diff --git a/.env.example b/.env.example
index fdfe5d0b0f..0790badeae 100644
--- a/.env.example
+++ b/.env.example
@@ -187,8 +187,13 @@ OMNIROUTE_USE_TURBOPACK=1
 # Hostname/bind address for the Next.js server.
 # Used by: scripts/dev/run-next.mjs (HOST), Playwright runner (HOSTNAME).
 # Default: 0.0.0.0 (HOST) / 127.0.0.1 (HOSTNAME inside tests).
+# NOTE: Do NOT use `HOSTNAME` — it is a POSIX shell variable automatically set to
+# the machine name by bash/zsh. The .env loader cannot override it (first-wins
+# semantics). Use OMNIROUTE_SERVER_HOST instead for `omniroute serve`.
+# See: https://github.com/diegosouzapw/OmniRoute/issues/6194
 #HOST=0.0.0.0
 #HOSTNAME=127.0.0.1
+#OMNIROUTE_SERVER_HOST=0.0.0.0
 
 # Environment mode — affects Next.js behavior, logging verbosity, and caching.
 # Values: production | development  |  Default: production
@@ -1516,6 +1521,11 @@ APP_LOG_TO_FILE=true
 # PROXY_AUTO_REMOVE=false
 # Consecutive failures before an auto-remove fires. Default: 3.
 # PROXY_AUTO_REMOVE_AFTER=3
+# Let automated reachability probes (the scheduler + the "Test All" button) WRITE
+# a proxy's status. Default "false": probes are read-only and never deactivate a
+# proxy — only the operator sets active/inactive (a flaky probe must not strand an
+# assigned proxy; #6246). Set "true" to restore the legacy test-and-set behaviour.
+# PROXY_HEALTH_AUTO_DEACTIVATE=false
 
 # Allow OAuth and provider validation flows to bypass a pinned proxy and connect
 # directly when proxy reachability pre-checks fail. Default: false.
@@ -1698,6 +1708,10 @@ APP_LOG_TO_FILE=true
 # Routing-decision log verbosity: 0 silences, higher values log more bypass/route
 # decisions (src/mitm/server.cjs, _internal/bypass.cjs).
 # MITM_VERBOSE=1
+# Strip the leading `sudo` from MITM cert-trust commands (src/mitm/systemCommands.ts) —
+# for root-less / user-namespaced deployments (e.g. rootless Docker/Podman)
+# where the operator trusts the CA manually (e.g. via Node's extra-CA-certs mechanism).
+# OMNIROUTE_NO_SUDO=0
 
 # ── 1Proxy egress pool ──
 # Used by: src/lib/oneproxySync.ts — fetches proxy nodes from the OmniRoute
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 988f844aaf..be1d3e4465 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -506,7 +506,15 @@ jobs:
 
   build:
     name: Build
-    runs-on: ubuntu-latest
+    # Dynamic runner: when the release captain flips the USE_VPS_RUNNER repo var to
+    # 'true' (scripts/vps/release-runner-up.sh does it after the self-hosted VM is
+    # online), the heavy jobs run on the dedicated 32-core VPS runners (label
+    # omni-release) instead of queueing on the 20-concurrent-job hosted pool.
+    # Safety: fork PRs NEVER reach the self-hosted runner — the expression falls
+    # back to ubuntu-latest unless the PR head repo is this repository (push /
+    # dispatch events are own-origin by definition). Any failure path (VM down,
+    # var unset/false) also falls back to ubuntu-latest.
+    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }}
     needs: changes
     if: ${{ github.event_name != 'pull_request' || (needs.changes.outputs.code == 'true' && github.event.pull_request.draft == false) }}
     steps:
@@ -519,14 +527,21 @@ jobs:
           cache: npm
       - uses: ./.github/actions/npm-ci-retry
       - run: npm run check:node-runtime
-      - name: Cache Next.js build cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
-        with:
-          path: .build/next/cache
-          key: nextjs-${{ runner.os }}-node-${{ env.CI_NODE_VERSION }}-${{ hashFiles('package-lock.json') }}-${{ hashFiles('src/**/*', 'open-sse/**/*', 'db/**/*', 'next.config.mjs', 'tsconfig*.json', 'postcss.config.*', 'tailwind.config.*') }}
-          restore-keys: |
-            nextjs-${{ runner.os }}-node-${{ env.CI_NODE_VERSION }}-${{ hashFiles('package-lock.json') }}-
+      # NOTE: the webpack `.build/next/cache` actions/cache step was removed with the
+      # Turbopack switch below — Turbopack does not read/write the webpack cache dir
+      # (its persistent FS cache is still experimental and intentionally NOT enabled),
+      # so restoring the old ~0.5 GB webpack cache would only waste download time.
+      # Rolling back to webpack = revert this commit (cache step comes back with it).
+      #
+      # Turbopack production build (Next 16, stable): benchmarked 1.9× faster than the
+      # webpack pass (9min0s vs 17min15s on a 32-core box; multi-core Rust vs webpack's
+      # single-threaded compile). Standalone output smoke-validated (server boots,
+      # /api/monitoring/health 200). Downstream jobs (e2e ×9, package-artifact,
+      # electron-package-smoke) consume this artifact, so a green run here validates
+      # the Turbopack artifact end-to-end.
       - run: npm run build
+        env:
+          OMNIROUTE_USE_TURBOPACK: "1"
       - name: Archive Next.js build for downstream jobs
         # Use tar so the archive preserves paths relative to CWD (.build/next/...).
         # upload-artifact path-stripping is ambiguous when exclude patterns are used;
@@ -614,9 +629,16 @@ jobs:
 
