated host", () => {
+    const r = resolveRelayTarget(TARGET, "/v1/foo");
+    assert.equal(r.ok, true, "a normal path must pass");
+    if (r.ok) {
+      assert.equal(r.url, "https://api.anthropic.com/v1/foo");
+    }
+  });
+
+  it("accepts a path with a query string", () => {
+    const r = resolveRelayTarget(TARGET, "/v1/messages?beta=true");
+    assert.equal(r.ok, true);
+    if (r.ok) {
+      assert.equal(r.url, "https://api.anthropic.com/v1/messages?beta=true");
+    }
+  });
+
+  it("rejects a protocol-relative path that swaps the host (//evil.com/x)", () => {
+    const r = resolveRelayTarget(TARGET, "//evil.com/x");
+    assert.equal(r.ok, false, "//evil.com must NOT be allowed to change the host");
+    if (!r.ok) assert.equal(r.status, 403);
+  });
+
+  it("rejects a path containing userinfo (/x@evil.com)", () => {
+    const r = resolveRelayTarget(TARGET, "/x@evil.com");
+    assert.equal(r.ok, false, "@ in the path must be rejected");
+    if (!r.ok) assert.equal(r.status, 403);
+  });
+
+  it("rejects a backslash host-confusion path (\\evil.com)", () => {
+    const r = resolveRelayTarget(TARGET, "\\evil.com");
+    assert.equal(r.ok, false, "backslash must be rejected");
+    if (!r.ok) assert.equal(r.status, 403);
+  });
+
+  it("rejects a value that does not start with '/'", () => {
+    const r = resolveRelayTarget(TARGET, "evil.com/x");
+    assert.equal(r.ok, false, "a path must start with '/'");
+    if (!r.ok) assert.equal(r.status, 403);
+  });
+
+  it("rejects an embedded-credentials path that resolves a different host", () => {
+    // Classic userinfo trick: everything before '@' becomes userinfo, the real
+    // host is after it.
+    const r = resolveRelayTarget(TARGET, "/@evil.com/path");
+    assert.equal(r.ok, false);
+    if (!r.ok) assert.equal(r.status, 403);
+  });
+
+  it("rejects backslash-prefixed protocol-relative (\\\\evil.com)", () => {
+    const r = resolveRelayTarget(TARGET, "\\\\evil.com/x");
+    assert.equal(r.ok, false);
+    if (!r.ok) assert.equal(r.status, 403);
+  });
+});
+
+describe("buildRelayWorker — generated worker has no string-concat SSRF hole", () => {
+  it("does not concatenate the target with the raw relay path", () => {
+    const worker = __buildRelayWorkerForTest("deadbeefcafe");
+    // The vulnerable pattern was: target.replace(/\/$/, "") + relayPath
+    assert.ok(
+      !/\.replace\(\s*\/\\?\/\$\/\s*,\s*["']{2}\s*\)\s*\+\s*relayPath/.test(worker),
+      "worker must not append relayPath to target by string concatenation"
+    );
+    assert.ok(
+      !worker.includes('+ relayPath'),
+      "worker must not contain `+ relayPath` string concatenation"
+    );
+  });
+
+  it("embeds the resolveRelayTarget guard into the worker body", () => {
+    const worker = __buildRelayWorkerForTest("deadbeefcafe");
+    assert.ok(
+      worker.includes("resolveRelayTarget"),
+      "the worker must call the shared resolveRelayTarget guard"
+    );
+  });
+});
diff --git a/tests/unit/direct-dispatcher-pipelining-4580.test.ts b/tests/unit/direct-dispatcher-pipelining-4580.test.ts
index a56ed90831..3f6ae944df 100644
--- a/tests/unit/direct-dispatcher-pipelining-4580.test.ts
+++ b/tests/unit/direct-dispatcher-pipelining-4580.test.ts
@@ -1,6 +1,8 @@
 import { describe, it, afterEach } from "node:test";
 import assert from "node:assert/strict";
+import type { Dispatcher } from "undici";
 import {
+  __createRoundRobinDispatcherForTest,
   __getDefaultDispatcherOptionsForTest,
   __getProxyDispatcherOptionsForTest,
   getDefaultDispatcherConnectionLimit,
@@ -39,7 +41,10 @@ describe("#4580 direct dispatcher options", () => {
   });
 
   it("connection limit honors OMNIROUTE_DIRECT_DISPATCHER_CONNECTIONS", () => {
-    assert.equal(getDefaultDispatcherConnectionLimit({ OMNIROUTE_DIRECT_DISPATCHER_CONNECTIONS: "8" }), 8);
+    assert.equal(
+      getDefaultDispatcherConnectionLimit({ OMNIROUTE_DIRECT_DISPATCHER_CONNECTIONS: "8" }),
+      8
+    );
   });
 
   it("connection limit clamps invalid values to the default", () => {
@@ -49,4 +54,30 @@ describe("#4580 direct dispatcher options", () => {
     );
     assert.equal(getDefaultDispatcherConnectionLimit({}), 32);
   });
+
+  it("fans out direct requests across independent dispatcher pools", () => {
+    const calls: number[] = [];
+    const dispatchers = [0, 1, 2].map(
+      (index) =>
+        ({
+          dispatch() {
+            calls.push(index);
+            return true;
+          },
+          close() {},
+          destroy() {},
+        }) as unknown as Dispatcher
+    );
+    const dispatcher = __createRoundRobinDispatcherForTest(dispatchers);
+    const dispatchOptions = {
+      origin: "https://chatgpt.com",
+      path: "/backend-api/codex/responses",
+      method: "POST",
+    } as unknown as Parameters<Dispatcher["dispatch"]>[0];
+    const handler = {} as Parameters<Dispatcher["dispatch"]>[1];
+
+    for (let i = 0; i < 7; i++) dispatcher.dispatch(dispatchOptions, handler);
+
+    assert.deepEqual(calls, [0, 1, 2, 0, 1, 2, 0]);
+  });
 });
diff --git a/tests/unit/display-and-error-utils.test.ts b/tests/unit/display-and-error-utils.test.ts
index a2ad1ed3c4..b97ec91bbc 100644
--- a/tests/unit/display-and-error-utils.test.ts
+++ b/tests/unit/display-and-error-utils.test.ts
@@ -6,6 +6,7 @@ const { createErrorResponse, createErrorResponseFromUnknown } =
   await import("../../src/lib/api/errorResponse.ts");
 const { getAccountDisplayName, getProviderDisplayName } =
   await import("../../src/lib/display/names.ts");
+const { resolveProviderName } = await import("../../src/lib/display/useProviderNodeMap.ts");
 
 test("toJsonErrorPayload: preserves upstream error objects that already have error payloads", () => {
   const payload = {
@@ -201,6 +202,32 @@ test("getAccountDisplayName: respects priority order and fallback", () => {
   assert.equal(getAccountDisplayName(null), "Unknown Account");
 });
 
+test("resolveProviderName: returns user-given name from nodeMap for custom provider", () => {
+  const nodeMap = new Map([
+    ["openai-compatible-chat-abc123", { name: "My LLM", prefix: "my-llm" }],
+  ]);
+  assert.equal(
+    resolveProviderName("openai-compatible-chat-abc123", nodeMap),
+    "My LLM",
+    "should return the user-given name when present in the map"
+  );
+  // Falls back to prefix when name is blank
+  const mapNoName = new Map([
+    ["openai-compatible-chat-abc123", { name: null, prefix: "my-prefix" }],
+  ]);
+  assert.equal(resolveProviderName("openai-compatible-chat-abc123", mapNoName), "my-prefix");
+  // Falls back to de-UUIDed label when no node entry exists
+  assert.equal(
+    resolveProviderName("openai-compatible-chat-02669115-2545-4896-b003-cb4dac09d441", new Map()),
+    "Compatible (openai)"
+  );
+  // Falls back gracefully for unknown ids not in the map
+  assert.equal(resolveProviderName("plain-provider", nodeMap), "plain-provider");
+  // Handles null/undefined id
+  assert.equal(resolveProviderName(null, nodeMap), "Unknown Provider");
+  assert.equal(resolveProviderName(undefined, null), "Unknown Provider");
+});
+
 test("getProviderDisplayName: prefers node metadata and simplifies compatible IDs", () => {
   assert.equal(
     getProviderDisplayName("openai-compatible-chat-02669115-2545-4896-b003-cb4dac09d441", {
diff --git a/tests/unit/executor-codex.test.ts b/tests/unit/executor-codex.test.ts
index 673b205271..3ece99efe3 100644
--- a/tests/unit/executor-codex.test.ts
+++ b/tests/unit/executor-codex.test.ts
@@ -188,10 +188,10 @@ test("CodexExecutor.buildHeaders binds workspace ids and disables SSE accept for
   assert.equal(standardHeaders.Authorization, "Bearer codex-token");
   assert.equal(standardHeaders.Accept, "text/event-stream");
   assert.equal(standardHeaders["chatgpt-account-id"], "workspace-1");
-  assert.equal(standardHeaders.Version, "0.132.0");
+  assert.equal(standardHeaders.Version, "0.142.0");
   assert.equal(standardHeaders["Openai-Beta"], "responses=experimental");
   assert.equal(standardHeaders["X-Codex-Beta-Features"], "responses_websockets");
-  assert.equal(standardHeaders["User-Agent"], "codex-cli/0.132.0 (Windows 10.0.26200; x64)");
+  assert.equal(standardHeaders["User-Agent"], "codex-cli/0.142.0 (Windows 10.0.26200; x64)");
   assert.equal(compactHeaders.Accept, "application/json");
 });
 
@@ -200,13 +200,13 @@ test("CodexExecutor.buildHeaders honors safe env overrides for Version and User-
 
   await withEnv(
     {
-      CODEX_CLIENT_VERSION: "0.132.0",
+      CODEX_CLIENT_VERSION: "0.142.0",
       CODEX_USER_AGENT: undefined,
     },
     () => {
       const headers = executor.buildHeaders({ accessToken: "codex-token" }, true);
-      assert.equal(headers.Version, "0.132.0");
-      assert.equal(headers["User-Agent"], "codex-cli/0.132.0 (Windows 10.0.26200; x64)");
+      assert.equal(headers.Version, "0.142.0");
+      assert.equal(headers["User-Agent"], "codex-cli/0.142.0 (Windows 10.0.26200; x64)");
     }
   );
 
@@ -217,7 +217,7 @@ test("CodexExecutor.buildHeaders honors safe env overrides for Version and User-
     },
     () => {
       const headers = executor.buildHeaders({ accessToken: "codex-token" }, true);
-      assert.equal(headers.Version, "0.132.0");
+      assert.equal(headers.Version, "0.142.0");
       assert.equal(headers["User-Agent"], "custom-codex/9.9.9");
     }
   );
diff --git a/tests/unit/executor-github.test.ts b/tests/unit/executor-github.test.ts
index 6d8194e043..ddcbf272cc 100644
--- a/tests/unit/executor-github.test.ts
+++ b/tests/unit/executor-github.test.ts
@@ -71,6 +71,33 @@ test("GithubExecutor.buildUrl keeps GitHub Claude Opus 4.6 on /chat/completions"
   assert.equal(url, "https://api.githubcopilot.com/chat/completions");
 });
 
+test("GithubExecutor.buildUrl routes unlisted Codex models to /responses (9router#102)", () => {
+  // Copilot Codex models advertise supported_endpoints: ["/responses"]. When such
+  // a model isn't in the curated gh registry, getModelTargetFormat returns null and
+  // the request fell through to /chat/completions -> upstream 400 "model <id> is not
+  // accessible via the /chat/completions endpoint". Any *-codex id must route to
+  // /responses regardless of whether it's explicitly registered.
+  const executor = new GithubExecutor();
+  for (const model of [
+    "gpt-5-codex",
+    "gpt-5.1-codex",
+    "gpt-5.1-codex-mini",
+    "gpt-5.1-codex-max",
+    "gpt-5.2-codex",
+  ]) {
+    assert.equal(
+      executor.buildUrl(model, true),
+      "https://api.githubcopilot.com/responses",
+      `${model} must route to /responses`
+    );
+  }
+  // Non-codex unlisted models keep the chat/completions default.
+  assert.equal(
+    executor.buildUrl("some-random-chat-model", true),
+    "https://api.githubcopilot.com/chat/completions"
+  );
+});
+
 test("GithubExecutor.transformRequest injects JSON response instructions for Claude and strips reasoning fields", () => {
   const executor = new GithubExecutor();
   const body = {
diff --git a/tests/unit/executors-strip-unsupported-params.test.ts b/tests/unit/executors-strip-unsupported-params.test.ts
new file mode 100644
index 0000000000..d1896408c4
--- /dev/null
+++ b/tests/unit/executors-strip-unsupported-params.test.ts
@@ -0,0 +1,121 @@
+// Unit tests for stripUnsupportedParams: per-(provider,model) strip of params
+// the upstream rejects (HTTP 400). Port from 9router#7ae9fff6 (fixes #1748).
+//
+// Rule coverage:
+//   1. claude-opus-4 series: temperature deprecated → Anthropic 400.
+//   2. github + gpt-5.4: temperature unsupported.
+//   3. github + Claude (except opus/sonnet 4.6): thinking + reasoning_effort rejected.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import {
+  stripUnsupportedParams,
+  __STRIP_RULES_FOR_TEST,
+} from "../../open-sse/translator/paramSupport.ts";
+
+test("stripUnsupportedParams: drops temperature for claude-opus-4 models (any provider)", () => {
+  const body = { model: "claude-opus-4-20250514", temperature: 0.7, max_tokens: 100 };
+  stripUnsupportedParams("anthropic", "claude-opus-4-20250514", body);
+  assert.equal(body.temperature, undefined, "temperature must be stripped");
+  assert.equal(body.max_tokens, 100, "other params must survive");
+  assert.equal(body.model, "claude-opus-4-20250514", "model must not be touched");
+});
+
+test("stripUnsupportedParams: drops temperature for claude-opus-4-1 (case insensitive)", () => {
+  const body: Record<string, unknown> = { temperature: 0.5 };
+  stripUnsupportedParams("anthropic", "CLAUDE-OPUS-4-1-20250805", body);
+  assert.equal(body.temperature, undefined);
+});
+
+test("stripUnsupportedParams: keeps temperature for claude-sonnet-4 (only opus-4 affected)", () => {
+  const body: Record<string, unknown> = { temperature: 0.7 };
+  stripUnsupportedParams("anthropic", "claude-sonnet-4-20250514", body);
+  assert.equal(body.temperature, 0.7, "sonnet-4 still accepts temperature");
+});
+
+test("stripUnsupportedParams: keeps temperature for claude-opus-3 (regression guard)", () => {
+  const body: Record<string, unknown> = { temperature: 0.7 };
+  stripUnsupportedParams("anthropic", "claude-3-opus-20240229", body);
+  assert.equal(body.temperature, 0.7);
+});
+
+test("stripUnsupportedParams: github + gpt-5.4 strips temperature", () => {
+  const body: Record<string, unknown> = { temperature: 1, max_completion_tokens: 200 };
+  stripUnsupportedParams("github", "gpt-5.4", body);
+  assert.equal(body.temperature, undefined);
+  assert.equal(body.max_completion_tokens, 200);
+});
+
+test("stripUnsupportedParams: github + gpt-5 (non-5.4) keeps temperature", () => {
+  const body: Record<string, unknown> = { temperature: 1 };
+  stripUnsupportedParams("github", "gpt-5", body);
+  assert.equal(body.temperature, 1);
+});
+
+test("stripUnsupportedParams: github + Claude strips thinking + reasoning_effort", () => {
+  const body: Record<string, unknown> = {
+    thinking: { type: "enabled" },
+    reasoning_effort: "high",
+    temperature: 0.5,
+  };
+  stripUnsupportedParams("github", "claude-3-5-sonnet", body);
+  assert.equal(body.thinking, undefined, "Copilot rejects Claude-style thinking");
+  assert.equal(body.reasoning_effort, undefined);
+  assert.equal(body.temperature, 0.5, "non-targeted params survive");
+});
+
+test("stripUnsupportedParams: github + claude opus 4.6 KEEPS thinking + reasoning_effort", () => {
+  const body: Record<string, unknown> = {
+    thinking: { type: "enabled" },
+    reasoning_effort: "high",
+  };
+  stripUnsupportedParams("github", "claude-opus-4.6", body);
+  assert.equal(body.reasoning_effort, "high", "opus-4.6 supports reasoning_effort");
+  // Note: thinking survives too on opus-4.6 per upstream rule.
+  assert.deepEqual(body.thinking, { type: "enabled" });
+});
+
+test("stripUnsupportedParams: github + claude sonnet 4.6 KEEPS reasoning_effort", () => {
+  const body: Record<string, unknown> = { reasoning_effort: "low" };
+  stripUnsupportedParams("github", "claude-sonnet-4.6", body);
+  assert.equal(body.reasoning_effort, "low");
+});
+
+test("stripUnsupportedParams: non-github provider + Claude does NOT strip thinking", () => {
+  // The github-Claude rule is provider-scoped.
+  const body: Record<string, unknown> = { thinking: { type: "enabled" } };
+  stripUnsupportedParams("anthropic", "claude-3-5-sonnet", body);
+  assert.deepEqual(body.thinking, { type: "enabled" });
+});
+
+test("stripUnsupportedParams: only deletes when the key is present (never adds undefined)", () => {
+  const body: Record<string, unknown> = { max_tokens: 50 };
+  stripUnsupportedParams("anthropic", "claude-opus-4", body);
+  // No `temperature` key should be introduced.
+  assert.equal("temperature" in body, false);
+});
+
+test("stripUnsupportedParams: returns the same body reference (in-place mutation)", () => {
+  const body: Record<string, unknown> = { temperature: 0.7 };
+  const out = stripUnsupportedParams("anthropic", "claude-opus-4", body);
+  assert.equal(out, body);
+});
+
+test("stripUnsupportedParams: null/undefined body is a no-op", () => {
+  assert.equal(stripUnsupportedParams("anthropic", "claude-opus-4", null), null);
+  assert.equal(stripUnsupportedParams("anthropic", "claude-opus-4", undefined), undefined);
+});
+
+test("stripUnsupportedParams: missing model is a no-op", () => {
+  const body: Record<string, unknown> = { temperature: 0.7 };
+  stripUnsupportedParams("anthropic", "", body);
+  assert.equal(body.temperature, 0.7);
+});
+
+test("STRIP_RULES is non-empty and every rule has a drop list", () => {
+  assert.ok(__STRIP_RULES_FOR_TEST.length > 0);
+  for (const rule of __STRIP_RULES_FOR_TEST) {
+    assert.ok(Array.isArray(rule.drop) && rule.drop.length > 0);
+    assert.ok(typeof rule.match === "function" || rule.match instanceof RegExp);
+  }
+});
diff --git a/tests/unit/gemini-antigravity-pattern-preserved.test.ts b/tests/unit/gemini-antigravity-pattern-preserved.test.ts
new file mode 100644
index 0000000000..541ab428d4
--- /dev/null
+++ b/tests/unit/gemini-antigravity-pattern-preserved.test.ts
@@ -0,0 +1,54 @@
+// Regression test: `pattern` must be preserved in antigravity tool schemas.
+//
+// Upstream: decolua/9router @ f6c2f7ca / Fixes decolua/9router#1368.
+//
+// Tools such as glob/grep/file-search rely on a `pattern` constraint on
+// string parameters. Antigravity (Gemini-derived) DOES accept `pattern`,
+// so removing it for that surface drops critical tool semantics and
+// produces upstream 400s / wrong-tool-call behavior.
+//
+// Two assertions, mirroring how the field is consumed downstream:
+//   1) `pattern` must NOT live in the unsupported keyword set used by the
+//      antigravity schema cleaner.
+//   2) End-to-end, `cleanJSONSchemaForAntigravity` must preserve a `pattern`
+//      constraint placed on a string property (typical glob/grep tool).
+
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  GEMINI_UNSUPPORTED_SCHEMA_KEYS,
+  cleanJSONSchemaForAntigravity,
+} from "../../open-sse/translator/helpers/geminiHelper.ts";
+
+test("GEMINI_UNSUPPORTED_SCHEMA_KEYS does not strip `pattern` for antigravity", () => {
+  assert.equal(
+    GEMINI_UNSUPPORTED_SCHEMA_KEYS.has("pattern"),
+    false,
+    "`pattern` is supported by antigravity and must be preserved on tool schemas"
+  );
+});
+
+test("cleanJSONSchemaForAntigravity preserves `pattern` on glob/grep-style tool schema", () => {
+  const schema = {
+    type: "object",
+    properties: {
+      glob: {
+        type: "string",
+        description: "Glob pattern to match files",
+        pattern: "^[A-Za-z0-9_\\-/*.]+$",
+      },
+    },
+    required: ["glob"],
+  };
+
+  const cleaned = cleanJSONSchemaForAntigravity(schema) as {
+    properties: { glob: { pattern?: string } };
+  };
+
+  assert.equal(
+    cleaned.properties.glob.pattern,
+    "^[A-Za-z0-9_\\-/*.]+$",
+    "`pattern` constraint on a string property must survive antigravity cleaning"
+  );
+});
diff --git a/tests/unit/google-flow-video-4569.test.ts b/tests/unit/google-flow-video-4569.test.ts
new file mode 100644
index 0000000000..4f7e5f5889
--- /dev/null
+++ b/tests/unit/google-flow-video-4569.test.ts
@@ -0,0 +1,214 @@
+/**
+ * #4569 — Google Flow video generation helpers.
+ *
+ * Covers the pure transformation logic (param normalization, Veo submit-body
+ * construction, operation-name parsing, LRO result parsing, credential
+ * resolution) and a source guard asserting the wire endpoint stays isolated and
+ * flagged for live validation (Hard Rule #18).
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+
+import {
+  GOOGLE_FLOW_CREDENTIAL_PROVIDER,
+  GOOGLE_FLOW_HOST,
+  buildGoogleFlowSubmitBody,
+  normalizeFlowVideoParams,
+  parseFlowOperationName,
+  parseFlowOperationResult,
+  resolveFlowAccessToken,
+  resolveFlowProjectId,
+  resolveVideoCredentialProvider,
+} from "../../open-sse/handlers/videoGeneration/googleFlow.ts";
+
+import { getVideoProvider, parseVideoModel } from "../../open-sse/config/videoRegistry.ts";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+test("normalizeFlowVideoParams: defaults sampleCount to 1 and stringifies prompt", () => {
+  const p = normalizeFlowVideoParams({ prompt: "a cat surfing" });
+  assert.equal(p.prompt, "a cat surfing");
+  assert.equal(p.sampleCount, 1);
+  assert.equal(p.aspectRatio, undefined);
+  assert.equal(p.durationSeconds, undefined);
+});
+
+test("normalizeFlowVideoParams: reads snake_case OpenAI fields", () => {
+  const p = normalizeFlowVideoParams({
+    prompt: "x",
+    aspect_ratio: "16:9",
+    duration: 8,
+    n: 2,
+    negative_prompt: "blurry",
+    resolution: "1080p",
+  });
+  assert.equal(p.aspectRatio, "16:9");
+  assert.equal(p.durationSeconds, 8);
+  assert.equal(p.sampleCount, 2);
+  assert.equal(p.negativePrompt, "blurry");
+  assert.equal(p.resolution, "1080p");
+});
+
+test("normalizeFlowVideoParams: reads camelCase native fields", () => {
+  const p = normalizeFlowVideoParams({ prompt: "x", aspectRatio: "9:16", durationSeconds: 4 });
+  assert.equal(p.aspectRatio, "9:16");
+  assert.equal(p.durationSeconds, 4);
+});
+
+test("normalizeFlowVideoParams: treats ratio-shaped size as aspectRatio, ignores pixel size", () => {
+  assert.equal(normalizeFlowVideoParams({ prompt: "x", size: "16:9" }).aspectRatio, "16:9");
+  assert.equal(normalizeFlowVideoParams({ prompt: "x", size: "1024x1024" }).aspectRatio, undefined);
+});
+
+test("normalizeFlowVideoParams: rejects non-positive / non-finite numbers", () => {
+  const p = normalizeFlowVideoParams({ prompt: "x", n: 0, duration: -5 });
+  assert.equal(p.sampleCount, 1);
+  assert.equal(p.durationSeconds, undefined);
+});
+
+test("buildGoogleFlowSubmitBody: emits documented Veo instances/parameters shape", () => {
+  const body = buildGoogleFlowSubmitBody({
+    prompt: "a dog",
+    aspectRatio: "16:9",
+    durationSeconds: 6,
+    sampleCount: 1,
+    negativePrompt: "ugly",
+    resolution: "720p",
+  });
+  assert.deepEqual(body.instances, [{ prompt: "a dog" }]);
+  assert.equal(body.parameters.sampleCount, 1);
+  assert.equal(body.parameters.aspectRatio, "16:9");
+  assert.equal(body.parameters.durationSeconds, 6);
+  assert.equal(body.parameters.negativePrompt, "ugly");
+  assert.equal(body.parameters.resolution, "720p");
+});
+
+test("buildGoogleFlowSubmitBody: omits absent optional parameters", () => {
+  const body = buildGoogleFlowSubmitBody({ prompt: "p", sampleCount: 3 });
+  assert.deepEqual(body.parameters, { sampleCount: 3 });
+  assert.ok(!("aspectRatio" in body.parameters));
+  assert.ok(!("durationSeconds" in body.parameters));
+});
+
+test("parseFlowOperationName: handles {name} and {operation:{name}} and rejects junk", () => {
+  assert.equal(parseFlowOperationName({ name: "operations/abc" }), "operations/abc");
+  assert.equal(parseFlowOperationName({ operation: { name: "operations/xyz" } }), "operations/xyz");
+  assert.equal(parseFlowOperationName({}), null);
+  assert.equal(parseFlowOperationName(null), null);
+  assert.equal(parseFlowOperationName({ name: "" }), null);
+});
+
+test("parseFlowOperationResult: not done → keep polling", () => {
+  assert.deepEqual(parseFlowOperationResult({ done: false }), { done: false });
+  assert.deepEqual(parseFlowOperationResult({}), { done: false });
+});
+
+test("parseFlowOperationResult: done with base64 video (documented shape)", () => {
+  const r = parseFlowOperationResult({
+    done: true,
+    response: { videos: [{ bytesBase64Encoded: "AAAA" }] },
+  });
+  assert.equal(r.done, true);
+  assert.equal(r.base64, "AAAA");
+  assert.equal(r.format, "mp4");
+  assert.equal(r.error, undefined);
+});
+
+test("parseFlowOperationResult: done with gcsUri/uri video", () => {
+  assert.equal(
+    parseFlowOperationResult({ done: true, response: { videos: [{ gcsUri: "gs://b/v.mp4" }] } }).url,
+    "gs://b/v.mp4"
+  );
+  assert.equal(
+    parseFlowOperationResult({ done: true, response: { videos: [{ uri: "https://x/v.mp4" }] } }).url,
+    "https://x/v.mp4"
+  );
+});
+
+test("parseFlowOperationResult: done with alternate generateVideoResponse shape", () => {
+  const r = parseFlowOperationResult({
+    done: true,
+    response: {
+      generateVideoResponse: { generatedSamples: [{ video: { uri: "https://x/sample.mp4" } }] },
+    },
+  });
+  assert.equal(r.url, "https://x/sample.mp4");
+});
+
+test("parseFlowOperationResult: done with error surfaces the message", () => {
+  const r = parseFlowOperationResult({ done: true, error: { message: "quota exceeded" } });
+  assert.equal(r.done, true);
+  assert.equal(r.error, "quota exceeded");
+});
+
+test("parseFlowOperationResult: done but empty → explicit no-video error", () => {
+  const r = parseFlowOperationResult({ done: true, response: {} });
+  assert.equal(r.done, true);
+  assert.match(r.error ?? "", /no video/i);
+});
+
+test("parseFlowOperationResult: null/empty array elements do not crash (defensive)", () => {
+  // Upstream returning a null element must not throw a TypeError (gemini-code-assist #4769).
+  for (const response of [
+    { videos: [null] },
+    { videos: [undefined] },
+    { videos: [{}] },
+    { generateVideoResponse: { generatedSamples: [null] } },
+    { generateVideoResponse: { generatedSamples: [{ video: null }] } },
+    { generateVideoResponse: { generatedSamples: [{}] } },
+  ]) {
+    const r = parseFlowOperationResult({ done: true, response });
+    assert.equal(r.done, true);
+    assert.match(r.error ?? "", /no video/i);
+    assert.equal(r.base64, undefined);
+    assert.equal(r.url, undefined);
+  }
+});
+
+test("resolveFlowProjectId: direct, providerSpecificData, and missing", () => {
+  assert.equal(resolveFlowProjectId({ projectId: "proj-1" }), "proj-1");
+  assert.equal(resolveFlowProjectId({ providerSpecificData: { projectId: "proj-2" } }), "proj-2");
+  assert.equal(resolveFlowProjectId({}), null);
+  assert.equal(resolveFlowProjectId(null), null);
+});
+
+test("resolveFlowAccessToken: prefers accessToken, falls back to apiKey", () => {
+  assert.equal(resolveFlowAccessToken({ accessToken: "tok" }), "tok");
+  assert.equal(resolveFlowAccessToken({ apiKey: "key" }), "key");
+  assert.equal(resolveFlowAccessToken({}), null);
+});
+
+test("videoRegistry: googleflow provider is registered with oauth + google-flow format", () => {
+  const provider = getVideoProvider("googleflow");
+  assert.ok(provider, "googleflow provider must exist");
+  assert.equal(provider.format, "google-flow");
+  assert.equal(provider.authType, "oauth");
+  assert.ok(provider.models.length > 0, "must expose at least one Veo model");
+});
+
+test("videoRegistry: parseVideoModel resolves googleflow/<model> and its alias", () => {
+  const parsed = parseVideoModel("googleflow/veo-3.1-generate");
+  assert.equal(parsed.provider, "googleflow");
+  assert.equal(parsed.model, "veo-3.1-generate");
+  const aliased = parseVideoModel("flow/veo-3.1-generate");
+  assert.equal(aliased.provider, "googleflow");
+});
+
+test("resolveVideoCredentialProvider: googleflow reuses antigravity OAuth, others unchanged", () => {
+  assert.equal(resolveVideoCredentialProvider("googleflow"), "antigravity");
+  assert.equal(GOOGLE_FLOW_CREDENTIAL_PROVIDER, "antigravity");
+  assert.equal(resolveVideoCredentialProvider("vertex"), "vertex");
+  assert.equal(resolveVideoCredentialProvider("kie"), "kie");
+});
+
+test("source guard: wire endpoint stays isolated + flagged for live validation (Rule #18)", () => {
+  assert.match(GOOGLE_FLOW_HOST, /aisandbox-pa\.googleapis\.com/);
+  const src = readFileSync(
+    join(__dirname, "../../open-sse/handlers/videoGeneration/googleFlow.ts"),
+    "utf8"
+  );
+  assert.match(src, /PENDING LIVE VALIDATION/, "wire format must be flagged for HAR validation");
+});
diff --git a/tests/unit/guardrails/visionBridgeHelpers.callVisionModel.test.ts b/tests/unit/guardrails/visionBridgeHelpers.callVisionModel.test.ts
index ed98e35449..1465e927cb 100644
--- a/tests/unit/guardrails/visionBridgeHelpers.callVisionModel.test.ts
+++ b/tests/unit/guardrails/visionBridgeHelpers.callVisionModel.test.ts
@@ -4,11 +4,32 @@
 
 import test from "node:test";
 import assert from "node:assert/strict";
+import dns from "node:dns";
 import { callVisionModel, type VisionModelConfig } from "@/lib/guardrails/visionBridgeHelpers";
 
 // Store original fetch
 const originalFetch = globalThis.fetch;
 
+// Stub DNS for fetchRemoteImage's GHSA-cmhj-wh2f-9cgx DNS-rebinding guard
+// (assertHostnameResolvesPublic in src/shared/network/remoteImageFetch.ts).
+// These tests mock globalThis.fetch with example.com hosts that don't actually
+// resolve in CI; the call path (callVisionModel -> fetchRemoteImageAsDataUri)
+// does not expose a way to inject a `lookup` stub through to fetchRemoteImage,
+// so we monkey-patch dns.promises.lookup with a pass-through public-IP
+// resolver. Node --test runs each test file in its own process, so this
+// rebinding does not leak across files.
+const originalDnsLookup = dns.promises.lookup;
+(dns.promises as { lookup: unknown }).lookup = (async (
+  _hostname: string,
+  options?: { all?: boolean }
+) => {
+  const record = { address: "203.0.113.1", family: 4 };
+  return options && options.all ? [record] : record;
+}) as typeof dns.promises.lookup;
+process.on("exit", () => {
+  (dns.promises as { lookup: unknown }).lookup = originalDnsLookup;
+});
+
 test("callVisionModel returns description on success", async () => {
   // Mock global fetch
   const mockResponse = {
diff --git a/tests/unit/headroom-responses-format.test.ts b/tests/unit/headroom-responses-format.test.ts
new file mode 100644
index 0000000000..36cfda8b5b
--- /dev/null
+++ b/tests/unit/headroom-responses-format.test.ts
@@ -0,0 +1,138 @@
+// #1998 (upstream) — adaptBodyForCompression must use the full translator pair
+// (openaiResponsesToOpenAIRequest → compress → openaiToOpenAIResponsesRequest) when
+// body.input is in Responses format, so that:
+//   (a) function_call_output items with non-string `output` (JSON objects) are properly
+//       serialised and included in the compression pass (upstream bug: simple helper skips
+//       them because hasTextContent() returns false for object content), and
+//   (b) body.input stays Responses-shaped after the full round-trip.
+import { describe, it, after } from "node:test";
+import assert from "node:assert/strict";
+import { adaptBodyForCompression } from "../../open-sse/services/compression/bodyAdapter.ts";
+
+describe("adaptBodyForCompression openai-responses format (#1998)", () => {
+  after(() => {
+    // No DB touched.
+  });
+
+  it("includes function_call_output with object output in the compression pass", () => {
+    // The simple responsesItemToMessage() helper only sets content = item.output.
+    // When output is a JSON object (not a string), hasTextContent() returns false
+    // and the item is excluded from messages entirely — not compressable.
+    // The fix: use openaiResponsesToOpenAIRequest which JSON.stringifies object output
+    // so the text is available for compression engines.
+    const body: Record<string, unknown> = {
+      model: "gpt-5",
+      input: [
+        {
+          type: "function_call",
+          call_id: "c1",
+          name: "bash",
+          arguments: JSON.stringify({ command: "ls -la" }),
+        },
+        {
+          type: "function_call_output",
+          call_id: "c1",
+          // Object output — NOT a string. Simple helper loses this.
+          output: { result: "file1.ts file2.ts ".repeat(50) },
+        },
+      ],
+    };
+
+    const adapter = adaptBodyForCompression(body);
+
+    // After the fix, the adapter must recognise the function_call_output as
+    // compressable and include it in the messages array.
+    assert.ok(adapter.adapted, "adapter must be adapted (not a pass-through)");
+
+    const messages = (adapter.body as Record<string, unknown>).messages as Array<Record<string, unknown>>;
+    assert.ok(Array.isArray(messages) && messages.length > 0, "messages must be non-empty");
+
+    // At least one tool/assistant message must be present for compression engines.
+    const hasToolMsg = messages.some((m) => m.role === "tool" || m.role === "assistant");
+    assert.ok(hasToolMsg, "messages must include a tool/assistant entry from the function_call pair");
+  });
+
+  it("keeps body.input Responses-shaped after compress/restore round-trip for type:message items", () => {
+    // Verify the canonical behaviour: a Responses body.input with type:message items
+    // is correctly round-tripped through the adapter and restore.
+    const body: Record<string, unknown> = {
+      model: "gpt-5",
+      input: [
+        {
+          type: "message",
+          role: "user",
+          content: [{ type: "input_text", text: "a long original message ".repeat(20) }],
+        },
+      ],
+    };
+
+    const adapter = adaptBodyForCompression(body);
+    assert.ok(adapter.adapted, "adapter must be adapted for Responses body.input");
+
+    // Simulate compression: keep messages unchanged (no-op compression).
+    const compressedBody = { ...(adapter.body as Record<string, unknown>) };
+    const restored = adapter.restore(compressedBody);
+
+    // body.input must be an array of Responses items (not raw OpenAI messages).
+    assert.ok(Array.isArray(restored.input), "restored.input must be an array");
+    assert.equal((restored.input as unknown[]).length, 1, "restored.input must have one item");
+
+    const item = (restored.input as Array<Record<string, unknown>>)[0];
+    assert.equal(item.type, "message", "restored item must keep type:message");
+    assert.equal(item.role, "user", "restored item must keep role:user");
+    assert.ok(
+      Array.isArray(item.content),
+      "restored item.content must stay as an array (Responses format), not a string"
+    );
+    // Content must still carry the Responses input_text structure.
+    const firstContentPart = (item.content as Array<Record<string, unknown>>)[0];
+    assert.equal(
+      firstContentPart.type,
+      "input_text",
+      "content part must preserve type:input_text"
+    );
+    assert.ok(
+      typeof firstContentPart.text === "string" && firstContentPart.text.length > 0,
+      "content part must preserve the text value"
+    );
+  });
+
+  it("round-trips function_call_output with string output (preserves call_id and output field)", () => {
+    // Ensure string output is correctly restored in output field (not content field).
+    const body: Record<string, unknown> = {
+      model: "gpt-5",
+      input: [
+        {
+          type: "function_call",
+          call_id: "c2",
+          name: "read_file",
+          arguments: JSON.stringify({ path: "/foo.ts" }),
+        },
+        {
+          type: "function_call_output",
+          call_id: "c2",
+          output: "large file contents ".repeat(30),
+        },
+      ],
+    };
+
+    const adapter = adaptBodyForCompression(body);
+    assert.ok(adapter.adapted, "adapter must be adapted");
+
+    // Simulate no-op compression.
+    const compressedBody = { ...(adapter.body as Record<string, unknown>) };
+    const restored = adapter.restore(compressedBody);
+
+    assert.ok(Array.isArray(restored.input), "restored.input must be an array");
+    const items = restored.input as Array<Record<string, unknown>>;
+    assert.equal(items.length, 2, "both function_call and function_call_output must be present");
+
+    const outputItem = items.find((i) => i.type === "function_call_output") as Record<string, unknown>;
+    assert.ok(outputItem, "function_call_output item must be in restored.input");
+    assert.equal(outputItem.call_id, "c2", "call_id must be preserved");
+    assert.ok(
+      typeof outputItem.output === "string" && outputItem.output.length > 0,
+      "output field must be present and non-empty"
+    );
+  });
+});
diff --git a/tests/unit/home-provider-topology-default-4596.test.ts b/tests/unit/home-provider-topology-default-4596.test.ts
new file mode 100644
index 0000000000..c859602791
--- /dev/null
+++ b/tests/unit/home-provider-topology-default-4596.test.ts
@@ -0,0 +1,27 @@
+// Regression guard for #4596: the home provider-topology card (ReactFlow connection
+// map) vanished for installs that never persisted `showProviderTopologyOnHome`.
+// HomePageClient initialized the flag to `false` and only flipped it on an explicit
+// boolean from /api/settings, so an absent (undefined) setting kept the card hidden
+// forever — while AppearanceTab still showed the toggle as ON (`!== false`).
+// The card defaults ON; only an explicit `false` hides it.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+import { shouldShowProviderTopologyOnHome } from "../../src/app/(dashboard)/dashboard/homeAppearance.ts";
+
+test("absent setting (undefined) shows the topology card — the #4596 regression", () => {
+  assert.equal(shouldShowProviderTopologyOnHome(undefined), true);
+});
+
+test("explicit false hides the topology card (respects opt-out)", () => {
+  assert.equal(shouldShowProviderTopologyOnHome(false), false);
+});
+
+test("explicit true shows the topology card", () => {
+  assert.equal(shouldShowProviderTopologyOnHome(true), true);
+});
+
+test("non-boolean truthy/absent values keep the default-on behavior", () => {
+  // null (e.g. JSON null) and missing keys must not hide the card — only `false` does.
+  assert.equal(shouldShowProviderTopologyOnHome(null), true);
+});
diff --git a/tests/unit/image-compat-node-alias-shadow.test.ts b/tests/unit/image-compat-node-alias-shadow.test.ts
new file mode 100644
index 0000000000..06d4d1db08
--- /dev/null
+++ b/tests/unit/image-compat-node-alias-shadow.test.ts
@@ -0,0 +1,80 @@
+/**
+ * Regression test — ported from decolua/9router commit 047fdc89:
+ *   "fix(image): prevent compatible nodes from shadowing provider aliases"
+ *
+ * A user-defined openai-compatible provider node with `prefix: "cf"` must NOT
+ * shadow the built-in `cloudflare-ai` provider (alias `cf`). Cloudflare image
+ * routes like `cf/@cf/black-forest-labs/...` must keep resolving to the
+ * built-in cloudflare-ai provider, regardless of any compatible-node prefix
+ * collision.
+ *
+ * Inverse case: a non-reserved compatible-node prefix (e.g. `oct`) must still
+ * resolve to the compatible node. The fix is a reserved-prefix guard — it must
+ * not break user-defined prefixes that don't collide with built-in aliases.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(
+  path.join(os.tmpdir(), "omniroute-image-compat-shadow-")
+);
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const providersDb = await import("../../src/lib/db/providers.ts");
+const { getModelInfo } = await import("../../src/sse/services/model.ts");
+
+test.before(async () => {
+  await providersDb.createProviderNode({
+    id: "openai-compatible-cf-collision",
+    type: "openai-compatible",
+    name: "Compatible CF Collision",
+    prefix: "cf",
+    baseUrl: "https://compatible.test/v1",
+    chatPath: "/v1/chat/completions",
+    modelsPath: "/v1/models",
+  });
+  await providersDb.createProviderNode({
+    id: "openai-compatible-oct-passthrough",
+    type: "openai-compatible",
+    name: "Compatible OCT",
+    prefix: "oct",
+    baseUrl: "https://compatible-oct.test/v1",
+    chatPath: "/v1/chat/completions",
+    modelsPath: "/v1/models",
+  });
+});
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+test("compatible node with prefix=cf must NOT shadow the built-in cloudflare-ai alias", async () => {
+  const info = (await getModelInfo("cf/@cf/black-forest-labs/flux-2-klein-9b")) as {
+    provider?: string;
+    model?: string;
+  };
+  assert.equal(
+    info.provider,
+    "cloudflare-ai",
+    "cf/ must keep routing to the built-in cloudflare-ai provider (not the compatible node)"
+  );
+  assert.equal(info.model, "@cf/black-forest-labs/flux-2-klein-9b");
+});
+
+test("non-reserved compatible-node prefix (oct) still routes to the compatible node", async () => {
+  const info = (await getModelInfo("oct/gpt-image-1")) as {
+    provider?: string;
+    model?: string;
+  };
+  assert.equal(
+    info.provider,
+    "openai-compatible-oct-passthrough",
+    "user-defined prefixes that don't collide with built-in aliases must still resolve to the compatible node"
+  );
+  assert.equal(info.model, "gpt-image-1");
+});
diff --git a/tests/unit/image-generation-handler.test.ts b/tests/unit/image-generation-handler.test.ts
index 83128984ae..0fcc9e5d13 100644
--- a/tests/unit/image-generation-handler.test.ts
+++ b/tests/unit/image-generation-handler.test.ts
@@ -1,11 +1,34 @@
 import test from "node:test";
 import assert from "node:assert/strict";
+import dns from "node:dns";
 import { mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
 process.env.DATA_DIR = mkdtempSync(join(tmpdir(), "omniroute-images-"));
 
+// Stub DNS for fetchRemoteImage's GHSA-cmhj-wh2f-9cgx DNS-rebinding guard
+// (assertHostnameResolvesPublic in src/shared/network/remoteImageFetch.ts).
+// Several image-handler tests (Fal AI URL->b64 normalization, BFL polling
+// with base64 input images, NanoBanana polling with URL->b64 conversion)
+// mock globalThis.fetch with example.com URLs that don't resolve in CI; the
+// handler invokes fetchRemoteImage without exposing a `lookup` injection
+// point, so we monkey-patch dns.promises.lookup to always return a public IP
+// so the rebinding guard passes and the test exercises the mocked fetch
+// behaviour as intended. Node --test runs each file in its own process, so
+// this rebinding does not leak across files.
+const originalDnsLookup = dns.promises.lookup;
+(dns.promises as { lookup: unknown }).lookup = (async (
+  _hostname: string,
+  options?: { all?: boolean }
+) => {
+  const record = { address: "203.0.113.1", family: 4 };
+  return options && options.all ? [record] : record;
+}) as typeof dns.promises.lookup;
+process.on("exit", () => {
+  (dns.promises as { lookup: unknown }).lookup = originalDnsLookup;
+});
+
 const { IMAGE_PROVIDERS, parseImageModel, getAllImageModels } =
   await import("../../open-sse/config/imageRegistry.ts");
 const { handleImageGeneration } = await import("../../open-sse/handlers/imageGeneration.ts");
diff --git a/tests/unit/kiro-region-ssrf-guard.test.ts b/tests/unit/kiro-region-ssrf-guard.test.ts
new file mode 100644
index 0000000000..57adc8015a
--- /dev/null
+++ b/tests/unit/kiro-region-ssrf-guard.test.ts
@@ -0,0 +1,96 @@
+// SSRF regression guard for kiro region — GHSA-6mwv-4mrm-5p3m.
+// Without the assertValidAwsRegion guard, a malicious region value
+// would be interpolated directly into upstream URLs like
+// `https://oidc.${region}.amazonaws.com/token`, allowing the caller to
+// redirect the proxy to arbitrary hosts (file://, 127.0.0.1, EC2 metadata, etc).
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import {
+  AWS_REGION_PATTERN,
+  assertValidAwsRegion,
+} from "../../src/lib/oauth/constants/oauth";
+import { KiroService } from "../../src/lib/oauth/services/kiro";
+
+describe("AWS_REGION_PATTERN", () => {
+  it("accepts canonical AWS regions", () => {
+    for (const r of [
+      "us-east-1",
+      "us-west-2",
+      "eu-west-1",
+      "ap-southeast-2",
+      "ca-central-1",
+      "sa-east-1",
+      "me-south-1",
+      "af-south-1",
+      "eu-central-2",
+    ]) {
+      assert.ok(AWS_REGION_PATTERN.test(r), `expected ${r} to match`);
+    }
+  });
+
+  it("rejects SSRF-shaped values", () => {
+    for (const bad of [
+      "127.0.0.1",
+      "169.254.169.254",
+      "localhost",
+      "evil.example.com",
+      "us-east-1.evil.com",
+      "us-east-1/../foo",
+      "us-east-1#frag",
+      "us-east-1?x=1",
+      "file:///etc/passwd",
+      "http://internal",
+      "",
+      "US-EAST-1", // wrong case
+      "us_east_1",
+      "us-east-",
+      "-east-1",
+      "us--east-1",
+    ]) {
+      assert.ok(!AWS_REGION_PATTERN.test(bad), `expected ${bad!} to be rejected`);
+    }
+  });
+});
+
+describe("assertValidAwsRegion", () => {
+  it("returns the region when valid", () => {
+    assert.equal(assertValidAwsRegion("us-east-1"), "us-east-1");
+  });
+
+  it("throws on non-string", () => {
+    assert.throws(() => assertValidAwsRegion(undefined as unknown as string));
+    assert.throws(() => assertValidAwsRegion(null as unknown as string));
+    assert.throws(() => assertValidAwsRegion(123 as unknown as string));
+  });
+
+  it("throws on invalid region", () => {
+    assert.throws(() => assertValidAwsRegion("127.0.0.1"));
+    assert.throws(() => assertValidAwsRegion("evil.com"));
+    assert.throws(() => assertValidAwsRegion(""));
+  });
+});
+
+describe("KiroService SSRF guard", () => {
+  const svc = new KiroService();
+
+  it("registerClient rejects malicious region", async () => {
+    await assert.rejects(() => svc.registerClient("127.0.0.1"));
+    await assert.rejects(() => svc.registerClient("evil.example.com"));
+  });
+
+  it("startDeviceAuthorization rejects malicious region", async () => {
+    await assert.rejects(() =>
+      svc.startDeviceAuthorization("cid", "csec", "https://x", "169.254.169.254")
+    );
+  });
+
+  it("pollDeviceToken rejects malicious region", async () => {
+    await assert.rejects(() =>
+      svc.pollDeviceToken("cid", "csec", "dc", "127.0.0.1")
+    );
+  });
+
+  it("validateImportToken rejects malicious region before fetching", async () => {
+    await assert.rejects(() => svc.validateImportToken("aorAAAAAGfoo", "127.0.0.1"));
+  });
+});
diff --git a/tests/unit/kiro-toolresult-compression.test.ts b/tests/unit/kiro-toolresult-compression.test.ts
new file mode 100644
index 0000000000..4db2bc5dbb
--- /dev/null
+++ b/tests/unit/kiro-toolresult-compression.test.ts
@@ -0,0 +1,238 @@
+/**
+ * Kiro (AWS CodeWhisperer) tool-result compression — ported from upstream
+ * decolua/9router#1194 (zanuartri).
+ *
+ * The upstream PR added Kiro-format support directly inside RTK. OmniRoute
+ * lifts that capability to `bodyAdapter`, so the Kiro envelope
+ * (`conversationState.history[].userInputMessage.userInputMessageContext.toolResults`)
+ * flattens to OpenAI-shape `role:"tool"` messages — every compression engine
+ * (RTK, lite, aggressive, etc.) automatically benefits, not just RTK.
+ *
+ * Error tool results (status === "error") are skipped to preserve diagnostics
+ * (matches upstream behavior).
+ */
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+
+import { applyRtkCompression } from "../../open-sse/services/compression/engines/rtk/index.ts";
+import { adaptBodyForCompression } from "../../open-sse/services/compression/bodyAdapter.ts";
+
+function buildKiroBodyWithBuildOutput(): Record<string, unknown> {
+  const noisyNpmOutput = [
+    "npm warn deprecated har-validator@5.1.5: this library is no longer supported",
+    "npm warn deprecated uuid@3.4.0: uuid@10 and below is no longer supported",
+    "npm warn deprecated request@2.88.2: request has been deprecated",
+    "npm warn deprecated inflight@1.0.6: This module is not supported",
+    "npm warn deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported",
+    "npm warn deprecated rimraf@2.7.1: Rimraf versions prior to v4 are no longer supported",
+    "",
+    "added 47 packages, and audited 48 packages in 13s",
+    "",
+    "3 packages are looking for funding",
+    "  run `npm fund` for details",
+    "",
+    "4 vulnerabilities (2 moderate, 2 critical)",
+    "",
+    "Some issues need review, and may require choosing",
+    "a different dependency.",
+    "",
+    "Run `npm audit` for details.",
+  ].join("\n");
+
+  return {
+    conversationState: {
+      chatTriggerType: "MANUAL",
+      conversationId: "test-port-1194",
+      currentMessage: {
+        userInputMessage: {
+          content: "Install express",
+          modelId: "claude-sonnet-4.5",
+          userInputMessageContext: {
+            toolResults: [
+              {
+                toolUseId: "tool_1",
+                status: "success",
+                content: [{ text: noisyNpmOutput }],
+              },
+            ],
+          },
+        },
+      },
+      history: [],
+    },
+  };
+}
+
+describe("Kiro tool-result compression (port of decolua/9router#1194)", () => {
+  it("adapts a Kiro conversationState body to messages with the tool-result text exposed", () => {
+    const body = buildKiroBodyWithBuildOutput();
+    const adapter = adaptBodyForCompression(body);
+    const messages = (adapter.body.messages ?? []) as Array<{
+      role?: string;
+      content?: unknown;
+    }>;
+    assert.ok(adapter.adapted, "Kiro body must be flagged as adapted");
+    assert.ok(
+      messages.some((m) => m.role === "tool" && typeof m.content === "string"),
+      "adapter must surface tool-result text as a role:tool message"
+    );
+  });
+
+  it("compresses tool-result text inside Kiro currentMessage and writes the rewritten text back", () => {
+    const body = buildKiroBodyWithBuildOutput();
+    const before = (
+      (body.conversationState as Record<string, unknown>).currentMessage as Record<string, unknown>
+    ).userInputMessage as {
+      userInputMessageContext: { toolResults: Array<{ content: Array<{ text: string }> }> };
+    };
+    const originalLen = before.userInputMessageContext.toolResults[0].content[0].text.length;
+
+    const result = applyRtkCompression(body);
+
+    assert.equal(result.compressed, true, "RTK must compress noisy build output");
+    assert.ok(result.stats, "stats must be returned");
+    assert.ok(
+      result.stats!.compressedTokens < result.stats!.originalTokens,
+      "compressedTokens must drop"
+    );
+
+    const restored = (
+      (result.body as Record<string, unknown>).conversationState as Record<string, unknown>
+    ).currentMessage as {
+      userInputMessage: {
+        userInputMessageContext: { toolResults: Array<{ content: Array<{ text: string }> }> };
+      };
+    };
+    const afterLen = restored.userInputMessage.userInputMessageContext.toolResults[0].content[0]
+      .text.length;
+    assert.ok(
+      afterLen < originalLen,
+      `Kiro tool-result text must shrink (before=${originalLen}, after=${afterLen})`
+    );
+  });
+
+  it("compresses tool-result text inside Kiro history[] entries", () => {
+    // Reuse the noisy npm-install fixture (already proven to trigger a build-output
+    // filter in the currentMessage test) so this test exercises the history[] path
+    // without depending on a separate filter (cargo, etc.) being registered.
+    const compilingLines: string[] = [
+      "npm warn deprecated har-validator@5.1.5: this library is no longer supported",
+      "npm warn deprecated uuid@3.4.0: uuid@10 and below is no longer supported",
+      "npm warn deprecated request@2.88.2: request has been deprecated",
+      "npm warn deprecated inflight@1.0.6: This module is not supported",
+      "npm warn deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported",
+      "npm warn deprecated rimraf@2.7.1: Rimraf versions prior to v4 are no longer supported",
+      "",
+      "added 47 packages, and audited 48 packages in 13s",
+      "",
+      "3 packages are looking for funding",
+      "  run `npm fund` for details",
+      "",
+      "4 vulnerabilities (2 moderate, 2 critical)",
+      "",
+      "Run `npm audit` for details.",
+    ];
+
+    const body: Record<string, unknown> = {
+      conversationState: {
+        chatTriggerType: "MANUAL",
+        conversationId: "test-history",
+        currentMessage: {
+          userInputMessage: {
+            content: "What happened?",
+            modelId: "claude-sonnet-4.5",
+          },
+        },
+        history: [
+          {
+            userInputMessage: {
+              content: "Run npm install",
+              modelId: "claude-sonnet-4.5",
+              userInputMessageContext: {
+                toolResults: [
+                  {
+                    toolUseId: "tool_2",
+                    status: "success",
+                    content: [{ text: compilingLines.join("\n") }],
+                  },
+                ],
+              },
+            },
+          },
+        ],
+      },
+    };
+
+    const originalLen = compilingLines.join("\n").length;
+    const result = applyRtkCompression(body);
+
+    assert.equal(result.compressed, true, "history tool result must compress");
+    const state = (result.body as Record<string, unknown>).conversationState as {
+      history: Array<{
+        userInputMessage: {
+          userInputMessageContext: { toolResults: Array<{ content: Array<{ text: string }> }> };
+        };
+      }>;
+    };
+    const afterLen = state.history[0].userInputMessage.userInputMessageContext.toolResults[0]
+      .content[0].text.length;
+    assert.ok(
+      afterLen < originalLen,
+      `history tool-result text must shrink (before=${originalLen}, after=${afterLen})`
+    );
+  });
+
+  it("preserves error tool results (status === 'error') without rewriting their text", () => {
+    const errorText =
+      "npm error code E404\nnpm error 404 Not Found - GET https://registry.npmjs.org/invalid-package";
+    const body: Record<string, unknown> = {
+      conversationState: {
+        chatTriggerType: "MANUAL",
+        conversationId: "test-error",
+        currentMessage: {
+          userInputMessage: {
+            content: "Install invalid-package",
+            modelId: "claude-sonnet-4.5",
+            userInputMessageContext: {
+              toolResults: [
+                {
+                  toolUseId: "tool_err",
+                  status: "error",
+                  content: [{ text: errorText }],
+                },
+              ],
+            },
+          },
+        },
+        history: [],
+      },
+    };
+
+    const result = applyRtkCompression(body);
+    const after = (
+      (result.body as Record<string, unknown>).conversationState as {
+        currentMessage: {
+          userInputMessage: {
+            userInputMessageContext: { toolResults: Array<{ content: Array<{ text: string }> }> };
+          };
+        };
+      }
+    ).currentMessage.userInputMessage.userInputMessageContext.toolResults[0].content[0].text;
+    assert.equal(after, errorText, "error tool-result text must be preserved byte-for-byte");
+  });
+
+  it("handles a malformed Kiro body without crashing", () => {
+    const malformed: Array<Record<string, unknown>> = [
+      { conversationState: null },
+      { conversationState: {} },
+      { conversationState: { history: null, currentMessage: null } },
+      { conversationState: { history: "not-an-array" } },
+    ];
+    for (const body of malformed) {
+      const result = applyRtkCompression(body);
+      assert.ok(result, "must not throw on malformed Kiro body");
+      // No tool-result text → engine reports no compression
+      assert.equal(result.compressed, false);
+    }
+  });
+});
diff --git a/tests/unit/llm-selector-custom-vision-models.test.ts b/tests/unit/llm-selector-custom-vision-models.test.ts
new file mode 100644
index 0000000000..3d79da12fd
--- /dev/null
+++ b/tests/unit/llm-selector-custom-vision-models.test.ts
@@ -0,0 +1,74 @@
+/**
+ * Custom vision models in the LLM selector / `/v1/models` catalog
+ * (port of upstream decolua/9router 5e5e78d3 — "fix: show custom vision
+ * models in LLM selector and model list").
+ *
+ * Upstream stored an `imageToText` kind on user-added custom models and the
+ * selector hid them from the default LLM list. OmniRoute already keeps custom
+ * chat models in the LLM list, but the equivalent gap is the `supportsVision`
+ * flag on a custom model: the catalog used to only set `capabilities.vision`
+ * when the model id matched the conservative `isVisionModelId` heuristic
+ * (`pixtral`, `llava`, `qwen-vl`, …). A user who registered a custom chat
+ * model called e.g. `my-vision-llm` and explicitly checked "vision-capable"
+ * still saw no `capabilities.vision` in `/v1/models`, so the LLM selector and
+ * downstream routing treated it as text-only.
+ *
+ * This file pins the OmniRoute-flavoured behaviour:
+ *   • a custom chat model with `supportsVision: true` MUST surface
+ *     `capabilities: { vision: true }` via the catalog helper, regardless of
+ *     whether the model id matches the static vision heuristic.
+ *   • the existing id-based heuristic (`isVisionModelId`) still works.
+ *   • when neither signal is present, no vision fields are emitted (no false
+ *     positives — same conservative guard #4071 / #4072).
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const catalog = await import("../../src/app/api/v1/models/catalog.ts");
+
+type VisionFields = { capabilities: { vision: true } } | null;
+type Helper = (entry: unknown, ...candidateIds: Array<string | null | undefined>) => VisionFields;
+
+const getCustomVisionCapabilityFields = (
+  catalog as unknown as { getCustomVisionCapabilityFields?: Helper }
+).getCustomVisionCapabilityFields;
+
+test("custom vision helper is exported from the catalog module", () => {
+  assert.equal(
+    typeof getCustomVisionCapabilityFields,
+    "function",
+    "expected getCustomVisionCapabilityFields to be exported from src/app/api/v1/models/catalog.ts"
+  );
+});
+
+test("supportsVision flag on a custom model surfaces capabilities.vision (LLM selector unblock)", () => {
+  const helper = getCustomVisionCapabilityFields as Helper;
+  const entry = { id: "my-vision-llm", supportsVision: true };
+  const fields = helper(entry, "openai-compat/my-vision-llm", "my-vision-llm");
+  assert.ok(fields, "supportsVision=true must yield vision fields");
+  assert.equal(fields?.capabilities.vision, true);
+});
+
+test("id-based isVisionModelId heuristic still works when supportsVision is unset", () => {
+  const helper = getCustomVisionCapabilityFields as Helper;
+  const entry = { id: "pixtral-12b" };
+  const fields = helper(entry, "openai-compat/pixtral-12b", "pixtral-12b");
+  assert.ok(fields, "well-known vision model id must yield vision fields");
+  assert.equal(fields?.capabilities.vision, true);
+});
+
+test("no signal → no vision fields (avoids #4071-style false positives)", () => {
+  const helper = getCustomVisionCapabilityFields as Helper;
+  const entry = { id: "plain-text-llm" };
+  const fields = helper(entry, "openai-compat/plain-text-llm", "plain-text-llm");
+  assert.equal(fields, null);
+});
+
+test("explicit supportsVision=false is respected (text-only override)", () => {
+  const helper = getCustomVisionCapabilityFields as Helper;
+  // Even if the id matches the heuristic, an explicit false flag wins so the
+  // user can downgrade a mis-classified model.
+  const entry = { id: "pixtral-12b", supportsVision: false };
+  const fields = helper(entry, "alias/pixtral-12b", "pixtral-12b");
+  assert.equal(fields, null);
+});
diff --git a/tests/unit/migration-107-quota-share-strategy.test.ts b/tests/unit/migration-107-quota-share-strategy.test.ts
new file mode 100644
index 0000000000..5399ba7d55
--- /dev/null
+++ b/tests/unit/migration-107-quota-share-strategy.test.ts
@@ -0,0 +1,140 @@
+/**
+ * tests/unit/migration-107-quota-share-strategy.test.ts
+ *
+ * Migration 107 flips the routing strategy of the existing auto-minted qtSd/ combos
+ * from the legacy "fill-first" to the dedicated "quota-share" engine (Fase 3 #9),
+ * WITHOUT touching combos already on quota-share or any user-authored combo.
+ *
+ * The migration is applied in isolation against an in-memory DB seeded with a mix
+ * of combos, so the assertions pin the exact WHERE scope (name LIKE 'qtSd/%' AND
+ * strategy = 'fill-first') and prove the other JSON fields are preserved.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import Database from "better-sqlite3";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const MIGRATION_107 = fs.readFileSync(
+  path.join(__dirname, "../../src/lib/db/migrations/107_quota_combos_quota_share_strategy.sql"),
+  "utf-8"
+);
+
+interface TestDb {
+  exec: (sql: string) => unknown;
+  prepare: (sql: string) => {
+    run: (...p: unknown[]) => unknown;
+    get: (...p: unknown[]) => Record<string, unknown> | undefined;
+  };
+  close: () => void;
+}
+
+function makeDb(): TestDb {
+  const db = new Database(":memory:") as unknown as TestDb;
+  db.exec(
+    `CREATE TABLE combos (
+       id TEXT PRIMARY KEY,
+       name TEXT NOT NULL UNIQUE,
+       data TEXT NOT NULL,
+       created_at TEXT NOT NULL,
+       updated_at TEXT NOT NULL
+     );`
+  );
+  return db;
+}
+
+function insertCombo(db: TestDb, id: string, name: string, strategy: string): void {
+  const data = JSON.stringify({
+    name,
+    strategy,
+    models: [{ kind: "model", model: "p/m", weight: 100 }],
+    isHidden: name.startsWith("qtSd/"),
+  });
+  db.prepare(
+    "INSERT INTO combos (id, name, data, created_at, updated_at) VALUES (?, ?, ?, '2026-01-01T00:00:00Z', '2026-01-01T00:00:00Z')"
+  ).run(id, name, data);
+}
+
+function strategyOf(db: TestDb, name: string): string | null {
+  const row = db
+    .prepare("SELECT json_extract(data, '$.strategy') AS s FROM combos WHERE name = ?")
+    .get(name);
+  return (row?.s as string | undefined) ?? null;
+}
+
+function dataOf(db: TestDb, name: string): Record<string, unknown> {
+  const row = db.prepare("SELECT data FROM combos WHERE name = ?").get(name);
+  return JSON.parse(row!.data as string) as Record<string, unknown>;
+}
+
+test("107 flips stale qtSd/ fill-first combos to quota-share", () => {
+  const db = makeDb();
+  insertCombo(db, "c1", "qtSd/grp/deepseek/deepseek-v4-flash", "fill-first");
+  insertCombo(db, "c2", "qtSd/grp/claude/claude-opus-4-8", "fill-first");
+
+  db.exec(MIGRATION_107);
+
+  assert.equal(strategyOf(db, "qtSd/grp/deepseek/deepseek-v4-flash"), "quota-share");
+  assert.equal(strategyOf(db, "qtSd/grp/claude/claude-opus-4-8"), "quota-share");
+  db.close();
+});
+
+test("107 preserves the other JSON fields (only strategy changes)", () => {
+  const db = makeDb();
+  insertCombo(db, "c1", "qtSd/grp/glm/glm-5", "fill-first");
+
+  db.exec(MIGRATION_107);
+
+  const data = dataOf(db, "qtSd/grp/glm/glm-5");
+  assert.equal(data.strategy, "quota-share");
+  assert.equal(data.isHidden, true, "isHidden must be preserved");
+  assert.deepEqual(
+    data.models,
+    [{ kind: "model", model: "p/m", weight: 100 }],
+    "models array must be preserved"
+  );
+  db.close();
+});
+
+test("107 leaves qtSd/ combos already on quota-share untouched", () => {
+  const db = makeDb();
+  insertCombo(db, "c1", "qtSd/grp/glm/glm-4.6", "quota-share");
+
+  db.exec(MIGRATION_107);
+
+  assert.equal(strategyOf(db, "qtSd/grp/glm/glm-4.6"), "quota-share");
+  db.close();
+});
+
+test("107 never touches user-authored (non-qtSd/) combos", () => {
+  const db = makeDb();
+  insertCombo(db, "c1", "my-coding-combo", "fill-first");
+  insertCombo(db, "c2", "team/fast", "fill-first");
+
+  db.exec(MIGRATION_107);
+
+  assert.equal(
+    strategyOf(db, "my-coding-combo"),
+    "fill-first",
+    "a user's fill-first combo must be preserved"
+  );
+  assert.equal(strategyOf(db, "team/fast"), "fill-first");
+  db.close();
+});
+
+test("107 is idempotent (second run is a no-op)", () => {
+  const db = makeDb();
+  insertCombo(db, "c1", "qtSd/grp/minimax/MiniMax-M2.7", "fill-first");
+
+  db.exec(MIGRATION_107);
+  const afterFirst = dataOf(db, "qtSd/grp/minimax/MiniMax-M2.7");
+  db.exec(MIGRATION_107);
+  const afterSecond = dataOf(db, "qtSd/grp/minimax/MiniMax-M2.7");
+
+  assert.equal(strategyOf(db, "qtSd/grp/minimax/MiniMax-M2.7"), "quota-share");
+  assert.deepEqual(afterFirst, afterSecond, "second run must not change the row");
+  db.close();
+});
diff --git a/tests/unit/nanobanana-image-handler.test.ts b/tests/unit/nanobanana-image-handler.test.ts
index 0462622442..0e956e6d56 100644
--- a/tests/unit/nanobanana-image-handler.test.ts
+++ b/tests/unit/nanobanana-image-handler.test.ts
@@ -1,8 +1,28 @@
 import test from "node:test";
 import assert from "node:assert/strict";
+import dns from "node:dns";
 
 import { handleImageGeneration } from "../../open-sse/handlers/imageGeneration.ts";
 
+// Stub DNS for fetchRemoteImage's GHSA-cmhj-wh2f-9cgx DNS-rebinding guard
+// (assertHostnameResolvesPublic in src/shared/network/remoteImageFetch.ts).
+// The b64_json test mocks globalThis.fetch with an example.com URL that
+// doesn't resolve in CI; the handler invokes fetchRemoteImage without
+// exposing a `lookup` injection point, so we monkey-patch dns.promises.lookup
+// to always return a public IP so the rebinding guard passes and the test
+// exercises the mocked fetch behaviour as intended.
+const originalDnsLookup = dns.promises.lookup;
+(dns.promises as { lookup: unknown }).lookup = (async (
+  _hostname: string,
+  options?: { all?: boolean }
+) => {
+  const record = { address: "203.0.113.1", family: 4 };
+  return options && options.all ? [record] : record;
+}) as typeof dns.promises.lookup;
+process.on("exit", () => {
+  (dns.promises as { lookup: unknown }).lookup = originalDnsLookup;
+});
+
 test("handleImageGeneration(nanobanana): async submit+poll returns URL payload", async () => {
   const originalFetch = globalThis.fetch;
   let pollCount = 0;
diff --git a/tests/unit/next-config.test.ts b/tests/unit/next-config.test.ts
index 475735d936..4a523e50b2 100644
--- a/tests/unit/next-config.test.ts
+++ b/tests/unit/next-config.test.ts
@@ -232,3 +232,22 @@ test("next-intl webpack hook preserves caller config and filters known extractor
     false
   );
 });
+
+test("optimizePackageImports excludes the internal @omniroute/open-sse workspace (build-OOM guard)", async () => {
+  // Regression guard: adding the internal `@omniroute/open-sse` workspace to
+  // optimizePackageImports makes Next.js resolve its entire barrel at build
+  // time, driving the webpack production pass into a heap runaway that OOM'd
+  // even at 28 GB. optimizePackageImports is for EXTERNAL barrel libs only.
+  const { default: nextConfig } = await loadNextConfig("optimize-pkg-imports");
+  const list = nextConfig.experimental?.optimizePackageImports ?? [];
+
+  assert.ok(Array.isArray(list), "optimizePackageImports should be an array");
+  assert.ok(
+    !list.includes("@omniroute/open-sse"),
+    "do NOT add the internal @omniroute/open-sse workspace to optimizePackageImports — it OOMs the production build"
+  );
+  // The intended external barrel libs must remain optimized.
+  for (const lib of ["lucide-react", "date-fns", "next-intl"]) {
+    assert.ok(list.includes(lib), `expected external barrel lib ${lib} to stay optimized`);
+  }
+});
diff --git a/tests/unit/oauth-providers-config.test.ts b/tests/unit/oauth-providers-config.test.ts
index 04f4ff2520..a00b26179f 100644
--- a/tests/unit/oauth-providers-config.test.ts
+++ b/tests/unit/oauth-providers-config.test.ts
@@ -28,6 +28,7 @@ const {
   CLAUDE_CONFIG,
   CLINE_CONFIG,
   CODEX_CONFIG,
+  CODEBUDDY_CN_CONFIG,
   CURSOR_CONFIG,
   GEMINI_CONFIG,
   GITHUB_CONFIG,
@@ -66,6 +67,7 @@ const EXPECTED_PROVIDER_KEYS = [
   "cline",
   "windsurf",
   "devin-cli",
+  "codebuddy-cn",
 ];
 
 const EXPECTED_CONFIG_BY_PROVIDER = {
@@ -87,6 +89,7 @@ const EXPECTED_CONFIG_BY_PROVIDER = {
   windsurf: WINDSURF_CONFIG,
   "devin-cli": WINDSURF_CONFIG,
   trae: TRAE_CONFIG,
+  "codebuddy-cn": CODEBUDDY_CN_CONFIG,
 };
 
 const REQUIRED_FIELDS_BY_PROVIDER = {
@@ -399,29 +402,21 @@ test("custom Google OAuth callbacks preserve the requested callback path and que
 });
 
 test("custom Google OAuth credentials switch IPv6 loopback callbacks to public base URL", () => {
-  const redirectUri = resolveBrowserOAuthRedirectUri(
-    "gemini-cli",
-    "http://[::1]:20128/callback",
-    {
-      OMNIROUTE_PUBLIC_BASE_URL: "https://omniroute.example.com",
-      GEMINI_OAUTH_CLIENT_ID: "custom-gemini.apps.googleusercontent.com",
-      GEMINI_OAUTH_CLIENT_SECRET: "custom-gemini-secret",
-    }
-  );
+  const redirectUri = resolveBrowserOAuthRedirectUri("gemini-cli", "http://[::1]:20128/callback", {
+    OMNIROUTE_PUBLIC_BASE_URL: "https://omniroute.example.com",
+    GEMINI_OAUTH_CLIENT_ID: "custom-gemini.apps.googleusercontent.com",
+    GEMINI_OAUTH_CLIENT_SECRET: "custom-gemini-secret",
+  });
 
   assert.equal(redirectUri, "https://omniroute.example.com/callback");
 });
 
 test("custom Google OAuth callbacks default root loopback paths to callback path", () => {
-  const redirectUri = resolveBrowserOAuthRedirectUri(
-    "antigravity",
-    "http://127.0.0.1:20128",
-    {
-      NEXT_PUBLIC_BASE_URL: "https://omniroute.example.com",
-      ANTIGRAVITY_OAUTH_CLIENT_ID: "custom-antigravity.apps.googleusercontent.com",
-      ANTIGRAVITY_OAUTH_CLIENT_SECRET: "custom-antigravity-secret",
-    }
-  );
+  const redirectUri = resolveBrowserOAuthRedirectUri("antigravity", "http://127.0.0.1:20128", {
+    NEXT_PUBLIC_BASE_URL: "https://omniroute.example.com",
+    ANTIGRAVITY_OAUTH_CLIENT_ID: "custom-antigravity.apps.googleusercontent.com",
+    ANTIGRAVITY_OAUTH_CLIENT_SECRET: "custom-antigravity-secret",
+  });
 
   assert.equal(redirectUri, "https://omniroute.example.com/callback");
 });
diff --git a/tests/unit/openai-developer-role-normalize.test.ts b/tests/unit/openai-developer-role-normalize.test.ts
new file mode 100644
index 0000000000..8d6d5190ee
--- /dev/null
+++ b/tests/unit/openai-developer-role-normalize.test.ts
@@ -0,0 +1,38 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+import { filterToOpenAIFormat } from "../../open-sse/translator/helpers/openaiHelper.ts";
+
+// Ported from upstream decolua/9router#1011 — many OpenAI-compatible providers
+// reject the `developer` role (introduced by OpenAI Responses API). Normalize to
+// `system` so passthrough requests keep working downstream.
+test("filterToOpenAIFormat normalizes developer role to system", () => {
+  const body = {
+    messages: [
+      { role: "developer", content: "You are helpful" },
+      { role: "user", content: "Hi" },
+    ],
+  };
+
+  const out = filterToOpenAIFormat(body);
+
+  assert.equal(out.messages[0].role, "system");
+  assert.equal(out.messages[0].content, "You are helpful");
+  assert.equal(out.messages[1].role, "user");
+});
+
+test("filterToOpenAIFormat normalizes developer role with array content", () => {
+  const body = {
+    messages: [
+      {
+        role: "developer",
+        content: [{ type: "text", text: "Be concise" }],
+      },
+    ],
+  };
+
+  const out = filterToOpenAIFormat(body);
+
+  assert.equal(out.messages[0].role, "system");
+  assert.deepEqual(out.messages[0].content, [{ type: "text", text: "Be concise" }]);
+});
diff --git a/tests/unit/opencode-deepseek-reasoning-injected.test.ts b/tests/unit/opencode-deepseek-reasoning-injected.test.ts
new file mode 100644
index 0000000000..9e98a6c601
--- /dev/null
+++ b/tests/unit/opencode-deepseek-reasoning-injected.test.ts
@@ -0,0 +1,94 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+
+const { OpencodeExecutor } = await import("../../open-sse/executors/opencode.ts");
+
+/**
+ * Regression test for upstream decolua/9router#1099 (issue #1543):
+ *
+ * OpenCode is a meta-provider that proxies multi-turn chats to thinking-mode
+ * upstreams (DeepSeek V4 Flash, Kimi, MiniMax, ...). Those upstreams require
+ * `reasoning_content` to be echoed back on every assistant message in the
+ * conversation history; otherwise they return:
+ *
+ *     400 Bad Request — reasoning_content must be passed back
+ *
+ * Standard OpenAI clients do not preserve `reasoning_content` across turns, so
+ * OpencodeExecutor.transformRequest must inject a non-empty placeholder on any
+ * assistant message that lacks it when routing to a thinking-mode model.
+ */
+describe("OpencodeExecutor — DeepSeek reasoning_content injection (#1099)", () => {
+  const executor = new OpencodeExecutor("opencode-zen");
+
+  function buildBody(extraAssistant: Record<string, unknown>) {
+    return {
+      model: "oc/deepseek-v4-flash-free",
+      stream: true,
+      messages: [
+        { role: "user", content: "hi" },
+        { role: "assistant", content: "previous answer", ...extraAssistant },
+        { role: "user", content: "follow up" },
+      ],
+    };
+  }
+
+  it("injects reasoning_content on an assistant message that lacks it (deepseek model)", () => {
+    const out = executor.transformRequest(
+      "oc/deepseek-v4-flash-free",
+      buildBody({}),
+      true,
+      { apiKey: "test" } as never
+    );
+    const assistant = out.messages.find((m: { role: string }) => m.role === "assistant");
+    assert.equal(typeof assistant.reasoning_content, "string");
+    assert.ok(
+      assistant.reasoning_content.length > 0,
+      "expected non-empty reasoning_content placeholder injected"
+    );
+  });
+
+  it("preserves an existing non-empty reasoning_content instead of overwriting", () => {
+    const original = "prior chain of thought";
+    const out = executor.transformRequest(
+      "oc/deepseek-v4-flash-free",
+      buildBody({ reasoning_content: original }),
+      true,
+      { apiKey: "test" } as never
+    );
+    const assistant = out.messages.find((m: { role: string }) => m.role === "assistant");
+    assert.equal(assistant.reasoning_content, original);
+  });
+
+  it("injects for kimi-family models routed through opencode", () => {
+    const body = {
+      model: "oc/kimi-k2-thinking",
+      stream: false,
+      messages: [
+        { role: "user", content: "hi" },
+        { role: "assistant", content: "answer" },
+      ],
+    };
+    const out = executor.transformRequest("oc/kimi-k2-thinking", body, false, {
+      apiKey: "test",
+    } as never);
+    const assistant = out.messages.find((m: { role: string }) => m.role === "assistant");
+    assert.equal(typeof assistant.reasoning_content, "string");
+    assert.ok(assistant.reasoning_content.length > 0);
+  });
+
+  it("does not inject for non-thinking opencode models (no false positives)", () => {
+    const body = {
+      model: "oc/gpt-5",
+      stream: false,
+      messages: [
+        { role: "user", content: "hi" },
+        { role: "assistant", content: "answer" },
+      ],
+    };
+    const out = executor.transformRequest("oc/gpt-5", body, false, {
+      apiKey: "test",
+    } as never);
+    const assistant = out.messages.find((m: { role: string }) => m.role === "assistant");
+    assert.equal(assistant.reasoning_content, undefined);
+  });
+});
diff --git a/tests/unit/opencode-go-catalog-alignment.test.ts b/tests/unit/opencode-go-catalog-alignment.test.ts
new file mode 100644
index 0000000000..dd9741a1dd
--- /dev/null
+++ b/tests/unit/opencode-go-catalog-alignment.test.ts
@@ -0,0 +1,45 @@
+/**
+ * OpenCode Go model catalog alignment with the official Go docs.
+ *
+ * Port of decolua/9router 8efacc114 (thanks @nguyenha935): the official Go API
+ * advertises `glm-5.2` and routes Kimi chat traffic through `kimi-k2.7-code`
+ * (the live API rejects the plain `kimi-k2.7` alias for `/chat/completions`
+ * even though the public docs example uses it). OmniRoute previously shipped
+ * the older registry without these IDs.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { opencode_goProvider } = await import(
+  "../../open-sse/config/providers/registry/opencode/go/index.ts"
+);
+
+function modelIds(): string[] {
+  return (opencode_goProvider.models ?? []).map((m) => m.id);
+}
+
+test("opencode-go advertises glm-5.2 (official Go endpoint addition)", () => {
+  assert.ok(
+    modelIds().includes("glm-5.2"),
+    `expected glm-5.2 in opencode-go catalog, got: ${modelIds().join(", ")}`
+  );
+});
+
+test("opencode-go advertises kimi-k2.7-code (live API rejects plain kimi-k2.7 for chat)", () => {
+  assert.ok(
+    modelIds().includes("kimi-k2.7-code"),
+    `expected kimi-k2.7-code in opencode-go catalog, got: ${modelIds().join(", ")}`
+  );
+});
+
+test("opencode-go preserves the pre-existing minimax-m3 and qwen routing via targetFormat=claude", () => {
+  // Routing through the /messages endpoint is OmniRoute's declarative
+  // equivalent of upstream's MESSAGES_FORMAT_MODELS set; the alignment
+  // change must not regress this.
+  const byId = new Map(
+    (opencode_goProvider.models ?? []).map((m) => [m.id, m as Record<string, unknown>])
+  );
+  assert.equal(byId.get("minimax-m3")?.targetFormat, "claude");
+  assert.equal(byId.get("qwen3.7-max")?.targetFormat, "claude");
+});
diff --git a/tests/unit/opencode-proxy-rotation-4954.test.ts b/tests/unit/opencode-proxy-rotation-4954.test.ts
new file mode 100644
index 0000000000..25a1c49119
--- /dev/null
+++ b/tests/unit/opencode-proxy-rotation-4954.test.ts
@@ -0,0 +1,168 @@
+import { describe, it, beforeEach, afterEach, before, after } from "node:test";
+import assert from "node:assert";
+import net from "node:net";
+import { OpencodeExecutor } from "../../open-sse/executors/opencode.ts";
+import { resolveProxyForRequest } from "../../open-sse/utils/proxyFetch.ts";
+
+/**
+ * #4954 — "OpenCode Free" exposes per-account proxy + multi-account rotation in
+ * the UI (NoAuthAccountCard persists providerSpecificData.fingerprints +
+ * providerSpecificData.accountProxies), but the executor ignored them entirely:
+ * every request egressed direct and never rotated. These tests pin the wiring:
+ *
+ *   1. A request for an account that has a configured proxy must egress THROUGH
+ *      that proxy (resolveProxyForRequest reports source "context", not "direct").
+ *   2. On a 429 the executor must rotate to the NEXT account (and its proxy).
+ *
+ * The dispatch layer is mocked by stubbing globalThis.fetch — exactly what the
+ * proxy context wraps — and we observe the proxy that resolveProxyForRequest sees
+ * for the in-flight request, mirroring the mimocode proxy integration test. Two
+ * throwaway local TCP listeners stand in for the proxies so runWithProxyContext's
+ * fast-fail reachability probe passes without a live SOCKS/HTTP proxy.
+ */
+
+const log = { debug() {}, info() {}, warn() {}, error() {} };
+
+const ACCOUNT_A = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+const ACCOUNT_B = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";
+
+// Two local listeners so the proxy fast-fail reachability check succeeds. The
+// proxy host/port are observable in the egress context — that is what asserts the
+// per-account proxy is honored (was always "direct" before #4954).
+let serverA: net.Server;
+let serverB: net.Server;
+let portA = 0;
+let portB = 0;
+
+function listen(server: net.Server): Promise<number> {
+  return new Promise((resolve) => {
+    server.listen(0, "127.0.0.1", () => {
+      resolve((server.address() as net.AddressInfo).port);
+    });
+  });
+}
+
+before(async () => {
+  serverA = net.createServer((s) => s.destroy());
+  serverB = net.createServer((s) => s.destroy());
+  portA = await listen(serverA);
+  portB = await listen(serverB);
+});
+
+after(() => {
+  serverA?.close();
+  serverB?.close();
+});
+
+function credentialsWithProxies() {
+  return {
+    apiKey: null,
+    accessToken: null,
+    connectionId: "noauth",
+    providerSpecificData: {
+      fingerprints: [ACCOUNT_A, ACCOUNT_B],
+      accountProxies: [
+        { fingerprint: ACCOUNT_A, proxy: { type: "http", host: "127.0.0.1", port: portA } },
+        { fingerprint: ACCOUNT_B, proxy: { type: "http", host: "127.0.0.1", port: portB } },
+      ],
+    },
+  } as any;
+}
+
+describe("OpencodeExecutor per-account proxy + rotation (#4954)", () => {
+  let originalFetch: typeof globalThis.fetch;
+  let observed: Array<{ source: string; host: string | null; port: string | null }>;
+
+  beforeEach(() => {
+    originalFetch = globalThis.fetch;
+    observed = [];
+  });
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch;
+  });
+
+  /** Record the proxy context resolved for each dispatch, then return `status`. */
+  function installFetchStub(statuses: number[]) {
+    let call = 0;
+    globalThis.fetch = (async (input: any) => {
+      const url = typeof input === "string" ? input : input?.url || String(input);
+      const resolved = resolveProxyForRequest(url);
+      let host: string | null = null;
+      let port: string | null = null;
+      try {
+        if (resolved.proxyUrl) {
+          const u = new URL(resolved.proxyUrl);
+          host = u.hostname;
+          port = u.port;
+        }
+      } catch {
+        host = resolved.proxyUrl;
+      }
+      observed.push({ source: resolved.source, host, port });
+      const status = statuses[Math.min(call, statuses.length - 1)];
+      call++;
+      return new Response(JSON.stringify({ ok: status === 200 }), {
+        status,
+        headers: { "Content-Type": "application/json" },
+      });
+    }) as typeof globalThis.fetch;
+  }
+
+  it("dispatches through the selected account's proxy (not direct)", async () => {
+    const exec = new OpencodeExecutor("opencode-zen");
+    installFetchStub([200]);
+
+    const result = await exec.execute({
+      model: "grok-code",
+      body: { messages: [{ role: "user", content: "hi" }], stream: false },
+      stream: false,
+      signal: null,
+      credentials: credentialsWithProxies(),
+      log,
+    });
+
+    assert.strictEqual((result as any).response.status, 200);
+    assert.ok(observed.length >= 1, "at least one dispatch happened");
+    const first = observed[0];
+    assert.strictEqual(
+      first.source,
+      "context",
+      `expected proxy-context egress, got source="${first.source}" (was always "direct" before #4954)`
+    );
+    assert.strictEqual(first.host, "127.0.0.1", "egress must use a configured proxy host");
+    assert.ok(
+      first.port === String(portA) || first.port === String(portB),
+      `expected one of the configured proxy ports, got "${first.port}"`
+    );
+  });
+
+  it("rotates to the next account (and its proxy) on a 429", async () => {
+    const exec = new OpencodeExecutor("opencode-zen");
+    // first account → 429, second account → 200
+    installFetchStub([429, 200]);
+
+    const result = await exec.execute({
+      model: "grok-code",
+      body: { messages: [{ role: "user", content: "hi" }], stream: false },
+      stream: false,
+      signal: null,
+      credentials: credentialsWithProxies(),
+      log,
+    });
+
+    assert.strictEqual((result as any).response.status, 200, "final response should succeed");
+    assert.ok(observed.length >= 2, "should have retried on a second account after 429");
+    const ports = observed.map((p) => p.port);
+    assert.ok(ports.includes(String(portA)), "first attempt should use account A's proxy");
+    assert.ok(ports.includes(String(portB)), "rotated attempt should use account B's proxy");
+    assert.notStrictEqual(
+      observed[0].port,
+      observed[1].port,
+      "rotation must switch to a different account/proxy"
+    );
+    for (const p of observed) {
+      assert.strictEqual(p.source, "context", "every dispatch must egress through a proxy context");
+    }
+  });
+});
diff --git a/tests/unit/ops-scripts.test.ts b/tests/unit/ops-scripts.test.ts
new file mode 100644
index 0000000000..f811fb5e14
--- /dev/null
+++ b/tests/unit/ops-scripts.test.ts
@@ -0,0 +1,184 @@
+/**
+ * tests/unit/ops-scripts.test.ts
+ *
+ * Contract tests for the incident-runbook ops scripts under bin/ (referenced by
+ * docs/INCIDENT_RESPONSE.md and docs/PERF_BUDGETS.md):
+ *   rollback.sh · snapshot-data.sh · restore-data.sh · restore-policies.sh ·
+ *   cold-start-bench.sh
+ *
+ * These scripts touch deploys and the SQLite store, so the suite pins down the
+ * safety contract rather than full ops behavior: every script is executable
+ * bash with strict mode, prints usage on --help, the restore commands refuse to
+ * run without a snapshot id, and a snapshot→restore round-trip works while the
+ * non-interactive TTY guard blocks an unattended destructive restore.
+ */
+
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const ROOT = path.resolve(import.meta.dirname, "..", "..");
+const BIN = path.join(ROOT, "bin");
+const SCRIPTS = [
+  "rollback.sh",
+  "snapshot-data.sh",
+  "restore-data.sh",
+  "restore-policies.sh",
+  "cold-start-bench.sh",
+];
+
+const hasSqlite3 = spawnSync("sqlite3", ["--version"], { stdio: "ignore" }).status === 0;
+
+/** Run a bin/ script with a NON-tty stdin (so the TTY guard engages). */
+function runScript(script: string, args: string[], env: Record<string, string> = {}) {
+  return spawnSync("bash", [path.join(BIN, script), ...args], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    env: { ...process.env, ...env },
+  });
+}
+
+describe("ops runbook scripts (bin/*.sh)", () => {
+  it("every script exists, is executable, and uses bash + strict mode", () => {
+    for (const s of SCRIPTS) {
+      const p = path.join(BIN, s);
+      assert.ok(fs.existsSync(p), `${s} is missing`);
+      assert.ok(fs.statSync(p).mode & 0o111, `${s} is not executable (chmod +x)`);
+      const body = fs.readFileSync(p, "utf8");
+      assert.ok(body.startsWith("#!/usr/bin/env bash"), `${s} missing bash shebang`);
+      assert.ok(body.includes("set -euo pipefail"), `${s} missing 'set -euo pipefail'`);
+    }
+  });
+
+  it("the shared helper and every script pass `bash -n` (syntax check)", () => {
+    for (const s of [...SCRIPTS, "_ops-common.sh"]) {
+      const r = spawnSync("bash", ["-n", path.join(BIN, s)], { encoding: "utf8" });
+      assert.equal(r.status, 0, `${s} has a syntax error: ${r.stderr}`);
+    }
+  });
+
+  it("--help exits 0 with a usage banner for every script", () => {
+    for (const s of SCRIPTS) {
+      const r = runScript(s, ["--help"]);
+      assert.equal(r.status, 0, `${s} --help exited ${r.status}: ${r.stderr}`);
+      assert.match(r.stdout, /Usage:/, `${s} --help printed no usage banner`);
+    }
+  });
+
+  it("restore scripts refuse to run without a snapshot id", () => {
+    for (const s of ["restore-data.sh", "restore-policies.sh"]) {
+      const r = runScript(s, []);
+      assert.notEqual(r.status, 0, `${s} should fail without an id`);
+      assert.match(r.stderr, /snapshot id required/, `${s} wrong error: ${r.stderr}`);
+    }
+  });
+
+  it("snapshot → restore-data round-trips, and the TTY guard blocks unattended restores", async () => {
+    const dataDir = fs.mkdtempSync(path.join(os.tmpdir(), "omni-ops-"));
+    try {
+      const Database = (await import("better-sqlite3")).default;
+      const dbPath = path.join(dataDir, "storage.sqlite");
+      let db = new Database(dbPath);
+      db.exec(
+        "CREATE TABLE api_keys (id TEXT PRIMARY KEY, name TEXT);" +
+          "INSERT INTO api_keys VALUES ('k1','orig');"
+      );
+      db.close();
+
+      const env = { DATA_DIR: dataDir };
+      const snap = runScript("snapshot-data.sh", ["--label", "test"], env);
+      assert.equal(snap.status, 0, `snapshot failed: ${snap.stderr}`);
+      const id = snap.stdout.trim();
+      assert.ok(id, "snapshot id not printed on stdout");
+      assert.ok(
+        fs.existsSync(path.join(dataDir, "db_backups", `snapshot_${id}`, "storage.sqlite")),
+        "snapshot dir not created"
+      );
+
+      // Mutate the live DB so a successful restore is observable.
+      db = new Database(dbPath);
+      db.exec("UPDATE api_keys SET name='changed' WHERE id='k1';");
+      db.close();
+
+      // Guard: non-interactive restore WITHOUT --yes must refuse (nothing destroyed).
+      const blocked = runScript("restore-data.sh", [id], env);
+      assert.notEqual(blocked.status, 0, "restore without --yes should be blocked");
+      assert.match(blocked.stderr, /TTY/, `expected TTY guard, got: ${blocked.stderr}`);
+      db = new Database(dbPath);
+      assert.equal(
+        (db.prepare("SELECT name FROM api_keys WHERE id='k1'").get() as { name: string }).name,
+        "changed",
+        "blocked restore must not have changed the DB"
+      );
+      db.close();
+
+      // With --yes it reverts to the snapshot.
+      const ok = runScript("restore-data.sh", [id, "--yes"], env);
+      assert.equal(ok.status, 0, `restore failed: ${ok.stderr}`);
+      db = new Database(dbPath);
+      assert.equal(
+        (db.prepare("SELECT name FROM api_keys WHERE id='k1'").get() as { name: string }).name,
+        "orig",
+        "restore did not revert the row"
+      );
+      db.close();
+    } finally {
+      fs.rmSync(dataDir, { recursive: true, force: true });
+    }
+  });
+
+  it(
+    "restore-policies replaces only api_key* tables, preserving other tables",
+    { skip: hasSqlite3 ? false : "sqlite3 CLI not installed" },
+    async () => {
+      const dataDir = fs.mkdtempSync(path.join(os.tmpdir(), "omni-pol-"));
+      try {
+        const Database = (await import("better-sqlite3")).default;
+        const dbPath = path.join(dataDir, "storage.sqlite");
+        let db = new Database(dbPath);
+        db.exec(
+          "CREATE TABLE api_keys (id TEXT PRIMARY KEY, name TEXT);" +
+            "INSERT INTO api_keys VALUES ('k1','orig');" +
+            "CREATE TABLE sessions (id TEXT PRIMARY KEY);" +
+            "INSERT INTO sessions VALUES ('s-old');"
+        );
+        db.close();
+
+        const env = { DATA_DIR: dataDir };
+        const id = runScript("snapshot-data.sh", [], env).stdout.trim();
+        assert.ok(id, "snapshot id not printed");
+
+        // Change BOTH a policy table and a non-policy table after the snapshot.
+        db = new Database(dbPath);
+        db.exec(
+          "UPDATE api_keys SET name='changed' WHERE id='k1';" +
+            "INSERT INTO sessions VALUES ('s-new');"
+        );
+        db.close();
+
+        const r = runScript("restore-policies.sh", [id, "--yes"], env);
+        assert.equal(r.status, 0, `restore-policies failed: ${r.stderr}`);
+
+        db = new Database(dbPath);
+        // Policy table reverted…
+        assert.equal(
+          (db.prepare("SELECT name FROM api_keys WHERE id='k1'").get() as { name: string }).name,
+          "orig",
+          "api_keys policy was not restored"
+        );
+        // …non-policy table left intact (live usage not rewound).
+        assert.equal(
+          (db.prepare("SELECT COUNT(*) c FROM sessions").get() as { c: number }).c,
+          2,
+          "non-policy table must not be touched by restore-policies"
+        );
+        db.close();
+      } finally {
+        fs.rmSync(dataDir, { recursive: true, force: true });
+      }
+    }
+  );
+});
diff --git a/tests/unit/perplexity-key-validation-models.test.ts b/tests/unit/perplexity-key-validation-models.test.ts
new file mode 100644
index 0000000000..ee078ea5cb
--- /dev/null
+++ b/tests/unit/perplexity-key-validation-models.test.ts
@@ -0,0 +1,50 @@
+// Regression test for perplexity API key validation.
+//
+// Perplexity deprecated the unversioned `/models` endpoint (returns 404), so
+// our default validation probe — which derives `<baseUrl>/models` from the
+// perplexity registry entry via `addModelsSuffix` — would always fail to
+// confirm a valid key, falling through to the chat-completions probe and
+// often misclassifying live keys as "Invalid". Inspired by upstream
+// 9router fix (see commit message); we port it OmniRoute-style by
+// declaring an explicit `modelsUrl` on the perplexity registry entry.
+
+import { describe, it } from "node:test";
+import assert from "node:assert";
+
+describe("perplexity registry — key validation models endpoint", () => {
+  it("declares a modelsUrl pointing at /v1/models (not the deprecated /models)", async () => {
+    const { getRegistryEntry } = await import(
+      "../../open-sse/config/providerRegistry.ts"
+    );
+    const entry = getRegistryEntry("perplexity");
+    assert.ok(entry, "perplexity must be registered in the execution registry");
+    assert.equal(entry.format, "openai");
+    assert.ok(
+      typeof entry.modelsUrl === "string" && entry.modelsUrl.length > 0,
+      "perplexity registry entry must declare an explicit modelsUrl so key " +
+        "validation does not hit the deprecated <baseUrl>/models endpoint"
+    );
+    assert.equal(
+      entry.modelsUrl,
+      "https://api.perplexity.ai/v1/models",
+      "perplexity modelsUrl must point at the versioned /v1/models endpoint " +
+        "(unversioned /models was deprecated and now returns 404)"
+    );
+  });
+
+  it("does not derive a /models URL that ends in /chat/completions/models", async () => {
+    const { getRegistryEntry } = await import(
+      "../../open-sse/config/providerRegistry.ts"
+    );
+    const entry = getRegistryEntry("perplexity");
+    assert.ok(entry?.modelsUrl, "modelsUrl required");
+    assert.ok(
+      !entry.modelsUrl.includes("/chat/completions"),
+      "modelsUrl must not include /chat/completions"
+    );
+    assert.ok(
+      entry.modelsUrl.endsWith("/v1/models"),
+      "modelsUrl must end with /v1/models"
+    );
+  });
+});
diff --git a/tests/unit/pollinations-jsonmode-3981.test.ts b/tests/unit/pollinations-jsonmode-3981.test.ts
new file mode 100644
index 0000000000..b823d4318f
--- /dev/null
+++ b/tests/unit/pollinations-jsonmode-3981.test.ts
@@ -0,0 +1,38 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { PollinationsExecutor } from "../../open-sse/executors/pollinations.ts";
+
+// #3981: Pollinations rejects (HTTP 400 "messages must contain the word 'json'")
+// any request with jsonMode=true whose messages don't mention "json". Setting
+// jsonMode unconditionally broke every normal chat request. jsonMode must only
+// be enabled when the caller actually requested JSON output.
+
+test("#3981 transformRequest does NOT force jsonMode for a normal request", () => {
+  const executor = new PollinationsExecutor();
+  const body: any = {
+    messages: [{ role: "user", content: "Hello there" }],
+  };
+  const out = executor.transformRequest("openai", body, true, null);
+  assert.notEqual(out.jsonMode, true);
+});
+
+test("#3981 transformRequest enables jsonMode when response_format json_object is requested", () => {
+  const executor = new PollinationsExecutor();
+  const body: any = {
+    messages: [{ role: "user", content: "Return json" }],
+    response_format: { type: "json_object" },
+  };
+  const out = executor.transformRequest("openai", body, true, null);
+  assert.equal(out.jsonMode, true);
+});
+
+test("#3981 transformRequest enables jsonMode when response_format json_schema is requested", () => {
+  const executor = new PollinationsExecutor();
+  const body: any = {
+    messages: [{ role: "user", content: "Return structured json" }],
+    response_format: { type: "json_schema", json_schema: { name: "x", schema: {} } },
+  };
+  const out = executor.transformRequest("openai", body, true, null);
+  assert.equal(out.jsonMode, true);
+});
diff --git a/tests/unit/pricing-constants-split.test.ts b/tests/unit/pricing-constants-split.test.ts
new file mode 100644
index 0000000000..53651ec782
--- /dev/null
+++ b/tests/unit/pricing-constants-split.test.ts
@@ -0,0 +1,56 @@
+// Characterization of the pricing.ts split (god-file decomposition): the host became a barrel that
+// re-exports DEFAULT_PRICING (now merged from 4 semantic family files that import shared tier consts)
+// and keeps the 3 helper functions. Pure-data move → behavior identical. Locks: public surface, the
+// spread-merge integrity, and that lookups/cost math resolve unchanged.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+const P = await import("../../src/shared/constants/pricing.ts");
+
+test("barrel still exports DEFAULT_PRICING + the 3 helpers", () => {
+  for (const name of [
+    "DEFAULT_PRICING",
+    "getPricingForModel",
+    "getDefaultPricing",
+    "calculateCostFromTokens",
+  ]) {
+    assert.ok(name in P, `missing export: ${name}`);
+  }
+});
+
+test("DEFAULT_PRICING merges the 4 family files; families partition all entries", async () => {
+  const merged = Object.keys((P as Record<string, object>).DEFAULT_PRICING).length;
+  const families: [string, string][] = [
+    ["oauth-subscriptions", "DEFAULT_PRICING_OAUTH"],
+    ["frontier-labs", "DEFAULT_PRICING_FRONTIER"],
+    ["inference-hosts", "DEFAULT_PRICING_INFERENCE"],
+    ["regional", "DEFAULT_PRICING_REGIONAL"],
+  ];
+  let famTotal = 0;
+  const seen = new Set<string>();
+  for (const [file, exportName] of families) {
+    const mod = await import(`../../src/shared/constants/pricing/${file}.ts`);
+    for (const k of Object.keys(mod[exportName])) {
+      assert.ok(!seen.has(k), `pricing key ${k} appears in more than one family`);
+      seen.add(k);
+      famTotal++;
+    }
+  }
+  assert.equal(merged, famTotal, "spread-merge lost/duplicated a top-level key");
+  assert.ok(merged > 25);
+});
+
+test("shared tier consts feed the parts (a known model resolves to a shared rate)", () => {
+  const pricing = (P as Record<string, (p: string, m: string) => unknown>).getPricingForModel(
+    "openai",
+    "gpt-4o"
+  );
+  assert.ok(pricing && typeof pricing === "object");
+  assert.equal(typeof (pricing as { input?: number }).input, "number");
+});
+
+test("calculateCostFromTokens stays callable and numeric", () => {
+  const fn = (P as Record<string, (...a: unknown[]) => unknown>).calculateCostFromTokens;
+  const out = fn("openai", "gpt-4o", { prompt_tokens: 1000, completion_tokens: 1000 });
+  assert.equal(typeof out, "number");
+});
diff --git a/tests/unit/provider-request-capture-toolname-map-4091.test.ts b/tests/unit/provider-request-capture-toolname-map-4091.test.ts
index c8dd34f720..c2be7e4358 100644
--- a/tests/unit/provider-request-capture-toolname-map-4091.test.ts
+++ b/tests/unit/provider-request-capture-toolname-map-4091.test.ts
@@ -1,6 +1,6 @@
 /**
- * #4091 — MCP tool dispatch broken in Claude Code ("No such tool available")
- * on native Claude OAuth, regression from v3.8.27.
+ * #4091 — third-party tool-name cloak map must survive the request-capture
+ * round-trip (native Claude OAuth; original symptom: "No such tool available").
  *
  * Root cause: the native-Claude tool-name cloak stores the per-request
  * alias→original map as a NON-ENUMERABLE `_toolNameMap` on the request body.
@@ -10,8 +10,13 @@
  * `finalBody = providerRequestCapture.body(transformedBody)` then resolves to
  * that round-tripped copy, so the response-side un-cloak
  * (`mergeResponseToolNameMap` → `remapToolNamesInResponse`) sees an empty map
- * and the cloaked PascalCase name (`McpN8nMcpSearchWorkflows`) streams verbatim
- * to Claude Code, which rejects it client-side.
+ * and the cloaked PascalCase name streams verbatim to Claude Code, which
+ * rejects it client-side.
+ *
+ * The example tool is a generic third-party name (`search_workflows`), not an
+ * `mcp__…` name: #4861 deliberately exempts the `mcp__` namespace from cloaking
+ * (Anthropic accepts those natively), so only non-`mcp__` third-party tools are
+ * cloaked and exercise this map-preservation path.
  *
  * These tests pin the lossy boundary: `createPreparedRequestLogger().body()`
  * must preserve the cloak map from the real (fallback) transformed body even
@@ -40,8 +45,8 @@ function makeCapture() {
   return { capture: createPreparedRequestLogger(reqLogger, scope), logged };
 }
 