   test-unit:
     name: Unit Tests (${{ matrix.shard }}/8)
-    runs-on: ubuntu-latest
+    # Same dynamic-runner rule as Build (own-origin only; fallback ubuntu-latest).
+    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }}
     timeout-minutes: 25
-    needs: build
+    # needs: changes (not build) — this job never downloads the next-build artifact;
+    # gating it on Build only serialized ~20min of wall-clock for nothing. Jobs that
+    # DO consume the artifact (e2e, package-artifact, electron-package-smoke) keep
+    # needs: build. The `if` mirrors Build's own skip condition so docs-only PRs
+    # still skip the suite.
+    needs: changes
+    if: ${{ github.event_name != 'pull_request' || (needs.changes.outputs.code == 'true' && github.event.pull_request.draft == false) }}
     strategy:
       fail-fast: false
       matrix:
@@ -662,9 +684,12 @@ jobs:
 
   test-vitest:
     name: Vitest (MCP / autoCombo / UI components)
-    runs-on: ubuntu-latest
+    # Same dynamic-runner rule as Build (own-origin only; fallback ubuntu-latest).
+    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }}
     timeout-minutes: 15
-    needs: build
+    # needs: changes (not build) — no artifact consumed; see test-unit note.
+    needs: changes
+    if: ${{ github.event_name != 'pull_request' || (needs.changes.outputs.code == 'true' && github.event.pull_request.draft == false) }}
     env:
       JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation
       API_KEY_SECRET: ci-test-api-key-secret-long
@@ -952,7 +977,9 @@ jobs:
     name: Integration Tests (${{ matrix.shard }}/2)
     runs-on: ubuntu-latest
     timeout-minutes: 15
-    needs: build
+    # needs: changes (not build) — no artifact consumed; see test-unit note.
+    needs: changes
+    if: ${{ github.event_name != 'pull_request' || (needs.changes.outputs.code == 'true' && github.event.pull_request.draft == false) }}
     strategy:
       fail-fast: false
       matrix:
@@ -979,7 +1006,9 @@ jobs:
   test-security:
     name: Security Tests
     runs-on: ubuntu-latest
-    needs: build
+    # needs: changes (not build) — no artifact consumed; see test-unit note.
+    needs: changes
+    if: ${{ github.event_name != 'pull_request' || (needs.changes.outputs.code == 'true' && github.event.pull_request.draft == false) }}
     env:
       JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation
       API_KEY_SECRET: ci-test-api-key-secret-long
diff --git a/Dockerfile b/Dockerfile
index 01f54c1bd1..92894f55c2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -60,22 +60,25 @@ RUN --mount=type=cache,target=/root/.npm \
   && npm rebuild better-sqlite3 \
   && node -e "require('better-sqlite3')(':memory:').close()"
 
-# Build with webpack (stable). Turbopack hit a non-recoverable internal panic on this
-# Next.js version during the v3.8.27 release build — TurbopackInternalError "entered
-# unreachable code: there must be a path to a root" in ImportTracer::get_traces, on both
-# linux/amd64 and linux/arm64. Webpack is the proven engine (build:release / VPS / CI Build
-# all green). Re-enable Turbopack (=1) once the upstream tracer bug is fixed.
+# Build with Turbopack (stable in Next 16, the repo default). The v3.8.27-era
+# TurbopackInternalError panic ("entered unreachable code: there must be a path to a
+# root" in ImportTracer::get_traces) no longer reproduces on Next 16.2.9 — validated
+# 2026-07-05 with clean amd64 (12min14s, image smoke-tested: /api/monitoring/health
+# 200) and arm64 (qemu, exit 0, zero panic strings) builds. Turbopack cut the bare
+# build from 17min to 9min on the same 32-core box. Webpack stays available as the
+# escape hatch: `--build-arg`/-e OMNIROUTE_USE_TURBOPACK=0.
 # See docs/ops/QUALITY_GATE_PLAYBOOK.md Parte 6.
-ENV OMNIROUTE_USE_TURBOPACK=0
+ENV OMNIROUTE_USE_TURBOPACK=1
 
 # Raise the V8 heap ceiling for the build. The webpack production optimization
-# pass (forced above since Turbopack panics) needs more than V8's default ceiling
-# (~2 GB) for a codebase this size; a memory-constrained Docker build otherwise
-# dies with "FATAL ERROR: ... JavaScript heap out of memory" during the builder
-# stage (#4076). NODE_OPTIONS propagates to the spawned `next build` child
-# (build-next-isolated.mjs → resolveNextBuildEnv spreads process.env). Build-only;
-# the runtime heap is set separately on the runner stage (OMNIROUTE_MEMORY_MB).
-# Override for hosts with more/less RAM: `--build-arg OMNIROUTE_BUILD_MEMORY_MB=6144`.
+# pass needs more than V8's default ceiling (~2 GB) for a codebase this size; a
+# memory-constrained Docker build otherwise dies with "FATAL ERROR: ... JavaScript
+# heap out of memory" during the builder stage (#4076). Turbopack's compile is
+# native (Rust) and less V8-heap-bound, but the prerender/export phase still runs
+# on V8, so keep the ceiling. NODE_OPTIONS propagates to the spawned `next build`
+# child (build-next-isolated.mjs → resolveNextBuildEnv spreads process.env).
+# Build-only; the runtime heap is set separately on the runner stage
+# (OMNIROUTE_MEMORY_MB). Override: `--build-arg OMNIROUTE_BUILD_MEMORY_MB=6144`.
 ARG OMNIROUTE_BUILD_MEMORY_MB=4096
 ENV NODE_OPTIONS="--max-old-space-size=${OMNIROUTE_BUILD_MEMORY_MB}"
 
diff --git a/bin/cli/commands/doctor.mjs b/bin/cli/commands/doctor.mjs
index 0a2b78db74..087101b50d 100644
--- a/bin/cli/commands/doctor.mjs
+++ b/bin/cli/commands/doctor.mjs
@@ -380,18 +380,61 @@ function resolveLivenessUrl(options = {}) {
   return `http://${formatHostForUrl(host || "127.0.0.1")}:${dashboardPort}/api/health/degradation`;
 }
 