-const ALIAS = "McpN8nMcpSearchWorkflows";
-const ORIGINAL = "mcp__n8n-mcp__search_workflows";
+const ALIAS = "SearchWorkflows";
+const ORIGINAL = "search_workflows";
 
 function makeCloakedClaudeBody(): Record<string, unknown> {
   const body: Record<string, unknown> = {
diff --git a/tests/unit/provider-validation-branches.test.ts b/tests/unit/provider-validation-branches.test.ts
index a54b8aaa5c..9cd98eb72e 100644
--- a/tests/unit/provider-validation-branches.test.ts
+++ b/tests/unit/provider-validation-branches.test.ts
@@ -168,7 +168,10 @@ test("anthropic-compatible validation requires a base URL", async () => {
   assert.match(result.error, /No base URL configured/i);
 });
 
-test("anthropic-compatible validation rejects invalid keys from /models", async () => {
+test("anthropic-compatible validation rejects invalid keys (auth-fail on both /models and /messages)", async () => {
+  // After the 584cf66a port, /models alone is not authoritative — many compatible
+  // proxies 401/403 on /models even with a valid key. To prove the key is bad we
+  // require an auth-shaped failure on POST /v1/messages too.
   const calls = [];
   globalThis.fetch = async (url) => {
     calls.push(String(url));
@@ -183,7 +186,10 @@ test("anthropic-compatible validation rejects invalid keys from /models", async
 
   assert.equal(result.valid, false);
   assert.equal(result.error, "Invalid API key");
-  assert.deepEqual(calls, ["https://api.example.com/v1/models"]);
+  assert.deepEqual(calls, [
+    "https://api.example.com/v1/models",
+    "https://api.example.com/v1/messages",
+  ]);
 });
 
 test("anthropic-compatible validation falls back to /messages and treats 400 as auth success", async () => {
diff --git a/tests/unit/providers-constants-split.test.ts b/tests/unit/providers-constants-split.test.ts
new file mode 100644
index 0000000000..5358563d9a
--- /dev/null
+++ b/tests/unit/providers-constants-split.test.ts
@@ -0,0 +1,87 @@
+// Characterization of the providers.ts catalog split (god-file decomposition): the host became a
+// barrel that re-exports 10 data catalogs now living under constants/providers/*, and APIKEY is
+// merged from 6 semantic family files (apikey/<family>.ts). Locks: the public surface (every catalog
+// + helpers still exported), the spread-merge integrity (157 APIKEY entries, no loss/dup), and that
+// load-time Zod validation still runs. Pure-data move → behavior must be identical.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+const P = await import("../../src/shared/constants/providers.ts");
+
+test("barrel still exports every catalog + key helpers", () => {
+  for (const name of [
+    "NOAUTH_PROVIDERS",
+    "OAUTH_PROVIDERS",
+    "WEB_COOKIE_PROVIDERS",
+    "APIKEY_PROVIDERS",
+    "LOCAL_PROVIDERS",
+    "SEARCH_PROVIDERS",
+    "AUDIO_ONLY_PROVIDERS",
+    "UPSTREAM_PROXY_PROVIDERS",
+    "CLOUD_AGENT_PROVIDERS",
+    "SYSTEM_PROVIDERS",
+    "AI_PROVIDERS",
+    "ALIAS_TO_ID",
+    "ID_TO_ALIAS",
+    "getProviderById",
+    "getProviderByAlias",
+    "resolveProviderId",
+  ]) {
+    assert.ok(name in P, `missing export: ${name}`);
+  }
+});
+
+test("APIKEY_PROVIDERS merges the 6 family files into 157 entries (no loss / no dup)", async () => {
+  const keys = Object.keys((P as Record<string, object>).APIKEY_PROVIDERS);
+  assert.equal(keys.length, 157);
+  assert.equal(new Set(keys).size, 157, "duplicate keys after spread-merge");
+  // the merged object's entry-count equals the sum of the 6 semantic family files; families are a
+  // strict partition (every provider in exactly one), so the sum must be exactly 157.
+  const families: [string, string][] = [
+    ["gateways", "APIKEY_PROVIDERS_GATEWAYS"],
+    ["frontier-labs", "APIKEY_PROVIDERS_FRONTIER"],
+    ["inference-hosts", "APIKEY_PROVIDERS_INFERENCE"],
+    ["enterprise-cloud", "APIKEY_PROVIDERS_ENTERPRISE"],
+    ["regional", "APIKEY_PROVIDERS_REGIONAL"],
+    ["specialty-media", "APIKEY_PROVIDERS_SPECIALTY"],
+  ];
+  let famTotal = 0;
+  const seen = new Set<string>();
+  for (const [file, exportName] of families) {
+    const mod = await import(`../../src/shared/constants/providers/apikey/${file}.ts`);
+    const famKeys = Object.keys(mod[exportName]);
+    famTotal += famKeys.length;
+    for (const k of famKeys) {
+      assert.ok(!seen.has(k), `provider ${k} appears in more than one family`);
+      seen.add(k);
+    }
+  }
+  assert.equal(famTotal, 157, "families must partition all 157 providers");
+});
+
+test("AI_PROVIDERS Proxy aggregates all sections; lookups resolve", () => {
+  const ai = (P as Record<string, Record<string, unknown>>).AI_PROVIDERS;
+  assert.ok(Object.keys(ai).length > 200);
+  assert.ok((P as Record<string, (id: string) => unknown>).getProviderById("openai"));
+  assert.ok((P as Record<string, (id: string) => unknown>).getProviderById("claude"));
+  // a moved catalog is reachable through the barrel re-export
+  assert.ok((P as Record<string, Record<string, unknown>>).APIKEY_PROVIDERS["openai"]);
+});
+
+test("each extracted data module is importable on its own", async () => {
+  const mods = [
+    ["noauth", "NOAUTH_PROVIDERS"],
+    ["oauth", "OAUTH_PROVIDERS"],
+    ["web-cookie", "WEB_COOKIE_PROVIDERS"],
+    ["local", "LOCAL_PROVIDERS"],
+    ["search", "SEARCH_PROVIDERS"],
+    ["audio", "AUDIO_ONLY_PROVIDERS"],
+    ["upstream-proxy", "UPSTREAM_PROXY_PROVIDERS"],
+    ["cloud-agent", "CLOUD_AGENT_PROVIDERS"],
+    ["system", "SYSTEM_PROVIDERS"],
+  ];
+  for (const [file, name] of mods) {
+    const m = await import(`../../src/shared/constants/providers/${file}.ts`);
+    assert.ok(m[name] && typeof m[name] === "object", `${file}.ts must export ${name}`);
+  }
+});
diff --git a/tests/unit/proxy-bypass-scope-guard-3226.test.ts b/tests/unit/proxy-bypass-scope-guard-3226.test.ts
index 00243e3b04..5b40bde4b0 100644
--- a/tests/unit/proxy-bypass-scope-guard-3226.test.ts
+++ b/tests/unit/proxy-bypass-scope-guard-3226.test.ts
@@ -18,14 +18,19 @@ import assert from "node:assert/strict";
 import { readFileSync } from "node:fs";
 
 test("bypassProxyPatch is present in the NVIDIA validation path (#3226 documented exception)", () => {
-  const validation = readFileSync("src/lib/providers/validation.ts", "utf8");
+  // After the validation.ts godfile split (#4921–#4930), bypassProxyPatch moved to the
+  // extracted validation/headers.ts. Assert the bypass lives in the validation LAYER
+  // (validation.ts + its extracted modules), not that it stayed in one file.
+  const validationLayer =
+    readFileSync("src/lib/providers/validation.ts", "utf8") +
+    readFileSync("src/lib/providers/validation/headers.ts", "utf8");
   assert.ok(
-    validation.includes("bypassProxyPatch"),
-    "expected bypassProxyPatch to be present in validation.ts (the documented NVIDIA exception)"
+    validationLayer.includes("bypassProxyPatch"),
+    "expected bypassProxyPatch in the validation layer (validation/headers.ts) — the documented NVIDIA exception"
   );
   assert.ok(
-    validation.includes("directHttpsRequest"),
-    "expected directHttpsRequest helper to be present in validation.ts"
+    validationLayer.includes("directHttpsRequest"),
+    "expected directHttpsRequest helper in the validation layer"
   );
 });
 
diff --git a/tests/unit/proxy-pool-cloudflare-workers-deployer.test.ts b/tests/unit/proxy-pool-cloudflare-workers-deployer.test.ts
new file mode 100644
index 0000000000..6109a52452
--- /dev/null
+++ b/tests/unit/proxy-pool-cloudflare-workers-deployer.test.ts
@@ -0,0 +1,183 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+// Port of upstream decolua/9router PR #1360: Cloudflare Workers as proxy relay.
+//
+// Architecture mirrors the existing Vercel relay (same x-relay-target /
+// x-relay-path / x-relay-auth header spec, same SSRF guard inlined into the
+// worker, same fail-closed missing-relayAuth check). Only the deployment
+// target changes: instead of POSTing to the Vercel /v13/deployments API,
+// we PUT a Worker script to Cloudflare's accounts/{accountId}/workers/scripts
+// API and enable the workers.dev subdomain.
+//
+// Coverage:
+//  1. buildCloudflareWorkerScript(relayAuth) returns an Edge-runtime worker
+//     module whose source enforces the same x-relay-auth check as the
+//     Vercel relay (so a leaked workers.dev URL cannot be used as an
+//     open SSRF proxy by a third party).
+//  2. proxyFetch's relay short-circuit treats type "cloudflare" the same
+//     way as "vercel" — uses buildVercelRelayHeaders + routes to the
+//     workers.dev origin, never the upstream target.
+//  3. The proxyDispatcher / DB layer recognise "cloudflare" as a relay
+//     type (extractRelayAuth fires, dispatcher returns the worker URL).
+
+// --- Install the relay sink BEFORE importing the module under test. ---
+type FetchCall = { input: unknown; init: RequestInit & { headers?: HeadersInit } };
+const relayCalls: FetchCall[] = [];
+const realGlobalFetch = globalThis.fetch;
+
+const relaySink = (async (input: unknown, init: RequestInit = {}) => {
+  relayCalls.push({ input, init });
+  return Response.json({ via: "cloudflare-relay" });
+}) as unknown as typeof globalThis.fetch;
+
+globalThis.fetch = relaySink;
+
+const proxyDispatcher = await import("../../open-sse/utils/proxyDispatcher.ts");
+const { buildVercelRelayHeaders, proxyConfigToUrl } = proxyDispatcher;
+const proxyFetchMod = await import("../../open-sse/utils/proxyFetch.ts");
+const { proxyFetch, runWithProxyContext } = proxyFetchMod;
+
+const cfDeploy = await import("../../src/lib/proxyRelay/cloudflareWorkerScript.ts");
+const { buildCloudflareWorkerScript } = cfDeploy;
+
+test.after(() => {
+  globalThis.fetch = realGlobalFetch;
+});
+
+test.beforeEach(() => {
+  relayCalls.length = 0;
+});
+
+// --------------------------------------------------------------------------
+// 1. buildCloudflareWorkerScript — emitted worker source contract
+// --------------------------------------------------------------------------
+
+test("buildCloudflareWorkerScript embeds the supplied relayAuth literal", () => {
+  const src = buildCloudflareWorkerScript("a-very-specific-secret-token");
+  assert.ok(
+    src.includes('"a-very-specific-secret-token"'),
+    "worker source must embed the relayAuth secret as a string literal"
+  );
+});
+
+test("buildCloudflareWorkerScript rejects requests without a valid x-relay-auth header", () => {
+  // The worker source must enforce the same auth check as the Vercel relay:
+  // a 401 short-circuit when x-relay-auth does not match the embedded token.
+  // We don't run the worker here — we check the source contains the guard.
+  const src = buildCloudflareWorkerScript("the-secret");
+  assert.ok(
+    /x-relay-auth/.test(src),
+    "worker source must reference the x-relay-auth header"
+  );
+  assert.ok(
+    /401|Unauthorized/.test(src),
+    "worker source must short-circuit unauthorised requests with 401"
+  );
+});
+
+test("buildCloudflareWorkerScript blocks loopback / RFC1918 / link-local hosts (SSRF guard)", () => {
+  // Mirrors the Vercel relay's inlined SSRF guard. A leaked workers.dev URL
+  // must not be usable to scan internal networks.
+  const src = buildCloudflareWorkerScript("tok");
+  // The guard recognises private CIDRs / loopback by literal substrings in
+  // the inline function. These specific tokens are load-bearing.
+  assert.ok(/127\.0\.0\.1|localhost/.test(src), "blocks loopback hosts");
+  assert.ok(/192\.168|10\.|172/.test(src), "blocks RFC1918 hosts");
+  assert.ok(/169\.254|link-local|fe80/.test(src), "blocks link-local hosts");
+});
+
+test("buildCloudflareWorkerScript uses ESM default-export fetch handler (Workers Modules format)", () => {
+  // Cloudflare's PUT /workers/scripts API expects a module-format worker
+  // (main_module = index.js, content-type application/javascript+module).
+  // The handler must be exposed as `export default { fetch }`.
+  const src = buildCloudflareWorkerScript("tok");
+  assert.ok(/export\s+default/.test(src), "must be an ES module (export default)");
+  assert.ok(/fetch\s*\(/.test(src), "must export a fetch handler");
+});
+
+// --------------------------------------------------------------------------
+// 2. proxyFetch — cloudflare type takes the relay short-circuit
+// --------------------------------------------------------------------------
+
+const CLOUDFLARE_CTX = {
+  type: "cloudflare" as const,
+  host: "omniroute-relay.acme.workers.dev",
+  relayAuth: "live-cf-secret",
+};
+
+test("proxyFetch routes a cloudflare-type context through the relay endpoint with relay headers", async () => {
+  const response = await runWithProxyContext(CLOUDFLARE_CTX, () =>
+    proxyFetch("https://api.anthropic.com/v1/messages?x=1", {
+      method: "POST",
+      headers: { "x-existing": "keep-me" },
+    })
+  );
+
+  assert.deepEqual(await response.json(), { via: "cloudflare-relay" });
+  assert.equal(relayCalls.length, 1, "exactly one relay dispatch");
+  const call = relayCalls[0];
+
+  // Rewritten to the workers.dev origin, NOT the upstream target.
+  assert.equal(call.input, "https://omniroute-relay.acme.workers.dev");
+
+  const sentHeaders = new Headers(call.init.headers);
+  assert.equal(sentHeaders.get("x-relay-target"), "https://api.anthropic.com");
+  assert.equal(sentHeaders.get("x-relay-path"), "/v1/messages?x=1");
+  assert.equal(sentHeaders.get("x-relay-auth"), "live-cf-secret");
+  assert.equal(sentHeaders.get("x-existing"), "keep-me");
+  assert.equal(call.init.method, "POST");
+  assert.equal((call.init as { duplex?: string }).duplex, "half");
+});
+
+test("proxyFetch throws (without dispatching) when a cloudflare context is missing relayAuth", async () => {
+  await assert.rejects(
+    runWithProxyContext({ type: "cloudflare", host: "x.workers.dev" }, () =>
+      proxyFetch("https://api.anthropic.com/v1/messages", { method: "POST" })
+    ),
+    /relay configuration error: missing relayAuth/
+  );
+  assert.equal(relayCalls.length, 0, "no relay dispatch when relayAuth is missing");
+});
+
+test("the missing-relayAuth error message does not leak internal [ProxyFetch] diagnostics", async () => {
+  await runWithProxyContext({ type: "cloudflare", host: "x.workers.dev" }, async () => {
+    try {
+      await proxyFetch("https://api.anthropic.com/v1/messages", { method: "POST" });
+      assert.fail("expected the relay branch to throw on missing relayAuth");
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      assert.ok(!message.includes("[ProxyFetch]"), "no internal [ProxyFetch] label");
+      assert.ok(!message.includes("at /"), "no stack-trace path leaked");
+    }
+  });
+});
+
+// --------------------------------------------------------------------------
+// 3. proxyConfigToUrl — cloudflare type yields the worker https origin
+// --------------------------------------------------------------------------
+
+test("proxyConfigToUrl returns the cloudflare worker URL (no HTTP-proxy dispatcher needed)", () => {
+  const url = proxyConfigToUrl({
+    type: "cloudflare",
+    host: "omniroute-relay.acme.workers.dev",
+  });
+  assert.equal(url, "https://omniroute-relay.acme.workers.dev");
+});
+
+// --------------------------------------------------------------------------
+// 4. buildVercelRelayHeaders is shared (renamed-or-aliased? at minimum still
+//    works for cloudflare — same header spec).
+// --------------------------------------------------------------------------
+
+test("buildVercelRelayHeaders is the shared relay-header builder used for cloudflare too", () => {
+  const headers = buildVercelRelayHeaders(
+    "https://api.openai.com/v1/chat/completions",
+    "cf-tok"
+  );
+  assert.deepEqual(headers, {
+    "x-relay-target": "https://api.openai.com",
+    "x-relay-path": "/v1/chat/completions",
+    "x-relay-auth": "cf-tok",
+  });
+});
diff --git a/tests/unit/proxy-pool-deno-deploy-relay.test.ts b/tests/unit/proxy-pool-deno-deploy-relay.test.ts
new file mode 100644
index 0000000000..2c802bdb73
--- /dev/null
+++ b/tests/unit/proxy-pool-deno-deploy-relay.test.ts
@@ -0,0 +1,100 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+// Port of decolua/9router PR #1437 — Deno Deploy relays.
+// OmniRoute already supports Vercel-typed relays (#2743 test). Deno Deploy is a
+// second cloud edge runtime that ships the same x-relay-{target,path,auth}
+// envelope: from the dispatch path's perspective the two are interchangeable.
+//
+// This test pins three contracts the port must respect:
+//   1. The deny-list of "this is a relay, not a TCP proxy" types is shared
+//      between vercel and deno via a single RELAY_TYPES set in proxyDispatcher
+//      (no copy-pasted `type === "vercel"` branches that would diverge).
+//   2. proxyConfigToUrl returns the relay URL verbatim for type:"deno" (callers
+//      use buildRelayHeaders() + fetch directly, just like vercel).
+//   3. proxyFetch routes a type:"deno" context through the relay branch with
+//      the same x-relay-* headers and never touches the TCP dispatcher path
+//      (which would fail loudly against the fake hostname).
+
+// --- Install the relay sink BEFORE importing the module under test. ---
+type FetchCall = { input: unknown; init: RequestInit & { headers?: HeadersInit } };
+const relayCalls: FetchCall[] = [];
+const realGlobalFetch = globalThis.fetch;
+
+const relaySink = (async (input: unknown, init: RequestInit = {}) => {
+  relayCalls.push({ input, init });
+  return Response.json({ via: "deno-relay" });
+}) as unknown as typeof globalThis.fetch;
+
+globalThis.fetch = relaySink;
+
+const proxyDispatcher = await import("../../open-sse/utils/proxyDispatcher.ts");
+const { proxyConfigToUrl, RELAY_TYPES } = proxyDispatcher;
+const proxyFetchMod = await import("../../open-sse/utils/proxyFetch.ts");
+const { proxyFetch, runWithProxyContext } = proxyFetchMod;
+
+test.after(() => {
+  globalThis.fetch = realGlobalFetch;
+});
+
+test.beforeEach(() => {
+  relayCalls.length = 0;
+});
+
+test("RELAY_TYPES is the single source of truth for relay-typed proxies", () => {
+  // Both edge-relay types route through the x-relay-* envelope, not a TCP
+  // dispatcher. Centralising the set prevents the upstream PR-1437 mistake of
+  // adding `|| type === "deno"` at every callsite (one is bound to be missed).
+  assert.ok(RELAY_TYPES instanceof Set, "RELAY_TYPES must be a Set");
+  assert.ok(RELAY_TYPES.has("vercel"), "vercel is a relay type");
+  assert.ok(RELAY_TYPES.has("deno"), "deno is a relay type");
+  assert.ok(!RELAY_TYPES.has("http"), "http is NOT a relay type");
+  assert.ok(!RELAY_TYPES.has("socks5"), "socks5 is NOT a relay type");
+});
+
+test("proxyConfigToUrl returns the relay URL verbatim for type:'deno'", () => {
+  const url = proxyConfigToUrl({
+    type: "deno",
+    host: "my-relay.example-org.deno.net",
+  });
+  assert.equal(url, "https://my-relay.example-org.deno.net");
+});
+
+test("proxyFetch routes a deno-type context through the relay endpoint with relay headers", async () => {
+  const DENO_CTX = {
+    type: "deno" as const,
+    host: "my-relay.example-org.deno.net",
+    relayAuth: "deno-relay-secret",
+  };
+
+  const response = await runWithProxyContext(DENO_CTX, () =>
+    proxyFetch("https://api.anthropic.com/v1/messages?x=1", {
+      method: "POST",
+      headers: { "x-existing": "keep-me" },
+    })
+  );
+
+  assert.deepEqual(await response.json(), { via: "deno-relay" });
+  assert.equal(relayCalls.length, 1, "exactly one relay dispatch");
+
+  const call = relayCalls[0];
+  assert.equal(call.input, "https://my-relay.example-org.deno.net");
+
+  const sentHeaders = new Headers(call.init.headers);
+  assert.equal(sentHeaders.get("x-relay-target"), "https://api.anthropic.com");
+  assert.equal(sentHeaders.get("x-relay-path"), "/v1/messages?x=1");
+  assert.equal(sentHeaders.get("x-relay-auth"), "deno-relay-secret");
+  assert.equal(sentHeaders.get("x-existing"), "keep-me");
+  assert.equal(call.init.method, "POST");
+  assert.equal((call.init as { duplex?: string }).duplex, "half");
+});
+
+test("proxyFetch fails closed when a deno context is missing relayAuth", async () => {
+  await assert.rejects(
+    runWithProxyContext({ type: "deno", host: "relay.example-org.deno.net" }, () =>
+      proxyFetch("https://api.anthropic.com/v1/messages", { method: "POST" })
+    ),
+    /relay configuration error: missing relayAuth/i
+  );
+  assert.equal(relayCalls.length, 0, "no relay dispatch when relayAuth is missing");
+});
diff --git a/tests/unit/proxy-pool-sync-4878.test.ts b/tests/unit/proxy-pool-sync-4878.test.ts
new file mode 100644
index 0000000000..557cd3799a
--- /dev/null
+++ b/tests/unit/proxy-pool-sync-4878.test.ts
@@ -0,0 +1,140 @@
+import "../../open-sse/utils/setupPolyfill.ts";
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-pool-sync-4878-"));
+const ORIGINAL_DATA_DIR = process.env.DATA_DIR;
+
+process.env.DATA_DIR = TEST_DATA_DIR;
+delete process.env.OMNIROUTE_API_KEY;
+
+const core = await import("../../src/lib/db/core.ts");
+const freeProxiesDb = await import("../../src/lib/db/freeProxies.ts");
+const addToPoolRoute = await import(
+  "../../src/app/api/settings/free-proxies/[id]/add-to-pool/route.ts"
+);
+const rateLimiter = await import("../../src/shared/utils/rateLimiter.ts");
+
+function reset() {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+function makeReq(): Request {
+  return new Request("http://localhost/test", { method: "POST" });
+}
+
+test.beforeEach(() => {
+  reset();
+  addToPoolRoute._resetConnectivityTesterForTests();
+});
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  if (ORIGINAL_DATA_DIR === undefined) {
+    delete process.env.DATA_DIR;
+  } else {
+    process.env.DATA_DIR = ORIGINAL_DATA_DIR;
+  }
+});
+
+// ── SUB-FIX 1: non-2xx status when the add fails ─────────────────────────────
+
+test("#4878 add-to-pool returns a non-2xx status when connectivity test fails", async () => {
+  const { id } = await freeProxiesDb.upsertFreeProxy({
+    source: "1proxy",
+    host: "10.9.0.1",
+    port: 8080,
+    type: "http",
+    countryCode: null,
+    qualityScore: null,
+    latencyMs: null,
+    anonymity: null,
+    lastValidated: null,
+  });
+
+  addToPoolRoute._setConnectivityTesterForTests(async () => ({ success: false, latencyMs: 7 }));
+
+  const res = await addToPoolRoute.POST(makeReq(), { params: Promise.resolve({ id }) });
+  assert.ok(
+    !res.ok && res.status >= 400,
+    `expected a non-2xx status on failure, got ${res.status}`
+  );
+  const body = await res.json();
+  assert.equal(body.success, false);
+  assert.ok(body.error);
+
+  // Proxy must NOT have been added to the pool.
+  const fp = await freeProxiesDb.getFreeProxyById(id);
+  assert.ok(!fp?.inPool);
+});
+
+test("#4878 add-to-pool still returns 2xx + success:true on the happy path", async () => {
+  const { id } = await freeProxiesDb.upsertFreeProxy({
+    source: "1proxy",
+    host: "10.9.0.2",
+    port: 8080,
+    type: "http",
+    countryCode: null,
+    qualityScore: null,
+    latencyMs: null,
+    anonymity: null,
+    lastValidated: null,
+  });
+
+  addToPoolRoute._setConnectivityTesterForTests(async () => ({
+    success: true,
+    latencyMs: 5,
+    publicIp: "1.2.3.4",
+  }));
+
+  const res = await addToPoolRoute.POST(makeReq(), { params: Promise.resolve({ id }) });
+  assert.ok(res.ok, `expected a 2xx status on success, got ${res.status}`);
+  const body = await res.json();
+  assert.equal(body.success, true);
+});
+
+// ── SUB-FIX 2: sync timestamp is persisted and surfaced in stats ─────────────
+
+test("#4878 recordFreeProxySync persists a lastSyncAt surfaced by getFreeProxyStats", async () => {
+  // No proxies upserted at all → MAX(last_validated) is NULL. The sync
+  // timestamp must still be reported once a sync has run.
+  const before = await freeProxiesDb.getFreeProxyStats();
+  assert.equal(before.lastSyncAt, null);
+
+  const ts = await freeProxiesDb.recordFreeProxySync();
+  assert.ok(typeof ts === "string" && ts.length > 0);
+
+  const after = await freeProxiesDb.getFreeProxyStats();
+  assert.equal(after.lastSyncAt, ts);
+});
+
+test("#4878 recordFreeProxySync advances lastSyncAt on a subsequent sync", async () => {
+  const first = await freeProxiesDb.recordFreeProxySync("2020-01-01T00:00:00.000Z");
+  assert.equal(first, "2020-01-01T00:00:00.000Z");
+  const second = await freeProxiesDb.recordFreeProxySync("2030-06-25T12:00:00.000Z");
+  assert.equal(second, "2030-06-25T12:00:00.000Z");
+
+  const stats = await freeProxiesDb.getFreeProxyStats();
+  assert.equal(stats.lastSyncAt, "2030-06-25T12:00:00.000Z");
+});
+
+// ── SUB-FIX 3: Redis error-log throttle is state-change-gated ─────────────────
+
+test("#4878 shouldLogRedisError only logs once per error-state change", () => {
+  const tracker = rateLimiter._createRedisLogThrottleForTests();
+
+  // First error in a run → log.
+  assert.equal(tracker.shouldLog("ECONNREFUSED"), true);
+  // Same error repeated (retry flood) → suppressed.
+  assert.equal(tracker.shouldLog("ECONNREFUSED"), false);
+  assert.equal(tracker.shouldLog("ECONNREFUSED"), false);
+  // A different error message → state changed → log once more.
+  assert.equal(tracker.shouldLog("ETIMEDOUT"), true);
+  assert.equal(tracker.shouldLog("ETIMEDOUT"), false);
+});
diff --git a/tests/unit/qoder-display-label.test.ts b/tests/unit/qoder-display-label.test.ts
new file mode 100644
index 0000000000..4909898bdd
--- /dev/null
+++ b/tests/unit/qoder-display-label.test.ts
@@ -0,0 +1,17 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { OAUTH_PROVIDERS, getProviderById } = await import(
+  "../../src/shared/constants/providers.ts"
+);
+
+test("Qoder provider display label is 'Qoder' (not 'Qoder AI')", () => {
+  assert.equal((OAUTH_PROVIDERS as Record<string, { name: string }>).qoder.name, "Qoder");
+});
+
+test("getProviderById('qoder') resolves the renamed display label", () => {
+  const provider = getProviderById("qoder");
+  assert.ok(provider, "qoder provider should resolve");
+  assert.equal(provider.name, "Qoder");
+  assert.notEqual(provider.name, "Qoder AI");
+});
diff --git a/tests/unit/qoder-executor.test.ts b/tests/unit/qoder-executor.test.ts
index 60fc4b21c7..18e4a534c4 100644
--- a/tests/unit/qoder-executor.test.ts
+++ b/tests/unit/qoder-executor.test.ts
@@ -285,18 +285,26 @@ test("QoderExecutor: PAT token falls back to Cosy auth when Bearer returns 401",
 
   globalThis.fetch = async (url, options) => {
     callCount++;
-    if (callCount === 1) {
+    const u = String(url);
+    if (u === "https://api.qoder.com/v1/chat/completions") {
       // First call to api.qoder.com returns 401 TOKEN_INVALID
-      assert.equal(String(url), "https://api.qoder.com/v1/chat/completions");
       assert.equal(options.headers.Authorization, "Bearer pt-0pUI-test-token");
       return new Response(JSON.stringify({ code: "TOKEN_INVALID", message: "invalid apikey" }), {
         status: 401,
         headers: { "Content-Type": "application/json" },
       });
     }
-    // Second call to api1.qoder.sh (Cosy fallback) returns SSE response
-    assert.ok(String(url).includes("api1.qoder.sh"));
-    assert.ok(String(url).includes("agent_chat_generation"));
+    if (u.includes("/jobToken/exchange")) {
+      // #4683: the PAT is exchanged for a short-lived jt-* job token before the Cosy call.
+      assert.deepEqual(JSON.parse(String(options.body)), { personal_token: "pt-0pUI-test-token" });
+      return new Response(JSON.stringify({ job_token: "jt-from-exchange", expires_in: 86400 }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      });
+    }
+    // Cosy fallback call to api1.qoder.sh returns SSE response
+    assert.ok(u.includes("api1.qoder.sh"));
+    assert.ok(u.includes("agent_chat_generation"));
     assert.ok(options.headers["Cosy-Key"]);
     assert.ok(options.headers["Cosy-User"]);
     assert.ok(options.headers["Cosy-Date"]);
@@ -315,7 +323,11 @@ test("QoderExecutor: PAT token falls back to Cosy auth when Bearer returns 401",
       credentials: { apiKey: "pt-0pUI-test-token" },
     });
 
-    assert.equal(callCount, 2, "Should have made 2 fetch calls (1 Bearer + 1 Cosy)");
+    assert.equal(
+      callCount,
+      3,
+      "Should have made 3 fetch calls (1 Bearer + 1 jobToken exchange + 1 Cosy)"
+    );
     assert.equal(response.status, 200);
     const payload = await response.json();
     assert.equal(payload.object, "chat.completion");
diff --git a/tests/unit/qoder-jobtoken-exchange-4683.test.ts b/tests/unit/qoder-jobtoken-exchange-4683.test.ts
new file mode 100644
index 0000000000..e3a24e4d0c
--- /dev/null
+++ b/tests/unit/qoder-jobtoken-exchange-4683.test.ts
@@ -0,0 +1,129 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+// #4683: Qoder PAT (`pt-*`) chat requests failed with a Cosy 500 because OmniRoute
+// injected the raw `pt-*` PAT into the Cosy `security_oauth_token`. The official
+// qodercli uses a TWO-step flow: exchange the PAT for a short-lived `jt-*` job token
+// at openapi.qoder.sh/api/v1/jobToken/exchange, then carry the `jt-*` in the Cosy
+// envelope. These tests assert the exchange now happens and the `jt-*` is what flows
+// downstream — the raw `pt-*` must never be the Cosy token anymore.
+
+const {
+  parseQoderJobTokenResponse,
+  exchangeQoderJobToken,
+  resolveQoderJobToken,
+  isQoderPatToken,
+  validateQoderCliPat,
+  __clearQoderJobTokenCache,
+} = await import("../../open-sse/services/qoderCli.ts");
+
+function jsonResponse(body: unknown, init: { ok?: boolean; status?: number } = {}) {
+  return {
+    ok: init.ok ?? true,
+    status: init.status ?? 200,
+    json: async () => body,
+    text: async () => (typeof body === "string" ? body : JSON.stringify(body)),
+  } as unknown as Response;
+}
+
+test("#4683 isQoderPatToken only matches pt-* tokens", () => {
+  assert.equal(isQoderPatToken("pt-abc"), true);
+  assert.equal(isQoderPatToken("jt-abc"), false);
+  assert.equal(isQoderPatToken("sk-abc"), false);
+  assert.equal(isQoderPatToken(""), false);
+});
+
+test("#4683 parseQoderJobTokenResponse extracts jt-* across response shapes", () => {
+  assert.equal(parseQoderJobTokenResponse({ job_token: "jt-1" })?.jobToken, "jt-1");
+  assert.equal(parseQoderJobTokenResponse({ data: { jobToken: "jt-2" } })?.jobToken, "jt-2");
+  // expires_in is reported in seconds -> milliseconds.
+  assert.equal(
+    parseQoderJobTokenResponse({ job_token: "jt-3", expires_in: 86400 })?.expiresInMs,
+    86400 * 1000
+  );
+  // No jt-* anywhere -> null.
+  assert.equal(parseQoderJobTokenResponse({ token: "pt-nope" }), null);
+  assert.equal(parseQoderJobTokenResponse(null), null);
+});
+
+test("#4683 exchangeQoderJobToken POSTs the PAT to the exchange endpoint", async () => {
+  const calls: { url: string; body: unknown }[] = [];
+  const fetchImpl = async (url: string, init?: Record<string, unknown>) => {
+    calls.push({ url, body: JSON.parse(String(init?.body ?? "{}")) });
+    return jsonResponse({ job_token: "jt-from-exchange", expires_in: 86400 });
+  };
+
+  const result = await exchangeQoderJobToken("pt-secret", { fetchImpl });
+  assert.equal(result?.jobToken, "jt-from-exchange");
+  assert.equal(calls.length, 1);
+  assert.match(calls[0].url, /openapi\.qoder\.sh\/api\/v1\/jobToken\/exchange/);
+  assert.deepEqual(calls[0].body, { personal_token: "pt-secret" });
+});
+
+test("#4683 resolveQoderJobToken exchanges a pt-* once and caches the jt-*", async () => {
+  __clearQoderJobTokenCache();
+  let fetchCount = 0;
+  const fetchImpl = async () => {
+    fetchCount += 1;
+    return jsonResponse({ job_token: "jt-cached", expires_in: 86400 });
+  };
+
+  const first = await resolveQoderJobToken("pt-x", { fetchImpl, now: 1_000 });
+  const second = await resolveQoderJobToken("pt-x", { fetchImpl, now: 2_000 });
+  assert.equal(first, "jt-cached");
+  assert.equal(second, "jt-cached");
+  assert.equal(fetchCount, 1, "second resolve must hit the cache, not re-exchange");
+  __clearQoderJobTokenCache();
+});
+
+test("#4683 resolveQoderJobToken passes a jt-* through without exchanging", async () => {
+  __clearQoderJobTokenCache();
+  let fetchCount = 0;
+  const fetchImpl = async () => {
+    fetchCount += 1;
+    return jsonResponse({ job_token: "jt-unused" });
+  };
+  const resolved = await resolveQoderJobToken("jt-already", { fetchImpl });
+  assert.equal(resolved, "jt-already");
+  assert.equal(fetchCount, 0);
+});
+
+test("#4683 resolveQoderJobToken falls back to the PAT when the exchange fails", async () => {
+  __clearQoderJobTokenCache();
+  const fetchImpl = async () => jsonResponse({ error: "nope" }, { ok: false, status: 500 });
+  const resolved = await resolveQoderJobToken("pt-y", { fetchImpl });
+  assert.equal(resolved, "pt-y", "graceful fallback keeps prior behavior");
+  __clearQoderJobTokenCache();
+});
+
+test("#4683 validateQoderCliPat performs the jobToken exchange before the Cosy chat call", async () => {
+  __clearQoderJobTokenCache();
+  const originalFetch = globalThis.fetch;
+  const urls: string[] = [];
+  // @ts-ignore - test stub
+  globalThis.fetch = async (url: string, init?: Record<string, unknown>) => {
+    urls.push(String(url));
+    if (String(url).includes("/ping")) return jsonResponse({ ok: true });
+    if (String(url).includes("/jobToken/exchange")) {
+      assert.deepEqual(JSON.parse(String(init?.body ?? "{}")), { personal_token: "pt-live" });
+      return jsonResponse({ job_token: "jt-live", expires_in: 86400 });
+    }
+    // agent_chat_generation -> accept (valid)
+    return jsonResponse({ success: true }, { ok: true, status: 200 });
+  };
+
+  try {
+    const res = await validateQoderCliPat({ apiKey: "pt-live" });
+    assert.equal(res.valid, true);
+    const exchangeIdx = urls.findIndex((u) => u.includes("/jobToken/exchange"));
+    const chatIdx = urls.findIndex((u) => u.includes("agent_chat_generation"));
+    assert.ok(
+      exchangeIdx >= 0,
+      "the PAT->job-token exchange step must run (was skipped before #4683)"
+    );
+    assert.ok(chatIdx >= 0 && exchangeIdx < chatIdx, "exchange must precede the Cosy chat call");
+  } finally {
+    globalThis.fetch = originalFetch;
+    __clearQoderJobTokenCache();
+  }
+});
diff --git a/tests/unit/quota-account-buckets.test.ts b/tests/unit/quota-account-buckets.test.ts
new file mode 100644
index 0000000000..a1e5f944b1
--- /dev/null
+++ b/tests/unit/quota-account-buckets.test.ts
@@ -0,0 +1,222 @@
+/**
+ * tests/unit/quota-account-buckets.test.ts
+ *
+ * Unit tests for src/lib/quota/accountBuckets.ts.
+ *
+ * Required cases (Phase 3 #3):
+ *   - 5h reaches limit → saturated; after resets_at passes → auto-eligible (lazy)
+ *   - per-model buckets independent: 7d:opus saturated does NOT saturate 7d:sonnet
+ *   - concurrent 5h and 7d: saturating 5h does NOT saturate 7d
+ *   - fail-open: no data → not saturated
+ *
+ * The clock is injected via `nowMs` so the lazy-reset behaviour is deterministic
+ * (no real Date.now() on the tested path).
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  isBucketSaturated,
+  recordUsage,
+  updateAccountBuckets,
+  _clearBucketsForTest,
+  _bucketCountForTest,
+  SATURATION_THRESHOLD_PCT,
+  type ClaudeUsageResult,
+  type UsageQuotaSlim,
+} from "../../src/lib/quota/accountBuckets.ts";
+
+// Fixed epoch for deterministic tests — 2026-06-24T12:00:00Z.
+const NOW = Date.UTC(2026, 5, 24, 12, 0, 0);
+const ONE_HOUR_MS = 60 * 60 * 1000;
+const FUTURE_ISO = new Date(NOW + ONE_HOUR_MS).toISOString(); // window still open
+const PAST_ISO = new Date(NOW - ONE_HOUR_MS).toISOString(); // window already reset
+
+function makeQuota(used: number, resetAt: string | null): UsageQuotaSlim {
+  return { used, total: 100, resetAt };
+}
+
+test.beforeEach(() => {
+  _clearBucketsForTest();
+});
+
+// ─── fail-open ────────────────────────────────────────────────────────────────
+
+test("isBucketSaturated: no entry → false (fail-open, no data)", () => {
+  assert.equal(isBucketSaturated("conn-1", "5h", NOW), false);
+  assert.equal(isBucketSaturated("conn-1", "7d", NOW), false);
+  assert.equal(isBucketSaturated("conn-1", "7d:opus", NOW), false);
+});
+
+test("isBucketSaturated: empty connectionId or windowKey → false", () => {
+  assert.equal(isBucketSaturated("", "5h", NOW), false);
+  assert.equal(isBucketSaturated("conn-1", "", NOW), false);
+});
+
+// ─── 5h window saturation + lazy reset ───────────────────────────────────────
+
+test("5h bucket: reaches 100% → saturated; after resets_at passes → auto-eligible (lazy)", () => {
+  const connectionId = "conn-5h";
+  const windowKey = "5h";
+
+  recordUsage(connectionId, windowKey, 100, FUTURE_ISO, NOW);
+  assert.equal(isBucketSaturated(connectionId, windowKey, NOW), true, "should be saturated at 100%");
+
+  // Advance the clock past resets_at — lazy reset fires on the next read.
+  const afterReset = NOW + ONE_HOUR_MS + 1;
+  assert.equal(
+    isBucketSaturated(connectionId, windowKey, afterReset),
+    false,
+    "should be eligible again once resets_at has passed"
+  );
+});
+
+test("5h bucket: 99% (below threshold) → NOT saturated", () => {
+  recordUsage("conn-99pct", "5h", 99, FUTURE_ISO, NOW);
+  assert.equal(isBucketSaturated("conn-99pct", "5h", NOW), false);
+});
+
+test("SATURATION_THRESHOLD_PCT is 100", () => {
+  assert.equal(SATURATION_THRESHOLD_PCT, 100);
+});
+
+test("5h bucket: stale signal (resets_at already past) is NOT recorded", () => {
+  recordUsage("conn-stale", "5h", 100, PAST_ISO, NOW);
+  assert.equal(isBucketSaturated("conn-stale", "5h", NOW), false);
+  assert.equal(_bucketCountForTest(), 0);
+});
+
+// ─── 7d window ───────────────────────────────────────────────────────────────
+
+test("7d bucket: reaches 100% → saturated", () => {
+  recordUsage("conn-7d", "7d", 100, FUTURE_ISO, NOW);
+  assert.equal(isBucketSaturated("conn-7d", "7d", NOW), true);
+});
+
+test("concurrent windows: saturating 5h does NOT saturate 7d", () => {
+  recordUsage("conn-two-windows", "5h", 100, FUTURE_ISO, NOW);
+  assert.equal(isBucketSaturated("conn-two-windows", "5h", NOW), true, "5h should be saturated");
+  assert.equal(isBucketSaturated("conn-two-windows", "7d", NOW), false, "7d should NOT be saturated");
+});
+
+test("concurrent windows: saturating 7d does NOT saturate 5h", () => {
+  recordUsage("conn-7d-only", "7d", 100, FUTURE_ISO, NOW);
+  assert.equal(isBucketSaturated("conn-7d-only", "7d", NOW), true, "7d should be saturated");
+  assert.equal(isBucketSaturated("conn-7d-only", "5h", NOW), false, "5h should NOT be saturated");
+});
+
+// ─── per-model buckets ────────────────────────────────────────────────────────
+
+test("per-model buckets are independent: 7d:opus saturated does NOT saturate 7d:sonnet", () => {
+  recordUsage("conn-models", "7d:opus", 100, FUTURE_ISO, NOW);
+  assert.equal(isBucketSaturated("conn-models", "7d:opus", NOW), true, "opus should be saturated");
+  assert.equal(
+    isBucketSaturated("conn-models", "7d:sonnet", NOW),
+    false,
+    "sonnet should NOT be saturated"
+  );
+});
+
+test("per-model: 7d:sonnet saturated does NOT affect the base 7d bucket", () => {
+  recordUsage("conn-pm-base", "7d:sonnet", 100, FUTURE_ISO, NOW);
+  assert.equal(isBucketSaturated("conn-pm-base", "7d:sonnet", NOW), true);
+  assert.equal(isBucketSaturated("conn-pm-base", "7d", NOW), false, "base 7d should be independent");
+});
+
+test("per-model: lazy reset works for 7d:designer", () => {
+  recordUsage("conn-designer", "7d:designer", 100, FUTURE_ISO, NOW);
+  assert.equal(isBucketSaturated("conn-designer", "7d:designer", NOW), true);
+
+  const afterReset = NOW + ONE_HOUR_MS + 1;
+  assert.equal(isBucketSaturated("conn-designer", "7d:designer", afterReset), false);
+});
+
+// ─── updateAccountBuckets mapping (getClaudeUsage shape) ──────────────────────
+
+test("updateAccountBuckets: null result → no-op (fail-open)", () => {
+  updateAccountBuckets("conn-null", null, NOW);
+  assert.equal(_bucketCountForTest(), 0);
+});
+
+test("updateAccountBuckets: empty quotas → no-op", () => {
+  updateAccountBuckets("conn-empty", { quotas: {} }, NOW);
+  assert.equal(_bucketCountForTest(), 0);
+});
+
+test("updateAccountBuckets: 'session (5h)' maps to '5h' window key", () => {
+  const usage: ClaudeUsageResult = {
+    quotas: { "session (5h)": makeQuota(100, FUTURE_ISO) },
+  };
+  updateAccountBuckets("conn-map-5h", usage, NOW);
+  assert.equal(isBucketSaturated("conn-map-5h", "5h", NOW), true);
+});
+
+test("updateAccountBuckets: 'weekly (7d)' maps to '7d' window key", () => {
+  const usage: ClaudeUsageResult = {
+    quotas: { "weekly (7d)": makeQuota(100, FUTURE_ISO) },
+  };
+  updateAccountBuckets("conn-map-7d", usage, NOW);
+  assert.equal(isBucketSaturated("conn-map-7d", "7d", NOW), true);
+});
+
+test("updateAccountBuckets: 'weekly designer (7d)' maps to '7d:designer' (base 7d unaffected)", () => {
+  const usage: ClaudeUsageResult = {
+    quotas: { "weekly designer (7d)": makeQuota(100, FUTURE_ISO) },
+  };
+  updateAccountBuckets("conn-designer-map", usage, NOW);
+  assert.equal(isBucketSaturated("conn-designer-map", "7d:designer", NOW), true);
+  assert.equal(isBucketSaturated("conn-designer-map", "7d", NOW), false, "base 7d unaffected");
+});
+
+test("updateAccountBuckets: an unsaturated update clears a previously saturated bucket", () => {
+  recordUsage("conn-unsaturate", "5h", 100, FUTURE_ISO, NOW);
+  assert.equal(isBucketSaturated("conn-unsaturate", "5h", NOW), true);
+
+  const usage: ClaudeUsageResult = {
+    quotas: { "session (5h)": makeQuota(50, FUTURE_ISO) },
+  };
+  updateAccountBuckets("conn-unsaturate", usage, NOW);
+  assert.equal(
+    isBucketSaturated("conn-unsaturate", "5h", NOW),
+    false,
+    "should be cleared when the latest reading is below threshold"
+  );
+});
+
+test("updateAccountBuckets: multiple windows recorded from one usage payload", () => {
+  const usage: ClaudeUsageResult = {
+    quotas: {
+      "session (5h)": makeQuota(100, FUTURE_ISO),
+      "weekly (7d)": makeQuota(85, FUTURE_ISO), // not saturated
+      "weekly designer (7d)": makeQuota(100, FUTURE_ISO),
+    },
+  };
+  updateAccountBuckets("conn-multi", usage, NOW);
+  assert.equal(isBucketSaturated("conn-multi", "5h", NOW), true, "5h saturated");
+  assert.equal(isBucketSaturated("conn-multi", "7d", NOW), false, "7d at 85% not saturated");
+  assert.equal(isBucketSaturated("conn-multi", "7d:designer", NOW), true, "designer 7d saturated");
+});
+
+// ─── recordUsage guards ───────────────────────────────────────────────────────
+
+test("recordUsage: no-op when connectionId is empty", () => {
+  recordUsage("", "5h", 100, FUTURE_ISO, NOW);
+  assert.equal(_bucketCountForTest(), 0);
+});
+
+test("recordUsage: no-op when windowKey is empty", () => {
+  recordUsage("conn-empty-wk", "", 100, FUTURE_ISO, NOW);
+  assert.equal(_bucketCountForTest(), 0);
+});
+
+test("recordUsage: null resetAt → saturated with unknown reset (lazy reset cannot fire)", () => {
+  recordUsage("conn-null-reset", "5h", 100, null, NOW);
+  assert.equal(isBucketSaturated("conn-null-reset", "5h", NOW), true);
+  // Without a known resets_at, the lazy reset has nothing to compare against.
+  assert.equal(
+    isBucketSaturated("conn-null-reset", "5h", NOW + 24 * ONE_HOUR_MS),
+    true,
+    "stays saturated until a fresh non-saturated reading clears it"
+  );
+});
diff --git a/tests/unit/quota-combo-balancing.test.ts b/tests/unit/quota-combo-balancing.test.ts
index 7af1eb9a26..f5cd331499 100644
--- a/tests/unit/quota-combo-balancing.test.ts
+++ b/tests/unit/quota-combo-balancing.test.ts
@@ -3,7 +3,7 @@
  *
  * Task 4 TDD — Fix same-provider combo collision:
  * a pool with N connections to the same provider must produce ONE combo
- * per model with ALL connection steps + strategy "fill-first".
+ * per model with ALL connection steps + strategy "quota-share".
  *
  * Uses "openrouter" (1 model: "auto") as test provider.
  */
@@ -19,9 +19,7 @@ import path from "node:path";
 // load. Never delete the SQLite file between tests — under --test-concurrency=4
 // modules are cached across files and SQLITE_FILE is frozen at first import.
 // Wipe test data via SQL DELETEs instead to avoid cross-file path corruption.
-const TEST_DATA_DIR = fs.mkdtempSync(
-  path.join(os.tmpdir(), "omniroute-quota-combo-balancing-")
-);
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-quota-combo-balancing-"));
 process.env.DATA_DIR = TEST_DATA_DIR;
 
 const core = await import("../../src/lib/db/core.ts");
@@ -29,9 +27,8 @@ const poolsDb = await import("../../src/lib/db/quotaPools.ts");
 const providersDb = await import("../../src/lib/db/providers.ts");
 const combosDb = await import("../../src/lib/db/combos.ts");
 const { syncQuotaCombos } = await import("../../src/lib/quota/quotaCombos.ts");
-const { isQuotaModelName, quotaModelName } = await import(
-  "../../src/lib/quota/quotaModelNaming.ts"
-);
+const { isQuotaModelName, quotaModelName } =
+  await import("../../src/lib/quota/quotaModelNaming.ts");
 const { PROVIDER_MODELS } = await import("../../open-sse/config/providerModels.ts");
 
 // Trigger migration once at module load so the schema is ready for the first
@@ -98,7 +95,9 @@ test.after(() => {
 // Helper
 // ---------------------------------------------------------------------------
 
-async function listQuotaCombos(): Promise<Array<{ name: string; models: unknown[]; strategy: unknown }>> {
+async function listQuotaCombos(): Promise<
+  Array<{ name: string; models: unknown[]; strategy: unknown }>
+> {
   const all = await combosDb.getCombos();
   return all
     .filter((c) => typeof c.name === "string" && isQuotaModelName(c.name as string))
@@ -116,7 +115,7 @@ const FIRST_MODEL = "auto"; // single model in openrouter registry
 // B1 — 2-connection same-provider pool: one combo per model with 2 steps
 // ---------------------------------------------------------------------------
 
-test("B1: syncQuotaCombos — 2-connection same-provider pool produces ONE combo per model with 2 steps + fill-first", async () => {
+test("B1: syncQuotaCombos — 2-connection same-provider pool produces ONE combo per model with 2 steps + quota-share", async () => {
   const modelsForProvider = (PROVIDER_MODELS[PROVIDER] ?? []).map((m) => m.id);
   assert.ok(modelsForProvider.length > 0, `${PROVIDER} must have at least one model in registry`);
 
@@ -152,7 +151,7 @@ test("B1: syncQuotaCombos — 2-connection same-provider pool produces ONE combo
     `expected exactly ${modelsForProvider.length} combo(s), one per model`
   );
 
-  // For each model, assert: one combo, 2 steps, fill-first, both connIds present.
+  // For each model, assert: one combo, 2 steps, quota-share, both connIds present.
   for (const modelId of modelsForProvider) {
     // B4: combos are named with the GROUP name ("GroupDemo"), not pool name.
     const comboName = quotaModelName("GroupDemo", PROVIDER, modelId);
@@ -167,11 +166,11 @@ test("B1: syncQuotaCombos — 2-connection same-provider pool produces ONE combo
 
     const combo = matchingCombos[0];
 
-    // Strategy must be fill-first.
+    // Strategy must be quota-share.
     assert.equal(
       combo.strategy,
-      "fill-first",
-      `combo "${comboName}" strategy should be "fill-first", got "${combo.strategy}"`
+      "quota-share",
+      `combo "${comboName}" strategy should be "quota-share", got "${combo.strategy}"`
     );
 
     // Must have exactly 2 steps (one per connection).
@@ -182,9 +181,7 @@ test("B1: syncQuotaCombos — 2-connection same-provider pool produces ONE combo
     );
 
     // Both connection IDs must appear in the steps.
-    const stepConnIds = (combo.models as Array<Record<string, unknown>>).map(
-      (s) => s.connectionId
-    );
+    const stepConnIds = (combo.models as Array<Record<string, unknown>>).map((s) => s.connectionId);
     assert.ok(
       stepConnIds.includes(idA),
       `combo "${comboName}" steps should include connA (${idA}), got: ${JSON.stringify(stepConnIds)}`
@@ -286,7 +283,11 @@ test("B3: syncQuotaCombos — idempotent on 2-connection pool (no duplicates aft
       2,
       `after 2nd sync, combo "${combo.name}" should still have 2 steps, got ${combo.models.length}`
     );
-    assert.equal(combo.strategy, "fill-first", `combo "${combo.name}" strategy must remain "fill-first"`);
+    assert.equal(
+      combo.strategy,
+      "quota-share",
+      `combo "${combo.name}" strategy must remain "quota-share"`
+    );
   }
 });
 
@@ -388,7 +389,11 @@ test("B5: after syncQuotaCombos on 2-connection pool, getComboByName returns the
     2,
     `combo "${comboName}" models.length should be 2, got ${(found.models as unknown[]).length}`
   );
-  assert.equal(found.strategy, "fill-first", `combo "${comboName}" strategy should be "fill-first"`);
+  assert.equal(
+    found.strategy,
+    "quota-share",
+    `combo "${comboName}" strategy should be "quota-share"`
+  );
 
   // Verify no second combo by scanning all combos for the same name.
   const all = await combosDb.getCombos();
diff --git a/tests/unit/quota-combos-sync.test.ts b/tests/unit/quota-combos-sync.test.ts
index 0d3c74c0f6..a0a1b5b502 100644
--- a/tests/unit/quota-combos-sync.test.ts
+++ b/tests/unit/quota-combos-sync.test.ts
@@ -332,3 +332,90 @@ test("removeQuotaCombosForPool: unknown pool id — no throw", async () => {
     "removeQuotaCombosForPool with unknown poolId should not throw"
   );
 });
+
+// ---------------------------------------------------------------------------
+// Guard B (issue #10): a pool whose connections no longer resolve (empty/dangling
+// connection list) must NOT prune/delete the group's existing combos. Pruning is
+// provider-scoped, and with no resolvable connection the provider is unknown — so
+// syncQuotaCombos returns early (poolProvider === undefined) BEFORE the prune loop.
+// This proves the `if (!poolProvider) return` guard covers the empty-connection
+// path: a transient connection-resolution failure cannot wipe a group's combos.
+// ---------------------------------------------------------------------------
+
+test("syncQuotaCombos: pool with no resolvable connection does NOT prune existing combos (Guard B)", async () => {
+  // 1. Seed a glm connection + pool and mint combos.
+  const conn = await providersDb.createProviderConnection({
+    provider: "glm",
+    authType: "apikey",
+    name: "quota-combos-guardB",
+    apiKey: "sk-test-glm-guardb",
+  });
+  const connId = (conn as Record<string, unknown>).id as string;
+  const pool = poolsDb.createPool({ connectionId: connId, name: "GuardBPool" });
+
+  await syncQuotaCombos(pool.id);
+  const before = await listQuotaCombos();
+  assert.ok(before.length > 0, "expected combos after initial sync");
+  const beforeNames = new Set(before.map((c) => c.name));
+
+  // 2. Delete the provider connection while the pool still references it.
+  //    The join row (quota_pool_connections) remains → getConnectionIds returns a
+  //    dangling id whose getProviderConnectionById() resolves to null. This is the
+  //    "connections do not resolve" scenario.
+  const removed = await providersDb.deleteProviderConnection(connId);
+  assert.equal(removed, true, "connection should be deleted");
+  assert.equal(
+    await providersDb.getProviderConnectionById(connId),
+    null,
+    "connection must no longer resolve"
+  );
+
+  // 3. Re-sync. With no resolvable connection, poolProvider is undefined → the
+  //    guard returns before pruning. Existing combos must be untouched.
+  await syncQuotaCombos(pool.id);
+
+  const after = await listQuotaCombos();
+  assert.equal(
+    after.length,
+    before.length,
+    "combos must NOT be pruned when the pool has no resolvable connection"
+  );
+  for (const name of beforeNames) {
+    const stillThere = after.some((c) => c.name === name);
+    assert.ok(stillThere, `combo was wrongly pruned: ${name}`);
+  }
+});
+
+test("syncQuotaCombos: pool whose join table is emptied (truly no connectionIds) does NOT prune combos (Guard B)", async () => {
+  // Variant of Guard B where the join table itself is empty AND the primary
+  // connection is gone — connectionIds falls back to [pool.connectionId], which
+  // also fails to resolve. Still must not prune.
+  const conn = await providersDb.createProviderConnection({
+    provider: "glm",
+    authType: "apikey",
+    name: "quota-combos-guardB-empty",
+    apiKey: "sk-test-glm-guardb-empty",
+  });
+  const connId = (conn as Record<string, unknown>).id as string;
+  const pool = poolsDb.createPool({ connectionId: connId, name: "GuardBEmptyPool" });
+
+  await syncQuotaCombos(pool.id);
+  const before = await listQuotaCombos();
+  assert.ok(before.length > 0, "expected combos after initial sync");
+
+  // Empty the join table for this pool AND delete the connection row.
+  const db = core.getDbInstance() as unknown as {
+    prepare: (sql: string) => { run: (...p: unknown[]) => unknown };
+  };
+  db.prepare("DELETE FROM quota_pool_connections WHERE pool_id = ?").run(pool.id);
+  await providersDb.deleteProviderConnection(connId);
+
+  await syncQuotaCombos(pool.id);
+
+  const after = await listQuotaCombos();
+  assert.equal(
+    after.length,
+    before.length,
+    "combos must survive when the pool has an empty/unresolvable connection set"
+  );
+});
diff --git a/tests/unit/quota-connection-recovery.test.ts b/tests/unit/quota-connection-recovery.test.ts
new file mode 100644
index 0000000000..24120ab1ac
--- /dev/null
+++ b/tests/unit/quota-connection-recovery.test.ts
@@ -0,0 +1,212 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  isRecoverableCooldownConnection,
+  resolveConnectionRecoveryIntervalMs,
+  runConnectionRecoveryTick,
+  selectRecoverableConnections,
+  type RecoverableConnectionInput,
+} from "../../src/lib/quota/connectionRecovery.ts";
+
+const NOW = Date.UTC(2026, 5, 23, 12, 0, 0); // fixed clock for deterministic tests
+const PAST = new Date(NOW - 60_000).toISOString(); // 60s in the past → cooldown elapsed
+const FUTURE = new Date(NOW + 60_000).toISOString(); // 60s in the future → still cooling
+
+function conn(overrides: Partial<RecoverableConnectionInput>): RecoverableConnectionInput {
+  // Use the `in` operator so an EXPLICIT null/undefined override is honored
+  // (??/|| would collapse it back to the default and hide the no-cooldown case).
+  return {
+    id: "id" in overrides ? (overrides.id as string) : "c1",
+    testStatus: "testStatus" in overrides ? overrides.testStatus : "unavailable",
+    rateLimitedUntil: "rateLimitedUntil" in overrides ? overrides.rateLimitedUntil : PAST,
+  };
+}
+
+test("isRecoverableCooldownConnection: unavailable + elapsed cooldown → recoverable", () => {
+  assert.equal(
+    isRecoverableCooldownConnection(conn({ testStatus: "unavailable", rateLimitedUntil: PAST }), NOW),
+    true
+  );
+});
+
+test("isRecoverableCooldownConnection: cooldown still in the future → NOT recoverable", () => {
+  assert.equal(
+    isRecoverableCooldownConnection(
+      conn({ testStatus: "unavailable", rateLimitedUntil: FUTURE }),
+      NOW
+    ),
+    false
+  );
+});
+
+test("isRecoverableCooldownConnection: terminal states are never recovered", () => {
+  for (const status of ["banned", "expired", "credits_exhausted"]) {
+    assert.equal(
+      isRecoverableCooldownConnection(conn({ testStatus: status, rateLimitedUntil: PAST }), NOW),
+      false,
+      `${status} must not be recoverable`
+    );
+  }
+});
+
+test("isRecoverableCooldownConnection: terminal-status matching is case/space insensitive", () => {
+  assert.equal(
+    isRecoverableCooldownConnection(conn({ testStatus: " Banned ", rateLimitedUntil: PAST }), NOW),
+    false
+  );
+});
+
+test("isRecoverableCooldownConnection: no rateLimitedUntil → NOT recoverable", () => {
+  assert.equal(
+    isRecoverableCooldownConnection(conn({ testStatus: "unavailable", rateLimitedUntil: null }), NOW),
+    false
+  );
+  assert.equal(
+    isRecoverableCooldownConnection(
+      conn({ testStatus: "unavailable", rateLimitedUntil: undefined }),
+      NOW
+    ),
+    false
+  );
+});
+
+test("isRecoverableCooldownConnection: status other than 'unavailable' is left alone", () => {
+  // Only the transient-cooldown status should be proactively restored. An
+  // 'active' or null status with a stale rateLimitedUntil is not this job's
+  // concern (the lazy backoff-decay path already handles active rows).
+  assert.equal(
+    isRecoverableCooldownConnection(conn({ testStatus: "active", rateLimitedUntil: PAST }), NOW),
+    false
+  );
+  assert.equal(
+    isRecoverableCooldownConnection(conn({ testStatus: null, rateLimitedUntil: PAST }), NOW),
+    false
+  );
+});
+
+test("isRecoverableCooldownConnection: missing connection id → NOT recoverable", () => {
+  assert.equal(
+    isRecoverableCooldownConnection(conn({ id: "", rateLimitedUntil: PAST }), NOW),
+    false
+  );
+});
+
+test("isRecoverableCooldownConnection: numeric-epoch rateLimitedUntil string is tolerated", () => {
+  // The rate_limited_until TEXT column can hold a numeric epoch string (#3954).
+  assert.equal(
+    isRecoverableCooldownConnection(
+      conn({ testStatus: "unavailable", rateLimitedUntil: String(NOW - 1_000) }),
+      NOW
+    ),
+    true
+  );
+  assert.equal(
+    isRecoverableCooldownConnection(
+      conn({ testStatus: "unavailable", rateLimitedUntil: String(NOW + 1_000) }),
+      NOW
+    ),
+    false
+  );
+});
+
+test("selectRecoverableConnections returns only the elapsed-cooldown unavailable rows", () => {
+  const connections: RecoverableConnectionInput[] = [
+    conn({ id: "elapsed", testStatus: "unavailable", rateLimitedUntil: PAST }),
+    conn({ id: "still-cooling", testStatus: "unavailable", rateLimitedUntil: FUTURE }),
+    conn({ id: "banned", testStatus: "banned", rateLimitedUntil: PAST }),
+    conn({ id: "expired", testStatus: "expired", rateLimitedUntil: PAST }),
+    conn({ id: "credits", testStatus: "credits_exhausted", rateLimitedUntil: PAST }),
+    conn({ id: "no-cooldown", testStatus: "unavailable", rateLimitedUntil: null }),
+    conn({ id: "active", testStatus: "active", rateLimitedUntil: PAST }),
+  ];
+
+  const recoverable = selectRecoverableConnections(connections, NOW);
+  assert.deepEqual(
+    recoverable.map((c) => c.id),
+    ["elapsed"]
+  );
+});
+
+test("selectRecoverableConnections returns [] for empty / non-array input", () => {
+  assert.deepEqual(selectRecoverableConnections([], NOW), []);
+  assert.deepEqual(
+    selectRecoverableConnections(undefined as unknown as RecoverableConnectionInput[], NOW),
+    []
+  );
+});
+
+test("selectRecoverableConnections does not mutate the input array", () => {
+  const connections: RecoverableConnectionInput[] = [
+    conn({ id: "a", rateLimitedUntil: PAST }),
+    conn({ id: "b", rateLimitedUntil: FUTURE }),
+  ];
+  const before = connections.length;
+  selectRecoverableConnections(connections, NOW);
+  assert.equal(connections.length, before);
+});
+
+test("runConnectionRecoveryTick clears only the elapsed-cooldown connections (injected deps, no DB)", async () => {
+  const cleared: string[] = [];
+  const result = await runConnectionRecoveryTick({
+    nowMs: NOW,
+    loadConnections: async () => [
+      conn({ id: "elapsed", testStatus: "unavailable", rateLimitedUntil: PAST }),
+      conn({ id: "still-cooling", testStatus: "unavailable", rateLimitedUntil: FUTURE }),
+      conn({ id: "banned", testStatus: "banned", rateLimitedUntil: PAST }),
+      conn({ id: "active", testStatus: "active", rateLimitedUntil: PAST }),
+    ],
+    clearConnectionError: async (connectionId) => {
+      cleared.push(connectionId);
+    },
+  });
+
+  assert.deepEqual(cleared, ["elapsed"]);
+  assert.equal(result.scanned, 4);
+  assert.equal(result.recovered, 1);
+  assert.deepEqual(result.recoveredIds, ["elapsed"]);
+});
+
+test("runConnectionRecoveryTick isolates a per-connection clear failure (others still recovered)", async () => {
+  const cleared: string[] = [];
+  const warnings: string[] = [];
+  const result = await runConnectionRecoveryTick({
+    nowMs: NOW,
+    loadConnections: async () => [
+      conn({ id: "boom", testStatus: "unavailable", rateLimitedUntil: PAST }),
+      conn({ id: "ok", testStatus: "unavailable", rateLimitedUntil: PAST }),
+    ],
+    clearConnectionError: async (connectionId) => {
+      if (connectionId === "boom") throw new Error("db write failed");
+      cleared.push(connectionId);
+    },
+    logger: { warn: (m) => warnings.push(m) },
+  });
+
+  assert.deepEqual(cleared, ["ok"]);
+  assert.equal(result.recovered, 1);
+  assert.equal(warnings.length, 1);
+});
+
+test("runConnectionRecoveryTick returns a zero result and never throws when loading fails", async () => {
+  const result = await runConnectionRecoveryTick({
+    nowMs: NOW,
+    loadConnections: async () => {
+      throw new Error("DB unavailable");
+    },
+    clearConnectionError: async () => {
+      throw new Error("must not be called");
+    },
+  });
+  assert.deepEqual(result, { scanned: 0, recovered: 0, recoveredIds: [] });
+});
+
+test("resolveConnectionRecoveryIntervalMs defaults to 60s and clamps to a floor", () => {
+  assert.equal(resolveConnectionRecoveryIntervalMs(undefined), 60_000);
+  assert.equal(resolveConnectionRecoveryIntervalMs(""), 60_000);
+  assert.equal(resolveConnectionRecoveryIntervalMs("not-a-number"), 60_000);
+  assert.equal(resolveConnectionRecoveryIntervalMs("0"), 60_000);
+  assert.equal(resolveConnectionRecoveryIntervalMs("-5"), 60_000);
+  assert.equal(resolveConnectionRecoveryIntervalMs("120000"), 120_000);
+  assert.equal(resolveConnectionRecoveryIntervalMs("1000"), 5_000); // clamped up to MIN_TICK_MS
+});
diff --git a/tests/unit/quota-epsilon-unconfigured-allow.test.ts b/tests/unit/quota-epsilon-unconfigured-allow.test.ts
new file mode 100644
index 0000000000..1d93c6053e
--- /dev/null
+++ b/tests/unit/quota-epsilon-unconfigured-allow.test.ts
@@ -0,0 +1,98 @@
+/**
+ * tests/unit/quota-epsilon-unconfigured-allow.test.ts
+ *
+ * Bug: a quota pool whose provider plan carries a PLACEHOLDER limit
+ * (Number.EPSILON — glm / minimax / kimi-coding / deepseek in planRegistry.ts,
+ * meaning "limit unknown, set it manually in the Wizard 'Limite' step") blocks
+ * every request AFTER the first one.
+ *
+ * decideFairShare's global-saturated gate fires as soon as
+ *   consumedTotal >= effectiveLimit
+ * and effectiveLimit ≈ EPSILON, so ANY recorded consumption trips it — for hard,
+ * soft AND burst policies. planRegistry.ts documents the intent ("Sliding window /
+ * fair-share devem tratar limit=0 como 'manual obrigatório'") but enforce.ts never
+ * implemented the guard.
+ *
+ * Expected: an unconfigured (EPSILON) dimension is NOT enforced — the pool stays
+ * usable until a real limit is configured. Real limits still enforce normally
+ * (covered by quota-division-blocks.test.ts).
+ *
+ * Mirrors the SqliteQuotaStore + enforceQuotaShare integration setup from
+ * quota-division-blocks.test.ts.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-quota-epsilon-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const providersDb = await import("../../src/lib/db/providers.ts");
+const quotaPools = await import("../../src/lib/db/quotaPools.ts");
+const { SqliteQuotaStore } = await import("../../src/lib/quota/sqliteQuotaStore.ts");
+const { enforceQuotaShare } = await import("../../src/lib/quota/enforce.ts");
+const core = await import("../../src/lib/db/core.ts");
+
+test.after(() => {
+  core.resetDbInstance();
+  if (fs.existsSync(TEST_DATA_DIR)) {
+    try {
+      fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+    } catch {
+      /* ignore */
+    }
+  }
+});
+
+test("EPSILON (unconfigured) plan does not block after the first request", async () => {
+  const KEY = "key-eps";
+
+  // glm seeds tokens/5h + tokens/weekly with limit=Number.EPSILON (placeholder).
+  const conn = await providersDb.createProviderConnection({
+    provider: "glm",
+    authType: "apikey",
+    name: "quota-epsilon-glm",
+    apiKey: "sk-glm-epsilon",
+  });
+  const connId = (conn as Record<string, unknown>).id as string;
+  assert.ok(connId, "connection should have an id");
+
+  const pool = quotaPools.createPool({
+    connectionId: connId,
+    name: "EpsilonPool",
+    allocations: [{ apiKeyId: KEY, weight: 100, policy: "hard" }],
+  });
+
+  // First request: allowed (nothing consumed yet).
+  const first = await enforceQuotaShare({
+    apiKeyId: KEY,
+    connectionId: connId,
+    provider: "glm",
+    estimatedCost: { tokens: 5000 },
+  });
+  assert.equal(
+    first.kind,
+    "allow",
+    `first request should be allowed; got ${JSON.stringify(first)}`
+  );
+
+  // Record consumption on the EPSILON dimension (tokens/5h).
+  const store = new SqliteQuotaStore();
+  await store.consume(KEY, { poolId: pool.id, unit: "tokens", window: "5h" }, 5000);
+
+  // Second request: MUST still be allowed — an unconfigured EPSILON limit is not a real cap.
+  const second = await enforceQuotaShare({
+    apiKeyId: KEY,
+    connectionId: connId,
+    provider: "glm",
+    estimatedCost: { tokens: 5000 },
+  });
+  assert.equal(
+    second.kind,
+    "allow",
+    `unconfigured EPSILON plan must not block after the first request; got ${JSON.stringify(second)}`
+  );
+});
diff --git a/tests/unit/quota-exclusive-catalog-4806.test.ts b/tests/unit/quota-exclusive-catalog-4806.test.ts
new file mode 100644
index 0000000000..75cd30bcec
--- /dev/null
+++ b/tests/unit/quota-exclusive-catalog-4806.test.ts
@@ -0,0 +1,182 @@
+/**
+ * tests/unit/quota-exclusive-catalog-4806.test.ts
+ *
+ * Regression for #4806 — "[BUG] Cota Exclusiva: modelos virtuais param de
+ * listar após ativação".
+ *
+ * When an API key is scoped to a quota pool (allowedQuotas non-empty — the
+ * "Cota exclusiva" state), GET /v1/models must list that pool's
+ * qtSd/<group>/<provider>/<model> virtual models. Clients such as Claude
+ * Desktop build their model picker from /v1/models, so an empty list shows
+ * "0 modelo encontrado" and the key cannot be used.
+ *
+ * Root cause (before the fix): getUnifiedModelsResponse filtered the *base*
+ * catalog list with filterModelsToQuotaPools(), but the base list never
+ * contains qtSd/* combos — they are isHidden:true and skipped while the base
+ * list is built (catalog.ts: `if (combo.isHidden === true) continue;`). The
+ * filter only KEEPS qtSd/* names, so filtering a list that has none returns
+ * [] → 0 models for every quota-exclusive key.
+ *
+ * Uses "glm" as the provider because it has a small, stable model list in the
+ * static registry (same convention as quota-combos-sync.test.ts).
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-quota-exclusive-catalog-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.API_KEY_SECRET = process.env.API_KEY_SECRET || "quota-exclusive-catalog-secret";
+
+const core = await import("../../src/lib/db/core.ts");
+const apiKeysDb = await import("../../src/lib/db/apiKeys.ts");
+const poolsDb = await import("../../src/lib/db/quotaPools.ts");
+const groupsDb = await import("../../src/lib/db/quotaGroups.ts");
+const providersDb = await import("../../src/lib/db/providers.ts");
+const v1ModelsCatalog = await import("../../src/app/api/v1/models/catalog.ts");
+const { syncQuotaCombos } = await import("../../src/lib/quota/quotaCombos.ts");
+const { quotaGroupSlug, isQuotaModelName, parseQuotaModelName } =
+  await import("../../src/lib/quota/quotaModelNaming.ts");
+
+async function resetStorage() {
+  apiKeysDb.resetApiKeyState();
+  core.resetDbInstance();
+  for (let attempt = 0; attempt < 10; attempt++) {
+    try {
+      if (fs.existsSync(TEST_DATA_DIR)) {
+        fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+      }
+      break;
+    } catch (error: unknown) {
+      const err = error as NodeJS.ErrnoException;
+      if ((err?.code === "EBUSY" || err?.code === "EPERM") && attempt < 9) {
+        await new Promise((resolve) => setTimeout(resolve, 50 * (attempt + 1)));
+      } else {
+        throw error;
+      }
+    }
+  }
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+test.beforeEach(async () => {
+  await resetStorage();
+});
+
+test.after(async () => {
+  apiKeysDb.resetApiKeyState();
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+test("#4806 quota-exclusive key lists its qtSd/* virtual models in GET /v1/models", async () => {
+  // Group "Times" → slug "times"; combos will be qtSd/times/glm/<model>.
+  const group = groupsDb.createGroup("Times");
+
+  const conn = await providersDb.createProviderConnection({
+    provider: "glm",
+    authType: "apikey",
+    name: "quota-4806-glm",
+    apiKey: "sk-glm-4806",
+  });
+  const connId = (conn as Record<string, unknown>).id as string;
+  assert.ok(connId, "connection should have an id");
+
+  const pool = poolsDb.createPool({ connectionId: connId, name: "Times", groupId: group.id });
+  await syncQuotaCombos(pool.id); // mint the hidden qtSd/times/glm/* combos
+
+  // Make the key "quota exclusive" by scoping it to the pool.
+  const created = await apiKeysDb.createApiKey("Quota-4806 Key", "machine-4806");
+  await apiKeysDb.updateApiKeyPermissions(created.id, { allowedQuotas: [pool.id] });
+
+  const res = await v1ModelsCatalog.getUnifiedModelsResponse(
+    new Request("http://localhost/api/v1/models", {
+      headers: { Authorization: `Bearer ${created.key}` },
+    })
+  );
+  assert.equal(res.status, 200);
+  const body = (await res.json()) as { data: Array<{ id: string }> };
+
+  const slug = quotaGroupSlug("Times"); // "times"
+  const qtsdForKey = body.data.filter(
+    (m) => isQuotaModelName(m.id) && parseQuotaModelName(m.id)?.groupSlug === slug
+  );
+
+  assert.ok(
+    qtsdForKey.length > 0,
+    `quota-exclusive key must see its qtSd/${slug}/glm/* models in /v1/models; ` +
+      `got ${body.data.length} total, ${qtsdForKey.length} qtSd. ` +
+      `ids=${JSON.stringify(body.data.map((m) => m.id).slice(0, 8))}`
+  );
+
+  // Every returned model must belong to the key's group (no leakage of other pools/raw models).
+  for (const m of body.data) {
+    assert.ok(
+      isQuotaModelName(m.id) && parseQuotaModelName(m.id)?.groupSlug === slug,
+      `quota-exclusive key should only see its own qtSd/${slug}/* models; leaked: ${m.id}`
+    );
+  }
+});
+
+test("#4806 quota-exclusive key does NOT see qtSd/* of a group it is not allocated to", async () => {
+  // Group A (glm) — the key's group.
+  const groupA = groupsDb.createGroup("Alpha");
+  const connA = await providersDb.createProviderConnection({
+    provider: "glm",
+    authType: "apikey",
+    name: "quota-4806-glm-a",
+    apiKey: "sk-glm-4806-a",
+  });
+  const poolA = poolsDb.createPool({
+    connectionId: (connA as Record<string, unknown>).id as string,
+    name: "Alpha",
+    groupId: groupA.id,
+  });
+  await syncQuotaCombos(poolA.id);
+
+  // Group B (codex) — a DIFFERENT group the key is NOT allocated to.
+  const groupB = groupsDb.createGroup("Beta");
+  const connB = await providersDb.createProviderConnection({
+    provider: "codex",
+    authType: "apikey",
+    name: "quota-4806-codex-b",
+    apiKey: "sk-codex-4806-b",
+  });
+  const poolB = poolsDb.createPool({
+    connectionId: (connB as Record<string, unknown>).id as string,
+    name: "Beta",
+    groupId: groupB.id,
+  });
+  await syncQuotaCombos(poolB.id);
+
+  // Key scoped ONLY to group A's pool.
+  const created = await apiKeysDb.createApiKey("Quota-4806 Key A", "machine-4806-a");
+  await apiKeysDb.updateApiKeyPermissions(created.id, { allowedQuotas: [poolA.id] });
+
+  const res = await v1ModelsCatalog.getUnifiedModelsResponse(
+    new Request("http://localhost/api/v1/models", {
+      headers: { Authorization: `Bearer ${created.key}` },
+    })
+  );
+  assert.equal(res.status, 200);
+  const body = (await res.json()) as { data: Array<{ id: string }> };
+
+  const slugA = quotaGroupSlug("Alpha");
+  const slugB = quotaGroupSlug("Beta");
+
+  assert.ok(
+    body.data.some((m) => parseQuotaModelName(m.id)?.groupSlug === slugA),
+    "key must see its own group A qtSd/* models"
+  );
+  const leakedFromB = body.data.filter((m) => parseQuotaModelName(m.id)?.groupSlug === slugB);
+  assert.equal(
+    leakedFromB.length,
+    0,
+    `key in group A must NOT see group B (${slugB}) models; leaked: ${JSON.stringify(
+      leakedFromB.map((m) => m.id)
+    )}`
+  );
+});
diff --git a/tests/unit/quota-fair-share.test.ts b/tests/unit/quota-fair-share.test.ts
index 37efde61b7..904dd3a859 100644
--- a/tests/unit/quota-fair-share.test.ts
+++ b/tests/unit/quota-fair-share.test.ts
@@ -201,3 +201,49 @@ test("fairShare: empty dimensions → allow:ok", () => {
   assert.equal(result.kind, "allow");
   assert.equal(result.reason, "ok");
 });
+
+// ─── Guard A: unknown/garbage policy must fail SAFE (treated as hard) ─────────
+// Defensive guard for issue #10: a policy value outside hard|soft|burst (e.g. a
+// corrupted DB row read through `row.policy as Policy`) previously fell through
+// every switch case in decideFairShare and returned a silent `allow`
+// (fail-OPEN). It must be treated as the most restrictive policy (hard) so an
+// unknown policy can never bypass fair-share enforcement.
+
+test("fairShare: GUARD-A strict mode, unknown policy over fair_share → block:fair-share (treated as hard)", () => {
+  // globalUsedPercent=0.6 >= 0.5 → strict; consumed=600 > fair_share=500.
+  // policy is garbage ("bogus") — must behave like hard and BLOCK, not allow.
+  const result = decideFairShare({
+    dimensions: [dim({ limit: 1000, consumedTotal: 700, globalUsedPercent: 0.6 })],
+    // Cast through unknown to bypass the Policy type — simulates a corrupted row.
+    allocation: { weight: 50, policy: "bogus" as unknown as "hard" },
+    consumedByThisKey: { "pool1:tokens:hourly": 600 },
+    saturationThreshold: THRESHOLD,
+  });
+  assert.equal(result.kind, "block");
+  assert.equal(result.reason, "fair-share");
+});
+
+test("fairShare: GUARD-A strict mode, unknown policy UNDER fair_share → allow (hard semantics still allow under share)", () => {
+  // Treated as hard: under fair_share is allowed even in strict mode.
+  const result = decideFairShare({
+    dimensions: [dim({ limit: 1000, consumedTotal: 700, globalUsedPercent: 0.7 })],
+    allocation: { weight: 50, policy: "garbage" as unknown as "hard" },
+    consumedByThisKey: { "pool1:tokens:hourly": 300 },
+    saturationThreshold: THRESHOLD,
+  });
+  assert.equal(result.kind, "allow");
+});
+
+test("fairShare: GUARD-A generous mode, unknown policy → hard semantics (no soft penalize / no burst leniency)", () => {
+  // Generous mode (globalUsedPercent=0.3), consumed=600 > fair_share=500, but
+  // consumedTotal=600 < 1000 so hard allows borrowing. Must NOT be flagged as
+  // penalized (that would be soft) and must NOT block (key < global limit).
+  const result = decideFairShare({
+    dimensions: [dim({ limit: 1000, consumedTotal: 600, globalUsedPercent: 0.3 })],
+    allocation: { weight: 50, policy: "weird" as unknown as "hard" },
+    consumedByThisKey: { "pool1:tokens:hourly": 600 },
+    saturationThreshold: THRESHOLD,
+  });
+  assert.equal(result.kind, "allow");
+  assert.equal(result.penalized, undefined, "unknown policy must not get soft penalize semantics");
+});
diff --git a/tests/unit/quota-multiprovider.test.ts b/tests/unit/quota-multiprovider.test.ts
index 161cf54ab7..d15b0e6a5b 100644
--- a/tests/unit/quota-multiprovider.test.ts
+++ b/tests/unit/quota-multiprovider.test.ts
@@ -15,8 +15,8 @@
  * (one step pinned to connA). That assertion encoded the OLD COLLISION BUG — a
  * second same-provider connection would overwrite the combo, leaving only the last
  * connId's step. Task 4 fixes this by grouping all connections into one N-step
- * fill-first combo per model. D2.5 and D2.6 now assert the CORRECT behavior:
- * models.length === 2 (both connections) and strategy === "fill-first". This is
+ * quota-share combo per model. D2.5 and D2.6 now assert the CORRECT behavior:
+ * models.length === 2 (both connections) and strategy === "quota-share". This is
  * alignment to the corrected implementation, NOT masking — the prior assertions
  * encoded the bug, not the desired behavior.
  *
@@ -30,7 +30,7 @@
  *  D2.4 — enforce: pool with connectionIds [connA, connB]; enforce with connA
  *          (the primary) still finds the pool — no regression on primary.
  *  D2.5 — combos: syncQuotaCombos for a 2-connection same-provider pool creates
- *          one combo per model with 2 steps (both connIds) + strategy fill-first.
+ *          one combo per model with 2 steps (both connIds) + strategy quota-share.
  *  D2.6 — combos: prune — after removing connB from the pool (→ only connA),
  *          re-sync collapses each combo to 1 step (connA only).
  */
@@ -55,9 +55,8 @@ const providersDb = await import("../../src/lib/db/providers.ts");
 const combosDb = await import("../../src/lib/db/combos.ts");
 const { resolveQuotaKeyScope } = await import("../../src/lib/quota/quotaKey.ts");
 const { syncQuotaCombos } = await import("../../src/lib/quota/quotaCombos.ts");
-const { isQuotaModelName, parseQuotaModelName, quotaModelName } = await import(
-  "../../src/lib/quota/quotaModelNaming.ts"
-);
+const { isQuotaModelName, parseQuotaModelName, quotaModelName } =
+  await import("../../src/lib/quota/quotaModelNaming.ts");
 const { PROVIDER_MODELS } = await import("../../open-sse/config/providerModels.ts");
 
 // Trigger migration once at module load so the schema is ready for the first
@@ -124,7 +123,9 @@ test.after(() => {
 // Helpers
 // ---------------------------------------------------------------------------
 
-async function listQuotaCombos(): Promise<Array<{ name: string; models: unknown[]; strategy: unknown }>> {
+async function listQuotaCombos(): Promise<
+  Array<{ name: string; models: unknown[]; strategy: unknown }>
+> {
   const all = await combosDb.getCombos();
   return all
     .filter((c) => typeof c.name === "string" && isQuotaModelName(c.name))
@@ -263,9 +264,7 @@ test("D2.3: enforceQuotaShare — input connectionId matching a non-primary memb
 
   // Assign an API key to the pool.
   const API_KEY_ID = "test-key-d23";
-  poolsDb.upsertAllocations(pool.id, [
-    { apiKeyId: API_KEY_ID, weight: 50, policy: "hard" },
-  ]);
+  poolsDb.upsertAllocations(pool.id, [{ apiKeyId: API_KEY_ID, weight: 50, policy: "hard" }]);
 
   // Confirm allocation exists.
   const allocations = listAllocationsForApiKey(API_KEY_ID);
@@ -320,9 +319,7 @@ test("D2.4: enforceQuotaShare — input connectionId matching the PRIMARY member
   });
 
   const API_KEY_ID = "test-key-d24";
-  poolsDb.upsertAllocations(pool.id, [
-    { apiKeyId: API_KEY_ID, weight: 50, policy: "hard" },
-  ]);
+  poolsDb.upsertAllocations(pool.id, [{ apiKeyId: API_KEY_ID, weight: 50, policy: "hard" }]);
 
   // Enforce with connA (the primary).
   const resultA = await enforceQuotaShare({
@@ -342,9 +339,9 @@ test("D2.4: enforceQuotaShare — input connectionId matching the PRIMARY member
 // D2.5 — combos: syncQuotaCombos for 2-connection same-provider pool
 // ---------------------------------------------------------------------------
 
-test("D2.5: syncQuotaCombos — 2-connection same-provider pool creates one combo per model with 2 steps + fill-first (Task 4)", async () => {
+test("D2.5: syncQuotaCombos — 2-connection same-provider pool creates one combo per model with 2 steps + quota-share (Task 4)", async () => {
   // Task 4: N same-provider connections must produce ONE combo per model with
-  // ALL connections' steps + strategy "fill-first". The old behavior (single step
+  // ALL connections' steps + strategy "quota-share". The old behavior (single step
   // pinned to connA, strategy "priority") was the collision bug — last upsert won.
   const connA = await providersDb.createProviderConnection({
     provider: PROVIDER_A,
@@ -384,7 +381,7 @@ test("D2.5: syncQuotaCombos — 2-connection same-provider pool creates one comb
   const quotaCombos = await listQuotaCombos();
   const comboMap = new Map(quotaCombos.map((c) => [c.name, c]));
 
-  // ── Verify PROVIDER_A combos exist with N-step fill-first ─────────────────
+  // ── Verify PROVIDER_A combos exist with N-step quota-share ─────────────────
   for (const modelId of modelsA) {
     // Combos are named with the GROUP name ("GroupDemo", from group-demo), not pool name.
     const expectedName = quotaModelName("GroupDemo", PROVIDER_A, modelId);
@@ -398,11 +395,11 @@ test("D2.5: syncQuotaCombos — 2-connection same-provider pool creates one comb
       `combo ${expectedName} should have 2 steps (both connections), got ${combo.models.length}`
     );
 
-    // Task 4: strategy must be fill-first.
+    // Task 4: strategy must be quota-share.
     assert.equal(
       combo.strategy,
-      "fill-first",
-      `combo ${expectedName} strategy should be "fill-first", got "${combo.strategy}"`
+      "quota-share",
+      `combo ${expectedName} strategy should be "quota-share", got "${combo.strategy}"`
     );
 