+async function probeUrl(url) {
+  try {
+    const response = await fetchWithTimeout(url);
+    return { ok: response.ok, status: response.status };
+  } catch {
+    return { ok: false, status: 0 };
+  }
+}
+
 async function checkServerLiveness(options = {}) {
   const url = resolveLivenessUrl(options);
 
-  try {
-    const response = await fetchWithTimeout(url);
-    if (!response.ok) {
-      return warn("Server liveness", `Server responded with HTTP ${response.status}`, { url });
-    }
-    return ok("Server liveness", "Server health endpoint is reachable", { url });
-  } catch {
-    return warn("Server liveness", "Server health endpoint is not reachable", { url });
+  // First attempt: configured health endpoint (may require auth token).
+  const primary = await probeUrl(url);
+  if (primary.ok) {
+    return ok("Server liveness", "Server health endpoint is reachable", { url, status: primary.status });
   }
+
+  // #6162: /api/health and /api/health/degradation require a management token.
+  // When unauthenticated, fall back to probing a publicly served static asset
+  // (favicon.ico) to confirm the Next.js server is alive and reachable.
+  // Derive the fallback URL from the primary URL (preserving protocol/host/port)
+  // so custom liveness URL configurations are honored. Fall back to defaults
+  // only if the primary URL can't be parsed.
+  let fallbackUrl;
+  try {
+    const parsed = new URL(url);
+    parsed.pathname = "/favicon.ico";
+    parsed.search = "";
+    parsed.hash = "";
+    fallbackUrl = parsed.toString();
+  } catch {
+    const port = parsePort(process.env.PORT || "20128", 20128);
+    const dashboardPort = parsePort(process.env.DASHBOARD_PORT || String(port), port);
+    const host = String(options.livenessHost || process.env.OMNIROUTE_DOCTOR_HOST || "127.0.0.1")
+      .trim()
+      .replace(/^https?:\/\//, "")
+      .replace(/\/.*$/, "");
+    fallbackUrl = `http://${formatHostForUrl(host || "127.0.0.1")}:${dashboardPort}/favicon.ico`;
+  }
+  const fallback = await probeUrl(fallbackUrl);
+
+  if (fallback.ok) {
+    return ok(
+      "Server liveness",
+      `Server reachable (health endpoint returned ${primary.status}, likely requires MANAGEMENT_TOKEN)`,
+      { primaryUrl: url, primaryStatus: primary.status, fallbackUrl, fallbackStatus: fallback.status }
+    );
+  }
+
+  return warn(
+    "Server liveness",
+    `Server health endpoint returned HTTP ${primary.status || "no-response"} and fallback probe failed`,
+    { primaryUrl: url, primaryStatus: primary.status, fallbackUrl, fallbackStatus: fallback.status }
+  );
 }
 
 export async function collectDoctorChecks(context = {}, options = {}) {
diff --git a/bin/cli/commands/serve.mjs b/bin/cli/commands/serve.mjs
index 9ba6579c3f..ab9d793ca3 100644
--- a/bin/cli/commands/serve.mjs
+++ b/bin/cli/commands/serve.mjs
@@ -2,7 +2,7 @@ import { spawn } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
-import { platform, totalmem } from "node:os";
+import { platform, totalmem, hostname as osHostname } from "node:os";
 import { t } from "../i18n.mjs";
 import { writePidFile, cleanupPidFile, waitForServer } from "../utils/pid.mjs";
 import { ServerSupervisor, detectMitmCrash } from "../runtime/processSupervisor.mjs";
@@ -170,7 +170,16 @@ export async function runServe(opts = {}) {
     PORT: String(dashboardPort),
     DASHBOARD_PORT: String(dashboardPort),
     API_PORT: String(apiPort),
-    HOSTNAME: process.env.HOSTNAME || "0.0.0.0",
+    // #6194: POSIX shells (bash/zsh) auto-set HOSTNAME to the machine name — the
+    // .env loader (first-wins) can never override it. Ignore HOSTNAME when it
+    // matches the OS-reported hostname (the auto-set signature). OMNIROUTE_SERVER_HOST
+    // takes precedence; legacy HOSTNAME values that don't match os.hostname() are
+    // still honoured for backward compatibility (e.g. Windows CMD/PowerShell users
+    // who set HOSTNAME in .env where it is NOT auto-set).
+    HOSTNAME:
+      process.env.OMNIROUTE_SERVER_HOST ||
+      (process.env.HOSTNAME !== osHostname() ? process.env.HOSTNAME : undefined) ||
+      "0.0.0.0",
     NODE_ENV: "production",
     // #5238: preserve a user-set NODE_OPTIONS (incl. their own
     // `--max-old-space-size=…`) instead of clobbering it with the calibrated
diff --git a/config/quality/eslint-suppressions.json b/config/quality/eslint-suppressions.json
index 0cab8df64d..c74f3b1b34 100644
--- a/config/quality/eslint-suppressions.json
+++ b/config/quality/eslint-suppressions.json
@@ -242,11 +242,6 @@
       "count": 1
     }
   },
-  "src/app/(dashboard)/dashboard/settings/components/ComboDefaultsTab.tsx": {
-    "no-restricted-syntax": {
-      "count": 1
-    }
-  },
   "src/app/(dashboard)/dashboard/settings/components/ModelLockoutCard.tsx": {
     "react-hooks/exhaustive-deps": {
       "count": 1
@@ -1132,11 +1127,6 @@
       "count": 4
     }
   },
-  "tests/unit/copilot-gemini-claude-route-no-responses.test.ts": {
-    "@typescript-eslint/no-explicit-any": {
-      "count": 9
-    }
-  },
   "tests/unit/cursor-usage-fetcher.test.ts": {
     "@typescript-eslint/no-explicit-any": {
       "count": 1
@@ -1397,11 +1387,6 @@
       "count": 1
     }
   },
-  "tests/unit/executor-kiro.test.ts": {
-    "@typescript-eslint/no-explicit-any": {
-      "count": 1
-    }
-  },
   "tests/unit/executor-nlpcloud.test.ts": {
     "@typescript-eslint/no-explicit-any": {
       "count": 2
@@ -1572,11 +1557,6 @@
       "count": 2
     }
   },
-  "tests/unit/messages-count-tokens-route.test.ts": {
-    "@typescript-eslint/no-explicit-any": {
-      "count": 4
-    }
-  },
   "tests/unit/mimocode-executor.test.ts": {
     "@typescript-eslint/no-explicit-any": {
       "count": 58
@@ -2007,11 +1987,6 @@
       "count": 9
     }
   },
-  "tests/unit/save-call-log-persistence.test.ts": {
-    "@typescript-eslint/no-explicit-any": {
-      "count": 7
-    }
-  },
   "tests/unit/schema-coercion.test.ts": {
     "@typescript-eslint/no-explicit-any": {
       "count": 12
@@ -2357,11 +2332,6 @@
       "count": 76
     }
   },
-  "tests/unit/web-cookie-providers-new.test.ts": {
-    "@typescript-eslint/no-explicit-any": {
-      "count": 18
-    }
-  },
   "tests/unit/web-runtime-env.test.ts": {
     "@typescript-eslint/no-explicit-any": {
       "count": 1
diff --git a/config/quality/file-size-baseline.json b/config/quality/file-size-baseline.json
index 090083aa63..65bcb345d9 100644
--- a/config/quality/file-size-baseline.json
+++ b/config/quality/file-size-baseline.json
@@ -182,7 +182,7 @@
     "open-sse/services/tokenRefresh.ts": 2181,
     "open-sse/services/usage.ts": 3454,
     "open-sse/translator/request/openai-to-gemini.ts": 906,
-    "open-sse/translator/request/openai-to-kiro.ts": 853,
+    "open-sse/translator/request/openai-to-kiro.ts": 890,
     "open-sse/translator/response/openai-responses.ts": 1092,
     "open-sse/utils/cursorAgentProtobuf.ts": 1521,
     "open-sse/utils/stream.ts": 2727,
@@ -206,7 +206,7 @@
     "src/app/(dashboard)/dashboard/providers/[id]/hooks/useProviderConnections.ts": 954,
     "src/app/(dashboard)/dashboard/providers/[id]/hooks/useProviderModels.ts": 155,
     "src/app/(dashboard)/dashboard/providers/[id]/hooks/useProviderSettings.ts": 264,
-    "src/app/(dashboard)/dashboard/providers/[id]/providerPageHelpers.ts": 1021,
+    "src/app/(dashboard)/dashboard/providers/[id]/providerPageHelpers.ts": 1034,
     "src/app/(dashboard)/dashboard/providers/components/onboarding/ProviderOnboardingWizard.tsx": 906,
     "src/app/(dashboard)/dashboard/providers/page.tsx": 1927,
     "src/app/(dashboard)/dashboard/runtime/RuntimePageClient.tsx": 1201,
@@ -221,7 +221,7 @@
     "src/app/(dashboard)/dashboard/settings/components/SystemStorageTab.tsx": 1924,
     "src/app/(dashboard)/dashboard/usage/components/BudgetTab.tsx": 1016,
     "src/app/(dashboard)/dashboard/usage/components/EvalsTab.tsx": 2148,
-    "src/app/(dashboard)/dashboard/usage/components/ProviderLimits/index.tsx": 1121,
+    "src/app/(dashboard)/dashboard/usage/components/ProviderLimits/index.tsx": 1127,
     "src/app/api/oauth/[provider]/[action]/route.ts": 960,
     "src/app/api/providers/[id]/models/route.ts": 2593,
     "src/app/api/providers/[id]/test/route.ts": 940,
@@ -314,13 +314,13 @@
     "tests/unit/translator-helper-branches.test.ts": 870,
     "tests/unit/translator-openai-responses-req.test.ts": 1172,
     "tests/unit/translator-openai-to-gemini.test.ts": 1579,
-    "tests/unit/translator-openai-to-kiro.test.ts": 1093,
+    "tests/unit/translator-openai-to-kiro.test.ts": 1234,
     "tests/unit/translator-resp-gemini-to-openai.test.ts": 1234,
     "tests/unit/usage-service-hardening.test.ts": 1633,
     "tests/unit/vscode-token-routes.test.ts": 1212,
     "tests/unit/combo-config.test.ts": 881,
     "_rebaseline_2026_07_02_5928_base_red": "web-cookie-providers-new.test.ts 845->850: #5928 (test(security) Kimi Web URL host parse, CodeQL #689) grew the file +5 lines and merged into release/v3.8.44 WITHOUT rebaselining, leaving a fast-gates base-red that blocked every subsequent PR->release. Test growth is legitimate (a security regression test); maintainer absorbs the drift here. Frozen at 850.",
-    "tests/unit/web-cookie-providers-new.test.ts": 850,
+    "tests/unit/web-cookie-providers-new.test.ts": 890,
     "tests/unit/response-sanitizer.test.ts": 906
   },
   "_rebaseline_2026_06_09": "Re-baseline consciente pre-release v3.8.19: 9 arquivos cresceram durante o ciclo (features mergeadas: RequestLoggerV2 +281 request-logger rework, stream +101, combo +73, chatCore +45, catalog +32 fable-5/catalog-flag, callLogs +4, accountFallback +2, usageHistory novo 840) + core.ts +7 (fix resetAllDbModuleState, PR 3536). A catraca segue valendo destes valores — proximo crescimento falha. Decisao: encolher (esp. RequestLoggerV2/chatCore) e a issue #3501 ficam para o ciclo seguinte.",
@@ -371,5 +371,9 @@
   "_rebaseline_2026_06_22_phase4c_adaptive_context_budget": "Compression Phase 4 (C) adaptive context-budget wiring own growth: open-sse/services/compression/strategySelector.ts 818->848 (+30 at the existing selectCompressionPlan dispatch chokepoint). selectCompressionPlan gains an 8th optional `adaptiveOptions` param (modelContextLimit/requestMaxTokens/onAdaptive sink) and, after resolveBasePlan and before the caching-aware pass, runs the PURE resolveAdaptivePlan when config.contextBudget.mode is floor|replace-autotrigger; the new adaptiveEnabled(config) helper also gates the legacy shouldAutoTrigger branch inside resolveBasePlan off when adaptive owns automatic-by-size escalation (D-C4). The escalation ladder, target computation, and the resolver itself live in open-sse/services/compression/adaptiveCompression/{computeTarget,ladder,resolveAdaptivePlan,types}.ts (all <cap, fully unit-tested by Tasks 1-4). strategySelector.ts is cohesive dispatch wiring at the existing compression chokepoint, not extractable without hiding the dispatch boundary, mirroring the prior compression rebaselines (#4217/#4210/phase4b). Covered by tests/unit/compression/adaptive-select-plan-wiring.test.ts (4 tests) + adaptive-chatcore-source-guard.test.ts (2). chatCore.ts also grows ~30 lines at the same call site (threads getTokenLimit(provider,effectiveModel) + request max_tokens into adaptiveOptions and records the adaptive telemetry block onto compression.completed) but stays under its frozen cap. Structural shrink of this file tracked in #3501.",