     // Both connIds must appear across steps.
@@ -429,7 +426,7 @@ test("D2.5: syncQuotaCombos — 2-connection same-provider pool creates one comb
 // ---------------------------------------------------------------------------
 
 test("D2.6: syncQuotaCombos — after removing connB from same-provider pool, re-sync collapses each combo to 1 step (connA only)", async () => {
-  // Task 4: initially a 2-connection pool produces 2-step fill-first combos.
+  // Task 4: initially a 2-connection pool produces 2-step quota-share combos.
   // After removing connB (pool → only connA), re-sync rebuilds each combo with
   // a single step pinned to connA. The combo names are unchanged (same provider/
   // model), so no prune happens — the combos are updated in-place.
@@ -498,7 +495,10 @@ test("D2.6: syncQuotaCombos — after removing connB from same-provider pool, re
   const afterProviders = new Set(
     after.map((c) => parseQuotaModelName(c.name)?.provider).filter(Boolean)
   );
-  assert.ok(afterProviders.has(PROVIDER_A), `${PROVIDER_A} combos should survive after connB removal`);
+  assert.ok(
+    afterProviders.has(PROVIDER_A),
+    `${PROVIDER_A} combos should survive after connB removal`
+  );
   for (const modelId of modelsA) {
     const expectedName = quotaModelName("GroupDemo", PROVIDER_A, modelId);
     const found = after.find((c) => c.name === expectedName);
diff --git a/tests/unit/quota-per-key-model-hotpath.test.ts b/tests/unit/quota-per-key-model-hotpath.test.ts
new file mode 100644
index 0000000000..aa6f84dc33
--- /dev/null
+++ b/tests/unit/quota-per-key-model-hotpath.test.ts
@@ -0,0 +1,166 @@
+/**
+ * tests/unit/quota-per-key-model-hotpath.test.ts
+ *
+ * Integration test for the per-(key, model) cap END-TO-END through the actual
+ * hot-path hooks (Fase 3 #7 plumbing). Unlike quota-per-key-model.test.ts (which
+ * drives recordConsumption/enforceQuotaShare directly), this proves the `model`
+ * field actually flows through:
+ *
+ *   scheduleQuotaShareConsumption(...)  ← non-streaming POST-hook (chatCore)
+ *      → scheduleRecordConsumption → recordConsumption (model-scoped bucket)
+ *   enforceQuotaShare({ ..., model })    ← PRE-hook the chatCore enforce site uses
+ *
+ * Scenario:
+ *   - Configure a cap of N requests for (keyA, modelM).
+ *   - Drive N consumptions through scheduleQuotaShareConsumption({ model: modelM }).
+ *   - enforceQuotaShare({ model: modelM }) → block (the hook plumbed `model`).
+ *   - enforceQuotaShare({ model: modelM2 }) → allow (cap is per-model, other model free).
+ *
+ * If the hot-path hook ever drops `model` again (feature goes inert), the block
+ * assertion fails — guarding the plumbing this PR adds.
+ *
+ * Part of: Group B — Quota Sharing Engine, Fase 3 #7.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+// ── Single isolated DATA_DIR (same reset pattern as db-quota-pools.test.ts) ───
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-model-cap-hotpath-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const { createPool, upsertAllocations } = await import("../../src/lib/db/quotaPools.ts");
+const { setModelCap } = await import("../../src/lib/db/quotaModelCaps.ts");
+const { enforceQuotaShare } = await import("../../src/lib/quota/enforce.ts");
+const { resetQuotaStoreSingleton } = await import("../../src/lib/quota/storeFactory.ts");
+const { scheduleQuotaShareConsumption } = await import(
+  "../../open-sse/handlers/chatCore/quotaShareConsumption.ts"
+);
+
+// ── Fixtures ──────────────────────────────────────────────────────────────────
+const CONN_ID = "conn-model-cap-hotpath";
+const PROVIDER = "kimi"; // kimi has {unit:"requests", window:"hourly", limit:1500} in planRegistry
+const KEY_A = "key-model-cap-hotpath-a";
+const MODEL_M = "kimi-k2";
+const MODEL_M2 = "kimi-k2-lite";
+const CAP_N = 3; // requests
+
+async function resetStorage() {
+  resetQuotaStoreSingleton();
+  core.resetDbInstance();
+  for (let attempt = 0; attempt < 10; attempt++) {
+    try {
+      if (fs.existsSync(TEST_DATA_DIR)) {
+        fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+      }
+      break;
+    } catch (err: unknown) {
+      const code = (err as NodeJS.ErrnoException)?.code;
+      if ((code === "EBUSY" || code === "EPERM") && attempt < 9) {
+        await new Promise((resolve) => setTimeout(resolve, 50 * (attempt + 1)));
+      } else {
+        throw err;
+      }
+    }
+  }
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+test.beforeEach(async () => {
+  await resetStorage();
+});
+
+test.after(async () => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+function makePool() {
+  const pool = createPool({ connectionId: CONN_ID, name: "Model Cap Hotpath Pool" });
+  upsertAllocations(pool.id, [{ apiKeyId: KEY_A, weight: 100, policy: "hard" }]);
+  return pool;
+}
+
+/**
+ * Drive ONE consumption through the real non-streaming hot-path hook.
+ * scheduleQuotaShareConsumption → scheduleRecordConsumption (setImmediate) →
+ * recordConsumption. We await a macrotask tick so the setImmediate fires.
+ */
+async function consumeViaHotPath(model: string, requests: number) {
+  for (let i = 0; i < requests; i++) {
+    await scheduleQuotaShareConsumption({
+      apiKeyId: KEY_A,
+      connectionId: CONN_ID,
+      provider: PROVIDER,
+      model,
+      // usage with prompt+completion tokens so buildConsumptionCost computes tokens;
+      // for a "requests" cap the requests:1 field is what matters.
+      usage: { prompt_tokens: 5, completion_tokens: 5 },
+      estimatedCost: 0,
+    });
+    // Let the setImmediate-scheduled recordConsumption run before the next iteration.
+    await new Promise((r) => setImmediate(r));
+    await new Promise((r) => setTimeout(r, 5));
+  }
+}
+
+// ---------------------------------------------------------------------------
+// End-to-end: cap blocks via the hot-path hook (proves `model` is plumbed)
+// ---------------------------------------------------------------------------
+test("hot-path: model cap blocks after N consumptions driven through scheduleQuotaShareConsumption", async () => {
+  const pool = makePool();
+  setModelCap({ poolId: pool.id, apiKeyId: KEY_A, model: MODEL_M, capValue: CAP_N, capUnit: "requests" });
+
+  // Drive CAP_N consumptions through the REAL non-streaming hot-path hook.
+  await consumeViaHotPath(MODEL_M, CAP_N);
+
+  // The enforce PRE-hook (with model, as chatCore now calls it) must block on model M.
+  const blocked = await enforceQuotaShare({
+    apiKeyId: KEY_A,
+    connectionId: CONN_ID,
+    provider: PROVIDER,
+    model: MODEL_M,
+    estimatedCost: {},
+  });
+  assert.equal(blocked.kind, "block", "model M must be blocked after N hot-path consumptions");
+  assert.ok(
+    "reason" in blocked && blocked.reason.includes("model-cap"),
+    `reason must mention model-cap; got: ${"reason" in blocked ? blocked.reason : "(no reason)"}`,
+  );
+
+  // A different model in the SAME pool (no cap) must still be allowed.
+  const allowedOther = await enforceQuotaShare({
+    apiKeyId: KEY_A,
+    connectionId: CONN_ID,
+    provider: PROVIDER,
+    model: MODEL_M2,
+    estimatedCost: {},
+  });
+  assert.equal(allowedOther.kind, "allow", "model M2 (no cap) must still be allowed");
+});
+
+// ---------------------------------------------------------------------------
+// Regression guard: hot-path WITHOUT model on enforce → no model-cap block.
+// (If a caller forgets to pass model, the cap simply does not fire — fail-open.)
+// ---------------------------------------------------------------------------
+test("hot-path: enforce WITHOUT model never triggers model-cap block (fail-safe)", async () => {
+  const pool = makePool();
+  setModelCap({ poolId: pool.id, apiKeyId: KEY_A, model: MODEL_M, capValue: 1, capUnit: "requests" });
+
+  // Consume via hot path WITH model so the bucket fills.
+  await consumeViaHotPath(MODEL_M, 2);
+
+  // Enforce WITHOUT model: the model-cap pre-check is skipped entirely.
+  // (Pool-level fair-share still runs; weight=100, well under fair-share → allow.)
+  const noModel = await enforceQuotaShare({
+    apiKeyId: KEY_A,
+    connectionId: CONN_ID,
+    provider: PROVIDER,
+    estimatedCost: {},
+  });
+  assert.equal(noModel.kind, "allow", "enforce without model → no model-cap block");
+});
diff --git a/tests/unit/quota-per-key-model.test.ts b/tests/unit/quota-per-key-model.test.ts
new file mode 100644
index 0000000000..0ce1970382
--- /dev/null
+++ b/tests/unit/quota-per-key-model.test.ts
@@ -0,0 +1,201 @@
+/**
+ * tests/unit/quota-per-key-model.test.ts
+ *
+ * TDD for per-(key, model) budget/rate-limit cap (Fase 3 #7).
+ *
+ * Scenarios:
+ *   1. keyA has a cap of N requests for model M; after N uses → enforce blocks keyA on model M.
+ *   2. keyA blocked on M still allowed on model M2 (no cap / cap not reached) in the same pool.
+ *   3. No cap configured → behaviour unchanged (no block).
+ *   4. Cap value ≤ EPSILON → ignored (placeholder skip, consistent with planRegistry pattern).
+ *
+ * Uses real SQLite (same single-dir reset pattern as db-quota-pools.test.ts).
+ * Live enforceQuotaShare + recordConsumption path ensures end-to-end correctness.
+ *
+ * Part of: Group B — Quota Sharing Engine, Fase 3 #7.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+// ── Single isolated DATA_DIR (same pattern as db-quota-pools.test.ts) ────
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-model-cap-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+// ── Module imports (after DATA_DIR is set) ────────────────────────────────
+const core = await import("../../src/lib/db/core.ts");
+const { createPool, upsertAllocations } = await import("../../src/lib/db/quotaPools.ts");
+const { setModelCap } = await import("../../src/lib/db/quotaModelCaps.ts");
+const { enforceQuotaShare, recordConsumption } = await import("../../src/lib/quota/enforce.ts");
+const { resetQuotaStoreSingleton } = await import("../../src/lib/quota/storeFactory.ts");
+
+// ── Storage reset helper (same as db-quota-pools.test.ts) ────────────────
+async function resetStorage() {
+  resetQuotaStoreSingleton();
+  core.resetDbInstance();
+  for (let attempt = 0; attempt < 10; attempt++) {
+    try {
+      if (fs.existsSync(TEST_DATA_DIR)) {
+        fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+      }
+      break;
+    } catch (err: unknown) {
+      const code = (err as NodeJS.ErrnoException)?.code;
+      if ((code === "EBUSY" || code === "EPERM") && attempt < 9) {
+        await new Promise((resolve) => setTimeout(resolve, 50 * (attempt + 1)));
+      } else {
+        throw err;
+      }
+    }
+  }
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+// ── Test fixtures ─────────────────────────────────────────────────────────
+const CONN_ID = "conn-model-cap-test";
+const PROVIDER = "kimi"; // kimi has {unit:"requests", window:"hourly", limit:1500} in planRegistry
+const KEY_A = "key-model-cap-a";
+const MODEL_M = "kimi-k2";
+const MODEL_M2 = "kimi-k2-lite";
+const CAP_N = 3; // requests
+
+// ── Hooks ─────────────────────────────────────────────────────────────────
+test.beforeEach(async () => {
+  await resetStorage();
+});
+
+test.after(async () => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+// ── Helper: create pool with KEY_A allocation ─────────────────────────────
+function makePool() {
+  const pool = createPool({ connectionId: CONN_ID, name: "Model Cap Test Pool" });
+  upsertAllocations(pool.id, [{ apiKeyId: KEY_A, weight: 100, policy: "hard" }]);
+  return pool;
+}
+
+// ---------------------------------------------------------------------------
+// Scenario 1: cap N requests on model M → block after N uses
+// ---------------------------------------------------------------------------
+test("per-(key,model) cap — keyA blocked on model M after N requests", async () => {
+  const pool = makePool();
+  setModelCap({ poolId: pool.id, apiKeyId: KEY_A, model: MODEL_M, capValue: CAP_N, capUnit: "requests" });
+
+  // Simulate CAP_N prior consumptions
+  for (let i = 0; i < CAP_N; i++) {
+    await recordConsumption({
+      apiKeyId: KEY_A,
+      connectionId: CONN_ID,
+      provider: PROVIDER,
+      model: MODEL_M,
+      cost: { requests: 1 },
+    });
+  }
+
+  const result = await enforceQuotaShare({
+    apiKeyId: KEY_A,
+    connectionId: CONN_ID,
+    provider: PROVIDER,
+    model: MODEL_M,
+    estimatedCost: {},
+  });
+
+  assert.equal(result.kind, "block", "must block when model cap is reached");
+  assert.ok(
+    "reason" in result && result.reason.includes("model-cap"),
+    `reason must mention model-cap; got: ${"reason" in result ? result.reason : "(no reason)"}`,
+  );
+  assert.equal("httpStatus" in result && result.httpStatus, 429, "must return 429");
+});
+
+// ---------------------------------------------------------------------------
+// Scenario 2: keyA blocked on M still allowed on M2
+// ---------------------------------------------------------------------------
+test("per-(key,model) cap — keyA blocked on M, still allowed on M2 same pool", async () => {
+  const pool = makePool();
+  setModelCap({ poolId: pool.id, apiKeyId: KEY_A, model: MODEL_M, capValue: 1, capUnit: "requests" });
+
+  // Consume the single request cap on model M
+  await recordConsumption({
+    apiKeyId: KEY_A,
+    connectionId: CONN_ID,
+    provider: PROVIDER,
+    model: MODEL_M,
+    cost: { requests: 1 },
+  });
+
+  // Model M must be blocked
+  const resultM = await enforceQuotaShare({
+    apiKeyId: KEY_A,
+    connectionId: CONN_ID,
+    provider: PROVIDER,
+    model: MODEL_M,
+    estimatedCost: {},
+  });
+  assert.equal(resultM.kind, "block", "model M should be blocked");
+  assert.ok(
+    "reason" in resultM && resultM.reason.includes("model-cap"),
+    `reason must mention model-cap; got: ${"reason" in resultM ? resultM.reason : "(no reason)"}`,
+  );
+
+  // Model M2 (no cap configured) must still be allowed
+  const resultM2 = await enforceQuotaShare({
+    apiKeyId: KEY_A,
+    connectionId: CONN_ID,
+    provider: PROVIDER,
+    model: MODEL_M2,
+    estimatedCost: {},
+  });
+  assert.equal(resultM2.kind, "allow", "model M2 should still be allowed (no cap on M2)");
+});
+
+// ---------------------------------------------------------------------------
+// Scenario 3: no cap configured → behaviour unchanged (allow)
+// ---------------------------------------------------------------------------
+test("per-(key,model) cap — no cap configured → no block (unchanged behaviour)", async () => {
+  makePool();
+  // No setModelCap call — cap table is empty
+
+  const result = await enforceQuotaShare({
+    apiKeyId: KEY_A,
+    connectionId: CONN_ID,
+    provider: PROVIDER,
+    model: MODEL_M,
+    estimatedCost: {},
+  });
+
+  // With a pool but no model cap, the pool-level fair-share check runs.
+  // KEY_A has weight=100, 0 consumption → well within fair-share → allow.
+  assert.equal(result.kind, "allow", "no model cap → no block");
+});
+
+// ---------------------------------------------------------------------------
+// Scenario 4: cap ≤ EPSILON → ignored (placeholder skip)
+// ---------------------------------------------------------------------------
+test("per-(key,model) cap — EPSILON cap value → ignored, request allowed", async () => {
+  const pool = makePool();
+
+  // Insert a placeholder cap directly (Number.EPSILON > 0 passes DB CHECK constraint
+  // but enforce.ts skips it: !(capValue > Number.EPSILON) → true for EPSILON).
+  core.getDbInstance()
+    .prepare(
+      `INSERT INTO quota_allocation_model_caps (pool_id, api_key_id, model, cap_value, cap_unit)
+       VALUES (?, ?, ?, ?, ?)`
+    )
+    .run(pool.id, KEY_A, MODEL_M, Number.EPSILON, "requests");
+
+  const result = await enforceQuotaShare({
+    apiKeyId: KEY_A,
+    connectionId: CONN_ID,
+    provider: PROVIDER,
+    model: MODEL_M,
+    estimatedCost: {},
+  });
+
+  assert.equal(result.kind, "allow", "EPSILON cap → placeholder → skip → allow");
+});
diff --git a/tests/unit/quota-saturation-anthropic-oauth.test.ts b/tests/unit/quota-saturation-anthropic-oauth.test.ts
new file mode 100644
index 0000000000..05deab4602
--- /dev/null
+++ b/tests/unit/quota-saturation-anthropic-oauth.test.ts
@@ -0,0 +1,188 @@
+/**
+ * tests/unit/quota-saturation-anthropic-oauth.test.ts
+ *
+ * #1 — Real plan-window saturation for Claude/Anthropic fair-share.
+ *
+ * Before this change, the anthropic/claude branch of getSaturation only read
+ * the per-minute REQUEST rate-limit headers (anthropic-ratelimit-requests-*),
+ * which do NOT reflect the Claude Pro/Max 5h / weekly plan window. fairShare
+ * was therefore nearly blind for Claude.
+ *
+ * This suite asserts the branch now uses the REAL plan utilization that
+ * usage.ts already fetches from GET /api/oauth/usage (five_hour.utilization /
+ * seven_day.utilization), window-aware:
+ *   - dim.window "5h"     → five_hour.utilization  / 100
+ *   - dim.window "weekly" → seven_day.utilization  / 100
+ *
+ * The oauth/usage path and the DB connection lookup are injected (deps seam)
+ * so the test never touches the network or the DB. The 30s saturation cache is
+ * cleared between asserts via _clearSaturationCache().
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const satMod = await import("../../src/lib/quota/saturationSignals.ts");
+const { getSaturation, _clearSaturationCache, __setAnthropicSaturationDepsForTests } = satMod;
+
+// usage.ts shape: getClaudeUsage maps five_hour.utilization → quotas["session (5h)"].used
+// and seven_day.utilization → quotas["weekly (7d)"].used (used = % used, 0..100).
+function claudeUsageStub(fiveHourUtil: number, sevenDayUtil: number) {
+  return {
+    plan: "Claude Pro",
+    quotas: {
+      "session (5h)": {
+        used: fiveHourUtil,
+        total: 100,
+        remaining: Math.max(0, 100 - fiveHourUtil),
+        remainingPercentage: Math.max(0, 100 - fiveHourUtil),
+        resetAt: null,
+        unlimited: false,
+      },
+      "weekly (7d)": {
+        used: sevenDayUtil,
+        total: 100,
+        remaining: Math.max(0, 100 - sevenDayUtil),
+        remainingPercentage: Math.max(0, 100 - sevenDayUtil),
+        resetAt: null,
+        unlimited: false,
+      },
+    },
+    extraUsage: null,
+    bootstrap: null,
+  };
+}
+
+const OAUTH_CONN = {
+  id: "claude-conn-1",
+  provider: "claude",
+  authType: "oauth",
+  accessToken: "fake-oauth-token",
+};
+
+test.afterEach(() => {
+  // Restore real deps and clear cache so suites stay isolated.
+  __setAnthropicSaturationDepsForTests(null);
+  _clearSaturationCache();
+});
+
+// ─── Core: 5h window uses five_hour.utilization ──────────────────────────────
+
+test("getSaturation(claude, 5h) → five_hour.utilization/100 (80% → 0.8)", async () => {
+  _clearSaturationCache();
+  __setAnthropicSaturationDepsForTests({
+    loadConnection: async () => ({ ...OAUTH_CONN }),
+    fetchUsage: async () => claudeUsageStub(80, 40),
+  });
+
+  const val = await getSaturation("claude-conn-1", "claude", { unit: "percent", window: "5h" });
+  assert.ok(Math.abs(val - 0.8) < 1e-9, `expected ≈0.8, got ${val}`);
+});
+
+test("getSaturation(claude, weekly) → seven_day.utilization/100 (40% → 0.4)", async () => {
+  _clearSaturationCache();
+  __setAnthropicSaturationDepsForTests({
+    loadConnection: async () => ({ ...OAUTH_CONN }),
+    fetchUsage: async () => claudeUsageStub(80, 40),
+  });
+
+  const val = await getSaturation("claude-conn-1", "claude", { unit: "percent", window: "weekly" });
+  assert.ok(Math.abs(val - 0.4) < 1e-9, `expected ≈0.4, got ${val}`);
+});
+
+test('provider alias "anthropic" resolves the same plan-window utilization', async () => {
+  _clearSaturationCache();
+  __setAnthropicSaturationDepsForTests({
+    loadConnection: async () => ({ ...OAUTH_CONN }),
+    fetchUsage: async () => claudeUsageStub(95, 10),
+  });
+
+  const five = await getSaturation("claude-conn-1", "anthropic", { unit: "percent", window: "5h" });
+  assert.ok(Math.abs(five - 0.95) < 1e-9, `expected ≈0.95, got ${five}`);
+});
+
+// ─── Clamp ───────────────────────────────────────────────────────────────────
+
+test("utilization > 100 is clamped to 1", async () => {
+  _clearSaturationCache();
+  __setAnthropicSaturationDepsForTests({
+    loadConnection: async () => ({ ...OAUTH_CONN }),
+    fetchUsage: async () => claudeUsageStub(140, 0),
+  });
+
+  const val = await getSaturation("claude-conn-1", "claude", { unit: "percent", window: "5h" });
+  assert.equal(val, 1);
+});
+
+// ─── Fallback: API-key Claude (no OAuth token) → header path ──────────────────
+
+test("API-key Claude (no oauth/usage windows) falls back to rate-limit header path", async () => {
+  _clearSaturationCache();
+  // Seed the header cache the way the response handler would.
+  satMod.storeRateLimitHeaders("apikey-conn", "anthropic", {
+    "anthropic-ratelimit-requests-limit": "100",
+    "anthropic-ratelimit-requests-remaining": "30",
+  });
+  __setAnthropicSaturationDepsForTests({
+    // API-key connection → no usable oauth/usage window for plan saturation.
+    loadConnection: async () => ({
+      id: "apikey-conn",
+      provider: "claude",
+      authType: "apikey",
+      apiKey: "sk-ant-xxx",
+    }),
+    // Legacy/admin shape: no "session (5h)" / "weekly (7d)" keys.
+    fetchUsage: async () => ({ message: "Claude connected. Usage details require admin access." }),
+  });
+
+  const val = await getSaturation("apikey-conn", "claude", { unit: "percent", window: "5h" });
+  // used = 100 - 30 = 70 over limit 100 → 0.7 from the header fallback.
+  assert.ok(Math.abs(val - 0.7) < 1e-9, `expected header-fallback ≈0.7, got ${val}`);
+});
+
+// ─── Fail-open ────────────────────────────────────────────────────────────────
+
+test("no connection found → fails open (0), no throw", async () => {
+  _clearSaturationCache();
+  __setAnthropicSaturationDepsForTests({
+    loadConnection: async () => null,
+    fetchUsage: async () => {
+      throw new Error("must not be called when no connection");
+    },
+  });
+
+  const val = await getSaturation("missing-conn", "claude", { unit: "percent", window: "5h" });
+  assert.equal(val, 0);
+});
+
+test("oauth/usage fetch throws → fails open (0), no throw", async () => {
+  _clearSaturationCache();
+  __setAnthropicSaturationDepsForTests({
+    loadConnection: async () => ({ ...OAUTH_CONN }),
+    fetchUsage: async () => {
+      throw new Error("429 rate limited");
+    },
+  });
+
+  const val = await getSaturation("claude-conn-1", "claude", { unit: "percent", window: "5h" });
+  assert.equal(val, 0);
+});
+
+// ─── Cache: don't poll per request (Rule #18) ────────────────────────────────
+
+test("second call within 30s TTL is served from cache (fetchUsage NOT re-invoked)", async () => {
+  _clearSaturationCache();
+  let calls = 0;
+  __setAnthropicSaturationDepsForTests({
+    loadConnection: async () => ({ ...OAUTH_CONN }),
+    fetchUsage: async () => {
+      calls += 1;
+      return claudeUsageStub(80, 40);
+    },
+  });
+
+  const a = await getSaturation("claude-conn-1", "claude", { unit: "percent", window: "5h" });
+  const b = await getSaturation("claude-conn-1", "claude", { unit: "percent", window: "5h" });
+  assert.equal(a, b);
+  assert.equal(calls, 1, "oauth/usage must be fetched once, not per request");
+});
diff --git a/tests/unit/quota-saturation-token-headers.test.ts b/tests/unit/quota-saturation-token-headers.test.ts
new file mode 100644
index 0000000000..a60628e6b2
--- /dev/null
+++ b/tests/unit/quota-saturation-token-headers.test.ts
@@ -0,0 +1,306 @@
+/**
+ * tests/unit/quota-saturation-token-headers.test.ts
+ *
+ * #2 — Proactive saturation from TOKEN rate-limit headers (universal).
+ *
+ * storeRateLimitHeaders previously only captured the per-minute REQUEST headers
+ * (anthropic-ratelimit-requests-* / x-ratelimit-*-requests). TOKEN headers ride
+ * on EVERY upstream response (success too), so they let us throttle proactively
+ * before a 429.
+ *
+ * This suite asserts:
+ *   - storeRateLimitHeaders parses Anthropic token headers
+ *     (anthropic-ratelimit-tokens-{limit,remaining,reset}, reset = RFC3339)
+ *     and OpenAI token headers (x-ratelimit-{limit,remaining,reset}-tokens,
+ *     reset = duration string like "6m0s"/"1s").
+ *   - the resulting token-header saturation = 1 − remaining/limit (clamped 0..1).
+ *   - reset is normalized to an epoch-ms `resetAt` (RFC3339 → epoch,
+ *     duration → now + parsed seconds).
+ *   - the existing REQUEST path is untouched (no regression).
+ *   - getSaturation for a generic provider (openai) surfaces the token-header
+ *     signal when usage returns nothing (fallback/complement), failing open to 0.
+ *
+ * Pure parse + cache; no DB, no network. The 30s saturation cache and the
+ * token-header cache are cleared between asserts.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const satMod = await import("../../src/lib/quota/saturationSignals.ts");
+const {
+  storeRateLimitHeaders,
+  getTokenHeaderSaturation,
+  getSaturation,
+  _clearSaturationCache,
+  _clearRateLimitHeaders,
+  __setGenericUsageFetcherForTests,
+} = satMod;
+
+test.afterEach(() => {
+  _clearSaturationCache();
+  _clearRateLimitHeaders();
+  __setGenericUsageFetcherForTests(null);
+});
+
+// ─── Anthropic token headers (reset = RFC3339) ───────────────────────────────
+
+test("Anthropic token headers → saturation = 1 − remaining/limit", () => {
+  _clearRateLimitHeaders();
+  // 1000 limit, 250 remaining → 750 used → 0.75 saturation.
+  storeRateLimitHeaders("anth-conn-1", "anthropic", {
+    "anthropic-ratelimit-tokens-limit": "1000",
+    "anthropic-ratelimit-tokens-remaining": "250",
+    "anthropic-ratelimit-tokens-reset": "2026-01-01T00:00:30Z",
+  });
+
+  const sig = getTokenHeaderSaturation("anthropic", "anth-conn-1");
+  assert.ok(sig, "expected a token-header saturation signal");
+  assert.ok(Math.abs(sig!.saturation - 0.75) < 1e-9, `expected ≈0.75, got ${sig!.saturation}`);
+});
+
+test("Anthropic token reset (RFC3339) is normalized to epoch ms", () => {
+  _clearRateLimitHeaders();
+  storeRateLimitHeaders("anth-conn-2", "anthropic", {
+    "anthropic-ratelimit-tokens-limit": "1000",
+    "anthropic-ratelimit-tokens-remaining": "0",
+    "anthropic-ratelimit-tokens-reset": "2026-01-01T00:00:30Z",
+  });
+
+  const sig = getTokenHeaderSaturation("anthropic", "anth-conn-2");
+  assert.ok(sig, "expected signal");
+  const expected = Date.parse("2026-01-01T00:00:30Z");
+  assert.equal(sig!.resetAt, expected, `resetAt should be RFC3339 epoch ${expected}, got ${sig!.resetAt}`);
+  // fully exhausted → saturation 1.
+  assert.equal(sig!.saturation, 1);
+});
+
+test("Anthropic input/output token variants are captured when base tokens header absent", () => {
+  _clearRateLimitHeaders();
+  // No base anthropic-ratelimit-tokens-*; only the input variant present.
+  storeRateLimitHeaders("anth-conn-3", "anthropic", {
+    "anthropic-ratelimit-input-tokens-limit": "2000",
+    "anthropic-ratelimit-input-tokens-remaining": "500",
+    "anthropic-ratelimit-input-tokens-reset": "2026-01-01T00:01:00Z",
+  });
+
+  const sig = getTokenHeaderSaturation("anthropic", "anth-conn-3");
+  assert.ok(sig, "expected signal from input-tokens variant");
+  // 2000 limit, 500 remaining → 1500 used → 0.75.
+  assert.ok(Math.abs(sig!.saturation - 0.75) < 1e-9, `expected ≈0.75, got ${sig!.saturation}`);
+});
+
+// ─── OpenAI token headers (reset = DURATION) ─────────────────────────────────
+
+test("OpenAI token headers → saturation = 1 − remaining/limit", () => {
+  _clearRateLimitHeaders();
+  // 90000 limit, 9000 remaining → 81000 used → 0.9.
+  storeRateLimitHeaders("oai-conn-1", "openai", {
+    "x-ratelimit-limit-tokens": "90000",
+    "x-ratelimit-remaining-tokens": "9000",
+    "x-ratelimit-reset-tokens": "6m0s",
+  });
+
+  const sig = getTokenHeaderSaturation("openai", "oai-conn-1");
+  assert.ok(sig, "expected token-header signal");
+  assert.ok(Math.abs(sig!.saturation - 0.9) < 1e-9, `expected ≈0.9, got ${sig!.saturation}`);
+});
+
+test('OpenAI reset duration "6m0s" → now + 360s (epoch ms)', () => {
+  _clearRateLimitHeaders();
+  const before = Date.now();
+  storeRateLimitHeaders("oai-conn-2", "openai", {
+    "x-ratelimit-limit-tokens": "1000",
+    "x-ratelimit-remaining-tokens": "100",
+    "x-ratelimit-reset-tokens": "6m0s",
+  });
+  const after = Date.now();
+
+  const sig = getTokenHeaderSaturation("openai", "oai-conn-2");
+  assert.ok(sig, "expected signal");
+  // 6m0s = 360_000 ms in the future, measured from the store time.
+  assert.ok(
+    sig!.resetAt >= before + 360_000 && sig!.resetAt <= after + 360_000,
+    `resetAt should be ≈ now+360000, got ${sig!.resetAt} (window ${before + 360_000}..${after + 360_000})`
+  );
+});
+
+test('OpenAI reset duration "1s" → now + 1s (epoch ms)', () => {
+  _clearRateLimitHeaders();
+  const before = Date.now();
+  storeRateLimitHeaders("oai-conn-3", "openai", {
+    "x-ratelimit-limit-tokens": "1000",
+    "x-ratelimit-remaining-tokens": "500",
+    "x-ratelimit-reset-tokens": "1s",
+  });
+  const after = Date.now();
+
+  const sig = getTokenHeaderSaturation("openai", "oai-conn-3");
+  assert.ok(sig, "expected signal");
+  assert.ok(
+    sig!.resetAt >= before + 1000 && sig!.resetAt <= after + 1000,
+    `resetAt should be ≈ now+1000, got ${sig!.resetAt}`
+  );
+});
+
+test('OpenAI compound duration "1h30m15s" → 5415s', () => {
+  _clearRateLimitHeaders();
+  const before = Date.now();
+  storeRateLimitHeaders("oai-conn-4", "openai", {
+    "x-ratelimit-limit-tokens": "1000",
+    "x-ratelimit-remaining-tokens": "10",
+    "x-ratelimit-reset-tokens": "1h30m15s",
+  });
+  const after = Date.now();
+
+  const sig = getTokenHeaderSaturation("openai", "oai-conn-4");
+  assert.ok(sig, "expected signal");
+  const secs = (1 * 3600 + 30 * 60 + 15) * 1000; // 5_415_000
+  assert.ok(
+    sig!.resetAt >= before + secs && sig!.resetAt <= after + secs,
+    `resetAt should be ≈ now+${secs}, got ${sig!.resetAt}`
+  );
+});
+
+test('OpenAI fractional-second duration "1.5s" → 1500ms', () => {
+  _clearRateLimitHeaders();
+  const before = Date.now();
+  storeRateLimitHeaders("oai-conn-5", "openai", {
+    "x-ratelimit-limit-tokens": "1000",
+    "x-ratelimit-remaining-tokens": "10",
+    "x-ratelimit-reset-tokens": "1.5s",
+  });
+  const after = Date.now();
+
+  const sig = getTokenHeaderSaturation("openai", "oai-conn-5");
+  assert.ok(sig, "expected signal");
+  assert.ok(
+    sig!.resetAt >= before + 1500 && sig!.resetAt <= after + 1500,
+    `resetAt should be ≈ now+1500, got ${sig!.resetAt}`
+  );
+});
+
+// ─── Clamp / guards ──────────────────────────────────────────────────────────
+
+test("saturation is clamped to [0,1] (remaining > limit → 0)", () => {
+  _clearRateLimitHeaders();
+  storeRateLimitHeaders("oai-conn-clamp", "openai", {
+    "x-ratelimit-limit-tokens": "1000",
+    "x-ratelimit-remaining-tokens": "5000", // nonsensical but must not go negative
+  });
+
+  const sig = getTokenHeaderSaturation("openai", "oai-conn-clamp");
+  assert.ok(sig, "expected signal");
+  assert.equal(sig!.saturation, 0);
+});
+
+test("missing/invalid token headers → no signal (null)", () => {
+  _clearRateLimitHeaders();
+  storeRateLimitHeaders("oai-conn-none", "openai", {
+    "content-type": "application/json",
+  });
+  assert.equal(getTokenHeaderSaturation("openai", "oai-conn-none"), null);
+
+  // limit=0 must not divide-by-zero / produce a signal.
+  storeRateLimitHeaders("oai-conn-zero", "openai", {
+    "x-ratelimit-limit-tokens": "0",
+    "x-ratelimit-remaining-tokens": "0",
+  });
+  assert.equal(getTokenHeaderSaturation("openai", "oai-conn-zero"), null);
+});
+
+test("reset is optional — signal still produced without a reset header", () => {
+  _clearRateLimitHeaders();
+  storeRateLimitHeaders("oai-conn-noreset", "openai", {
+    "x-ratelimit-limit-tokens": "1000",
+    "x-ratelimit-remaining-tokens": "250",
+  });
+  const sig = getTokenHeaderSaturation("openai", "oai-conn-noreset");
+  assert.ok(sig, "expected signal without reset");
+  assert.ok(Math.abs(sig!.saturation - 0.75) < 1e-9);
+  assert.equal(sig!.resetAt, null);
+});
+
+// ─── No regression on the existing REQUEST path ──────────────────────────────
+
+test("REQUEST headers still drive getSaturation (anthropic header fallback unchanged)", async () => {
+  _clearSaturationCache();
+  _clearRateLimitHeaders();
+  // Only request headers (no oauth/usage, no token headers): the legacy fallback
+  // must still compute (limit-remaining)/limit = 0.7 for anthropic.
+  storeRateLimitHeaders("req-conn", "anthropic", {
+    "anthropic-ratelimit-requests-limit": "100",
+    "anthropic-ratelimit-requests-remaining": "30",
+  });
+
+  // No oauth token on the connection → fetchAnthropicSaturation falls to the header path.
+  satMod.__setAnthropicSaturationDepsForTests({
+    loadConnection: async () => ({ id: "req-conn", provider: "anthropic", authType: "apikey" }),
+    fetchUsage: async () => ({ message: "no plan window" }),
+  });
+
+  const val = await getSaturation("req-conn", "anthropic", { unit: "requests", window: "hourly" });
+  satMod.__setAnthropicSaturationDepsForTests(null);
+  assert.ok(Math.abs(val - 0.7) < 1e-9, `expected request-header fallback ≈0.7, got ${val}`);
+});
+
+// ─── Generic provider: token-header signal surfaces via getSaturation ────────
+
+test("getSaturation(openai) surfaces token-header saturation when usage returns nothing", async () => {
+  _clearSaturationCache();
+  _clearRateLimitHeaders();
+  // usage returns nothing usable → 0; token headers should provide the signal.
+  __setGenericUsageFetcherForTests(async () => null);
+  storeRateLimitHeaders("oai-gen-1", "openai", {
+    "x-ratelimit-limit-tokens": "1000",
+    "x-ratelimit-remaining-tokens": "100",
+    "x-ratelimit-reset-tokens": "30s",
+  });
+
+  const val = await getSaturation("oai-gen-1", "openai", { unit: "tokens", window: "hourly" });
+  assert.ok(Math.abs(val - 0.9) < 1e-9, `expected token-header ≈0.9, got ${val}`);
+});
+
+test("getSaturation(openai) prefers real usage percent over token headers when usage is present", async () => {
+  _clearSaturationCache();
+  _clearRateLimitHeaders();
+  // usage reports 0.5 (50% used) → authoritative; token headers say 0.9 but must not override.
+  __setGenericUsageFetcherForTests(async () => ({ percentUsed: 0.5 }));
+  storeRateLimitHeaders("oai-gen-2", "openai", {
+    "x-ratelimit-limit-tokens": "1000",
+    "x-ratelimit-remaining-tokens": "100", // → 0.9 if it leaked through
+  });
+
+  const val = await getSaturation("oai-gen-2", "openai", { unit: "tokens", window: "hourly" });
+  assert.ok(Math.abs(val - 0.5) < 1e-9, `expected usage ≈0.5 to win, got ${val}`);
+});
+
+test("getSaturation(openai) fails open to 0 when neither usage nor token headers exist", async () => {
+  _clearSaturationCache();
+  _clearRateLimitHeaders();
+  __setGenericUsageFetcherForTests(async () => null);
+
+  const val = await getSaturation("oai-gen-3", "openai", { unit: "tokens", window: "hourly" });
+  assert.equal(val, 0);
+});
+
+// ─── Cross-key / cross-provider isolation ────────────────────────────────────
+
+test("token-header signal is keyed by (provider, connectionId)", () => {
+  _clearRateLimitHeaders();
+  storeRateLimitHeaders("shared-id", "openai", {
+    "x-ratelimit-limit-tokens": "1000",
+    "x-ratelimit-remaining-tokens": "100", // 0.9
+  });
+  storeRateLimitHeaders("shared-id", "anthropic", {
+    "anthropic-ratelimit-tokens-limit": "1000",
+    "anthropic-ratelimit-tokens-remaining": "900", // 0.1
+  });
+
+  const oai = getTokenHeaderSaturation("openai", "shared-id");
+  const anth = getTokenHeaderSaturation("anthropic", "shared-id");
+  assert.ok(oai && Math.abs(oai.saturation - 0.9) < 1e-9);
+  assert.ok(anth && Math.abs(anth.saturation - 0.1) < 1e-9);
+  // A provider with no token headers stored → null.
+  assert.equal(getTokenHeaderSaturation("openai", "never-seen"), null);
+});
diff --git a/tests/unit/quota-share-strategy.test.ts b/tests/unit/quota-share-strategy.test.ts
new file mode 100644
index 0000000000..7d1e59f940
--- /dev/null
+++ b/tests/unit/quota-share-strategy.test.ts
@@ -0,0 +1,492 @@
+/**
+ * Unit tests for the dedicated quota-share strategy (Phase 3 #9).
+ *
+ * Covers the three mechanisms of the isolated strategy module plus its
+ * activation wiring:
+ *   1. per-model bucket gating (accountBuckets.isBucketSaturated)
+ *   2. DRR (deficit round-robin, quantum proportional to weight)
+ *   3. P2C over real in-flight counters (quotaShareInflight)
+ *   4. fail-open behavior (no data / all saturated / empty targets)
+ *   5. qtSd/ combos are minted with strategy "quota-share"
+ *
+ * Runner: node:test + assert/strict (NO vitest, NO jest). Clock is injected via
+ * the nowMs param on every call — the tested path never reads Date.now().
+ */
+
+import { test, describe, beforeEach } from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  selectQuotaShareTarget,
+  _clearDrrStateForTest,
+  _getDrrDeficitForTest,
+} from "../../open-sse/services/combo/quotaShareStrategy.ts";
+import {
+  incrementInflight,
+  decrementInflight,
+  getInflight,
+  _clearInflightForTest,
+  DEFAULT_LEASE_MS,
+} from "../../open-sse/services/combo/quotaShareInflight.ts";
+import { recordUsage, _clearBucketsForTest } from "../../src/lib/quota/accountBuckets.ts";
+import { QUOTA_SHARE_STRATEGY } from "../../src/lib/quota/quotaCombos.ts";
+import { INTERNAL_ROUTING_STRATEGY_VALUES } from "../../src/shared/constants/routingStrategies.ts";
+import type { ResolvedComboTarget } from "../../open-sse/services/combo/types.ts";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+const NOW = Date.UTC(2026, 5, 24, 12, 0, 0); // 2026-06-24T12:00:00.000Z
+const RESET_AT = new Date(NOW + 3_600_000).toISOString(); // +1h (window still open)
+
+function makeTarget(
+  executionKey: string,
+  connectionId: string,
+  weight = 100,
+  modelStr = "anthropic/claude-sonnet-4-5"
+): ResolvedComboTarget {
+  return {
+    kind: "model",
+    stepId: `step-${executionKey}`,
+    executionKey,
+    modelStr,
+    provider: modelStr.split("/")[0],
+    providerId: null,
+    connectionId,
+    weight,
+    label: null,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Setup — reset all module state before each case for isolation.
+// ---------------------------------------------------------------------------
+
+beforeEach(() => {
+  _clearBucketsForTest();
+  _clearDrrStateForTest();
+  _clearInflightForTest();
+});
+
+// ─── quotaShareInflight ─────────────────────────────────────────────────────
+
+describe("quotaShareInflight", () => {
+  test("increment → getInflight returns 1", () => {
+    incrementInflight("conn-a", DEFAULT_LEASE_MS, NOW);
+    assert.equal(getInflight("conn-a", NOW), 1);
+  });
+
+  test("increment twice → getInflight returns 2", () => {
+    incrementInflight("conn-a", DEFAULT_LEASE_MS, NOW);
+    incrementInflight("conn-a", DEFAULT_LEASE_MS, NOW);
+    assert.equal(getInflight("conn-a", NOW), 2);
+  });
+
+  test("decrement after increment → returns 0", () => {
+    incrementInflight("conn-a", DEFAULT_LEASE_MS, NOW);
+    decrementInflight("conn-a", NOW);
+    assert.equal(getInflight("conn-a", NOW), 0);
+  });
+
+  test("decrement below 0 is safe (floors at 0)", () => {
+    decrementInflight("conn-a", NOW); // no prior increment
+    assert.equal(getInflight("conn-a", NOW), 0);
+  });
+
+  test("TTL expiry: expired slot returns 0 without an explicit decrement", () => {
+    const leaseMs = 1_000;
+    incrementInflight("conn-b", leaseMs, NOW);
+    assert.equal(getInflight("conn-b", NOW), 1);
+    assert.equal(getInflight("conn-b", NOW + leaseMs + 1), 0);
+  });
+
+  test("empty connectionId returns 0 (fail-open)", () => {
+    assert.equal(getInflight("", NOW), 0);
+    incrementInflight("", DEFAULT_LEASE_MS, NOW); // must not throw / not store
+    assert.equal(getInflight("", NOW), 0);
+  });
+});
+
+// ─── per-model bucket gating ────────────────────────────────────────────────
+
+describe("gating: per-model bucket saturation", () => {
+  test("saturated 5h window → that connection is deprioritized, the clean one wins", () => {
+    recordUsage("conn-sat", "5h", 100, RESET_AT, NOW);
+
+    const targets = [makeTarget("ek-sat", "conn-sat"), makeTarget("ek-ok", "conn-ok")];
+    const result = selectQuotaShareTarget(targets, "combo-5h", "anthropic/claude-sonnet-4-5", NOW);
+
+    assert.ok(result.target !== null, "must return a target");
+    assert.equal(result.target.executionKey, "ek-ok", "non-saturated target must be selected");
+    // Saturated target stays available as a fallback (deprioritized, not dropped).
+    assert.ok(
+      result.orderedTargets.some((t) => t.executionKey === "ek-sat"),
+      "saturated target must still appear in the fallback list"
+    );
+  });
+
+  test("saturated 7d window → that connection is deprioritized", () => {
+    recordUsage("conn-7d", "7d", 100, RESET_AT, NOW);
+    const targets = [makeTarget("ek-7d", "conn-7d"), makeTarget("ek-clean", "conn-clean")];
+
+    const result = selectQuotaShareTarget(targets, "combo-7d", "anthropic/claude-sonnet-4-5", NOW);
+    assert.equal(result.target?.executionKey, "ek-clean");
+  });
+
+  test("saturated per-model 7d window for the requested model → deprioritized", () => {
+    recordUsage("conn-pm", "7d:claude-sonnet-4-5", 100, RESET_AT, NOW);
+    const targets = [
+      makeTarget("ek-pm", "conn-pm", 100, "anthropic/claude-sonnet-4-5"),
+      makeTarget("ek-other", "conn-other", 100, "anthropic/claude-sonnet-4-5"),
+    ];
+
+    const result = selectQuotaShareTarget(targets, "combo-pm", "anthropic/claude-sonnet-4-5", NOW);
+    assert.equal(result.target?.executionKey, "ek-other");
+  });
+
+  test("per-model saturation for a DIFFERENT model does NOT deprioritize", () => {
+    // conn-x is saturated only on 7d:claude-opus-4, but the request is for sonnet.
+    recordUsage("conn-x", "7d:claude-opus-4", 100, RESET_AT, NOW);
+    const targets = [makeTarget("ek-x", "conn-x", 100, "anthropic/claude-sonnet-4-5")];
+
+    const result = selectQuotaShareTarget(
+      targets,
+      "combo-other-model",
+      "anthropic/claude-sonnet-4-5",
+      NOW
+    );
+    assert.equal(
+      result.target?.executionKey,
+      "ek-x",
+      "must not be gated by an unrelated model window"
+    );
+  });
+
+  test("fail-open: all targets saturated → all eligible again, still returns a target", () => {
+    recordUsage("conn-1", "5h", 100, RESET_AT, NOW);
+    recordUsage("conn-2", "5h", 100, RESET_AT, NOW);
+    const targets = [makeTarget("ek-1", "conn-1"), makeTarget("ek-2", "conn-2")];
+
+    const result = selectQuotaShareTarget(targets, "combo-fo", "anthropic/claude-sonnet-4-5", NOW);
+    assert.ok(result.target !== null, "must not return null when everything is saturated");
+    assert.equal(result.orderedTargets.length, 2, "both targets remain dispatchable");
+  });
+
+  test("empty targets → returns null (fail-open, no crash)", () => {
+    const result = selectQuotaShareTarget([], "combo-empty", "anthropic/claude-sonnet-4-5", NOW);
+    assert.equal(result.target, null);
+    assert.deepEqual(result.orderedTargets, []);
+  });
+
+  test("no buckets recorded at all → fail-open, first/healthy target selected", () => {
+    const targets = [makeTarget("ek-a", "conn-a"), makeTarget("ek-b", "conn-b")];
+    const result = selectQuotaShareTarget(
+      targets,
+      "combo-nodata",
+      "anthropic/claude-sonnet-4-5",
+      NOW
+    );
+    assert.ok(result.target !== null);
+    assert.equal(result.orderedTargets.length, 2);
+  });
+});
+
+// ─── DRR ─────────────────────────────────────────────────────────────────────
+
+describe("DRR: deficit round robin", () => {
+  test("equal weight: two connections alternate across consecutive calls", () => {
+    const t1 = makeTarget("ek-1", "conn-1", 100);
+    const t2 = makeTarget("ek-2", "conn-2", 100);
+
+    const r1 = selectQuotaShareTarget([t1, t2], "combo-drr", "anthropic/claude-sonnet-4-5", NOW);
+    const r2 = selectQuotaShareTarget([t1, t2], "combo-drr", "anthropic/claude-sonnet-4-5", NOW);
+
+    const selected = [r1.target?.executionKey, r2.target?.executionKey];
+    assert.ok(selected.includes("ek-1"), "ek-1 must be selected at some point");
+    assert.ok(selected.includes("ek-2"), "ek-2 must be selected at some point");
+  });
+
+  test("higher weight connection receives proportionally more selections (2:1)", () => {
+    const t1 = makeTarget("ek-heavy", "conn-heavy", 200); // 2x weight
+    const t2 = makeTarget("ek-light", "conn-light", 100); // 1x weight
+
+    const counts: Record<string, number> = { "ek-heavy": 0, "ek-light": 0 };
+    for (let i = 0; i < 30; i++) {
+      const r = selectQuotaShareTarget(
+        [t1, t2],
+        "combo-weighted",
+        "anthropic/claude-sonnet-4-5",
+        NOW
+      );
+      if (r.target) counts[r.target.executionKey]++;
+      // Simulate the request settling (as a real caller's finally handler would),
+      // so the P2C in-flight tie-break sees equal load and the DRR weighting shows.
+      r.decrementInflight();
+    }
+    assert.ok(
+      counts["ek-heavy"] > counts["ek-light"],
+      `heavy (${counts["ek-heavy"]}) should be selected more than light (${counts["ek-light"]})`
+    );
+    // Roughly 2:1 — heavy should be at least ~1.5x light over 30 rounds.
+    assert.ok(
+      counts["ek-heavy"] >= counts["ek-light"] * 1.5,
+      `heavy/light ratio should be ~2:1, got ${counts["ek-heavy"]}:${counts["ek-light"]}`
+    );
+  });
+
+  test("DRR state is isolated per comboName", () => {
+    const t = makeTarget("ek-shared", "conn-shared", 100);
+    selectQuotaShareTarget([t], "combo-A", "anthropic/claude-sonnet-4-5", NOW);
+
+    const deficitA = _getDrrDeficitForTest("combo-A", "ek-shared");
+    const deficitB = _getDrrDeficitForTest("combo-B", "ek-shared");
+    assert.equal(deficitB, 0, "combo-B deficit must remain 0 (isolated)");
+    assert.equal(deficitA, 0, "the selected target's deficit must be reset to 0");
+  });
+
+  test("single eligible target is returned unchanged", () => {
+    const t = makeTarget("ek-solo", "conn-solo", 100);
+    const result = selectQuotaShareTarget([t], "combo-solo", "anthropic/claude-sonnet-4-5", NOW);
+    assert.equal(result.target?.executionKey, "ek-solo");
+    assert.equal(result.orderedTargets.length, 1);
+  });
+});
+
+// ─── P2C in-flight ────────────────────────────────────────────────────────────
+
+describe("P2C in-flight", () => {
+  test("between two candidates, the one with fewer in-flight wins over the DRR pick", () => {
+    const t1 = makeTarget("ek-busy", "conn-busy", 100);
+    const t2 = makeTarget("ek-free", "conn-free", 100);
+
+    // Pre-load conn-busy with active in-flight requests.
+    incrementInflight("conn-busy", DEFAULT_LEASE_MS, NOW);
+    incrementInflight("conn-busy", DEFAULT_LEASE_MS, NOW);
+
+    const result = selectQuotaShareTarget(
+      [t1, t2],
+      "combo-p2c",
+      "anthropic/claude-sonnet-4-5",
+      NOW
+    );
+    assert.equal(
+      result.target?.executionKey,
+      "ek-free",
+      "the target with the lower in-flight load must win the P2C tie-break"
+    );
+  });
+
+  test("decrementInflight() releases the in-flight load", () => {
+    const t = makeTarget("ek-dec", "conn-dec", 100);
+    const result = selectQuotaShareTarget([t], "combo-dec", "anthropic/claude-sonnet-4-5", NOW);
+    assert.equal(getInflight("conn-dec", NOW), 1, "in-flight should be 1 after a dispatch");
+    result.decrementInflight();
+    assert.equal(getInflight("conn-dec", NOW), 0, "in-flight should be 0 after the decrement");
+  });
+
+  test("decrementInflight() is idempotent (safe to call more than once)", () => {
+    const t = makeTarget("ek-idem", "conn-idem", 100);
+    const result = selectQuotaShareTarget([t], "combo-idem", "anthropic/claude-sonnet-4-5", NOW);
+    result.decrementInflight();
+    result.decrementInflight(); // must not go negative or throw
+    assert.equal(getInflight("conn-idem", NOW), 0);
+  });
+
+  test("TTL releases in-flight automatically when decrement is never called (abort fallback)", () => {
+    const t = makeTarget("ek-ttl", "conn-ttl", 100);
+    const result = selectQuotaShareTarget([t], "combo-ttl", "anthropic/claude-sonnet-4-5", NOW);
+    // Simulate an aborted request: do NOT call result.decrementInflight().
+    assert.equal(getInflight("conn-ttl", NOW), 1);
+    assert.equal(
+      getInflight("conn-ttl", NOW + DEFAULT_LEASE_MS + 1),
+      0,
+      "the slot must auto-expire after the lease, preventing a permanent leak"
+    );
+    // The returned callback must remain referenced to satisfy the contract.
+    assert.equal(typeof result.decrementInflight, "function");
+  });
+});
+
+// ─── gating: per-connection concurrency cap (maxConcurrent) ─────────────────
+
+describe("gating: per-connection maxConcurrent", () => {
+  // DISCRIMINATING scenario: the at-cap connection has the LOWEST absolute
+  // in-flight load, so without concurrency gating the existing P2C tie-break
+  // would pick it. Only a real per-connection cap gate demotes it. This is what
+  // separates "gating works" from "P2C already happened to pick the free one".
+  test("at-cap connection with the LOWEST absolute load is still demoted (P2C alone would pick it)", () => {
+    // conn-tight: cap=1, in-flight=1  → AT cap, but lowest absolute load.
+    // conn-roomy: cap=10, in-flight=3 → below cap, but higher absolute load.
+    incrementInflight("conn-tight", DEFAULT_LEASE_MS, NOW);
+    incrementInflight("conn-roomy", DEFAULT_LEASE_MS, NOW);
+    incrementInflight("conn-roomy", DEFAULT_LEASE_MS, NOW);
+    incrementInflight("conn-roomy", DEFAULT_LEASE_MS, NOW);
+
+    const targets = [
+      makeTarget("ek-tight", "conn-tight", 100),
+      makeTarget("ek-roomy", "conn-roomy", 100),
+    ];
+    const maxConcurrentByConnection = new Map<string, number | null>([
+      ["conn-tight", 1],
+      ["conn-roomy", 10],
+    ]);
+
+    const gated = selectQuotaShareTarget(
+      targets,
+      "combo-cap-lowest",
+      "anthropic/claude-sonnet-4-5",
+      NOW,
+      { maxConcurrentByConnection }
+    );
+    assert.equal(
+      gated.target?.executionKey,
+      "ek-roomy",
+      "the below-cap connection must win even though it has MORE absolute in-flight load"
+    );
+    // The at-cap connection is NOT dropped — it stays as a last-resort fallback.
+    assert.ok(
+      gated.orderedTargets.some((t) => t.executionKey === "ek-tight"),
+      "the capped connection must still appear in the fallback list (never hard-blocked)"
+    );
+  });
+
+  test("a connection BELOW its maxConcurrent is NOT deprioritized", () => {
+    // conn-a has maxConcurrent=3 and only 1 in-flight → still has room, fully eligible.
+    incrementInflight("conn-a", DEFAULT_LEASE_MS, NOW);
+    const targets = [makeTarget("ek-a", "conn-a")];
+    const maxConcurrentByConnection = new Map<string, number | null>([["conn-a", 3]]);
+
+    const result = selectQuotaShareTarget(
+      targets,
+      "combo-below",
+      "anthropic/claude-sonnet-4-5",
+      NOW,
+      { maxConcurrentByConnection }
+    );
+    assert.equal(result.target?.executionKey, "ek-a", "below-cap connection must remain selected");
+  });
+
+  test("fail-open: ALL connections at their cap → all stay eligible, still returns a target", () => {
+    incrementInflight("conn-1", DEFAULT_LEASE_MS, NOW);
+    incrementInflight("conn-2", DEFAULT_LEASE_MS, NOW);
+    const targets = [makeTarget("ek-1", "conn-1"), makeTarget("ek-2", "conn-2")];
+    const maxConcurrentByConnection = new Map<string, number | null>([
+      ["conn-1", 1],
+      ["conn-2", 1],
+    ]);
+
+    const result = selectQuotaShareTarget(
+      targets,
+      "combo-allcap",
+      "anthropic/claude-sonnet-4-5",
+      NOW,
+      { maxConcurrentByConnection }
+    );
+    assert.ok(result.target !== null, "must never hard-block: a target is still returned");
+    assert.equal(result.orderedTargets.length, 2, "both targets remain dispatchable");
+  });
+
+  // DISCRIMINATING: the only candidate is at its cap with HIGH load while
+  // another candidate is under-cap with LOWER load — so this overlaps with P2C.
+  // Here we force the opposite: the under-cap winner has HIGHER absolute load so
+  // P2C alone would NOT pick it; the gate must.
+  test("at-cap target with high weight is demoted below an under-cap, higher-load target", () => {
+    // conn-cap: cap=2, in-flight=2  → AT cap. weight 900 (DRR would crown it).
+    // conn-free: cap=50, in-flight=5 → below cap, but MORE absolute load than cap.
+    incrementInflight("conn-cap", DEFAULT_LEASE_MS, NOW);
+    incrementInflight("conn-cap", DEFAULT_LEASE_MS, NOW);
+    for (let i = 0; i < 5; i++) incrementInflight("conn-free", DEFAULT_LEASE_MS, NOW);
+
+    const targets = [makeTarget("ek-cap", "conn-cap", 900), makeTarget("ek-free", "conn-free", 1)];
+    const maxConcurrentByConnection = new Map<string, number | null>([
+      ["conn-cap", 2],
+      ["conn-free", 50],
+    ]);
+
+    const result = selectQuotaShareTarget(
+      targets,
+      "combo-cap-vs-load",
+      "anthropic/claude-sonnet-4-5",
+      NOW,
+      { maxConcurrentByConnection }
+    );
+    assert.equal(
+      result.target?.executionKey,
+      "ek-free",
+      "concurrency gating must demote the at-cap target even though it has lower absolute load and higher DRR weight"
+    );
+  });
+
+  test("maxConcurrent null / 0 / missing is treated as 'no limit' (never gates)", () => {
+    // conn-null is heavily loaded (3 in-flight) but has null cap; conn-light has
+    // a positive cap but is well below it. With "null = no limit", conn-null must
+    // NOT be gated — so the lower-load conn-light wins purely by P2C, and BOTH
+    // remain dispatchable (nothing was demoted to the saturated tail).
+    incrementInflight("conn-null", DEFAULT_LEASE_MS, NOW);
+    incrementInflight("conn-null", DEFAULT_LEASE_MS, NOW);
+    incrementInflight("conn-null", DEFAULT_LEASE_MS, NOW);
+    const targets = [makeTarget("ek-null", "conn-null"), makeTarget("ek-light", "conn-light")];
+    const maxConcurrentByConnection = new Map<string, number | null>([
+      ["conn-null", null],
+      ["conn-light", 10],
+    ]);
+
+    const result = selectQuotaShareTarget(
+      targets,
+      "combo-nolimit",
+      "anthropic/claude-sonnet-4-5",
+      NOW,
+      { maxConcurrentByConnection }
+    );
+    assert.ok(result.target !== null);
+    assert.equal(result.orderedTargets.length, 2, "no connection gated when cap is null");
+
+    // And a 0 cap must behave identically to null (no gating): a single 0-cap
+    // connection at high load must still be selectable.
+    incrementInflight("conn-zero", DEFAULT_LEASE_MS, NOW);
+    incrementInflight("conn-zero", DEFAULT_LEASE_MS, NOW);
+    const zeroResult = selectQuotaShareTarget(
+      [makeTarget("ek-zero", "conn-zero")],
+      "combo-zero",
+      "anthropic/claude-sonnet-4-5",
+      NOW,
+      { maxConcurrentByConnection: new Map<string, number | null>([["conn-zero", 0]]) }
+    );
+    assert.equal(zeroResult.target?.executionKey, "ek-zero", "0 cap means no limit, not block");
+  });
+
+  test("no options passed → behaves exactly as before (backward compatible)", () => {
+    // Heavily loaded connection but no maxConcurrent info at all → no gating.
+    incrementInflight("conn-x", DEFAULT_LEASE_MS, NOW);
+    incrementInflight("conn-x", DEFAULT_LEASE_MS, NOW);
+    const targets = [makeTarget("ek-x", "conn-x")];
+    const result = selectQuotaShareTarget(
+      targets,
+      "combo-compat",
+      "anthropic/claude-sonnet-4-5",
+      NOW
+    );
+    assert.equal(result.target?.executionKey, "ek-x");
+    assert.equal(result.orderedTargets.length, 1);
+  });
+});
+
+// ─── activation wiring ──────────────────────────────────────────────────────
+
+describe("activation: qtSd/ combos use strategy 'quota-share'", () => {
+  test("QUOTA_SHARE_STRATEGY constant equals 'quota-share'", () => {
+    assert.equal(
+      QUOTA_SHARE_STRATEGY,
+      "quota-share",
+      "quotaCombos must mint qtSd/ combos with the 'quota-share' strategy"
+    );
+  });
+
+  test("'quota-share' is registered as an INTERNAL routing strategy", () => {
+    assert.ok(
+      (INTERNAL_ROUTING_STRATEGY_VALUES as readonly string[]).includes("quota-share"),
+      "'quota-share' must be in the internal (non-UI) routing strategy list"
+    );
+  });
+});
diff --git a/tests/unit/rate-limit-queue-timeout-lockout.test.ts b/tests/unit/rate-limit-queue-timeout-lockout.test.ts
new file mode 100644
index 0000000000..0fb874cc7f
--- /dev/null
+++ b/tests/unit/rate-limit-queue-timeout-lockout.test.ts
@@ -0,0 +1,140 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omr-rl-queue-timeout-lockout-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.API_KEY_SECRET = "test-rl-lockout-secret";
+
+const core = await import("../../src/lib/db/core.ts");
+const providersDb = await import("../../src/lib/db/providers.ts");
+const { handleComboChat } = await import("../../open-sse/services/combo.ts");
+const { getModelLockoutInfo, isModelLocked } =
+  await import("../../open-sse/services/accountFallback.ts");
+
+function createLog() {
+  return {
+    info: () => {},
+    warn: () => {},
+    error: () => {},
+    debug: () => {},
+  };
+}
+
+async function seedConnection(provider: string, overrides: any = {}): Promise<any> {
+  return providersDb.createProviderConnection({
+    provider,
+    authType: "apikey",
+    name: overrides.name || `${provider}-${Math.random().toString(16).slice(2, 8)}`,
+    apiKey: overrides.apiKey || `sk-test-${Math.random().toString(16).slice(2, 8)}`,
+    isActive: true,
+    testStatus: "active",
+    rateLimitedUntil: null,
+    backoffLevel: overrides.backoffLevel || 0,
+    providerSpecificData: overrides.providerSpecificData || {},
+  });
+}
+
+function errorResponseWithoutConnectionId(status: number) {
+  return new Response(JSON.stringify({ error: { message: "Local queue timeout" } }), {
+    status,
+    headers: { "content-type": "application/json" },
+  });
+}
+
+function errorResponseWithConnectionId(status: number, connectionId: string) {
+  return new Response(JSON.stringify({ error: { message: "Local queue timeout" } }), {
+    status,
+    headers: {
+      "content-type": "application/json",
+      "X-OmniRoute-Selected-Connection-Id": connectionId,
+    },
+  });
+}
+
+test.afterEach(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+test("RATE_LIMIT_QUEUE_TIMEOUT lockout behaves correctly depending on connection ID header", async () => {
+  const provider = "openai";
+  const model = "gpt-4";
+
+  // Seed the connection first!
+  const connection = await seedConnection(provider);
+  const connectionId = connection.id;
+
+  const customSettings = {
+    modelLockout: {
+      enabled: true,
+      errorCodes: [502, 520],
+      baseCooldownMs: 3000,
+      maxCooldownMs: 5000,
+      maxBackoffSteps: 10,
+      useExponentialBackoff: true,
+    },
+  };
+
+  const logs = createLog();
+
+  // Scenario 1: Response lacks connection ID header (Current buggy behavior)
+  await handleComboChat({
+    body: {},
+    combo: {
+      name: "test-combo",
+      strategy: "priority",
+      models: [`${provider}/${model}`],
+      config: { maxRetries: 0, retryDelayMs: 0, fallbackDelayMs: 0 },
+    },
+    handleSingleModel: async () => {
+      return errorResponseWithoutConnectionId(502);
+    },
+    isModelAvailable: async () => true,
+    log: logs as any,
+    settings: customSettings,
+    allCombos: null,
+  });
+
+  // Verify that the model is NOT locked for the actual connection connectionId
+  const lockedForConnBuggy = isModelLocked(provider, connectionId, model);
+  assert.equal(
+    lockedForConnBuggy,
+    false,
+    "Model should not be locked for actual connection when header is missing"
+  );
+
+  // Verify that it got locked under the empty string connectionId ""
+  const lockedForEmptyBuggy = isModelLocked(provider, "", model);
+  assert.equal(
+    lockedForEmptyBuggy,
+    true,
+    "Model is incorrectly locked under empty string connectionId when header is missing"
+  );
+
+  const { clearAllModelLockouts } = await import("../../open-sse/services/accountFallback.ts");
+  clearAllModelLockouts();
+
+  await handleComboChat({
+    body: {},
+    combo: {
+      name: "test-combo",
+      strategy: "priority",
+      models: [`${provider}/${model}`],
+      config: { maxRetries: 0, retryDelayMs: 0, fallbackDelayMs: 0 },
+    },
+    handleSingleModel: async () => {
+      return errorResponseWithConnectionId(502, connectionId);
+    },
+    isModelAvailable: async () => true,
+    log: logs as any,
+    settings: customSettings,
+    allCombos: null,
+  });
+
+  // Verify that the model IS locked for the actual connection
+  const lockedForConnFixed = isModelLocked(provider, connectionId, model);
+  assert.equal(lockedForConnFixed, true, "Model should be locked for the correct connection ID");
+});
diff --git a/tests/unit/rate-limiter-eviction-4041.test.ts b/tests/unit/rate-limiter-eviction-4041.test.ts
new file mode 100644
index 0000000000..017f06c376
--- /dev/null
+++ b/tests/unit/rate-limiter-eviction-4041.test.ts
@@ -0,0 +1,116 @@
+/**
+ * Regression test for #4041 / #4771: FALLBACK_MEMORY_STORE accumulates
+ * stale window keys and never evicts them, leading to a slow heap leak
+ * (~500 MB → OOM over ~2 days idle in the self-hosted/no-Redis case).
+ *
+ * The fix adds `evictStaleRateLimitWindows(store, nowSeconds)` which
+ * must be exported from rateLimiter.ts.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+// Key format: rl:api_key:{id}:{windowSize}:{windowNumber}
+// A key's window ends at (windowNumber + 1) * windowSize (epoch-seconds).
+// Keys whose window ended in the past must be deleted; the current window must survive.
+
+function makeKey(id: string, windowSize: number, windowNumber: number): string {
+  return `rl:api_key:${id}:${windowSize}:${windowNumber}`;
+}
+
+test("evictStaleRateLimitWindows is exported from rateLimiter", async () => {
+  const { evictStaleRateLimitWindows } = await import("@/shared/utils/rateLimiter.js");
+  assert.equal(
+    typeof evictStaleRateLimitWindows,
+    "function",
+    "evictStaleRateLimitWindows must be exported"
+  );
+});
+
+test("evictStaleRateLimitWindows deletes keys whose window has ended and keeps current keys", async () => {
+  const { evictStaleRateLimitWindows } = await import("@/shared/utils/rateLimiter.js");
+
+  const nowSeconds = 1_000_000; // arbitrary fixed "now"
+  const windowSize = 60; // 60-second window
+  const currentWindow = Math.floor(nowSeconds / windowSize); // window that contains nowSeconds
+  const pastWindow1 = currentWindow - 1; // ended at currentWindow * windowSize — already past
+  const pastWindow2 = currentWindow - 5; // even older
+
+  const store = new Map<string, number>([
+    [makeKey("user-a", windowSize, pastWindow1), 3],
+    [makeKey("user-a", windowSize, pastWindow2), 7],
+    [makeKey("user-b", windowSize, pastWindow1), 1],
+    [makeKey("user-a", windowSize, currentWindow), 2], // LIVE — must survive
+  ]);
+
+  assert.equal(store.size, 4, "should start with 4 keys");
+
+  evictStaleRateLimitWindows(store, nowSeconds);
+
+  // Stale keys must be gone
+  assert.equal(
+    store.has(makeKey("user-a", windowSize, pastWindow1)),
+    false,
+    "past window -1 for user-a must be evicted"
+  );
+  assert.equal(
+    store.has(makeKey("user-a", windowSize, pastWindow2)),
+    false,
+    "past window -5 for user-a must be evicted"
+  );
+  assert.equal(
+    store.has(makeKey("user-b", windowSize, pastWindow1)),
+    false,
+    "past window -1 for user-b must be evicted"
+  );
+
+  // Current key must survive
+  assert.equal(
+    store.has(makeKey("user-a", windowSize, currentWindow)),
+    true,
+    "current window for user-a must survive"
+  );
+  assert.equal(
+    store.get(makeKey("user-a", windowSize, currentWindow)),
+    2,
+    "current window count must be unchanged"
+  );
+
+  assert.equal(store.size, 1, "only 1 key should remain after eviction");
+});
+
+test("evictStaleRateLimitWindows leaves store untouched when all keys are current", async () => {
+  const { evictStaleRateLimitWindows } = await import("@/shared/utils/rateLimiter.js");
+
+  const nowSeconds = 2_000_000;
+  const windowSize = 3600;
+  const currentWindow = Math.floor(nowSeconds / windowSize);
+
+  const store = new Map<string, number>([
+    [makeKey("x", windowSize, currentWindow), 5],
+    [makeKey("y", windowSize, currentWindow), 9],
+  ]);
+
+  evictStaleRateLimitWindows(store, nowSeconds);
+
+  assert.equal(store.size, 2, "no keys should be evicted when all are current");
+});
+
+test("evictStaleRateLimitWindows is a no-op on an empty store", async () => {
+  const { evictStaleRateLimitWindows } = await import("@/shared/utils/rateLimiter.js");
+
+  const store = new Map<string, number>();
+  evictStaleRateLimitWindows(store, 1_000_000);
+  assert.equal(store.size, 0);
+});
+
+test("evictStaleRateLimitWindows ignores keys with unexpected formats (does not throw)", async () => {
+  const { evictStaleRateLimitWindows } = await import("@/shared/utils/rateLimiter.js");
+
+  const store = new Map<string, number>([
+    ["not-a-rate-limit-key", 1],
+    ["rl:api_key:only-four-segments", 2],
+  ]);
+
+  // Must not throw
+  assert.doesNotThrow(() => evictStaleRateLimitWindows(store, 1_000_000));
+});
diff --git a/tests/unit/remote-image-fetch-dns-rebinding.test.ts b/tests/unit/remote-image-fetch-dns-rebinding.test.ts
new file mode 100644
index 0000000000..78293f1d9b
--- /dev/null
+++ b/tests/unit/remote-image-fetch-dns-rebinding.test.ts
@@ -0,0 +1,121 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { fetchRemoteImage } from "@/shared/network/remoteImageFetch";
+
+// GHSA-cmhj-wh2f-9cgx — DNS-rebinding SSRF: a public hostname whose DNS
+// resolves to a private/loopback IP would otherwise bypass the string-only
+// `parseAndValidatePublicUrl` guard. The fix is to (a) resolve the host once
+// up-front, (b) reject if any resolved record is private, and (c) pin the
+// connection to that resolved IP so a second DNS resolution at fetch-time
+// cannot rebind to a different (private) address.
+
+test("fetchRemoteImage rejects when DNS resolves a public hostname to loopback (rebinding)", async () => {
+  let fetchCalled = false;
+  await assert.rejects(
+    () =>
+      fetchRemoteImage("https://attacker.example.com/image.png", {
+        fetchImpl: async () => {
+          fetchCalled = true;
+          return new Response(new Uint8Array([1, 2, 3]), {
+            status: 200,
+            headers: { "content-type": "image/png" },
+          });
+        },
+        guard: "public-only",
+        // Inject a fake DNS resolver: attacker.example.com resolves to 127.0.0.1
+        lookup: async () => [{ address: "127.0.0.1", family: 4 }],
+      }),
+    /blocked|private|rebind/i
+  );
+  assert.equal(fetchCalled, false, "fetch must not be called when DNS resolves to a private IP");
+});
+
+test("fetchRemoteImage rejects when DNS resolves to cloud-metadata IP (169.254.169.254)", async () => {
+  let fetchCalled = false;
+  await assert.rejects(
+    () =>
+      fetchRemoteImage("https://cdn.example.com/image.png", {
+        fetchImpl: async () => {
+          fetchCalled = true;
+          return new Response("unexpected");
+        },
+        guard: "public-only",
+        lookup: async () => [{ address: "169.254.169.254", family: 4 }],
+      }),
+    /blocked|private|rebind/i
+  );
+  assert.equal(fetchCalled, false);
+});
+
+test("fetchRemoteImage rejects when any of multiple resolved IPs is private (multi-A trick)", async () => {
+  let fetchCalled = false;
+  await assert.rejects(
+    () =>
+      fetchRemoteImage("https://multi.example.com/image.png", {
+        fetchImpl: async () => {
+          fetchCalled = true;
+          return new Response("unexpected");
+        },
+        guard: "public-only",
+        lookup: async () => [
+          { address: "203.0.113.5", family: 4 },
+          { address: "10.0.0.1", family: 4 },
+        ],
+      }),
+    /blocked|private|rebind/i
+  );
+  assert.equal(fetchCalled, false);
+});
+
+test("fetchRemoteImage allows a public hostname that resolves to a public IP", async () => {
+  const result = await fetchRemoteImage("https://cdn.example.com/image.png", {
+    fetchImpl: async () =>
+      new Response(new Uint8Array([1, 2, 3]), {
+        status: 200,
+        headers: { "content-type": "image/png" },
+      }),
+    guard: "public-only",
+    lookup: async () => [{ address: "203.0.113.5", family: 4 }],
+  });
+  assert.equal(result.buffer.toString("base64"), "AQID");
+});
+
+test("fetchRemoteImage skips DNS resolution for IP-literal hosts (already string-validated)", async () => {
+  // IP literals are validated by parseAndValidatePublicUrl directly; the
+  // resolver injection should not be invoked.
+  let lookupCalled = false;
+  const result = await fetchRemoteImage("https://203.0.113.5/image.png", {
+    fetchImpl: async () =>
+      new Response(new Uint8Array([1]), {
+        status: 200,
+        headers: { "content-type": "image/png" },
+      }),
+    guard: "public-only",
+    lookup: async () => {
+      lookupCalled = true;
+      return [{ address: "203.0.113.5", family: 4 }];
+    },
+  });
+  assert.equal(result.buffer.toString("base64"), "AQ==");
+  assert.equal(lookupCalled, false, "IP-literal hosts must not trigger DNS lookup");
+});
+
+test("fetchRemoteImage rejects when DNS resolution fails entirely", async () => {
+  let fetchCalled = false;
+  await assert.rejects(
+    () =>
+      fetchRemoteImage("https://nx.example.com/image.png", {
+        fetchImpl: async () => {
+          fetchCalled = true;
+          return new Response("unexpected");
+        },
+        guard: "public-only",
+        lookup: async () => {
+          throw new Error("ENOTFOUND");
+        },
+      }),
+    /resolve|dns|blocked/i
+  );
+  assert.equal(fetchCalled, false);
+});
diff --git a/tests/unit/remote-image-fetch.test.ts b/tests/unit/remote-image-fetch.test.ts
index 56f7b80e1a..80ff9e3e7c 100644
--- a/tests/unit/remote-image-fetch.test.ts
+++ b/tests/unit/remote-image-fetch.test.ts
@@ -3,6 +3,11 @@ import test from "node:test";
 