   "_rebaseline_2026_06_25_rc17_pr_batch": "rc17 PR batch own growth (cohesive, not extractable): responseSanitizer.ts 1103->1122 (+19 = SanitizeOpenAIResponseOptions interface + stripReasoning option, #4678); tokenRefresh.ts 2070->2090 (+20 = codex 401 defense-in-depth unrecoverable-refresh guard, #4686); token-refresh-service.test.ts 1322->1353 (+31 = 401-unfamiliar-payload regression case, #4686); translator-openai-responses-req.test.ts 1047->1050 (+3 = reasoning_effort non-Copilot assertion update, #4688). All are the merged PRs own surgical additions at existing chokepoints.",
   "_rebaseline_2026_06_25_rc17b_leva2": "rc17 leva2 PR batch own growth (cohesive, not extractable): providerLimits.ts 950->955 (#4786 generalized accesstoken fallback); default.ts NEW frozen entry at 828 (#4729 anthropic-compatible Bearer + #4766 json_schema fallback + #4787 cline workos headers — three provider-specific header branches); openai-to-kiro.ts 807->814 (#4763 Claude-capability image gate); openai-responses.ts 923->937 (#4764 computeFinishReason guard); executor-default-base.test.ts 1339->1440 (#4766 json_schema fallback tests); translator-openai-to-kiro.test.ts 918->980 (#4763 non-Claude image gate tests).",
-  "_rebaseline_2026_06_27_v3838_filesize_drift": "Mid-cycle drift on release/v3.8.38 — feature/fix growth from already-merged PRs that the fast-path (PR->release skips check:file-size) let accumulate without a bump. src/shared/constants/sidebarVisibility.ts 1100->1198 (+98 = #3812 colored menu-icon support, per-item accent map across the sidebar entries; #5142 then dropped one orphan settings entry, net still above the frozen). src/sse/handlers/chat.ts 1560->1575 (+15 = #5064 self-inflicted-timeout cooldown skip + #5124 long OpenAI-compatible SSE hardening + #5110 embed-WS LIVE_WS_HOST honour / early empty-message reject). Localized feature/fix code next to existing branches, each covered by its own PR tests; not extractable without hiding the chokepoint. Structural shrink of chat.ts tracked in #3501."
+  "_rebaseline_2026_06_27_v3838_filesize_drift": "Mid-cycle drift on release/v3.8.38 — feature/fix growth from already-merged PRs that the fast-path (PR->release skips check:file-size) let accumulate without a bump. src/shared/constants/sidebarVisibility.ts 1100->1198 (+98 = #3812 colored menu-icon support, per-item accent map across the sidebar entries; #5142 then dropped one orphan settings entry, net still above the frozen). src/sse/handlers/chat.ts 1560->1575 (+15 = #5064 self-inflicted-timeout cooldown skip + #5124 long OpenAI-compatible SSE hardening + #5110 embed-WS LIVE_WS_HOST honour / early empty-message reject). Localized feature/fix code next to existing branches, each covered by its own PR tests; not extractable without hiding the chokepoint. Structural shrink of chat.ts tracked in #3501.",
+  "_rebaseline_2026_07_05_6211_providerlimits_fetch_timeout": "PR #6211 own growth: src/app/(dashboard)/dashboard/usage/components/ProviderLimits/index.tsx 1121->1127 (+6 = data-timeout guard for the quota page's two first-paint fetches — a PROVIDER_LIMITS_FETCH_TIMEOUT_MS const + fetchWithTimeout at the /api/providers/client and /api/usage/provider-limits call sites — so a never-settling connection can no longer wedge initialLoading on the skeleton, same infinite-skeleton class the PR also fixes on the providers page). Cohesive fix code at the existing fetch chokepoints (the 5-line rationale comment explains why a timeout/abort is needed where a try/catch only rescues a rejection); not extractable. Covered by tests/unit/providers-page-data-timeout.test.ts. Fast-path PR->release skips check:file-size, so this bump lands with the PR. Structural shrink of this file tracked in #3501.",
+  "_rebaseline_2026_07_05_6154_copilot_catalog_helpers": "PR #6154 own growth: src/app/(dashboard)/dashboard/providers/[id]/providerPageHelpers.ts 1021->1034 (+13 = GitHub Copilot catalog refresh — model-section helper wiring for the refreshed passthrough/compatible model lists). Cohesive UI-helper growth alongside the registry/modelSpecs catalog refresh; not extractable. Covered by the PR's provider-registry-github-copilot-* unit tests. Fast-path PR->release skips check:file-size, so this bump lands with the PR (contributor backryun).",
+  "_rebaseline_2026_07_05_6213_kiro_thinking_filesize": "PR #6213 own growth (kiro adaptive-thinking -> reasoning_content, +384): open-sse/translator/request/openai-to-kiro.ts 853->890 (+37 = additionalModelRequestFields builder for adaptive thinking: output_config.effort + thinking:{type:adaptive} + max_tokens, only when the request asked for thinking) and tests/unit/translator-openai-to-kiro.test.ts 1093->1234 (+141 = adaptive-thinking request/frame regression cases). The fast-path PR->release does NOT gate check:file-size on the merge, so this cohesive feature growth accumulated on the release tip (see the 2026-07-02 #5798 note for the same pattern). Superseded by the release captain's rebaseline-at-release.",
+  "_rebaseline_2026_07_05_6235_doubao_dola": "PR #6235 own growth: tests/unit/web-cookie-providers-new.test.ts 850->890 (+40 = doubao-web -> Dola global provider switch regression cases: new host/cookie-domain/token-source assertions for www.dola.com). Cohesive test growth alongside the provider switch; contributor backryun. Fast-path PR->release skips check:file-size, so this bump lands with the PR."
 }
diff --git a/config/quality/test-masking-allowlist.json b/config/quality/test-masking-allowlist.json
index 2529dd5267..d548c4a40c 100644
--- a/config/quality/test-masking-allowlist.json
+++ b/config/quality/test-masking-allowlist.json
@@ -21,6 +21,18 @@
     "open-sse/services/combo/__tests__/targetExhaustion.test.ts": {
       "replacement": "tests/unit/combo/combo-target-exhaustion.test.ts",
       "reason": "v3.8.44 #5976: os testes de exaustão eram flake-prone (delays Math.random, timeouts 30s, >3min no CI) e foram REESCRITOS como unit determinístico com MAIS cobertura (21 casos/52 asserts vs 13 casos/37 asserts). Documentado no commit 5fe225850. Revisão humana: apresentado ao operador no STOP #1 do release v3.8.44."
+    },
+    "src/shared/components/AutoRoutingBanner.test.tsx": {
+      "replacement": "tests/unit/home-no-autorouting-banner.test.ts",
+      "reason": "v3.8.45 #6164: fix(dashboard) remove the always-on Auto-Routing banner — o COMPONENTE foi deletado junto com o teste (feature removida pelo mantenedor, não mascaramento). O replacement guarda o novo contrato: a home NÃO renderiza o banner e o componente permanece deletado."
+    },
+    "tests/unit/free-provider-rankings-configured-filter.test.ts": {
+      "replacement": "tests/unit/freeProviderRankings-filters.test.ts",
+      "reason": "v3.8.45 #6251 supersede #6245: a página Free Provider Rankings migrou do toggle client-side 'Configured Only' (#6245, configuredProviderIds no cliente) para filtros server-side configuredOnly/availableOnly (#6251). O teste antigo pinava a implementação removida (7 asserts quebrados contra código que não existe); o replacement cobre o contrato novo com 11 casos (server-side, lib helper). Verificado legítimo — supersessão documentada no CHANGELOG do #6251."
     }
-  }
+  },
+  "tests/unit/catalog-updates-v3x.test.ts": "v3.8.45 #6248: fix(providers) remove deprecated MiMo V2 entries — os 5 asserts removidos pinavam specs de modelos mimo-v2-* que deixaram de existir no catálogo (54→49). Asserts seguem a remoção dos modelos, não enfraquecimento. Verificado legítimo. Prune após v3.8.45 mergear para main.",
+  "tests/unit/xiaomi-mimo-provider.test.ts": "v3.8.45 #6248: fix(providers) remove deprecated MiMo V2 entries — 2 asserts sobre mimo-v2-pro/omni/flash removidos junto com os modelos (21→19). Verificado legítimo, não mascaramento. Prune após v3.8.45 mergear para main.",
+  "tests/unit/provider-models-route.test.ts": "v3.8.45 #6170: fix(providers) correct Kiro model catalog to real upstream ids — 3 assert.ok positivos de ids fabricados (claude-opus-4.7/sonnet-4.6) substituídos por 1 assert positivo de conjunto + 1 assert NEGATIVO garantindo que os ids fabricados sumiram (310→309). Asserts migrados ao catálogo real, não enfraquecidos. Verificado legítimo. Prune após v3.8.45 mergear para main.",
+  "tests/unit/copilot-gemini-claude-route-no-responses.test.ts": "v3.8.45 #6154: fix(providers) refresh GitHub Copilot catalog — 2 asserts combinados (registry-exists + par claude/gemini) reescritos como loop per-model com assert.ok individual por id do catálogo novo (7→6). Asserts reestruturados ao catálogo atualizado, não enfraquecidos. Verificado legítimo. Prune após v3.8.45 mergear para main."
 }
diff --git a/docs/architecture/ARCHITECTURE.md b/docs/architecture/ARCHITECTURE.md
index e91387e535..0dc4bbfc4d 100644
--- a/docs/architecture/ARCHITECTURE.md
+++ b/docs/architecture/ARCHITECTURE.md
@@ -17,7 +17,7 @@ It provides a single OpenAI-compatible endpoint (`/v1/*`) and routes traffic acr
 
 Core capabilities:
 
-- OpenAI-compatible API surface for CLI/tools (237 providers, 68 executors)
+- OpenAI-compatible API surface for CLI/tools (237 providers, 73 executors)
 - Request/response translation across provider formats
 - Model combo fallback (multi-model sequence)
 - Structured combo steps (`provider + model + connection`) with runtime ordering by `compositeTiers`
diff --git a/docs/architecture/CODEBASE_DOCUMENTATION.md b/docs/architecture/CODEBASE_DOCUMENTATION.md
index 599c5dc58b..0bd52c6599 100644
--- a/docs/architecture/CODEBASE_DOCUMENTATION.md
+++ b/docs/architecture/CODEBASE_DOCUMENTATION.md
@@ -482,7 +482,7 @@ open-sse/
 
 ### 4.2 `open-sse/executors/`
 
-68 provider executors, each extending `BaseExecutor` (`base.ts`):
+73 provider executors, each extending `BaseExecutor` (`base.ts`):
 
 `antigravity`, `azure-openai`, `blackbox-web`, `chatgpt-web`, `cliproxyapi`,
 `cloudflare-ai`, `codex`, `commandCode`, `cursor`, `default`, `devin-cli`,
@@ -522,21 +522,21 @@ Hub-and-spoke translation (OpenAI is the hub).
 