 import { fetchRemoteImage } from "@/shared/network/remoteImageFetch";
 
+// Stub DNS resolver: every (unused) hostname resolves to a public IP. The
+// rebinding guard (GHSA-cmhj-wh2f-9cgx) needs a non-empty resolution; without
+// it, fictitious hosts like `cdn.example.com` would correctly be rejected.
+const publicLookup = async () => [{ address: "203.0.113.5" as string, family: 4 }];
+
 test("fetchRemoteImage reads public image bytes", async () => {
   const result = await fetchRemoteImage("https://cdn.example.com/image.png", {
     fetchImpl: async () =>
@@ -11,6 +16,7 @@ test("fetchRemoteImage reads public image bytes", async () => {
         headers: { "content-type": "image/png" },
       }),
     guard: "public-only",
+    lookup: publicLookup,
   });
 
   assert.equal(result.buffer.toString("base64"), "AQID");
@@ -45,6 +51,7 @@ test("fetchRemoteImage blocks redirects to private image hosts", async () => {
             headers: { location: "http://169.254.169.254/latest/meta-data" },
           }),
         guard: "public-only",
+        lookup: publicLookup,
       }),
     /Blocked private or local provider URL/
   );
diff --git a/tests/unit/resilience-settings-combo-cooldown-wait.test.ts b/tests/unit/resilience-settings-combo-cooldown-wait.test.ts
new file mode 100644
index 0000000000..63bfab127c
--- /dev/null
+++ b/tests/unit/resilience-settings-combo-cooldown-wait.test.ts
@@ -0,0 +1,102 @@
+/**
+ * TDD — ResilienceSettings.comboCooldownWait (quota-share combo cooldown-aware
+ * retry, Variante A). Locks the defaults, the resolve/merge round-trip and the
+ * clamping/validation contract of normalizeComboCooldownWaitSettings.
+ */
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import {
+  DEFAULT_RESILIENCE_SETTINGS,
+  mergeResilienceSettings,
+  resolveResilienceSettings,
+  type ResilienceSettings,
+} from "../../src/lib/resilience/settings.ts";
+
+function cloneDefaults(): ResilienceSettings {
+  return structuredClone(DEFAULT_RESILIENCE_SETTINGS);
+}
+
+test("default comboCooldownWait is conservative (on, 5s ceiling, 2 attempts, 8s budget)", () => {
+  const s = cloneDefaults().comboCooldownWait;
+  assert.equal(s.enabled, true);
+  assert.equal(s.maxWaitMs, 5000);
+  assert.equal(s.maxAttempts, 2);
+  assert.equal(s.budgetMs, 8000);
+});
+
+test("resolveResilienceSettings returns the default block when nothing is stored", () => {
+  const resolved = resolveResilienceSettings({});
+  assert.deepEqual(resolved.comboCooldownWait, DEFAULT_RESILIENCE_SETTINGS.comboCooldownWait);
+});
+
+test("resolveResilienceSettings reads stored comboCooldownWait overrides", () => {
+  const resolved = resolveResilienceSettings({
+    resilienceSettings: {
+      comboCooldownWait: { enabled: true, maxWaitMs: 3000, maxAttempts: 1, budgetMs: 4000 },
+    },
+  });
+  assert.deepEqual(resolved.comboCooldownWait, {
+    enabled: true,
+    maxWaitMs: 3000,
+    maxAttempts: 1,
+    budgetMs: 4000,
+  });
+});
+
+test("mergeResilienceSettings round-trips a partial patch", () => {
+  const merged = mergeResilienceSettings(cloneDefaults(), {
+    comboCooldownWait: { maxWaitMs: 2000 },
+  });
+  assert.equal(merged.comboCooldownWait.maxWaitMs, 2000);
+  // Unspecified fields keep the current value.
+  assert.equal(merged.comboCooldownWait.maxAttempts, 2);
+  assert.equal(merged.comboCooldownWait.budgetMs, 8000);
+  assert.equal(merged.comboCooldownWait.enabled, true);
+});
+
+test("enabled is forced false when maxWaitMs or maxAttempts is zero", () => {
+  const a = mergeResilienceSettings(cloneDefaults(), {
+    comboCooldownWait: { enabled: true, maxWaitMs: 0 },
+  });
+  assert.equal(a.comboCooldownWait.enabled, false);
+
+  const b = mergeResilienceSettings(cloneDefaults(), {
+    comboCooldownWait: { enabled: true, maxAttempts: 0 },
+  });
+  assert.equal(b.comboCooldownWait.enabled, false);
+});
+
+test("maxWaitMs is clamped to the 30s hard ceiling", () => {
+  const merged = mergeResilienceSettings(cloneDefaults(), {
+    comboCooldownWait: { maxWaitMs: 999_999 },
+  });
+  assert.equal(merged.comboCooldownWait.maxWaitMs, 30000);
+});
+
+test("budgetMs can never drop below a single maxWaitMs", () => {
+  const merged = mergeResilienceSettings(cloneDefaults(), {
+    comboCooldownWait: { maxWaitMs: 5000, budgetMs: 100 },
+  });
+  // budget floored at maxWaitMs so at least one wait can fire.
+  assert.equal(merged.comboCooldownWait.budgetMs, 5000);
+});
+
+test("explicit disable is honored", () => {
+  const merged = mergeResilienceSettings(cloneDefaults(), {
+    comboCooldownWait: { enabled: false },
+  });
+  assert.equal(merged.comboCooldownWait.enabled, false);
+});
+
+test("garbage values fall back to the current numbers", () => {
+  const merged = mergeResilienceSettings(cloneDefaults(), {
+    comboCooldownWait: {
+      maxWaitMs: "not-a-number" as never,
+      maxAttempts: null as never,
+      budgetMs: undefined,
+    },
+  });
+  assert.equal(merged.comboCooldownWait.maxWaitMs, 5000);
+  assert.equal(merged.comboCooldownWait.maxAttempts, 2);
+  assert.equal(merged.comboCooldownWait.budgetMs, 8000);
+});
diff --git a/tests/unit/resilience-settings-quota-share-concurrency.test.ts b/tests/unit/resilience-settings-quota-share-concurrency.test.ts
new file mode 100644
index 0000000000..8dd6e29830
--- /dev/null
+++ b/tests/unit/resilience-settings-quota-share-concurrency.test.ts
@@ -0,0 +1,66 @@
+/**
+ * TDD — ResilienceSettings.quotaShareConcurrencyLimit (FASE 2.1, the
+ * per-connection concurrency kill-switch for quota-share combos). Locks the
+ * default, the resolve/merge round-trip, and the boolean normalization.
+ */
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import {
+  DEFAULT_RESILIENCE_SETTINGS,
+  mergeResilienceSettings,
+  resolveResilienceSettings,
+  type ResilienceSettings,
+} from "../../src/lib/resilience/settings.ts";
+
+function cloneDefaults(): ResilienceSettings {
+  return structuredClone(DEFAULT_RESILIENCE_SETTINGS);
+}
+
+test("default quotaShareConcurrencyLimit is enabled (kill-switch on)", () => {
+  assert.deepEqual(cloneDefaults().quotaShareConcurrencyLimit, { enabled: true });
+});
+
+test("resolveResilienceSettings returns the default block when nothing is stored", () => {
+  const resolved = resolveResilienceSettings({});
+  assert.deepEqual(
+    resolved.quotaShareConcurrencyLimit,
+    DEFAULT_RESILIENCE_SETTINGS.quotaShareConcurrencyLimit
+  );
+});
+
+test("resolveResilienceSettings reads a stored disable override", () => {
+  const resolved = resolveResilienceSettings({
+    resilienceSettings: { quotaShareConcurrencyLimit: { enabled: false } },
+  });
+  assert.equal(resolved.quotaShareConcurrencyLimit.enabled, false);
+});
+
+test("mergeResilienceSettings round-trips a disable patch", () => {
+  const current = cloneDefaults();
+  const next = mergeResilienceSettings(current, {
+    quotaShareConcurrencyLimit: { enabled: false },
+  });
+  assert.equal(next.quotaShareConcurrencyLimit.enabled, false);
+  // unrelated blocks are preserved
+  assert.deepEqual(next.comboCooldownWait, current.comboCooldownWait);
+});
+
+test("garbage values fall back to the current enabled flag", () => {
+  const resolved = resolveResilienceSettings({
+    resilienceSettings: {
+      quotaShareConcurrencyLimit: { enabled: "nope" as unknown as boolean },
+    },
+  });
+  // non-boolean → falls back to the default (true)
+  assert.equal(resolved.quotaShareConcurrencyLimit.enabled, true);
+});
+
+test("an explicit re-enable patch is honored", () => {
+  const disabled = mergeResilienceSettings(cloneDefaults(), {
+    quotaShareConcurrencyLimit: { enabled: false },
+  });
+  const reenabled = mergeResilienceSettings(disabled, {
+    quotaShareConcurrencyLimit: { enabled: true },
+  });
+  assert.equal(reenabled.quotaShareConcurrencyLimit.enabled, true);
+});
diff --git a/tests/unit/resolve-routing-model.test.ts b/tests/unit/resolve-routing-model.test.ts
new file mode 100644
index 0000000000..b9a3c53b9e
--- /dev/null
+++ b/tests/unit/resolve-routing-model.test.ts
@@ -0,0 +1,32 @@
+// Regression guard for #4863: X-Route-Model header overrides body.model for routing.
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { resolveRoutingModel } from "../../src/sse/handlers/resolveRoutingModel.ts";
+
+function req(headers: Record<string, string>) {
+  return { headers: { get: (n: string) => headers[n.toLowerCase()] ?? null } };
+}
+
+describe("resolveRoutingModel (#4863)", () => {
+  it("uses body.model when no X-Route-Model header is present", () => {
+    assert.equal(resolveRoutingModel(req({}), { model: "gpt-5.3-codex" }), "gpt-5.3-codex");
+  });
+
+  it("X-Route-Model header overrides body.model", () => {
+    assert.equal(
+      resolveRoutingModel(req({ "x-route-model": "my-combo" }), { model: "codex/gpt-5.3-codex" }),
+      "my-combo"
+    );
+  });
+
+  it("trims surrounding whitespace from the header value", () => {
+    assert.equal(
+      resolveRoutingModel(req({ "x-route-model": "  alias-x  " }), { model: "fallback" }),
+      "alias-x"
+    );
+  });
+
+  it("falls back to body.model when the header is empty/whitespace-only", () => {
+    assert.equal(resolveRoutingModel(req({ "x-route-model": "   " }), { model: "fallback" }), "fallback");
+  });
+});
diff --git a/tests/unit/responses-parse-once-4041.test.ts b/tests/unit/responses-parse-once-4041.test.ts
new file mode 100644
index 0000000000..8b986e1bdb
--- /dev/null
+++ b/tests/unit/responses-parse-once-4041.test.ts
@@ -0,0 +1,205 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+// #4041: /v1/responses (Codex wire_api=responses hot path) parsed the JSON body 3-4x per
+// request — once in withInjectionGuard, once in withCodexPreferredModel, once for model
+// detection before SSE keepalive, and once more inside handleChat via resolveChatRequestBody.
+//
+// The fix threads the already-parsed body from withInjectionGuard into the wrapped handler
+// as a third argument (preParsedBody), mirroring the existing /v1/chat/completions pattern
+// (#4380). This test confirms: (a) withInjectionGuard passes the body it parsed to the inner
+// handler as a 3rd arg, and (b) withCodexPreferredModel reuses an already-parsed body
+// instead of re-cloning+re-parsing the request.
+
+// ─── Part A: withInjectionGuard threads the parsed body ──────────────────────
+
+const { withInjectionGuard } = await import("../../src/middleware/promptInjectionGuard.ts");
+
+test("#4041 withInjectionGuard passes the parsed body as 3rd arg to the inner handler", async () => {
+  let receivedPreParsed: unknown = undefined;
+
+  const innerHandler = async (_request: any, _context: any, preParsedBody: unknown) => {
+    receivedPreParsed = preParsedBody;
+    return new Response("ok");
+  };
+
+  const wrapped = withInjectionGuard(innerHandler, { mode: "warn" });
+  const payload = { messages: [{ role: "user", content: "Hello world" }] };
+
+  const request = new Request("http://localhost/v1/responses", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(payload),
+  });
+
+  await wrapped(request, {});
+
+  assert.deepEqual(
+    receivedPreParsed,
+    payload,
+    "withInjectionGuard must thread the body it already parsed into the inner handler as 3rd arg"
+  );
+});
+
+test("#4041 withInjectionGuard passes null as 3rd arg when body cannot be parsed", async () => {
+  let receivedPreParsed: unknown = "sentinel";
+
+  const innerHandler = async (_request: any, _context: any, preParsedBody: unknown) => {
+    receivedPreParsed = preParsedBody;
+    return new Response("ok");
+  };
+
+  const wrapped = withInjectionGuard(innerHandler, { mode: "warn" });
+
+  // A GET request skips the guard entirely — 3rd arg is NOT forwarded (handler gets 2 args)
+  // A POST with non-JSON body: body is null, still calls handler with null as 3rd arg
+  const request = new Request("http://localhost/v1/responses", {
+    method: "POST",
+    headers: { "Content-Type": "text/plain" },
+    body: "not json",
+  });
+
+  await wrapped(request, {});
+
+  assert.equal(
+    receivedPreParsed,
+    null,
+    "withInjectionGuard must pass null (not undefined) when body could not be parsed"
+  );
+});
+
+// ─── Part B: withCodexPreferredModel reuses pre-parsed body ──────────────────
+
+// Import the internal helper directly. It is not exported as a named export from
+// the route file by default, but we can import the module and access it.
+// We spy on Request.prototype behaviour by counting .clone() calls instead.
+
+test("#4041 withCodexPreferredModel accepts a pre-parsed body and avoids re-cloning the request", async () => {
+  // Stub out resolveResponsesApiModel and its dependencies so we can test the
+  // parse-counting in isolation without hitting the database.
+  const originalFetch = globalThis.fetch;
+
+  let cloneCount = 0;
+  let jsonCount = 0;
+
+  const fakeBody = { model: "gpt-4o", messages: [] };
+
+  // Build a minimal fake request whose .clone() / .json() we can count
+  function makeCountingRequest(body: object): Request {
+    const req = new Request("http://localhost/v1/responses", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+    });
+
+    // Wrap clone so we count calls
+    const origClone = req.clone.bind(req);
+    Object.defineProperty(req, "clone", {
+      value: () => {
+        cloneCount++;
+        return origClone();
+      },
+      writable: true,
+    });
+
+    return req;
+  }
+
+  // We import the route module to call withCodexPreferredModel.
+  // Because the module-level DB / getModelInfo calls are side-effecting, we only
+  // check that the function, when given a preParsedBody, returns early without cloning.
+  // We test this by ensuring cloneCount === 0 after a call where the model is unknown
+  // (resolveResponsesApiModel returns changed=false → early return).
+  //
+  // Simplest approach: inline-test the contract via the re-exported helper.
+
+  const req = makeCountingRequest(fakeBody);
+
+  // Simulate the behavior we want: if preParsedBody is supplied and the model field is
+  // already resolved, clone() must not be called on the original request.
+  // This is a white-box contract test — if the impl calls clone() when preParsedBody is
+  // provided, cloneCount will be > 0 and the assertion fails.
+
+  // Before fix: withCodexPreferredModel always does `const clone = request.clone()`
+  // After fix: it should use the pre-parsed body directly.
+
+  // We can test this without importing the whole route by checking that `resolveChatRequestBody`
+  // (the terminal consumer) also does not re-parse when given a pre-parsed body — verifying
+  // that the end-to-end threading avoids the extra parse.
+
+  const { resolveChatRequestBody } = await import("../../src/sse/handlers/requestBody.ts");
+
+  let innerJsonCalls = 0;
+  const countingReq = {
+    json: async () => {
+      innerJsonCalls++;
+      return fakeBody;
+    },
+  };
+
+  const result = await resolveChatRequestBody(countingReq, fakeBody);
+  assert.deepEqual(result, fakeBody);
+  assert.equal(
+    innerJsonCalls,
+    0,
+    "resolveChatRequestBody must not call request.json() when preParsedBody is provided"
+  );
+});
+
+// ─── Part C: full integration — count .json() calls through withInjectionGuard ──
+
+test("#4041 the body is parsed AT MOST ONCE through withInjectionGuard + inner handler", async () => {
+  let jsonParseCount = 0;
+
+  // Build a request where we count every .json() call (including on clones)
+  const payload = { model: "gpt-4o", messages: [{ role: "user", content: "hi" }] };
+  const bodyStr = JSON.stringify(payload);
+
+  // We create a real Request but intercept .clone() to return a spy-wrapped clone
+  const origRequest = new Request("http://localhost/v1/responses", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: bodyStr,
+  });
+
+  function wrapWithJsonSpy(req: Request): Request {
+    const origJson = req.json.bind(req);
+    const origClone = req.clone.bind(req);
+    Object.defineProperty(req, "json", {
+      value: async () => {
+        jsonParseCount++;
+        return origJson();
+      },
+      writable: true,
+    });
+    Object.defineProperty(req, "clone", {
+      value: () => {
+        const cloned = origClone();
+        return wrapWithJsonSpy(cloned);
+      },
+      writable: true,
+    });
+    return req;
+  }
+
+  const spyRequest = wrapWithJsonSpy(origRequest);
+
+  let preParsedBodyReceived: unknown = undefined;
+  const innerHandler = async (_req: any, _ctx: any, preParsedBody: unknown) => {
+    preParsedBodyReceived = preParsedBody;
+    return new Response("ok");
+  };
+
+  const wrapped = withInjectionGuard(innerHandler, { mode: "warn" });
+  await wrapped(spyRequest, {});
+
+  assert.ok(
+    jsonParseCount <= 1,
+    `Expected at most 1 JSON parse through withInjectionGuard, got ${jsonParseCount}`
+  );
+  assert.deepEqual(
+    preParsedBodyReceived,
+    payload,
+    "inner handler must receive the pre-parsed body as 3rd arg"
+  );
+});
diff --git a/tests/unit/route-guard-loopback-via-proxy.test.ts b/tests/unit/route-guard-loopback-via-proxy.test.ts
new file mode 100644
index 0000000000..77552ec260
--- /dev/null
+++ b/tests/unit/route-guard-loopback-via-proxy.test.ts
@@ -0,0 +1,112 @@
+/**
+ * Security regression: when OmniRoute itself runs behind an external reverse
+ * proxy (nginx / Caddy / Cloudflare Tunnel), `req.socket.remoteAddress` is the
+ * proxy hop — usually 127.0.0.1 — not the real end-user.
+ *
+ * Previously, the custom server stamped the loopback socket as the trusted
+ * peer IP, so `classifyHostLocality()` returned "loopback" for every remote
+ * caller arriving via the proxy → the LOCAL_ONLY route guard (which gates
+ * spawn-capable routes like `/api/cli-tools/runtime/*`, `/api/services/*`,
+ * `/api/plugins/*`, `/api/system/version`) was effectively bypassed. A leaked
+ * JWT over the public tunnel could trigger child-process spawning.
+ *
+ * Fix (mirrors upstream decolua/9router commit da667836): the custom server
+ * detects forwarding headers (`x-forwarded-for` / `x-real-ip`) and stamps a
+ * token-protected `via-proxy` marker. When the marker is present, locality
+ * derived from a loopback socket is downgraded to "remote" (fail closed).
+ *
+ * Hard Rules #15, #17 + Rule #18 (TDD before fix).
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import {
+  resolveStampedPeer,
+  resolveStampedViaProxy,
+  classifyStampedPeerLocality,
+} from "../../src/server/authz/peerStamp.ts";
+
+const TOK = "process-secret-token-abc";
+
+test("resolveStampedViaProxy: returns true only for the correctly-tokened stamp", () => {
+  assert.equal(resolveStampedViaProxy(`${TOK}|1`, TOK), true);
+  assert.equal(resolveStampedViaProxy(`${TOK}|0`, TOK), false);
+  assert.equal(resolveStampedViaProxy(null, TOK), false);
+  assert.equal(resolveStampedViaProxy("", TOK), false);
+});
+
+test("resolveStampedViaProxy: rejects forged / un-tokened values", () => {
+  assert.equal(resolveStampedViaProxy("1", TOK), false, "raw client value (no token)");
+  assert.equal(resolveStampedViaProxy("wrong-token|1", TOK), false, "forged token");
+  assert.equal(resolveStampedViaProxy(`${TOK}|1`, undefined), false, "no process token");
+});
+
+test("classifyStampedPeerLocality: loopback socket WITHOUT a proxy stamp stays loopback", () => {
+  // Local CLI / dashboard hit — the normal happy path.
+  assert.equal(
+    classifyStampedPeerLocality(`${TOK}|127.0.0.1`, null, TOK),
+    "loopback"
+  );
+  assert.equal(classifyStampedPeerLocality(`${TOK}|::1`, null, TOK), "loopback");
+});
+
+test("classifyStampedPeerLocality: loopback socket WITH a proxy stamp is REMOTE (fail closed)", () => {
+  // OmniRoute is behind nginx/Caddy/Cloudflare; the socket peer is the proxy.
+  // The real end-user is somewhere on the public internet → must not be trusted
+  // as local, otherwise the LOCAL_ONLY spawn-capable surface is reachable from
+  // a tunnel.
+  assert.equal(
+    classifyStampedPeerLocality(`${TOK}|127.0.0.1`, `${TOK}|1`, TOK),
+    "remote",
+    "loopback socket + via-proxy stamp must NOT be classified as local"
+  );
+  assert.equal(
+    classifyStampedPeerLocality(`${TOK}|::1`, `${TOK}|1`, TOK),
+    "remote"
+  );
+  assert.equal(
+    classifyStampedPeerLocality(`${TOK}|::ffff:127.0.0.1`, `${TOK}|1`, TOK),
+    "remote"
+  );
+});
+
+test("classifyStampedPeerLocality: private-LAN socket WITH a proxy stamp is still REMOTE", () => {
+  // Caddy/nginx running on a LAN box in front of OmniRoute. We do not know how
+  // the proxy is exposed (it could be tunneled to the public internet), so any
+  // proxy hop downgrades locality to remote.
+  assert.equal(
+    classifyStampedPeerLocality(`${TOK}|192.168.0.15`, `${TOK}|1`, TOK),
+    "remote"
+  );
+});
+
+test("classifyStampedPeerLocality: public-IP socket is remote regardless of stamp", () => {
+  assert.equal(
+    classifyStampedPeerLocality(`${TOK}|8.8.8.8`, null, TOK),
+    "remote"
+  );
+  assert.equal(
+    classifyStampedPeerLocality(`${TOK}|8.8.8.8`, `${TOK}|1`, TOK),
+    "remote"
+  );
+});
+
+test("classifyStampedPeerLocality: missing / forged peer stamp fails closed to remote", () => {
+  assert.equal(classifyStampedPeerLocality(null, null, TOK), "remote");
+  assert.equal(classifyStampedPeerLocality("forged|127.0.0.1", null, TOK), "remote");
+});
+
+test("classifyStampedPeerLocality: untrusted (un-tokened) via-proxy header is ignored", () => {
+  // A remote attacker who guesses the via-proxy header name but cannot mint the
+  // token must NOT be able to flip the locality verdict by themselves; the
+  // safety direction is OK (downgrade), but the inverse — pretending no proxy
+  // exists when one does — would only be exploitable if the attacker controlled
+  // BOTH headers, which the token gate prevents. We assert the bypass attempt
+  // (un-tokened via-proxy hint) does not leak into the verdict for the normal
+  // local-CLI case.
+  assert.equal(
+    classifyStampedPeerLocality(`${TOK}|127.0.0.1`, "1", TOK),
+    "loopback",
+    "un-tokened via-proxy hint is ignored (== false) — local CLI keeps loopback"
+  );
+});
diff --git a/tests/unit/runtime/sqliteRuntime-node26-compat.test.ts b/tests/unit/runtime/sqliteRuntime-node26-compat.test.ts
new file mode 100644
index 0000000000..1abd47ebe8
--- /dev/null
+++ b/tests/unit/runtime/sqliteRuntime-node26-compat.test.ts
@@ -0,0 +1,41 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+// Regression guard for upstream PR decolua/9router#1827 (issue #1812):
+// better-sqlite3 < 12.10.1 ships no prebuilt binary for Node 26 (ABI 147),
+// causing "Could not locate the bindings file" on startup. The pinned runtime
+// versions MUST be >= 12.10.1 so omniroute boots on Node 26.x.
+const MIN = [12, 10, 1] as const;
+
+function parseSemver(v: string): [number, number, number] {
+  const m = v.match(/(\d+)\.(\d+)\.(\d+)/);
+  assert.ok(m, `version "${v}" must contain semver`);
+  return [Number(m[1]), Number(m[2]), Number(m[3])];
+}
+
+function gte(a: readonly [number, number, number], b: readonly [number, number, number]) {
+  for (let i = 0; i < 3; i++) {
+    if (a[i] > b[i]) return true;
+    if (a[i] < b[i]) return false;
+  }
+  return true;
+}
+
+function readPin(file: string): string {
+  const src = readFileSync(join(process.cwd(), file), "utf8");
+  const m = src.match(/BETTER_SQLITE3_VERSION\s*=\s*["'`]([^"'`]+)["'`]/);
+  assert.ok(m, `BETTER_SQLITE3_VERSION not found in ${file}`);
+  return m[1];
+}
+
+test("bin/cli/runtime/nativeDeps.mjs pins better-sqlite3 >= 12.10.1 (Node 26 prebuilt)", () => {
+  const pin = readPin("bin/cli/runtime/nativeDeps.mjs");
+  assert.ok(gte(parseSemver(pin), MIN), `pin "${pin}" must be >= 12.10.1`);
+});
+
+test("bin/cli/runtime/sqliteRuntime.mjs pins better-sqlite3 >= 12.10.1 (Node 26 prebuilt)", () => {
+  const pin = readPin("bin/cli/runtime/sqliteRuntime.mjs");
+  assert.ok(gte(parseSemver(pin), MIN), `pin "${pin}" must be >= 12.10.1`);
+});
diff --git a/tests/unit/security/live-server-allowlist.test.ts b/tests/unit/security/live-server-allowlist.test.ts
new file mode 100644
index 0000000000..bd837118a0
--- /dev/null
+++ b/tests/unit/security/live-server-allowlist.test.ts
@@ -0,0 +1,177 @@
+/**
+ * Unit tests for `liveServerAllowList`.
+ *
+ * Bug #1 (plans/2026-06-23-omniroute-v3.8.34-deep-audit.md) introduced the
+ * `LIVE_WS_ALLOWED_HOSTS` opt-in for LAN/Tailscale deployments. These tests
+ * pin down the contract: defaults remain loopback-only; the env var extends
+ * the allow-list with bare hostnames or `host:port` pairs; the absence of
+ * Origin is still only acceptable on loopback.
+ *
+ * Runner note: lives under tests/unit/security/ (a node:test–collected subdir)
+ * and uses node:test + assert/strict so the gate `check:test-discovery` actually
+ * runs it. The original copy under tests/unit/server/ used vitest in a path no
+ * runner collected — it never executed (caught by Gate 6A.1).
+ */
+
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import {
+  buildAllowedOrigins,
+  buildAllowedHosts,
+  isOriginAllowed,
+  originHost,
+  originHostMatches,
+  parseCsvEnv,
+  DEFAULT_ALLOWED_ORIGINS,
+} from "@/server/ws/liveServerAllowList";
+
+const EMPTY_ENV: NodeJS.ProcessEnv = {};
+
+describe("parseCsvEnv", () => {
+  it("returns empty set for undefined", () => {
+    assert.equal(parseCsvEnv(undefined).size, 0);
+  });
+
+  it("returns empty set for empty string", () => {
+    assert.equal(parseCsvEnv("").size, 0);
+  });
+
+  it("trims whitespace and drops empty entries", () => {
+    const out = parseCsvEnv("  a , b ,, c  ");
+    assert.deepEqual([...out], ["a", "b", "c"]);
+  });
+
+  it("deduplicates entries", () => {
+    const out = parseCsvEnv("a,a,b");
+    assert.deepEqual([...out], ["a", "b"]);
+  });
+});
+
+describe("buildAllowedOrigins", () => {
+  it("includes the loopback defaults", () => {
+    const out = buildAllowedOrigins(EMPTY_ENV);
+    for (const origin of DEFAULT_ALLOWED_ORIGINS) {
+      assert.equal(out.has(origin), true);
+    }
+  });
+
+  it("extends defaults with LIVE_WS_ALLOWED_ORIGINS", () => {
+    const env = {
+      ...EMPTY_ENV,
+      LIVE_WS_ALLOWED_ORIGINS: "https://dash.example.com,https://other.example.com",
+    };
+    const out = buildAllowedOrigins(env);
+    assert.equal(out.has("https://dash.example.com"), true);
+    assert.equal(out.has("https://other.example.com"), true);
+    // Defaults remain.
+    assert.equal(out.has("http://localhost:20128"), true);
+  });
+});
+
+describe("buildAllowedHosts", () => {
+  it("returns empty set when env is not set", () => {
+    assert.equal(buildAllowedHosts(EMPTY_ENV).size, 0);
+  });
+
+  it("parses comma-separated hosts", () => {
+    const env = { ...EMPTY_ENV, LIVE_WS_ALLOWED_HOSTS: "100.96.135.160,desktop.tailnet.ts.net" };
+    const out = buildAllowedHosts(env);
+    assert.equal(out.has("100.96.135.160"), true);
+    assert.equal(out.has("desktop.tailnet.ts.net"), true);
+  });
+});
+
+describe("originHost", () => {
+  it("returns host and hostname for a valid URL", () => {
+    assert.deepEqual(originHost("http://100.96.135.160:20128"), {
+      host: "100.96.135.160:20128",
+      hostname: "100.96.135.160",
+    });
+  });
+
+  it("returns null for an invalid URL", () => {
+    assert.equal(originHost("not a url"), null);
+  });
+});
+
+describe("originHostMatches", () => {
+  it("returns false when the allow-list is empty", () => {
+    assert.equal(originHostMatches("http://100.96.135.160:20128", new Set()), false);
+  });
+
+  it("matches by exact host:port", () => {
+    const allow = new Set(["100.96.135.160:20128"]);
+    assert.equal(originHostMatches("http://100.96.135.160:20128", allow), true);
+  });
+
+  it("matches by bare hostname regardless of port", () => {
+    const allow = new Set(["100.96.135.160"]);
+    assert.equal(originHostMatches("http://100.96.135.160:20128", allow), true);
+    assert.equal(originHostMatches("http://100.96.135.160:55555", allow), true);
+  });
+
+  it("returns false for a non-matching host", () => {
+    const allow = new Set(["100.96.135.160"]);
+    assert.equal(originHostMatches("http://10.0.0.5:20128", allow), false);
+  });
+
+  it("returns false for an unparseable origin", () => {
+    const allow = new Set(["100.96.135.160"]);
+    assert.equal(originHostMatches("not-a-url", allow), false);
+  });
+});
+
+describe("isOriginAllowed", () => {
+  it("rejects any non-loopback origin by default", () => {
+    assert.equal(isOriginAllowed("http://100.96.135.160:20128", EMPTY_ENV), false);
+  });
+
+  it("accepts the default loopback origins", () => {
+    assert.equal(isOriginAllowed("http://127.0.0.1:20128", EMPTY_ENV), true);
+    assert.equal(isOriginAllowed("http://localhost:20128", EMPTY_ENV), true);
+    assert.equal(isOriginAllowed("http://[::1]:20128", EMPTY_ENV), true);
+  });
+
+  it("accepts an Origin matching LIVE_WS_ALLOWED_ORIGINS", () => {
+    const env = { ...EMPTY_ENV, LIVE_WS_ALLOWED_ORIGINS: "https://dash.example.com" };
+    assert.equal(isOriginAllowed("https://dash.example.com", env), true);
+  });
+
+  it("accepts a Tailscale Origin when LIVE_WS_ALLOWED_HOSTS is set", () => {
+    const env = { ...EMPTY_ENV, LIVE_WS_ALLOWED_HOSTS: "100.96.135.160" };
+    assert.equal(isOriginAllowed("http://100.96.135.160:20128", env), true);
+  });
+
+  it("accepts a Tailscale Origin matched by host:port when LIVE_WS_ALLOWED_HOSTS is set", () => {
+    const env = { ...EMPTY_ENV, LIVE_WS_ALLOWED_HOSTS: "100.96.135.160:20128" };
+    assert.equal(isOriginAllowed("http://100.96.135.160:20128", env), true);
+  });
+
+  it("does NOT accept a Tailscale Origin when LIVE_WS_ALLOWED_HOSTS is unset", () => {
+    // Critical security invariant: without explicit opt-in, the LAN/Tailscale
+    // surface is closed even though the listener is reachable.
+    assert.equal(isOriginAllowed("http://100.96.135.160:20128", EMPTY_ENV), false);
+  });
+
+  it("rejects a missing Origin when bound to LAN (0.0.0.0)", () => {
+    // A CLI client that omits Origin should NOT be accepted when the
+    // operator opted into LAN exposure. Browsers always send Origin, so the
+    // empty-Origin path is for non-browser callers; the security stance is
+    // "refuse unless loopback".
+    const env = { ...EMPTY_ENV, LIVE_WS_HOST: "0.0.0.0" };
+    assert.equal(isOriginAllowed(undefined, env), false);
+  });
+
+  it("accepts a missing Origin on loopback (CLI/MCP)", () => {
+    // CLI/MCP clients running on the same host omit Origin. The default
+    // listener (127.0.0.1) accepts them.
+    assert.equal(isOriginAllowed(undefined, EMPTY_ENV), true);
+  });
+
+  it("accepts a missing Origin on ::1 / localhost hosts", () => {
+    const env1 = { ...EMPTY_ENV, LIVE_WS_HOST: "::1" };
+    assert.equal(isOriginAllowed(undefined, env1), true);
+    const env2 = { ...EMPTY_ENV, LIVE_WS_HOST: "localhost" };
+    assert.equal(isOriginAllowed(undefined, env2), true);
+  });
+});
diff --git a/tests/unit/sse-error-passthrough-3324.test.ts b/tests/unit/sse-error-passthrough-3324.test.ts
index 8a74f06219..7ba2cac0f2 100644
--- a/tests/unit/sse-error-passthrough-3324.test.ts
+++ b/tests/unit/sse-error-passthrough-3324.test.ts
@@ -134,8 +134,10 @@ test("parseSSEToOpenAIResponse still returns null for an error-only SSE (boundar
 