 Highlights (full list under `open-sse/services/`):
 
-| Concern                   | Files                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Combo routing             | `combo.ts` (17 strategies), `comboConfig.ts`, `comboMetrics.ts`, `comboManifestMetrics.ts`, `comboAgentMiddleware.ts`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| Auto Combo engine         | `autoCombo/` — `engine.ts`, `scoring.ts`, `taskFitness.ts`, `virtualFactory.ts`, `modePacks.ts`, `autoPrefix.ts`, `persistence.ts`, `providerDiversity.ts`, `providerRegistryAccessor.ts`, `routerStrategy.ts`, `selfHealing.ts`, `index.ts`                                                                                                                                                                                                                                                                                                                                                                             |
-| Resilience                | `accountFallback.ts` (cooldown + lockout), `errorClassifier.ts`, `emergencyFallback.ts`, `rateLimitManager.ts`, `rateLimitSemaphore.ts`, `accountSemaphore.ts`, `accountSelector.ts`                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| Quotas                    | `quotaMonitor.ts`, `quotaPreflight.ts`, `bailianQuotaFetcher.ts`, `codexQuotaFetcher.ts`, `deepseekQuotaFetcher.ts`, `crofUsageFetcher.ts`, `antigravityCredits.ts`                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| Caching                   | `reasoningCache.ts`, `searchCache.ts`, `signatureCache.ts`, `requestDedup.ts`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| Routing intelligence      | `intentClassifier.ts`, `taskAwareRouter.ts`, `backgroundTaskDetector.ts`, `volumeDetector.ts`, `wildcardRouter.ts`, `workflowFSM.ts`, `specificityDetector.ts`, `specificityRules.ts`, `specificityTypes.ts`                                                                                                                                                                                                                                                                                                                                                                                                             |
-| Model handling            | `modelCapabilities.ts`, `modelDeprecation.ts`, `modelFamilyFallback.ts`, `modelStrip.ts`, `model.ts`, `provider.ts`, `providerRequestDefaults.ts`, `providerCostData.ts`, `payloadRules.ts`                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| Compression               | `compression/` — full compression engine wiring                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| Token + session           | `tokenRefresh.ts`, `sessionManager.ts`, `apiKeyRotator.ts`, `contextManager.ts`, `contextHandoff.ts`, `systemPrompt.ts`, `roleNormalizer.ts`, `responsesInputSanitizer.ts`, `toolSchemaSanitizer.ts`, `toolLimitDetector.ts`, `thinkingBudget.ts`                                                                                                                                                                                                                                                                                                                                                                        |
-| Tier / manifest           | `tierResolver.ts`, `tierConfig.ts`, `tierDefaults.json`, `tierTypes.ts`, `manifestAdapter.ts`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| IP / network              | `ipFilter.ts`, `webSearchFallback.ts`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| Batches                   | `batchProcessor.ts`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| Usage                     | `usage.ts`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| Concern              | Files                                                                                                                                                                                                                                             |
+| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Combo routing        | `combo.ts` (17 strategies), `comboConfig.ts`, `comboMetrics.ts`, `comboManifestMetrics.ts`, `comboAgentMiddleware.ts`                                                                                                                             |
+| Auto Combo engine    | `autoCombo/` — `engine.ts`, `scoring.ts`, `taskFitness.ts`, `virtualFactory.ts`, `modePacks.ts`, `autoPrefix.ts`, `persistence.ts`, `providerDiversity.ts`, `providerRegistryAccessor.ts`, `routerStrategy.ts`, `selfHealing.ts`, `index.ts`      |
+| Resilience           | `accountFallback.ts` (cooldown + lockout), `errorClassifier.ts`, `emergencyFallback.ts`, `rateLimitManager.ts`, `rateLimitSemaphore.ts`, `accountSemaphore.ts`, `accountSelector.ts`                                                              |
+| Quotas               | `quotaMonitor.ts`, `quotaPreflight.ts`, `bailianQuotaFetcher.ts`, `codexQuotaFetcher.ts`, `deepseekQuotaFetcher.ts`, `crofUsageFetcher.ts`, `antigravityCredits.ts`                                                                               |
+| Caching              | `reasoningCache.ts`, `searchCache.ts`, `signatureCache.ts`, `requestDedup.ts`                                                                                                                                                                     |
+| Routing intelligence | `intentClassifier.ts`, `taskAwareRouter.ts`, `backgroundTaskDetector.ts`, `volumeDetector.ts`, `wildcardRouter.ts`, `workflowFSM.ts`, `specificityDetector.ts`, `specificityRules.ts`, `specificityTypes.ts`                                      |
+| Model handling       | `modelCapabilities.ts`, `modelDeprecation.ts`, `modelFamilyFallback.ts`, `modelStrip.ts`, `model.ts`, `provider.ts`, `providerRequestDefaults.ts`, `providerCostData.ts`, `payloadRules.ts`                                                       |
+| Compression          | `compression/` — full compression engine wiring                                                                                                                                                                                                   |
+| Token + session      | `tokenRefresh.ts`, `sessionManager.ts`, `apiKeyRotator.ts`, `contextManager.ts`, `contextHandoff.ts`, `systemPrompt.ts`, `roleNormalizer.ts`, `responsesInputSanitizer.ts`, `toolSchemaSanitizer.ts`, `toolLimitDetector.ts`, `thinkingBudget.ts` |
+| Tier / manifest      | `tierResolver.ts`, `tierConfig.ts`, `tierDefaults.json`, `tierTypes.ts`, `manifestAdapter.ts`                                                                                                                                                     |
+| IP / network         | `ipFilter.ts`, `webSearchFallback.ts`                                                                                                                                                                                                             |
+| Batches              | `batchProcessor.ts`                                                                                                                                                                                                                               |
+| Usage                | `usage.ts`                                                                                                                                                                                                                                        |
 