 test("PART 1: windsurf authHint references the `Windsurf: Provide Auth Token` command", () => {
   const here = path.dirname(fileURLToPath(import.meta.url));
+  // After the providers.ts oauth-constants split, the windsurf authHint moved to
+  // src/shared/constants/providers/oauth.ts.
   const providers = readFileSync(
-    path.join(here, "../../src/shared/constants/providers.ts"),
+    path.join(here, "../../src/shared/constants/providers/oauth.ts"),
     "utf8"
   );
 
diff --git a/tests/unit/sync-env-bundled-require-5006.test.ts b/tests/unit/sync-env-bundled-require-5006.test.ts
new file mode 100644
index 0000000000..3082cbf551
--- /dev/null
+++ b/tests/unit/sync-env-bundled-require-5006.test.ts
@@ -0,0 +1,102 @@
+/**
+ * Regression guard for #5006 — `/api/system/env/repair` 500s on packaged install.
+ *
+ * Root cause: `route.ts` statically imports `scripts/dev/sync-env.mjs`, so webpack
+ * inlines it into the standalone route bundle. `sync-env.mjs` then ran
+ * `createRequire(import.meta.url)` at TOP-LEVEL module scope — when bundled,
+ * `import.meta.url` is frozen to the build-machine path
+ * (`file:///home/runner/.../sync-env.mjs`), which `createRequire` rejects at runtime.
+ * Because the throw happens during module evaluation (reached via the static import),
+ * the whole route module fails to load → every hit returns HTTP 500 → onboarding breaks.
+ *
+ * The fix moves `createRequire` out of top-level scope into the single function that
+ * needs `better-sqlite3` (guarded by the existing try/catch), and makes the root-dir
+ * resolution tolerant of an unusable `import.meta.url` (falls back to `process.cwd()`),
+ * so importing/evaluating the module — and calling its exports — never throws.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const SYNC_ENV_PATH = fileURLToPath(new URL("../../scripts/dev/sync-env.mjs", import.meta.url));
+
+const mod = (await import("../../scripts/dev/sync-env.mjs")) as {
+  getEnvSyncPlan: (opts?: { rootDir?: string; scope?: string }) => {
+    available: boolean;
+    created: boolean;
+    added: number;
+    missingEntries: Array<{ key: string; value: string }>;
+  };
+  syncEnv: (opts?: { rootDir?: string; quiet?: boolean; scope?: string }) => {
+    created: boolean;
+    added: number;
+  };
+};
+
+function writeOauthEnvExample(rootDir: string) {
+  fs.writeFileSync(
+    path.join(rootDir, ".env.example"),
+    [
+      "# ═══════════════════════════════════════════════════",
+      "#   OAUTH PROVIDER CREDENTIALS",
+      "# ═══════════════════════════════════════════════════",
+      "CLAUDE_OAUTH_CLIENT_ID=claude-default",
+      "CODEX_OAUTH_CLIENT_ID=codex-default",
+      "# ─────────────────────────────────────────────────────────────────────────────",
+      "# Provider User-Agent Overrides (optional)",
+      "# ─────────────────────────────────────────────────────────────────────────────",
+      "",
+    ].join("\n"),
+    "utf8"
+  );
+}
+
+test("#5006: sync-env.mjs does not call createRequire at module top-level scope", () => {
+  const source = fs.readFileSync(SYNC_ENV_PATH, "utf8");
+
+  // A top-level `const require = createRequire(import.meta.url)` (column 0, no
+  // leading indentation) is the exact crash vector: it runs during module
+  // evaluation with a webpack-frozen `import.meta.url`. It must live inside a
+  // function body / try-catch instead.
+  assert.doesNotMatch(
+    source,
+    /^const\s+require\s*=\s*createRequire\s*\(/m,
+    "createRequire(import.meta.url) must not run at top-level module scope (bundled import.meta.url is frozen → throws on module load → route 500)"
+  );
+
+  // `createRequire` is still used lazily where better-sqlite3 is needed — but only
+  // from inside a function (every occurrence is indented, never column 0).
+  for (const line of source.split(/\r?\n/)) {
+    if (/createRequire\s*\(/.test(line)) {
+      assert.match(
+        line,
+        /^\s+/,
+        `createRequire must be called from inside a function (indented), found top-level: ${line}`
+      );
+    }
+  }
+});
+
+test("#5006: getEnvSyncPlan(oauth) works with explicit rootDir and never throws on bad DATA_DIR", () => {
+  const rootDir = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-5006-"));
+  const origDataDir = process.env.DATA_DIR;
+  try {
+    writeOauthEnvExample(rootDir);
+    // Point DATA_DIR at a dir with no real SQLite DB — exercises the
+    // better-sqlite3 / createRequire path that used to crash at module load.
+    process.env.DATA_DIR = rootDir;
+
+    const plan = mod.getEnvSyncPlan({ rootDir, scope: "oauth" });
+
+    assert.equal(plan.available, true);
+    assert.equal(plan.added, 2);
+    const keys = plan.missingEntries.map((e) => e.key);
+    assert.deepEqual(keys.sort(), ["CLAUDE_OAUTH_CLIENT_ID", "CODEX_OAUTH_CLIENT_ID"]);
+  } finally {
+    process.env.DATA_DIR = origDataDir;
+    fs.rmSync(rootDir, { recursive: true, force: true });
+  }
+});
diff --git a/tests/unit/t20-t22-provider-headers.test.ts b/tests/unit/t20-t22-provider-headers.test.ts
index 5c60915512..aa65bf17e6 100644
--- a/tests/unit/t20-t22-provider-headers.test.ts
+++ b/tests/unit/t20-t22-provider-headers.test.ts
@@ -66,7 +66,7 @@ test("T20: codex config advertises current client headers and supported models",
   assert.equal(codex.headers.Version, getCodexClientVersion());
   assert.equal(codex.headers["Openai-Beta"], "responses=experimental");
   assert.equal(codex.headers["X-Codex-Beta-Features"], "responses_websockets");
-  assert.equal(codex.headers["User-Agent"], "codex-cli/0.132.0 (Windows 10.0.26200; x64)");
+  assert.equal(codex.headers["User-Agent"], "codex-cli/0.142.0 (Windows 10.0.26200; x64)");
   assert.ok(codex.models.some((model) => model.id === "gpt-5.5-medium"));
   assert.ok(!codex.models.some((model) => model.id === "codex-auto-review"));
 });
diff --git a/tests/unit/t28-model-catalog-updates.test.ts b/tests/unit/t28-model-catalog-updates.test.ts
index 2dfa9d4089..12a57ea7a9 100644
--- a/tests/unit/t28-model-catalog-updates.test.ts
+++ b/tests/unit/t28-model-catalog-updates.test.ts
@@ -72,6 +72,23 @@ test("T28: vertex catalog includes partner models when vertex executor is availa
   assert.ok(vertexIds.includes("GLM-5.1-FP8"));
 });
 
+test("T28: volcengine (Ark) catalog includes DeepSeek V4 models", () => {
+  const volcengineIds = REGISTRY.volcengine.models.map((m) => m.id);
+
+  assert.ok(
+    volcengineIds.includes("DeepSeek-V4-Flash"),
+    "volcengine Ark must list DeepSeek-V4-Flash"
+  );
+  assert.ok(
+    volcengineIds.includes("DeepSeek-V4-Pro"),
+    "volcengine Ark must list DeepSeek-V4-Pro"
+  );
+  // Existing models must still be present
+  assert.ok(volcengineIds.includes("deepseek-v3-2-251201"));
+  assert.ok(volcengineIds.includes("kimi-k2-5-260127"));
+  assert.ok(volcengineIds.includes("glm-4-7-251222"));
+});
+
 test("T28: new catalog models resolve through getModelInfoCore", async () => {
   const minimax = await getModelInfoCore("minimax/MiniMax-M2.7", {});
   assert.equal(minimax.provider, "minimax");
diff --git a/tests/unit/translator-claude-to-openai-orphan-tool-4385.test.ts b/tests/unit/translator-claude-to-openai-orphan-tool-4385.test.ts
index 67ac2857af..0f7a492eef 100644
--- a/tests/unit/translator-claude-to-openai-orphan-tool-4385.test.ts
+++ b/tests/unit/translator-claude-to-openai-orphan-tool-4385.test.ts
@@ -10,9 +10,8 @@ import assert from "node:assert/strict";
 // the assistant turn but kept the tool_result). OpenAI-compatible upstreams reject it.
 // This mirrors the orphan filter already on the Responses->Chat path (#2893).
 
-const { claudeToOpenAIRequest } = await import(
-  "../../open-sse/translator/request/claude-to-openai.ts"
-);
+const { claudeToOpenAIRequest } =
+  await import("../../open-sse/translator/request/claude-to-openai.ts");
 
 type Msg = { role: string; tool_call_id?: string; tool_calls?: { id?: string }[] };
 
@@ -92,3 +91,113 @@ test("#4385 keeps valid tool_results and drops orphans in the same user turn", (
   assert.equal(toolMsgs.length, 1);
   assert.equal(toolMsgs[0].tool_call_id, "tu_valid");
 });
+
+// #4714: regression (v3.8.26+) — Claude Code issues parallel tool_use in one
+// assistant turn but their tool_result blocks arrive across SEPARATE user turns
+// with interleaved text. The translator emitted each role:"tool" message in the
+// position of its originating user turn, so a later tool_result ended up AFTER a
+// user message instead of adjacent to its assistant.tool_calls. The #4385 orphan
+// filter kept it (the id DID match an assistant tool_call) but never re-ordered
+// it, so OpenAI-compatible upstreams (deepseek, etc.) still rejected the request
+// with 400 "Messages with role 'tool' must be a response to a preceding message
+// with 'tool_calls'". fixMissingToolResponses also injected a bogus
+// "[No response received]" placeholder for the not-yet-adjacent tool_call.
+
+// Helper: every role:"tool" must be immediately preceded by an assistant carrying
+// the matching tool_call id (or another tool message in the same group).
+function assertToolOrdering(messages: Msg[]) {
+  let activeIds: Set<string> | null = null;
+  for (const m of messages) {
+    if (m.role === "assistant" && Array.isArray(m.tool_calls)) {
+      activeIds = new Set(m.tool_calls.map((t) => String(t.id)));
+    } else if (m.role === "tool") {
+      assert.ok(
+        activeIds && activeIds.has(String(m.tool_call_id)),
+        `role:'tool' ${m.tool_call_id} is not preceded by a matching assistant tool_calls`
+      );
+    } else {
+      activeIds = null;
+    }
+  }
+}
+
+test("#4714 regroups parallel tool_results split across user turns next to their assistant", () => {
+  const result = claudeToOpenAIRequest(
+    "deepseek/deepseek-v4-flash-free",
+    {
+      messages: [
+        { role: "user", content: "do two things" },
+        {
+          role: "assistant",
+          content: [
+            { type: "text", text: "calling tools" },
+            { type: "tool_use", id: "callA", name: "toolA", input: { x: 1 } },
+            { type: "tool_use", id: "callB", name: "toolB", input: { y: 2 } },
+          ],
+        },
+        {
+          role: "user",
+          content: [
+            { type: "tool_result", tool_use_id: "callA", content: "result A" },
+            { type: "text", text: "and here's more context" },
+          ],
+        },
+        {
+          role: "user",
+          content: [{ type: "tool_result", tool_use_id: "callB", content: "result B" }],
+        },
+      ],
+    },
+    false
+  );
+
+  const messages = result.messages as Msg[];
+  // No upstream-rejecting ordering violations.
+  assertToolOrdering(messages);
+
+  // Both real tool results survive, adjacent to the assistant, in tool_calls order.
+  const assistantIdx = messages.findIndex(
+    (m) => m.role === "assistant" && Array.isArray(m.tool_calls)
+  );
+  assert.equal((messages[assistantIdx + 1] as Msg).tool_call_id, "callA");
+  assert.equal((messages[assistantIdx + 2] as Msg).tool_call_id, "callB");
+
+  // The real "result B" must NOT have been replaced by a placeholder.
+  const toolB = messages.find((m) => m.role === "tool" && m.tool_call_id === "callB") as
+    | (Msg & { content?: string })
+    | undefined;
+  assert.ok(toolB);
+  assert.notEqual(toolB.content, "[No response received]");
+  // Exactly one tool message per call id (no duplicate placeholder + real result).
+  assert.equal(messages.filter((m) => m.role === "tool" && m.tool_call_id === "callB").length, 1);
+});
+
+test("#4714 still inserts a placeholder for a genuinely unanswered parallel tool_call", () => {
+  const result = claudeToOpenAIRequest(
+    "deepseek/deepseek-v4-flash-free",
+    {
+      messages: [
+        {
+          role: "assistant",
+          content: [
+            { type: "tool_use", id: "ansA", name: "toolA", input: {} },
+            { type: "tool_use", id: "noAns", name: "toolB", input: {} },
+          ],
+        },
+        {
+          role: "user",
+          content: [{ type: "tool_result", tool_use_id: "ansA", content: "ok" }],
+        },
+      ],
+    },
+    false
+  );
+
+  const messages = result.messages as Msg[];
+  assertToolOrdering(messages);
+  const placeholder = messages.find((m) => m.role === "tool" && m.tool_call_id === "noAns") as
+    | (Msg & { content?: string })
+    | undefined;
+  assert.ok(placeholder, "missing tool_call must still get a placeholder response");
+  assert.equal(placeholder.content, "[No response received]");
+});
diff --git a/tests/unit/translator-gemini-schema-pattern-property.test.ts b/tests/unit/translator-gemini-schema-pattern-property.test.ts
index 85be361ce1..b5f9a869ac 100644
--- a/tests/unit/translator-gemini-schema-pattern-property.test.ts
+++ b/tests/unit/translator-gemini-schema-pattern-property.test.ts
@@ -41,9 +41,10 @@ test("#1368: a property named 'pattern' survives Gemini schema sanitization", ()
   );
 });
 
-test("#1368: a string-level `pattern` CONSTRAINT is still stripped", () => {
-  // When `pattern` is an actual validation constraint on a string schema node,
-  // Gemini does not support it, so it must still be removed.
+test("#1368: a string-level `pattern` CONSTRAINT is preserved for antigravity", () => {
+  // Antigravity (Gemini-derived) DOES accept `pattern` on string constraints.
+  // Stripping it broke glob/grep/file-search tools that express their argument
+  // regex via `pattern`. The sanitizer must keep it. (Ported from 9router @ f6c2f7ca.)
   const schema = {
     type: "object",
     properties: {
@@ -58,8 +59,8 @@ test("#1368: a string-level `pattern` CONSTRAINT is still stripped", () => {
 
   assert.ok(cleaned.properties.code, "the `code` property itself survives");
   assert.equal(
-    Object.prototype.hasOwnProperty.call(cleaned.properties.code, "pattern"),
-    false,
-    "the string `pattern` constraint must be stripped"
+    (cleaned.properties.code as { pattern?: string }).pattern,
+    "^[A-Z]{3}$",
+    "the string `pattern` constraint must be preserved for antigravity"
   );
 });
diff --git a/tests/unit/translator-helper-branches.test.ts b/tests/unit/translator-helper-branches.test.ts
index 630d7d3d8f..ef4afd8d1f 100644
--- a/tests/unit/translator-helper-branches.test.ts
+++ b/tests/unit/translator-helper-branches.test.ts
@@ -599,6 +599,26 @@ test("fixMissingToolResponses keeps OpenAI role:tool when assistant uses OpenAI
   assert.equal(fixed.messages[2].tool_call_id, "call_b");
 });
 
+test("fallbackToolCallId returns the right id shape with and without an index", () => {
+  const noIndex = toolCallHelper.fallbackToolCallId();
+  assert.match(
+    noIndex,
+    /^call_\d+$/,
+    "no-index form must be `call_<ts>` (matches kiro/openai-responses fallback shape)"
+  );
+
+  const withIndex = toolCallHelper.fallbackToolCallId(2);
+  assert.match(
+    withIndex,
+    /^call_2_\d+$/,
+    "index form must be `call_<i>_<ts>` (matches indexed fallback shape)"
+  );
+
+  // index 0 is falsy but defined — must still produce the indexed form, not the no-index form.
+  const zeroIndex = toolCallHelper.fallbackToolCallId(0);
+  assert.match(zeroIndex, /^call_0_\d+$/, "index 0 must use the indexed form, not the bare form");
+});
+
 test("translateRequest replays cached reasoning-only messages when interleaved field is reasoning_content", () => {
   clearReasoningCacheAll();
   clearModelsDevCapabilities();
diff --git a/tests/unit/translator-json-util.test.ts b/tests/unit/translator-json-util.test.ts
new file mode 100644
index 0000000000..0824f52f9c
--- /dev/null
+++ b/tests/unit/translator-json-util.test.ts
@@ -0,0 +1,45 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+// Unit coverage for the extracted safeParseJSON util and the two distinct
+// fallbacks its callers rely on:
+//   - geminiHelper.tryParseJSON  -> null fallback on parse error
+//   - openai-to-claude tryParseJSON -> raw-string passthrough on parse error
+const { safeParseJSON } = await import("../../open-sse/translator/helpers/jsonUtil.ts");
+const gemini = await import("../../open-sse/translator/helpers/geminiHelper.ts");
+
+test("safeParseJSON: non-string input is returned unchanged (passthrough)", () => {
+  assert.equal(safeParseJSON(42, null), 42);
+  assert.equal(safeParseJSON(null, "fb"), null);
+  assert.equal(safeParseJSON(undefined, "fb"), undefined);
+  const obj = { a: 1 };
+  assert.equal(safeParseJSON(obj, null), obj);
+});
+
+test("safeParseJSON: valid JSON strings parse regardless of fallback", () => {
+  assert.deepEqual(safeParseJSON('{"a":1}', null), { a: 1 });
+  assert.deepEqual(safeParseJSON("[1,2,3]", "ignored"), [1, 2, 3]);
+  assert.equal(safeParseJSON("42", null), 42);
+  assert.equal(safeParseJSON("true", null), true);
+  assert.equal(safeParseJSON("null", "ignored"), null);
+});
+
+test("safeParseJSON: invalid JSON returns the caller-chosen fallback", () => {
+  // null fallback (geminiHelper semantics)
+  assert.equal(safeParseJSON("not json", null), null);
+  assert.equal(safeParseJSON("{broken}", null), null);
+  assert.equal(safeParseJSON("", null), null);
+
+  // raw-string passthrough fallback (openai-to-claude semantics)
+  assert.equal(safeParseJSON("not json", "not json"), "not json");
+  assert.equal(safeParseJSON("{broken", "{broken"), "{broken");
+});
+
+test("geminiHelper.tryParseJSON still returns null on parse error (re-export delegates)", () => {
+  assert.deepEqual(gemini.tryParseJSON('{"ok":true}'), { ok: true });
+  assert.equal(gemini.tryParseJSON("{broken"), null);
+  assert.equal(gemini.tryParseJSON("not json"), null);
+  assert.equal(gemini.tryParseJSON(""), null);
+  // non-string passthrough preserved
+  assert.equal(gemini.tryParseJSON(123), 123);
+});
diff --git a/tests/unit/translator-resp-empty-string-tool-arg.test.ts b/tests/unit/translator-resp-empty-string-tool-arg.test.ts
new file mode 100644
index 0000000000..210b580b25
--- /dev/null
+++ b/tests/unit/translator-resp-empty-string-tool-arg.test.ts
@@ -0,0 +1,236 @@
+/**
+ * Regression tests for #4951: legitimate empty-string tool argument values must
+ * not be stripped during streaming response translation.
+ *
+ * Context: "Fix #1852" added a regex in openaiToClaudeResponse() to remove spurious
+ * empty-string / empty-array PLACEHOLDERS that some models emit as noise. The bug
+ * is that the same regex also removes fields whose VALUE is intentionally "".
+ * Example: {"file_path":"","content":"text"} → {"content":"text"} (data loss).
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { openaiToClaudeResponse } =
+  await import("../../open-sse/translator/response/openai-to-claude.ts");
+
+function createState() {
+  return {
+    toolCalls: new Map(),
+  };
+}
+
+function flatten(items) {
+  return items.flatMap((item) => item || []);
+}
+
+// ---------------------------------------------------------------------------
+// #4951 — single-chunk full-args scenario (DeepSeek-style providers that emit
+// the complete JSON in one chunk instead of streaming character-by-character).
+// ---------------------------------------------------------------------------
+
+test("#4951: single-chunk tool args with empty-string field — partial_json must be unparsable-safe and field must survive", () => {
+  const state = createState();
+
+  // Chunk 1: tool call start (no arguments yet)
+  const chunk1 = openaiToClaudeResponse(
+    {
+      id: "chatcmpl-4951-a",
+      model: "deepseek-v4-flash-free",
+      choices: [
+        {
+          index: 0,
+          delta: {
+            tool_calls: [
+              {
+                index: 0,
+                id: "call_4951",
+                type: "function",
+                function: {
+                  name: "write_file",
+                  arguments: "",
+                },
+              },
+            ],
+          },
+          finish_reason: null,
+        },
+      ],
+    },
+    state
+  );
+
+  // Chunk 2: full args delivered in one chunk (deepseek single-chunk pattern)
+  // Intentionally uses file_path:"" — the empty string is the legitimate value.
+  const fullArgs = JSON.stringify({ file_path: "", content: "hello world" });
+  const chunk2 = openaiToClaudeResponse(
+    {
+      id: "chatcmpl-4951-a",
+      model: "deepseek-v4-flash-free",
+      choices: [
+        {
+          index: 0,
+          delta: {
+            tool_calls: [
+              {
+                index: 0,
+                function: {
+                  arguments: fullArgs,
+                },
+              },
+            ],
+          },
+          finish_reason: "tool_calls",
+        },
+      ],
+    },
+    state
+  );
+
+  const events = flatten([chunk1, chunk2]);
+
+  // Find the content_block_delta events that carry input_json_delta
+  const jsonDeltas = events.filter(
+    (e) => e?.type === "content_block_delta" && e.delta?.type === "input_json_delta"
+  );
+
+  // There must be at least one delta with actual JSON content
+  assert.ok(jsonDeltas.length > 0, "expected at least one input_json_delta event");
+
+  // Concatenate all partial_json fragments — that is the assembled tool input
+  const assembled = jsonDeltas.map((e) => e.delta.partial_json).join("");
+
+  // Must parse successfully
+  let parsed: Record<string, unknown>;
+  try {
+    parsed = JSON.parse(assembled);
+  } catch (e) {
+    assert.fail(`assembled partial_json is not valid JSON: ${assembled}`);
+  }
+
+  // The file_path field with value "" must survive — this is the regression guard
+  assert.ok(
+    Object.prototype.hasOwnProperty.call(parsed, "file_path"),
+    `"file_path" field was stripped from tool args — regression of #4951. assembled=${assembled}`
+  );
+  assert.equal(
+    parsed.file_path,
+    "",
+    `"file_path" value was corrupted; expected "" got ${JSON.stringify(parsed.file_path)}`
+  );
+  assert.equal(parsed.content, "hello world", "content field must be preserved");
+});
+
+test("#4951: trailing-empty-string field (comma before) also survives", () => {
+  const state = createState();
+
+  const fullArgs = JSON.stringify({ query: "search term", extra_filter: "" });
+
+  const chunk1 = openaiToClaudeResponse(
+    {
+      id: "chatcmpl-4951-b",
+      model: "deepseek-v4",
+      choices: [
+        {
+          index: 0,
+          delta: {
+            tool_calls: [
+              {
+                index: 0,
+                id: "call_4951b",
+                type: "function",
+                function: { name: "search", arguments: fullArgs },
+              },
+            ],
+          },
+          finish_reason: "tool_calls",
+        },
+      ],
+    },
+    state
+  );
+
+  const events = flatten([chunk1]);
+  const jsonDeltas = events.filter(
+    (e) => e?.type === "content_block_delta" && e.delta?.type === "input_json_delta"
+  );
+
+  assert.ok(jsonDeltas.length > 0, "expected at least one input_json_delta event");
+  const assembled = jsonDeltas.map((e) => e.delta.partial_json).join("");
+
+  let parsed: Record<string, unknown>;
+  try {
+    parsed = JSON.parse(assembled);
+  } catch (e) {
+    assert.fail(`assembled partial_json is not valid JSON: ${assembled}`);
+  }
+
+  assert.ok(
+    Object.prototype.hasOwnProperty.call(parsed, "extra_filter"),
+    `"extra_filter" field was stripped — comma-prefix pattern regression of #4951. assembled=${assembled}`
+  );
+  assert.equal(parsed.extra_filter, "");
+  assert.equal(parsed.query, "search term");
+});
+
+test("#1852 preserved: purely-empty streaming chunks with noise placeholders are still stripped", () => {
+  // This test verifies that the original #1852 fix intent still works:
+  // Some models (e.g. GLM) emit placeholder JSON like {"param":""} as a spurious
+  // noise chunk BEFORE the real arguments arrive. The spurious-noise scenario is
+  // a single standalone-placeholder chunk: {"param":""} with nothing else.
+  //
+  // NOTE: #1852's original concern was about standalone-noise chunks like {"":""}
+  // or {args:""} as the FULL argument string (not mixed with real fields). With
+  // the fixed code, the strip is removed entirely and noise chunks pass through —
+  // which is safe because partial_json is assembled and then parsed at the Claude
+  // client, which handles unknown fields gracefully. If the upstream sends BOTH a
+  // noise chunk AND a real chunk, deduplication via appendToolCallArgumentDelta
+  // (snapshot-replace logic) ensures the final assembled JSON is valid anyway.
+  //
+  // This test just verifies the streaming path does not error out when a chunk
+  // contains only a noise-style placeholder value — it should emit it as-is.
+  const state = createState();
+
+  const chunk1 = openaiToClaudeResponse(
+    {
+      id: "chatcmpl-1852",
+      model: "glm-4",
+      choices: [
+        {
+          index: 0,
+          delta: {
+            tool_calls: [
+              {
+                index: 0,
+                id: "call_1852",
+                type: "function",
+                function: { name: "do_thing", arguments: '{"action":""}' },
+              },
+            ],
+          },
+          finish_reason: "tool_calls",
+        },
+      ],
+    },
+    state
+  );
+
+  const events = flatten([chunk1]);
+  const jsonDeltas = events.filter(
+    (e) => e?.type === "content_block_delta" && e.delta?.type === "input_json_delta"
+  );
+
+  // With the fix, the placeholder is emitted as-is (not stripped).
+  // The assembled JSON {"action":""} is still valid JSON — no corruption.
+  assert.ok(jsonDeltas.length > 0, "expected at least one input_json_delta event");
+  const assembled = jsonDeltas.map((e) => e.delta.partial_json).join("");
+
+  // Must be valid JSON — whether it's stripped or not, it must parse
+  let parsed: Record<string, unknown>;
+  try {
+    parsed = JSON.parse(assembled);
+  } catch (e) {
+    assert.fail(`assembled partial_json is not valid JSON: ${assembled}`);
+  }
+  // After fix: the field survives (it's legitimate from the translator's POV)
+  assert.ok(typeof parsed === "object" && parsed !== null, "parsed result must be an object");
+});
diff --git a/tests/unit/translator-strip-client-metadata-1157.test.ts b/tests/unit/translator-strip-client-metadata-1157.test.ts
new file mode 100644
index 0000000000..243b1407a3
--- /dev/null
+++ b/tests/unit/translator-strip-client-metadata-1157.test.ts
@@ -0,0 +1,26 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const openaiHelper = await import("../../open-sse/translator/helpers/openaiHelper.ts");
+
+// Regression for upstream issue 9router#1157: Codex-origin requests carry a
+// top-level `client_metadata` object. On the OpenAI->OpenAI chat-completions
+// passthrough, `filterToOpenAIFormat` is the only sanitizer, and it forwarded
+// `client_metadata` to api.openai.com, which rejects it with
+// 400 "Unknown parameter: 'client_metadata'". It must be stripped alongside
+// the other Claude/Codex-specific fields.
+test("filterToOpenAIFormat strips top-level client_metadata (9router#1157)", () => {
+  const body = {
+    messages: [{ role: "user", content: "hi" }],
+    client_metadata: { user_id: "abc", session_id: "xyz" },
+    metadata: { remove: true },
+    anthropic_version: "2023-06-01",
+  };
+
+  const result = openaiHelper.filterToOpenAIFormat(body);
+
+  assert.equal("client_metadata" in result, false);
+  assert.equal("metadata" in result, false);
+  assert.equal("anthropic_version" in result, false);
+  assert.equal(result.messages.length, 1);
+});
diff --git a/tests/unit/translator-thinking-provider-compat-2043.test.ts b/tests/unit/translator-thinking-provider-compat-2043.test.ts
new file mode 100644
index 0000000000..9766837d0e
--- /dev/null
+++ b/tests/unit/translator-thinking-provider-compat-2043.test.ts
@@ -0,0 +1,187 @@
+/**
+ * Tests for provider thinking compatibility fixes ported from decolua/9router#2043.
+ *
+ * Covers:
+ *   (a) DeepSeek unsigned thinking placeholders — no `signature` field in injected blocks.
+ *   (b) DeepSeek keeps existing thinking blocks as-is (not overwritten by cache/placeholder).
+ *   (c) Gemini `reasoning_effort: "auto"` maps to high budget (not silent fallback to default).
+ *   (d) Gemini `reasoning_effort: "max"` / `"xhigh"` clamp to high budget.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { prepareClaudeRequest } = await import("../../open-sse/translator/helpers/claudeHelper.ts");
+const reasoningCache = await import("../../open-sse/services/reasoningCache.ts");
+const { openaiToGeminiRequest } =
+  await import("../../open-sse/translator/request/openai-to-gemini.ts");
+const { capThinkingBudget } = await import("../../src/lib/modelCapabilities.ts");
+
+// ──────────────── Fix (a): DeepSeek placeholder has NO signature field ────────────────
+
+test("deepseek: injected thinking placeholder has no signature field", () => {
+  reasoningCache.clearReasoningCacheAll();
+  const body = {
+    model: "deepseek-v4-pro",
+    thinking: { type: "enabled", budget_tokens: 4096 },
+    messages: [
+      { role: "user", content: [{ type: "text", text: "q" }] },
+      {
+        role: "assistant",
+        content: [{ type: "tool_use", id: "toolu_1", name: "Read", input: { file_path: "x" } }],
+      },
+      {
+        role: "user",
+        content: [{ type: "tool_result", tool_use_id: "toolu_1", content: "ok" }],
+      },
+    ],
+  };
+  const out = prepareClaudeRequest(body as any, "deepseek");
+  const assistant = (out as any).messages.find((m: any) => m.role === "assistant");
+  assert.ok(assistant, "assistant message should exist");
+  assert.equal(assistant.content[0].type, "thinking", "injected block should be type=thinking");
+  assert.equal(
+    assistant.content[0].signature,
+    undefined,
+    "DeepSeek placeholder must NOT have a signature field"
+  );
+  assert.equal(assistant.content[1].type, "tool_use", "tool_use should follow the thinking block");
+});
+
+// ──────────────── Fix (b): DeepSeek keeps existing thinking blocks as-is ────────────────
+
+test("deepseek: existing thinking blocks are preserved as-is (text and type unchanged)", () => {
+  reasoningCache.clearReasoningCacheAll();
+  const body = {
+    model: "deepseek-v4-pro",
+    thinking: { type: "enabled", budget_tokens: 4096 },
+    messages: [
+      { role: "user", content: [{ type: "text", text: "q" }] },
+      {
+        role: "assistant",
+        content: [
+          { type: "thinking", thinking: "my actual reasoning", signature: "ds-sig" },
+          { type: "tool_use", id: "toolu_2", name: "Read", input: {} },
+        ],
+      },
+      {
+        role: "user",
+        content: [{ type: "tool_result", tool_use_id: "toolu_2", content: "ok" }],
+      },
+    ],
+  };
+  const out = prepareClaudeRequest(body as any, "deepseek");
+  const assistant = (out as any).messages.find((m: any) => m.role === "assistant");
+  assert.equal(assistant.content[0].type, "thinking");
+  assert.equal(
+    assistant.content[0].thinking,
+    "my actual reasoning",
+    "DeepSeek must keep existing thinking text verbatim"
+  );
+  // Signature stripping is acceptable (DeepSeek doesn't need it), but text must not
+  // be overwritten with placeholder or cache content.
+  assert.ok(
+    assistant.content.length >= 2,
+    "should not drop blocks: thinking + tool_use both present"
+  );
+  assert.equal(assistant.content[1].type, "tool_use");
+});
+
+test("deepseek: injected placeholder thinking text is non-empty dot sentinel", () => {
+  // The upstream uses "." as placeholder text for DeepSeek (not the long NON_ANTHROPIC placeholder)
+  reasoningCache.clearReasoningCacheAll();
+  const body = {
+    model: "deepseek-v4-pro",
+    thinking: { type: "enabled", budget_tokens: 4096 },
+    messages: [
+      { role: "user", content: [{ type: "text", text: "q" }] },
+      {
+        role: "assistant",
+        content: [{ type: "tool_use", id: "toolu_3", name: "Write", input: {} }],
+      },
+      {
+        role: "user",
+        content: [{ type: "tool_result", tool_use_id: "toolu_3", content: "done" }],
+      },
+    ],
+  };
+  const out = prepareClaudeRequest(body as any, "deepseek");
+  const assistant = (out as any).messages.find((m: any) => m.role === "assistant");
+  assert.equal(assistant.content[0].type, "thinking");
+  // Placeholder must be non-empty (DeepSeek rejects empty thinking text).
+  // The value is either "." (upstream canonical) or another non-empty fallback.
+  assert.ok(
+    typeof assistant.content[0].thinking === "string" && assistant.content[0].thinking.length > 0,
+    `thinking placeholder must be non-empty, got: ${JSON.stringify(assistant.content[0].thinking)}`
+  );
+  assert.equal(
+    assistant.content[0].signature,
+    undefined,
+    "no signature on injected DeepSeek block"
+  );
+});
+
+// ──────────────── Fix (c): Gemini reasoning_effort "auto" → high budget ────────────────
+
+test("Gemini: reasoning_effort 'auto' maps to a defined (non-zero) thinking budget", () => {
+  const out = openaiToGeminiRequest(
+    "gemini-3-pro",
+    {
+      messages: [{ role: "user", content: "hello" }],
+      reasoning_effort: "auto",
+    },
+    false
+  ) as any;
+
+  const thinkingBudget = out.generationConfig?.thinkingConfig?.thinkingBudget;
+  assert.ok(
+    typeof thinkingBudget === "number" && thinkingBudget > 0,
+    `reasoning_effort 'auto' should produce a positive thinkingBudget, got: ${thinkingBudget}`
+  );
+  // Specifically should be at least the high-tier budget level (clamped to model max)
+  const highBudget = capThinkingBudget("gemini-3-pro", 32768);
+  assert.equal(
+    thinkingBudget,
+    highBudget,
+    `reasoning_effort 'auto' should map to high budget (${highBudget})`
+  );
+});
+
+// ──────────────── Fix (d): Gemini reasoning_effort "max"/"xhigh" → high budget ────────────────
+
+test("Gemini: reasoning_effort 'max' clamps to high budget (not default fallback)", () => {
+  const out = openaiToGeminiRequest(
+    "gemini-3-pro",
+    {
+      messages: [{ role: "user", content: "hello" }],
+      reasoning_effort: "max",
+    },
+    false
+  ) as any;
+
+  const thinkingBudget = out.generationConfig?.thinkingConfig?.thinkingBudget;
+  const highBudget = capThinkingBudget("gemini-3-pro", 32768);
+  assert.equal(
+    thinkingBudget,
+    highBudget,
+    `reasoning_effort 'max' should clamp to high budget (${highBudget})`
+  );
+});
+
+test("Gemini: reasoning_effort 'xhigh' clamps to high budget (not default fallback)", () => {
+  const out = openaiToGeminiRequest(
+    "gemini-3-pro",
+    {
+      messages: [{ role: "user", content: "hello" }],
+      reasoning_effort: "xhigh",
+    },
+    false
+  ) as any;
+
+  const thinkingBudget = out.generationConfig?.thinkingConfig?.thinkingBudget;
+  const highBudget = capThinkingBudget("gemini-3-pro", 32768);
+  assert.equal(
+    thinkingBudget,
+    highBudget,
+    `reasoning_effort 'xhigh' should clamp to high budget (${highBudget})`
+  );
+});
diff --git a/tests/unit/translator-tools-anthropic-shape.test.ts b/tests/unit/translator-tools-anthropic-shape.test.ts
new file mode 100644
index 0000000000..824fe1d1db
--- /dev/null
+++ b/tests/unit/translator-tools-anthropic-shape.test.ts
@@ -0,0 +1,119 @@
+// Port of upstream decolua/9router@45240c19.
+// Anthropic-compatible Claude-shape providers (MiniMax and friends) reject
+// tools that carry a `type` field with error code 2013 ("invalid tool type").
+// When a client sends Anthropic-format requests but the tools are still in
+// OpenAI wire shape — `{ type: "function", function: { name, description,
+// parameters } }` — prepareClaudeRequest() must normalize them to the
+// Anthropic-native shape `{ name, description, input_schema }` before
+// forwarding to non-Anthropic providers. For Anthropic itself ("claude")
+// the shape is left untouched so first-party server-side tools like
+// web_search_20250305 keep flowing.
+import { describe, test } from "node:test";
+import assert from "node:assert/strict";
+import { prepareClaudeRequest } from "../../open-sse/translator/helpers/claudeHelper.ts";
+
+describe("prepareClaudeRequest tool-shape normalization for non-Anthropic providers", () => {
+  const buildBody = () => ({
+    model: "MiniMax-M2.7",
+    messages: [{ role: "user", content: [{ type: "text", text: "hi" }] }],
+    max_tokens: 256,
+    tools: [
+      // OpenAI wire shape inside an Anthropic-format request.
+      {
+        type: "function",
+        function: {
+          name: "get_weather",
+          description: "Get the weather",
+          parameters: {
+            type: "object",
+            properties: { city: { type: "string" } },
+            required: ["city"],
+          },
+        },
+      },
+      // Anthropic-native shape (no `type` field at all) — must pass through unchanged.
+      {
+        name: "lookup_user",
+        description: "Find a user",
+        input_schema: {
+          type: "object",
+          properties: { id: { type: "string" } },
+          required: ["id"],
+        },
+      },
+      // Built-in Anthropic server-side tool that non-Anthropic providers
+      // must NOT receive at all.
+      {
+        type: "web_search_20250305",
+        name: "web_search",
+      },
+    ],
+  });
+
+  test("folds function.{name,description,parameters} and drops `type` for minimax", () => {
+    const body = buildBody();
+    const result = prepareClaudeRequest(body as any, "minimax");
+    assert.ok(Array.isArray(result.tools));
+    // Built-in web_search_20250305 must be stripped for non-Anthropic providers.
+    assert.equal(result.tools!.length, 2);
+
+    const weather = result.tools!.find((t: any) => t.name === "get_weather") as any;
+    assert.ok(weather, "get_weather tool must survive normalization");
+    assert.equal(weather.type, undefined, "`type` must be stripped");
+    assert.equal(weather.function, undefined, "`function` wrapper must be folded");
+    assert.equal(weather.description, "Get the weather");
+    assert.deepEqual(weather.input_schema, {
+      type: "object",
+      properties: { city: { type: "string" } },
+      required: ["city"],
+    });
+
+    const lookup = result.tools!.find((t: any) => t.name === "lookup_user") as any;
+    assert.ok(lookup, "lookup_user tool must survive normalization");
+    assert.equal(lookup.type, undefined, "stray `type` must be stripped");
+    assert.deepEqual(lookup.input_schema, {
+      type: "object",
+      properties: { id: { type: "string" } },
+      required: ["id"],
+    });
+  });
+
+  test("does NOT rewrite tool shape for first-party claude (keeps built-ins)", () => {
+    const body = {
+      model: "claude-sonnet-4-5",
+      messages: [{ role: "user", content: [{ type: "text", text: "hi" }] }],
+      max_tokens: 256,
+      tools: [
+        // Anthropic-native shape.
+        {
+          name: "lookup_user",
+          description: "Find a user",
+          input_schema: {
+            type: "object",
+            properties: { id: { type: "string" } },
+            required: ["id"],
+          },
+        },
+        // Built-in Anthropic server-side tool — MUST be preserved for first-party claude.
+        {
+          type: "web_search_20250305",
+          name: "web_search",
+        },
+      ],
+    };
+    const result = prepareClaudeRequest(body as any, "claude");
+    assert.ok(Array.isArray(result.tools));
+    // Built-in web_search_20250305 must NOT be stripped for Anthropic-native upstream.
+    const webSearch = result.tools!.find((t: any) => t.type === "web_search_20250305");
+    assert.ok(webSearch, "web_search_20250305 must be preserved for claude");
+    assert.equal(webSearch!.type, "web_search_20250305");
+    // Anthropic-shape tool is untouched.
+    const lookup = result.tools!.find((t: any) => t.name === "lookup_user") as any;
+    assert.ok(lookup);
+    assert.deepEqual(lookup.input_schema, {
+      type: "object",
+      properties: { id: { type: "string" } },
+      required: ["id"],
+    });
+  });
+});
diff --git a/tests/unit/translator-xiaomi-mimo-reasoning-replay-1321.test.ts b/tests/unit/translator-xiaomi-mimo-reasoning-replay-1321.test.ts
new file mode 100644
index 0000000000..dac09a4dbe
--- /dev/null
+++ b/tests/unit/translator-xiaomi-mimo-reasoning-replay-1321.test.ts
@@ -0,0 +1,44 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { translateRequest } = await import("../../open-sse/translator/index.ts");
+const { FORMATS } = await import("../../open-sse/translator/formats.ts");
+
+// Regression for upstream issue 9router#1321 (and the #1337 echo-rules port):
+// Xiaomi MiMo thinking models enforce the same contract as DeepSeek V4 —
+// "Param Incorrect: The reasoning_content in the thinking mode must be passed
+// back to the API." — even on PLAIN (non-tool-call) assistant turns. The
+// xiaomi-mimo provider was already in REASONING_REPLAY_PROVIDERS so tool-call
+// turns got reasoning_content replayed, but the reasoning-ONLY replay path for
+// plain turns was gated by a DeepSeek-only predicate, so a multi-turn text
+// conversation whose reasoning_content the client stripped was forwarded
+// without the field and rejected with 400.
+test("translateRequest replays reasoning_content on plain xiaomi-mimo assistant turns (9router#1321)", () => {
+  const body = {
+    model: "mimo-v2.5-pro",
+    messages: [
+      { role: "user", content: "hi" },
+      // A plain assistant turn (no tool calls) whose reasoning_content the client dropped.
+      { role: "assistant", content: "Hello! How can I help?" },
+      { role: "user", content: "continue" },
+    ],
+  };
+
+  const result = translateRequest(
+    FORMATS.OPENAI,
+    FORMATS.OPENAI,
+    "mimo-v2.5-pro",
+    body,
+    true,
+    null,
+    "xiaomi-mimo"
+  );
+
+  const assistant = result.messages.find((m) => m.role === "assistant");
+  assert.ok(assistant, "assistant message present");
+  assert.equal(
+    typeof assistant.reasoning_content === "string" && assistant.reasoning_content.length > 0,
+    true,
+    "plain xiaomi-mimo assistant turn must carry a non-empty reasoning_content"
+  );
+});
diff --git a/tests/unit/tray-kill-orphan-pid.test.ts b/tests/unit/tray-kill-orphan-pid.test.ts
new file mode 100644
index 0000000000..5887effc41
--- /dev/null
+++ b/tests/unit/tray-kill-orphan-pid.test.ts
@@ -0,0 +1,97 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  getSystrayChildPid,
+  killSystrayUnix,
+} from "../../bin/cli/tray/traySystray.mjs";
+
+// Regression guard for the macOS orphan-NSStatusItem bug: systray2.kill(false)
+// only closes the IPC channel and leaves the Go tray binary subprocess running.
+// killSystrayUnix() must SIGKILL the child PID FIRST so a freshly spawned tray
+// (respawn / hide-to-tray) can register a new NSStatusItem.
+
+test("getSystrayChildPid reads pid from the _process field", () => {
+  const tray = { _process: { pid: 4242 } };
+  assert.equal(getSystrayChildPid(tray), 4242);
+});
+
+test("getSystrayChildPid falls back to the process() accessor", () => {
+  const tray = { process: () => ({ pid: 777 }) };
+  assert.equal(getSystrayChildPid(tray), 777);
+});
+
+test("getSystrayChildPid returns null when no child process is exposed", () => {
+  assert.equal(getSystrayChildPid({}), null);
+  assert.equal(getSystrayChildPid(null), null);
+  assert.equal(getSystrayChildPid({ _process: {} }), null);
+});
+
+test("killSystrayUnix SIGKILLs the child PID BEFORE closing IPC", () => {
+  const calls: string[] = [];
+  const origKill = process.kill;
+  let killedPid: number | undefined;
+  let killedSignal: string | number | undefined;
+
+  // @ts-expect-error - patching process.kill for the test
+  process.kill = (pid: number, signal?: string | number) => {
+    killedPid = pid;
+    killedSignal = signal;
+    calls.push("process.kill");
+    return true;
+  };
+
+  try {
+    const tray = {
+      _process: { pid: 9001 },
+      kill(closeOnly: boolean) {
+        calls.push(`tray.kill(${closeOnly})`);
+      },
+    };
+
+    killSystrayUnix(tray);
+
+    // The child PID is SIGKILLed first, then the IPC channel is closed.
+    assert.deepEqual(calls, ["process.kill", "tray.kill(false)"]);
+    assert.equal(killedPid, 9001);
+    assert.equal(killedSignal, "SIGKILL");
+  } finally {
+    process.kill = origKill;
+  }
+});
+
+test("killSystrayUnix still closes IPC when no child PID is available", () => {
+  const calls: string[] = [];
+  const origKill = process.kill;
+
+  // @ts-expect-error - patching process.kill for the test
+  process.kill = () => {
+    calls.push("process.kill");
+    return true;
+  };
+
+  try {
+    const tray = {
+      kill(closeOnly: boolean) {
+        calls.push(`tray.kill(${closeOnly})`);
+      },
+    };
+
+    killSystrayUnix(tray);
+
+    // No PID known -> never calls process.kill, but still closes IPC.
+    assert.deepEqual(calls, ["tray.kill(false)"]);
+  } finally {
+    process.kill = origKill;
+  }
+});
+
+test("killSystrayUnix swallows errors from a broken tray instance", () => {
+  const tray = {
+    kill() {
+      throw new Error("boom");
+    },
+  };
+  // Must not throw.
+  assert.doesNotThrow(() => killSystrayUnix(tray));
+});
diff --git a/tests/unit/ui/use-model-visibility-handlers-test-all.test.tsx b/tests/unit/ui/use-model-visibility-handlers-test-all.test.tsx
new file mode 100644
index 0000000000..61ae9babb7
--- /dev/null
+++ b/tests/unit/ui/use-model-visibility-handlers-test-all.test.tsx
@@ -0,0 +1,142 @@
+// @vitest-environment jsdom
+//
+// Regression for #4887: on OAuth providers (e.g. GLM Coding), "Test all models"
+// with auto-hide-failed enabled hid failed models in the DB but they STAYED on
+// screen, so it looked like nothing happened. The passthrough path (#3610,
+// PassthroughModelsSection) already switches the filter to "visible" after a run
+// that hid models, via shouldSwitchToVisibleFilter(...) → setVisibilityFilter.
+// The OAuth path (useModelVisibilityHandlers.handleTestAll — consumed by
+// ProviderModelsSection, which GLM renders) DID NOT, so just-hidden models stayed
+// visible under the "All" filter.
+//
+// This drives the real hook: a failing model + autoHideFailed on must leave the
+// hook's visibilityFilter === "visible" so the just-hidden model disappears.
+import React from "react";
+import { act } from "react";
+import { createRoot } from "react-dom/client";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+const mockFetch = vi.fn();
+vi.stubGlobal("fetch", mockFetch);
+
+const {
+  useModelVisibilityHandlers,
+} = await import(
+  "../../../src/app/(dashboard)/dashboard/providers/[id]/hooks/useModelVisibilityHandlers"
+);
+
+type Hook = ReturnType<typeof useModelVisibilityHandlers>;
+
+const t = ((key: string) => key) as any;
+const notify = { error: vi.fn(), success: vi.fn(), info: vi.fn() } as any;
+
+const baseParams = {
+  providerId: "glm",
+  modelAliases: {},
+  customMap: new Map(),
+  providerStorageAlias: "glm",
+  fetchProviderModelMeta: async () => {},
+  fetchAliases: async () => {},
+  notify,
+  t,
+  selectedConnection: { id: "conn-1", provider: "glm" },
+  providerNode: { id: "glm" },
+} as any;
+
+let container: HTMLDivElement | null = null;
+let root: ReturnType<typeof createRoot> | null = null;
+let captured: Hook | null = null;
+
+function TestComponent({ onHook }: { onHook: (h: Hook) => void }) {
+  const hook = useModelVisibilityHandlers(baseParams);
+  const { useEffect } = React;
+  useEffect(() => {
+    onHook(hook);
+  });
+  return null;
+}
+
+async function renderHook() {
+  (globalThis as any).IS_REACT_ACT_ENVIRONMENT = true;
+  container = document.createElement("div");
+  document.body.appendChild(container);
+  captured = null;
+  await act(async () => {
+    root = createRoot(container!);
+    root.render(<TestComponent onHook={(h) => (captured = h)} />);
+  });
+}
+
+/** Mock fetch: test-all returns the configured per-model status; the hide PATCH succeeds. */
+function setFetch(perModel: Record<string, "ok" | "error">) {
+  mockFetch.mockImplementation(async (url: string, init?: RequestInit) => {
+    if (typeof url === "string" && url.startsWith("/api/models/test-all")) {
+      const body = JSON.parse((init?.body as string) || "{}");
+      const full = body.modelIds?.[0] as string;
+      return {
+        ok: true,
+        json: async () => ({ results: { [full]: { status: perModel[full] ?? "error" } } }),
+      };
+    }
+    return { ok: true, text: async () => "", json: async () => ({}) };
+  });
+}
+
+describe("useModelVisibilityHandlers.handleTestAll — #4887 visible-filter parity", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    captured = null;
+  });
+  afterEach(() => {
+    if (root && container) act(() => root!.unmount());
+    container?.remove();
+    container = null;
+    root = null;
+    captured = null;
+  });
+
+  it("switches visibilityFilter to 'visible' when autoHideFailed is on and a model was hidden", async () => {
+    setFetch({ "glm/model-ok": "ok", "glm/model-bad": "error" });
+    await renderHook();
+
+    expect(captured!.visibilityFilter).toBe("all");
+
+    act(() => captured!.setAutoHideFailed(true));
+    expect(captured!.autoHideFailed).toBe(true);
+
+    await act(async () => {
+      await captured!.handleTestAll([
+        { modelId: "model-ok", fullModel: "glm/model-ok" },
+        { modelId: "model-bad", fullModel: "glm/model-bad" },
+      ]);
+    });
+
+    // The failed model was hidden — the filter must flip so it disappears on-screen.
+    expect(captured!.visibilityFilter).toBe("visible");
+  });
+
+  it("does NOT switch the filter when autoHideFailed is off (nothing hidden)", async () => {
+    setFetch({ "glm/model-bad": "error" });
+    await renderHook();
+    expect(captured!.autoHideFailed).toBe(false);
+
+    await act(async () => {
+      await captured!.handleTestAll([{ modelId: "model-bad", fullModel: "glm/model-bad" }]);
+    });
+
+    expect(captured!.visibilityFilter).toBe("all");
+  });
+
+  it("does NOT switch the filter when all models pass (nothing hidden)", async () => {
+    setFetch({ "glm/model-ok": "ok" });
+    await renderHook();
+
+    act(() => captured!.setAutoHideFailed(true));
+
+    await act(async () => {
+      await captured!.handleTestAll([{ modelId: "model-ok", fullModel: "glm/model-ok" }]);
+    });
+
+    expect(captured!.visibilityFilter).toBe("all");
+  });
+});
diff --git a/tests/unit/usage-antigravity-family-split.test.ts b/tests/unit/usage-antigravity-family-split.test.ts
new file mode 100644
index 0000000000..f1d3a5887a
--- /dev/null
+++ b/tests/unit/usage-antigravity-family-split.test.ts
@@ -0,0 +1,45 @@
+// Characterization of the services/usage.ts Antigravity-family split (god-file decomposition): the
+// full Antigravity (Gemini Code Assist) usage family — code-assist tier/plan mapping, credit probing,
+// the user-quota/available-models fetchers + their module-level caches, and getAntigravityUsage —
+// moved into services/usage/antigravity.ts. The 4 data caches + their proactive TTL-purge setInterval
+// moved as a unit (the previously-shared purge timer was split so each module owns its own cleanup).
+// Behavior-preserving move; the fetcher + quota math stay covered by usage-utils / usage-service-
+// hardening / code-assist-subscription (which exercise them via usage.ts __testing).
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+const A = await import("../../open-sse/services/usage/antigravity.ts");
+const HOST = await import("../../open-sse/services/usage.ts");
+
+test("leaf exports the host-facing Antigravity helpers", () => {
+  for (const name of [
+    "getAntigravityUsage",
+    "getAntigravityPlanLabel",
+    "mapCodeAssistSubscriptionToPlanLabel",
+    "mapCodeAssistTierIdToLabel",
+    "mapSubscriptionTierStringToPlanLabel",
+  ]) {
+    assert.equal(typeof (A as Record<string, unknown>)[name], "function", `missing ${name}`);
+  }
+});
+
+test("host __testing re-exports the same Antigravity function identities", () => {
+  const t = (HOST as Record<string, Record<string, unknown>>).__testing;
+  assert.equal(t.getAntigravityPlanLabel, A.getAntigravityPlanLabel);
+  assert.equal(t.mapCodeAssistSubscriptionToPlanLabel, A.mapCodeAssistSubscriptionToPlanLabel);
+  assert.equal(t.mapCodeAssistTierIdToLabel, A.mapCodeAssistTierIdToLabel);
+  assert.equal(t.mapSubscriptionTierStringToPlanLabel, A.mapSubscriptionTierStringToPlanLabel);
+});
+
+test("mapCodeAssistTierIdToLabel maps known tier ids, null otherwise", () => {
+  // unknown tier id → null (the label mapping only knows specific ids)
+  assert.equal(A.mapCodeAssistTierIdToLabel("totally-unknown-tier"), null);
+  // shape: always string|null
+  const out = A.mapCodeAssistTierIdToLabel("free-tier");
+  assert.ok(out === null || typeof out === "string");
+});
+
+test("getAntigravityPlanLabel returns a string for arbitrary input (never throws)", () => {
+  assert.equal(typeof A.getAntigravityPlanLabel(null), "string");
+  assert.equal(typeof A.getAntigravityPlanLabel({ tier: "x" }, { other: 1 }), "string");
+});
diff --git a/tests/unit/usage-endpoint-dimension.test.ts b/tests/unit/usage-endpoint-dimension.test.ts
new file mode 100644
index 0000000000..9712d92407
--- /dev/null
+++ b/tests/unit/usage-endpoint-dimension.test.ts
@@ -0,0 +1,125 @@
+/**
+ * Ported feature regression — decolua/9router#152 (thanks @toanalien).
+ *
+ * Covers the new `endpoint` column on usage_history + getEndpointUsageRows()
+ * aggregation. Asserts: persistence round-trip, NULL → 'unknown' folding,
+ * per-endpoint grouping, sinceIso filter.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-usage-endpoint-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const usageHistory = await import("../../src/lib/usage/usageHistory.ts");
+const usageAnalytics = await import("../../src/lib/db/usageAnalytics.ts");
+
+async function resetStorage() {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+  usageHistory.clearPendingRequests();
+}
+
+test.beforeEach(async () => {
+  await resetStorage();
+});
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+test("saveRequestUsage persists endpoint and getEndpointUsageRows groups by endpoint", async () => {
+  await usageHistory.saveRequestUsage({
+    provider: "openai",
+    model: "gpt-4o-mini",
+    tokens: { input: 10, output: 5 },
+    success: true,
+    latencyMs: 100,
+    timestamp: new Date().toISOString(),
+    endpoint: "/v1/chat/completions",
+  });
+  await usageHistory.saveRequestUsage({
+    provider: "openai",
+    model: "gpt-4o-mini",
+    tokens: { input: 20, output: 8 },
+    success: true,
+    latencyMs: 200,
+    timestamp: new Date().toISOString(),
+    endpoint: "/v1/chat/completions",
+  });
+  await usageHistory.saveRequestUsage({
+    provider: "anthropic",
+    model: "claude-sonnet-4",
+    tokens: { input: 30, output: 12 },
+    success: true,
+    latencyMs: 300,
+    timestamp: new Date().toISOString(),
+    endpoint: "/v1/messages",
+  });
+
+  const rows = usageAnalytics.getEndpointUsageRows();
+  const byKey = new Map(rows.map((r) => [`${r.endpoint}|${r.provider}|${r.model}`, r]));
+
+  const chat = byKey.get("/v1/chat/completions|openai|gpt-4o-mini");
+  assert.ok(chat, "expected /v1/chat/completions row");
+  assert.equal(chat.requests, 2);
+  assert.equal(chat.promptTokens, 30);
+  assert.equal(chat.completionTokens, 13);
+
+  const messages = byKey.get("/v1/messages|anthropic|claude-sonnet-4");
+  assert.ok(messages, "expected /v1/messages row");
+  assert.equal(messages.requests, 1);
+  assert.equal(messages.promptTokens, 30);
+});
+
+test("getEndpointUsageRows folds NULL endpoint into 'unknown' bucket (backward compat)", async () => {
+  // Legacy entry: no endpoint field set → stored as NULL.
+  await usageHistory.saveRequestUsage({
+    provider: "openai",
+    model: "gpt-4o-mini",
+    tokens: { input: 5, output: 5 },
+    success: true,
+    latencyMs: 50,
+    timestamp: new Date().toISOString(),
+  });
+
+  const rows = usageAnalytics.getEndpointUsageRows();
+  const unknown = rows.find((r) => r.endpoint === "unknown");
+  assert.ok(unknown, "NULL endpoint should fold into 'unknown'");
+  assert.equal(unknown.requests, 1);
+});
+
+test("getEndpointUsageRows honors sinceIso filter", async () => {
+  const old = new Date(Date.now() - 24 * 60 * 60 * 1000).toISOString();
+  const recent = new Date().toISOString();
+  await usageHistory.saveRequestUsage({
+    provider: "openai",
+    model: "gpt-4o-mini",
+    tokens: { input: 5, output: 5 },
+    success: true,
+    latencyMs: 50,
+    timestamp: old,
+    endpoint: "/v1/chat/completions",
+  });
+  await usageHistory.saveRequestUsage({
+    provider: "openai",
+    model: "gpt-4o-mini",
+    tokens: { input: 5, output: 5 },
+    success: true,
+    latencyMs: 50,
+    timestamp: recent,
+    endpoint: "/v1/chat/completions",
+  });
+
+  const sinceIso = new Date(Date.now() - 60 * 60 * 1000).toISOString();
+  const rows = usageAnalytics.getEndpointUsageRows({ sinceIso });
+  const chat = rows.find((r) => r.endpoint === "/v1/chat/completions");
+  assert.ok(chat);
+  assert.equal(chat.requests, 1, "only the recent row should be counted");
+});
diff --git a/tests/unit/usage-glm-family-split.test.ts b/tests/unit/usage-glm-family-split.test.ts
new file mode 100644
index 0000000000..b41fc77b4b
--- /dev/null
+++ b/tests/unit/usage-glm-family-split.test.ts
@@ -0,0 +1,30 @@
+// Characterization of the services/usage.ts GLM-family split (god-file decomposition): the GLM (Zhipu)
+// usage family — token/window quota naming, ordering, monthly-remaining math, getGlmUsage fetcher —
+// moved into services/usage/glm.ts. Behavior-preserving move; the locks pin the module surface, the
+// monthly-remaining math, and that usage.ts re-exports glmMonthlyRemainingPercentage (the
+// glm-coding-plan-monthly test imports it from services/usage).
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+const G = await import("../../open-sse/services/usage/glm.ts");
+const HOST = await import("../../open-sse/services/usage.ts");
+
+test("leaf exposes getGlmUsage + glmMonthlyRemainingPercentage", () => {
+  assert.equal(typeof (G as Record<string, unknown>).getGlmUsage, "function");
+  assert.equal(typeof (G as Record<string, unknown>).glmMonthlyRemainingPercentage, "function");
+});
+
+test("host re-exports glmMonthlyRemainingPercentage with the same identity", () => {
+  assert.equal(
+    (HOST as Record<string, unknown>).glmMonthlyRemainingPercentage,
+    (G as Record<string, unknown>).glmMonthlyRemainingPercentage
+  );
+});
+
+test("glmMonthlyRemainingPercentage clamps to 0..100", () => {
+  assert.equal(G.glmMonthlyRemainingPercentage(0, 100), 100);
+  assert.equal(G.glmMonthlyRemainingPercentage(1000, 500), 50);
+  assert.equal(G.glmMonthlyRemainingPercentage(1000, 1000), 100);
+  assert.equal(G.glmMonthlyRemainingPercentage(1000, 0), 0);
+  assert.equal(G.glmMonthlyRemainingPercentage(0, -5), 0);
+});
diff --git a/tests/unit/usage-minimax-family-split.test.ts b/tests/unit/usage-minimax-family-split.test.ts
new file mode 100644
index 0000000000..d55e4c61d7
--- /dev/null
+++ b/tests/unit/usage-minimax-family-split.test.ts
@@ -0,0 +1,49 @@
+// Characterization of the services/usage.ts MiniMax-family split (god-file decomposition): the full
+// MiniMax usage family (plan-label inference, per-window quota assembly, getMiniMaxUsage fetcher) moved
+// into services/usage/minimax.ts. Behavior-preserving move — these locks pin the module surface and a
+// couple of the pure helpers; the fetcher + quota math stay covered by minimax-coding-plan-usage and
+// usage-utils (which exercise them via usage.ts __testing).
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+const M = await import("../../open-sse/services/usage/minimax.ts");
+const HOST = await import("../../open-sse/services/usage.ts");
+
+test("leaf exposes the twelve MiniMax helpers the host re-exposes via __testing", () => {
+  for (const name of [
+    "inferMiniMaxPlanLabelFromTotals",
+    "getMiniMaxPlanLabel",
+    "getMiniMaxQuotaResetAt",
+    "isMiniMaxTextQuotaModel",
+    "getMiniMaxSessionTotal",
+    "getMiniMaxWeeklyTotal",
+    "createMiniMaxQuotaFromCount",
+    "createMiniMaxQuotaFromPercent",
+    "getMiniMaxRemainingPercent",
+    "getMiniMaxAuthErrorMessage",
+    "getMiniMaxErrorSummary",
+    "getMiniMaxUsage",
+  ]) {
+    assert.equal(typeof (M as Record<string, unknown>)[name], "function", `missing ${name}`);
+  }
+});
+
+test("host __testing re-exports the same MiniMax function identities", () => {
+  const t = (HOST as Record<string, Record<string, unknown>>).__testing;
+  assert.equal(t.getMiniMaxUsage, M.getMiniMaxUsage);
+  assert.equal(t.getMiniMaxPlanLabel, M.getMiniMaxPlanLabel);
+  assert.equal(t.getMiniMaxSessionTotal, M.getMiniMaxSessionTotal);
+});
+
+test("getMiniMaxPlanLabel cleans the raw plan title, falls back by session totals", () => {
+  // explicit title wins, "MiniMax"/"Coding Plan" noise stripped
+  assert.equal(M.getMiniMaxPlanLabel({ plan_name: "MiniMax Max Coding Plan" }), "Max");
+  // no title → inferred from session totals (>= 15000 → Max)
+  assert.equal(M.getMiniMaxPlanLabel({}, [{ current_interval_total_count: 20000 }]), "Max");
+  // nothing → default
+  assert.equal(M.getMiniMaxPlanLabel({}, []), "Coding Plan");
+});
+
+test("isMiniMaxTextQuotaModel flags text models", () => {
+  assert.equal(typeof M.isMiniMaxTextQuotaModel("MiniMax-Text-01"), "boolean");
+});
diff --git a/tests/unit/usage-quota-core-split.test.ts b/tests/unit/usage-quota-core-split.test.ts
new file mode 100644
index 0000000000..eb2197a5bf
--- /dev/null
+++ b/tests/unit/usage-quota-core-split.test.ts
@@ -0,0 +1,52 @@
+// Characterization of the services/usage.ts quota-core split (god-file decomposition): the shared
+// UsageQuota shape + the two pure builders (parseResetTime, createQuotaFromUsage) moved into
+// services/usage/quota.ts so the per-provider fetcher leaves can share them without a cycle.
+// Behavior-preserving move — these locks pin the timestamp normalization (sec vs ms, epoch-zero →
+// null, numeric strings) and the used/total → quota assembly (clamping, remaining %).
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+const Q = await import("../../open-sse/services/usage/quota.ts");
+
+test("parseResetTime normalizes seconds, millis, numeric strings; epoch-zero → null", () => {
+  // seconds (< 1e12) get *1000
+  assert.equal(Q.parseResetTime(1_700_000_000), new Date(1_700_000_000_000).toISOString());
+  // millis pass through
+  assert.equal(Q.parseResetTime(1_700_000_000_000), new Date(1_700_000_000_000).toISOString());
+  // numeric string as seconds
+  assert.equal(Q.parseResetTime("1700000000"), new Date(1_700_000_000_000).toISOString());
+  // ISO string passes through
+  assert.equal(Q.parseResetTime("2026-01-02T03:04:05.000Z"), "2026-01-02T03:04:05.000Z");
+  // epoch-zero / falsy / junk → null
+  assert.equal(Q.parseResetTime(0), null);
+  assert.equal(Q.parseResetTime(null), null);
+  assert.equal(Q.parseResetTime("not a date"), null);
+});
+
+test("createQuotaFromUsage clamps used to total and computes remaining %", () => {
+  const q = Q.createQuotaFromUsage(30, 100, null);
+  assert.equal(q.total, 100);
+  assert.equal(q.used, 30);
+  assert.equal(q.remaining, 70);
+  assert.equal(q.remainingPercentage, 70);
+  assert.equal(q.unlimited, false);
+  assert.equal(q.resetAt, null);
+
+  // used above total is clamped
+  const over = Q.createQuotaFromUsage(250, 100, null);
+  assert.equal(over.used, 100);
+  assert.equal(over.remaining, 0);
+  assert.equal(over.remainingPercentage, 0);
+
+  // total 0 → everything zeroed
+  const zero = Q.createQuotaFromUsage(5, 0, null);
+  assert.equal(zero.total, 0);
+  assert.equal(zero.used, 0);
+  assert.equal(zero.remaining, 0);
+  assert.equal(zero.remainingPercentage, 0);
+});
+
+test("createQuotaFromUsage threads the reset timestamp through parseResetTime", () => {
+  const q = Q.createQuotaFromUsage(1, 10, 1_700_000_000);
+  assert.equal(q.resetAt, new Date(1_700_000_000_000).toISOString());
+});
diff --git a/tests/unit/usage-scalars-split.test.ts b/tests/unit/usage-scalars-split.test.ts
new file mode 100644
index 0000000000..a6ac4f3613
--- /dev/null
+++ b/tests/unit/usage-scalars-split.test.ts
@@ -0,0 +1,69 @@
+// Characterization of the services/usage.ts scalar-helpers split (god-file decomposition): the pure
+// coercion/format primitives the per-provider usage fetchers share moved into services/usage/scalars.ts.
+// Behavior-preserving move — these locks pin the coercion edges (NaN/empty fallbacks, percentage
+// clamping, snake/camel field lookup precedence, copilot-prefix stripping in display labels).
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+const S = await import("../../open-sse/services/usage/scalars.ts");
+
+test("module exposes the nine scalar helpers", () => {
+  for (const name of [
+    "toRecord",
+    "toNumber",
+    "toPercentage",
+    "toTitleCase",
+    "getFieldValue",
+    "clampPercentage",
+    "roundCurrency",
+    "toDisplayLabel",
+    "pickFirstNonEmptyString",
+  ]) {
+    assert.equal(typeof (S as Record<string, unknown>)[name], "function", `missing ${name}`);
+  }
+});
+
+test("toRecord only passes through plain objects", () => {
+  assert.deepEqual(S.toRecord({ a: 1 }), { a: 1 });
+  assert.deepEqual(S.toRecord([1, 2]), {});
+  assert.deepEqual(S.toRecord(null), {});
+  assert.deepEqual(S.toRecord("x"), {});
+});
+
+test("toNumber coerces strings, falls back on NaN/empty", () => {
+  assert.equal(S.toNumber(42), 42);
+  assert.equal(S.toNumber("3.5"), 3.5);
+  assert.equal(S.toNumber("", 7), 7);
+  assert.equal(S.toNumber("abc", 9), 9);
+  assert.equal(S.toNumber(undefined, -1), -1);
+});
+
+test("toPercentage / clampPercentage clamp into 0..100", () => {
+  assert.equal(S.toPercentage(150), 100);
+  assert.equal(S.toPercentage(-5), 0);
+  assert.equal(S.toPercentage("42"), 42);
+  assert.equal(S.clampPercentage(250), 100);
+  assert.equal(S.clampPercentage(-3), 0);
+});
+
+test("getFieldValue prefers snake key, then camel, else null", () => {
+  assert.equal(S.getFieldValue({ plan_name: "a", planName: "b" }, "plan_name", "planName"), "a");
+  assert.equal(S.getFieldValue({ planName: "b" }, "plan_name", "planName"), "b");
+  assert.equal(S.getFieldValue({}, "plan_name", "planName"), null);
+});
+
+test("roundCurrency rounds to two decimals", () => {
+  assert.equal(S.roundCurrency(1.005), 1.0); // standard JS rounding edge
+  assert.equal(S.roundCurrency(2.347), 2.35);
+});
+
+test("toTitleCase / toDisplayLabel format labels", () => {
+  assert.equal(S.toTitleCase("pro_plus plan"), "Pro Plus Plan");
+  assert.equal(S.toDisplayLabel("copilot_pro+"), "Pro+");
+  assert.equal(S.toDisplayLabel("copilot business"), "Business");
+});
+
+test("pickFirstNonEmptyString returns first trimmed non-empty string", () => {
+  assert.equal(S.pickFirstNonEmptyString(null, 3, "  ", " hi "), "hi");
+  assert.equal(S.pickFirstNonEmptyString(null, 1), undefined);
+});
diff --git a/tests/unit/v1-models-aliases-included.test.ts b/tests/unit/v1-models-aliases-included.test.ts
new file mode 100644
index 0000000000..eb59e45597
--- /dev/null
+++ b/tests/unit/v1-models-aliases-included.test.ts
@@ -0,0 +1,79 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+// Port of upstream decolua/9router PR #730 — `/v1/models` must surface models added
+// through alias mappings (key_value namespace `modelAliases`) so compatible-provider
+// entries like `custom/kimi-k2.6` registered only via `setModelAlias("kimi-k2.6",
+// "custom/kimi-k2.6")` are still discoverable by OpenAI clients.
+//
+// The catalog already iterates `PROVIDER_MODELS`, synced available models, and
+// `customModels`. It never iterated `modelAliases`, so values pointing to bare
+// `<providerAlias>/<modelId>` entries were silently dropped from the listing even
+// though the model resolves at request time. This helper exposes the alias-backed
+// pairs as a pure function so the route can merge them into the per-provider model
+// list without changing the rest of the pipeline.
+
+import { extractAliasBackedModels } from "../../src/app/api/v1/models/aliasBackedModels.ts";
+
+test("returns the {providerKey, modelId} pair for each alias-backed entry", () => {
+  const aliases = {
+    "kimi-k2.6": "custom/kimi-k2.6",
+    "gpt-4o-mini-fast": "openai/gpt-4o-mini",
+  };
+  const out = extractAliasBackedModels(aliases);
+  assert.deepEqual(out.sort((a, b) => a.providerKey.localeCompare(b.providerKey)), [
+    { providerKey: "custom", modelId: "kimi-k2.6" },
+    { providerKey: "openai", modelId: "gpt-4o-mini" },
+  ]);
+});
+
+test("ignores alias values that are not strings", () => {
+  const aliases = {
+    bad1: 42,
+    bad2: null,
+    bad3: { foo: "openai/gpt-4o" },
+    good: "anthropic/claude-3-5-sonnet",
+  };
+  const out = extractAliasBackedModels(aliases);
+  assert.deepEqual(out, [{ providerKey: "anthropic", modelId: "claude-3-5-sonnet" }]);
+});
+
+test("ignores alias values without a provider/model split", () => {
+  const aliases = {
+    no_slash: "just-a-model-id",
+    empty: "",
+    only_prefix: "openai/",
+    only_suffix: "/model",
+  };
+  const out = extractAliasBackedModels(aliases);
+  assert.deepEqual(out, []);
+});
+
+test("preserves the full sub-path when the model id itself contains a slash", () => {
+  // e.g. openrouter-style "owner/model" identifiers
+  const aliases = {
+    or_alias: "openrouter/anthropic/claude-3.5-sonnet",
+  };
+  const out = extractAliasBackedModels(aliases);
+  assert.deepEqual(out, [
+    { providerKey: "openrouter", modelId: "anthropic/claude-3.5-sonnet" },
+  ]);
+});
+
+test("returns an empty list for an empty / null / undefined input", () => {
+  assert.deepEqual(extractAliasBackedModels({}), []);
+  assert.deepEqual(extractAliasBackedModels(null as unknown as Record<string, unknown>), []);
+  assert.deepEqual(
+    extractAliasBackedModels(undefined as unknown as Record<string, unknown>),
+    []
+  );
+});
+
+test("de-duplicates entries that resolve to the same {providerKey, modelId}", () => {
+  const aliases = {
+    primary: "custom/kimi-k2.6",
+    secondary: "custom/kimi-k2.6",
+  };
+  const out = extractAliasBackedModels(aliases);
+  assert.deepEqual(out, [{ providerKey: "custom", modelId: "kimi-k2.6" }]);
+});
diff --git a/tests/unit/validation-audio-misc-split.test.ts b/tests/unit/validation-audio-misc-split.test.ts
new file mode 100644
index 0000000000..c4a01dac89
--- /dev/null
+++ b/tests/unit/validation-audio-misc-split.test.ts
@@ -0,0 +1,34 @@
+// Characterization of the validation.ts audio/misc split (god-file decomposition): the audio/speech +
+// miscellaneous API-key validators (deepgram, assemblyai, elevenlabs, inworld, kie, aws-polly,
+// bailian, reka, maritalk, nlpcloud, runwayml, nous-research, poe) moved into
+// validation/audioMiscProviders.ts. Behavior-preserving move — the lock here is module surface; the
+// runtime behavior stays covered by the provider-validation-specialty / branches suites.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+const M = await import("../../src/lib/providers/validation/audioMiscProviders.ts");
+const HOST = await import("../../src/lib/providers/validation.ts");
+
+test("audioMiscProviders exposes its thirteen validators", () => {
+  for (const name of [
+    "validateDeepgramProvider",
+    "validateAssemblyAIProvider",
+    "validateElevenLabsProvider",
+    "validateInworldProvider",
+    "validateKieProvider",
+    "validateAwsPollyProvider",
+    "validateBailianCodingPlanProvider",
+    "validateRekaProvider",
+    "validateMaritalkProvider",
+    "validateNlpCloudProvider",
+    "validateRunwayProvider",
+    "validateNousResearchProvider",
+    "validatePoeProvider",
+  ]) {
+    assert.equal(typeof (M as Record<string, unknown>)[name], "function", `missing ${name}`);
+  }
+});
+
+test("host dispatcher surface stays intact after the move", () => {
+  assert.equal(typeof (HOST as Record<string, unknown>).validateProviderApiKey, "function");
+});
diff --git a/tests/unit/validation-cloud-providers-split.test.ts b/tests/unit/validation-cloud-providers-split.test.ts
new file mode 100644
index 0000000000..1436cf5df8
--- /dev/null
+++ b/tests/unit/validation-cloud-providers-split.test.ts
@@ -0,0 +1,38 @@
+// Characterization of the validation.ts enterprise-cloud split (god-file decomposition): the 10 cloud
+// validators (heroku/databricks/datarobot/snowflake/gigachat/azure-openai/azure-ai/watsonx/oci/sap)
+// moved into validation/cloudProviders.ts, and the shared "POST /chat/completions auth probe"
+// (validateDirectChatProvider) moved into validation/directChatProbe.ts so the host and the cloud
+// module share it without a cycle. Behavior-preserving move — the locks here are module surface +
+// the no-cycle wiring. Runtime behavior stays covered by provider-validation-azure-vertex/branches.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+const cloud = await import("../../src/lib/providers/validation/cloudProviders.ts");
+const probe = await import("../../src/lib/providers/validation/directChatProbe.ts");
+const HOST = await import("../../src/lib/providers/validation.ts");
+
+test("cloudProviders exposes the ten enterprise-cloud validators", () => {
+  for (const name of [
+    "validateHerokuProvider",
+    "validateDatabricksProvider",
+    "validateDataRobotProvider",
+    "validateSnowflakeProvider",
+    "validateGigachatProvider",
+    "validateAzureOpenAIProvider",
+    "validateAzureAiProvider",
+    "validateWatsonxProvider",
+    "validateOciProvider",
+    "validateSapProvider",
+  ]) {
+    assert.equal(typeof (cloud as Record<string, unknown>)[name], "function", `missing ${name}`);
+  }
+});
+
+test("directChatProbe exposes the shared validateDirectChatProvider helper", () => {
+  assert.equal(typeof probe.validateDirectChatProvider, "function");
+});
+
+test("host dispatcher surface stays intact after the move", () => {
+  assert.equal(typeof (HOST as Record<string, unknown>).validateProviderApiKey, "function");
+  assert.equal(typeof (HOST as Record<string, unknown>).validateCommandCodeProvider, "function");
+});
diff --git a/tests/unit/validation-format-validators-split.test.ts b/tests/unit/validation-format-validators-split.test.ts
new file mode 100644
index 0000000000..f1074ff9ed
--- /dev/null
+++ b/tests/unit/validation-format-validators-split.test.ts
@@ -0,0 +1,44 @@
+// Characterization of the validation.ts format-validators split (god-file decomposition): the nine
+// wire-format validators moved into two co-located modules by family — validation/openaiFormat.ts
+// (bedrock, openai-like, command-code, gemini-like, openai-compatible) and validation/anthropicFormat.ts
+// (anthropic-like, claude-oauth-inline, anthropic-compatible, claude-code-compatible). Behavior-
+// preserving move; the host keeps only the dispatcher + web-cookie validator. Locks: module surface
+// and that the host re-exports the two historically-public validators (route handler + tests import
+// them via this module). Runtime behavior stays covered by the provider-validation-* suites.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+const openai = await import("../../src/lib/providers/validation/openaiFormat.ts");
+const anthropic = await import("../../src/lib/providers/validation/anthropicFormat.ts");
+const HOST = await import("../../src/lib/providers/validation.ts");
+
+test("openaiFormat exposes its five validators", () => {
+  for (const name of [
+    "validateBedrockProvider",
+    "validateOpenAILikeProvider",
+    "validateCommandCodeProvider",
+    "validateGeminiLikeProvider",
+    "validateOpenAICompatibleProvider",
+  ]) {
+    assert.equal(typeof (openai as Record<string, unknown>)[name], "function", `missing ${name}`);
+  }
+});
+
+test("anthropicFormat exposes its four validators (incl. the internal claude-oauth-inline)", () => {
+  for (const name of [
+    "validateAnthropicLikeProvider",
+    "validateClaudeOAuthInline",
+    "validateAnthropicCompatibleProvider",
+    "validateClaudeCodeCompatibleProvider",
+  ]) {
+    assert.equal(typeof (anthropic as Record<string, unknown>)[name], "function", `missing ${name}`);
+  }
+});
+
+test("host re-exports the two historically-public validators + keeps the dispatcher", () => {
+  assert.equal(typeof (HOST as Record<string, unknown>).validateProviderApiKey, "function");
+  assert.equal(typeof (HOST as Record<string, unknown>).validateCommandCodeProvider, "function");
+  assert.equal(typeof (HOST as Record<string, unknown>).validateClaudeCodeCompatibleProvider, "function");
+  // and the web-cookie validator stays in the host
+  assert.equal(typeof (HOST as Record<string, unknown>).validateWebCookieProvider, "function");
+});
diff --git a/tests/unit/validation-helpers-split.test.ts b/tests/unit/validation-helpers-split.test.ts
new file mode 100644
index 0000000000..74baf47781
--- /dev/null
+++ b/tests/unit/validation-helpers-split.test.ts
@@ -0,0 +1,57 @@
+// Characterization of the validation.ts split (god-file decomposition): the pure infra layer
+// (URL normalizers, header builders, fetch/error transport) moved into co-located leaf modules under
+// providers/validation/. The host re-imports them and re-exports the two historically-public helpers
+// (isRetryableProxyTarget, isSecurityBlockError). These were a behavior-preserving move — no logic
+// change — so the locks here are: public surface stays intact, the new modules expose the helpers,
+// and a few pure functions still compute identically.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+const HOST = await import("../../src/lib/providers/validation.ts");
+const urls = await import("../../src/lib/providers/validation/urlHelpers.ts");
+const headers = await import("../../src/lib/providers/validation/headers.ts");
+const transport = await import("../../src/lib/providers/validation/transport.ts");
+
+test("host preserves its public surface (dispatcher + claude-code validator + re-exported guards)", () => {
+  for (const name of [
+    "validateProviderApiKey",
+    "validateClaudeCodeCompatibleProvider",
+    "validateWebCookieProvider",
+    "validateCommandCodeProvider",
+    "isRetryableProxyTarget",
+    "isSecurityBlockError",
+  ]) {
+    assert.equal(typeof (HOST as Record<string, unknown>)[name], "function", `missing ${name}`);
+  }
+});
+
+test("re-exported guards are the same function objects as transport's", () => {
+  assert.equal(
+    (HOST as Record<string, unknown>).isRetryableProxyTarget,
+    transport.isRetryableProxyTarget
+  );
+  assert.equal(
+    (HOST as Record<string, unknown>).isSecurityBlockError,
+    transport.isSecurityBlockError
+  );
+});
+
+test("urlHelpers: normalizeBaseUrl trims + strips trailing slash; addModelsSuffix swaps endpoints", () => {
+  assert.equal(urls.normalizeBaseUrl("  https://api.x.com/v1/  "), "https://api.x.com/v1");
+  assert.equal(urls.normalizeBaseUrl(123 as unknown as string), ""); // non-string guard (#2463)
+  assert.equal(urls.addModelsSuffix("https://api.x.com/v1/chat/completions"), "https://api.x.com/v1/models");
+  assert.equal(urls.addModelsSuffix("https://api.x.com/v1/models"), "https://api.x.com/v1/models");
+});
+
+test("headers: buildBearerHeaders sets Authorization; builders vary the scheme", () => {
+  assert.equal(headers.buildBearerHeaders("k").Authorization, "Bearer k");
+  assert.equal(headers.buildClarifaiHeaders("k").Authorization, "Key k");
+  assert.equal(headers.buildTokenHeaders("k").Authorization, "Token k");
+  assert.equal(headers.buildBearerHeaders("").Authorization, undefined); // empty key → no auth header
+});
+
+test("transport: isRetryableProxyTarget fails closed on bad URL and blocks private hosts", () => {
+  assert.equal(transport.isRetryableProxyTarget("not a url"), false);
+  assert.equal(transport.isRetryableProxyTarget("http://169.254.169.254/"), false);
+  assert.equal(transport.isRetryableProxyTarget("https://api.openai.com/v1"), true);
+});
diff --git a/tests/unit/validation-search-embedding-split.test.ts b/tests/unit/validation-search-embedding-split.test.ts
new file mode 100644
index 0000000000..e658598880
--- /dev/null
+++ b/tests/unit/validation-search-embedding-split.test.ts
@@ -0,0 +1,33 @@
+// Characterization of the validation.ts search + embedding split (god-file decomposition): the
+// web-search validators (+ SEARCH_VALIDATOR_CONFIGS) moved into validation/searchProviders.ts and the
+// embedding/rerank/clarifai validators into validation/embeddingProviders.ts. Behavior-preserving
+// move — the lock is module surface; runtime behavior stays covered by the search-provider-validation
+// and provider-validation-specialty suites.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+const search = await import("../../src/lib/providers/validation/searchProviders.ts");
+const embed = await import("../../src/lib/providers/validation/embeddingProviders.ts");
+const HOST = await import("../../src/lib/providers/validation.ts");
+
+test("searchProviders exposes the search validators + the per-provider config map", () => {
+  assert.equal(typeof (search as Record<string, unknown>).validateSearchProvider, "function");
+  assert.equal(typeof (search as Record<string, unknown>).validateGenericProvider, "function");
+  const cfg = (search as Record<string, Record<string, unknown>>).SEARCH_VALIDATOR_CONFIGS;
+  assert.ok(cfg && typeof cfg === "object");
+  assert.ok(Object.keys(cfg).length > 0, "SEARCH_VALIDATOR_CONFIGS must carry the provider configs");
+});
+
+test("embeddingProviders exposes clarifai + embedding + rerank validators", () => {
+  for (const name of [
+    "validateClarifaiProvider",
+    "validateEmbeddingApiProvider",
+    "validateRerankApiProvider",
+  ]) {
+    assert.equal(typeof (embed as Record<string, unknown>)[name], "function", `missing ${name}`);
+  }
+});
+
+test("host dispatcher surface stays intact after the move", () => {
+  assert.equal(typeof (HOST as Record<string, unknown>).validateProviderApiKey, "function");
+});
diff --git a/tests/unit/validation-web-providers-split.test.ts b/tests/unit/validation-web-providers-split.test.ts
new file mode 100644
index 0000000000..8b947604e7
--- /dev/null
+++ b/tests/unit/validation-web-providers-split.test.ts
@@ -0,0 +1,60 @@
+// Characterization of the validation.ts web-provider split (god-file decomposition): the 13 web-cookie
+// validators + the Meta AI request builder moved into co-located leaf modules (validation/metaAi.ts,
+// webProvidersA.ts, webProvidersB.ts). Behavior-preserving move — the locks here are: each module
+// exposes its validators, webProvidersB consumes metaAi, and buildMetaAiValidationBody still emits a
+// well-formed persisted-query body. The dispatcher's runtime wiring stays covered by the existing
+// provider-validation-specialty / web-cookie suites.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+const A = await import("../../src/lib/providers/validation/webProvidersA.ts");
+const B = await import("../../src/lib/providers/validation/webProvidersB.ts");
+const meta = await import("../../src/lib/providers/validation/metaAi.ts");
+const HOST = await import("../../src/lib/providers/validation.ts");
+
+test("webProvidersA exposes its six validators (deepseek/qwen/grok/chatgpt/perplexity/blackbox)", () => {
+  for (const name of [
+    "validateDeepSeekWebProvider",
+    "validateQwenWebProvider",
+    "validateGrokWebProvider",
+    "validateChatGptWebProvider",
+    "validatePerplexityWebProvider",
+    "validateBlackboxWebProvider",
+  ]) {
+    assert.equal(typeof (A as Record<string, unknown>)[name], "function", `A missing ${name}`);
+  }
+});
+
+test("webProvidersB exposes its eight validators (muse-spark/adapta/claude/gemini/copilot/t3/jules/inner-ai)", () => {
+  for (const name of [
+    "validateMuseSparkWebProvider",
+    "validateAdaptaWebProvider",
+    "validateClaudeWebProvider",
+    "validateGeminiWebProvider",
+    "validateCopilotWebProvider",
+    "validateT3WebProvider",
+    "validateJulesProvider",
+    "validateInnerAiProvider",
+  ]) {
+    assert.equal(typeof (B as Record<string, unknown>)[name], "function", `B missing ${name}`);
+  }
+});
+
+test("metaAi.buildMetaAiValidationBody emits a persisted-query body with fresh UUID-bearing variables", () => {
+  const body = meta.buildMetaAiValidationBody() as {
+    doc_id: string;
+    variables: { conversationId: string; userAgent: string; isNewConversation: boolean };
+  };
+  assert.equal(typeof body.doc_id, "string");
+  assert.ok(body.variables.conversationId.startsWith("c."), "conversationId is base62 c.* id");
+  assert.equal(body.variables.isNewConversation, true);
+  assert.ok(body.variables.userAgent.includes("Mozilla/"), "carries the Meta AI UA const");
+  // Two calls must mint distinct conversation ids (random-seeded).
+  const second = meta.buildMetaAiValidationBody() as { variables: { conversationId: string } };
+  assert.notEqual(body.variables.conversationId, second.variables.conversationId);
+});
+
+test("host dispatcher surface remains intact after the move", () => {
+  assert.equal(typeof (HOST as Record<string, unknown>).validateProviderApiKey, "function");
+  assert.equal(typeof (HOST as Record<string, unknown>).validateWebCookieProvider, "function");
+});
diff --git a/tests/unit/vercel-deploy-relay-path-ssrf.test.ts b/tests/unit/vercel-deploy-relay-path-ssrf.test.ts
new file mode 100644
index 0000000000..20716604a1
--- /dev/null
+++ b/tests/unit/vercel-deploy-relay-path-ssrf.test.ts
@@ -0,0 +1,87 @@
+// SSRF regression guard for the Vercel relay worker (lockstep with the Deno
+// Deploy relay fix; PR #4643 / deno-deploy follow-up).
+//
+// The generated Vercel edge function reads an attacker-controlled `x-relay-path`
+// header and previously appended it to the (validated) `x-relay-target` origin
+// via string concatenation: `fetch(target.replace(/\/$/, "") + relayPath)`.
+// That is bypassable via userinfo (`/x@evil.com`), a backslash (`\evil.com`), or
+// a protocol-relative path (`//evil.com/x`) — the same hole the Deno worker had.
+//
+// The fix reuses the SAME pure `resolveRelayTarget()` guard (exported from the
+// deno-deploy route, embedded into both workers via Function#toString). This
+// test mirrors `deno-deploy-relay-path-ssrf.test.ts`: it asserts the generated
+// Vercel worker no longer string-concatenates the path and embeds the guard.
+// The pure-function behavior itself is covered once in the deno test (same
+// function); here we focus on the Vercel worker wiring.
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { resolveRelayTarget } from "../../src/app/api/settings/proxy/deno-deploy/route";
+import { __buildRelayFunctionForTest } from "../../src/app/api/settings/proxy/vercel-deploy/route";
+
+const TARGET = "https://api.anthropic.com";
+
+describe("vercel relay reuses the SSRF-safe resolveRelayTarget guard", () => {
+  it("accepts a legitimate absolute path", () => {
+    const r = resolveRelayTarget(TARGET, "/v1/foo");
+    assert.equal(r.ok, true);
+    if (r.ok) assert.equal(r.url, "https://api.anthropic.com/v1/foo");
+  });
+
+  it("rejects //evil.com/x (host swap)", () => {
+    const r = resolveRelayTarget(TARGET, "//evil.com/x");
+    assert.equal(r.ok, false);
+    if (!r.ok) assert.equal(r.status, 403);
+  });
+
+  it("rejects /x@evil.com (userinfo)", () => {
+    const r = resolveRelayTarget(TARGET, "/x@evil.com");
+    assert.equal(r.ok, false);
+    if (!r.ok) assert.equal(r.status, 403);
+  });
+
+  it("rejects \\evil.com (backslash)", () => {
+    const r = resolveRelayTarget(TARGET, "\\evil.com");
+    assert.equal(r.ok, false);
+    if (!r.ok) assert.equal(r.status, 403);
+  });
+
+  it("rejects a value without a leading '/'", () => {
+    const r = resolveRelayTarget(TARGET, "evil.com/x");
+    assert.equal(r.ok, false);
+    if (!r.ok) assert.equal(r.status, 403);
+  });
+});
+
+describe("buildRelayFunction — generated Vercel worker has no string-concat SSRF hole", () => {
+  it("does not append relayPath to target by string concatenation", () => {
+    const worker = __buildRelayFunctionForTest("deadbeefcafe");
+    assert.ok(
+      !worker.includes("+ relayPath"),
+      "Vercel worker must not contain `+ relayPath` string concatenation"
+    );
+    assert.ok(
+      !/\.replace\(\s*\/\\?\/\$\/\s*,\s*["']{2}\s*\)\s*\+\s*relayPath/.test(worker),
+      "Vercel worker must not append relayPath to target by string concatenation"
+    );
+  });
+
+  it("embeds the resolveRelayTarget guard and fetches the resolved url", () => {
+    const worker = __buildRelayFunctionForTest("deadbeefcafe");
+    assert.ok(
+      worker.includes("resolveRelayTarget"),
+      "the Vercel worker must call the shared resolveRelayTarget guard"
+    );
+    assert.ok(
+      worker.includes("resolved.url"),
+      "the Vercel worker must fetch the SSRF-validated resolved url"
+    );
+  });
+
+  it("still ships the edge runtime config marker", () => {
+    const worker = __buildRelayFunctionForTest("deadbeefcafe");
+    assert.ok(
+      worker.includes('runtime: "edge"'),
+      "the Vercel edge runtime config must be preserved"
+    );
+  });
+});