 ### 4.6 `open-sse/mcp-server/`
 
diff --git a/docs/architecture/REPOSITORY_MAP.md b/docs/architecture/REPOSITORY_MAP.md
index 05b4488e14..2b1c5676d0 100644
--- a/docs/architecture/REPOSITORY_MAP.md
+++ b/docs/architecture/REPOSITORY_MAP.md
@@ -182,7 +182,7 @@ src/
 | `compliance/`                            | Audit log + provider audit — see `docs/security/COMPLIANCE.md`                                                                                                                                                                                                                                                          |
 | `compression/`                           | Compression engine glue (engines live in `open-sse/services/compression/`)                                                                                                                                                                                                                                              |
 | `config/`                                | Runtime config helpers                                                                                                                                                                                                                                                                                                  |
-| `db/`                                    | 45+ domain DB modules + 55 migrations (always go through here for SQLite)                                                                                                                                                                                                                                               |
+| `db/`                                    | 95+ domain DB modules + 110+ migrations (always go through here for SQLite)                                                                                                                                                                                                                                               |
 | `quota/`                                 | Quota Sharing Engine: `dimensions.ts` (types/Zod), `types.ts` (QuotaStore interface), `sqliteQuotaStore.ts`, `redisQuotaStore.ts`, `storeFactory.ts`, `fairShare.ts`, `burnRate.ts`, `planResolver.ts`, `planRegistry.ts`, `saturationSignals.ts`, `enforce.ts`, `spendRecorder.ts` — see `docs/routing/QUOTA_SHARE.md` |
 | `display/`                               | UI formatting helpers (cost, latency, etc.)                                                                                                                                                                                                                                                                             |
 | `embeddings/`                            | Embeddings service helpers                                                                                                                                                                                                                                                                                              |
diff --git a/docs/diagrams/db-schema-overview.mmd b/docs/diagrams/db-schema-overview.mmd
index debf71f3b1..b5554eccf8 100644
--- a/docs/diagrams/db-schema-overview.mmd
+++ b/docs/diagrams/db-schema-overview.mmd
@@ -1,5 +1,5 @@
 %% Database schema overview (selected core tables)
-%% Reflects: src/lib/db/* (45+ modules, 55 migrations)
+%% Reflects: src/lib/db/* (95+ modules, 110+ migrations)
 %% v3.8.0
 erDiagram
   api_keys ||--o{ api_key_usage : tracks
diff --git a/docs/i18n/ar/llm.txt b/docs/i18n/ar/llm.txt
index 4fa9b21284..775cd2b66e 100644
--- a/docs/i18n/ar/llm.txt
+++ b/docs/i18n/ar/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/az/llm.txt b/docs/i18n/az/llm.txt
index 3950dcb984..45c98fe7db 100644
--- a/docs/i18n/az/llm.txt
+++ b/docs/i18n/az/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/bg/llm.txt b/docs/i18n/bg/llm.txt
index 3950dcb984..45c98fe7db 100644
--- a/docs/i18n/bg/llm.txt
+++ b/docs/i18n/bg/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/bn/llm.txt b/docs/i18n/bn/llm.txt
index 40552a5a11..fdb0178a80 100644
--- a/docs/i18n/bn/llm.txt
+++ b/docs/i18n/bn/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/cs/llm.txt b/docs/i18n/cs/llm.txt
index ce6de2f065..baf7b823d8 100644
--- a/docs/i18n/cs/llm.txt
+++ b/docs/i18n/cs/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/da/llm.txt b/docs/i18n/da/llm.txt
index d9b36886d6..819865a7ed 100644
--- a/docs/i18n/da/llm.txt
+++ b/docs/i18n/da/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/de/llm.txt b/docs/i18n/de/llm.txt
index 80f08179c9..fd8b2bb12c 100644
--- a/docs/i18n/de/llm.txt
+++ b/docs/i18n/de/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/es/llm.txt b/docs/i18n/es/llm.txt
index a1cb33aff2..dc3ca451f0 100644
--- a/docs/i18n/es/llm.txt
+++ b/docs/i18n/es/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/fa/llm.txt b/docs/i18n/fa/llm.txt
index 6ba4136624..6848cd28f9 100644
--- a/docs/i18n/fa/llm.txt
+++ b/docs/i18n/fa/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/fi/llm.txt b/docs/i18n/fi/llm.txt
index 7c5e76fec8..96224f8a4d 100644
--- a/docs/i18n/fi/llm.txt
+++ b/docs/i18n/fi/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/fr/llm.txt b/docs/i18n/fr/llm.txt
index ead67c7773..7de5c69aac 100644
--- a/docs/i18n/fr/llm.txt
+++ b/docs/i18n/fr/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/gu/llm.txt b/docs/i18n/gu/llm.txt
index 65877bf751..3123e0b0aa 100644
--- a/docs/i18n/gu/llm.txt
+++ b/docs/i18n/gu/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/he/llm.txt b/docs/i18n/he/llm.txt
index 8f0e22ab34..f73b2bb1cc 100644
--- a/docs/i18n/he/llm.txt
+++ b/docs/i18n/he/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/hi/llm.txt b/docs/i18n/hi/llm.txt
index ac3b0774ea..64c9880884 100644
--- a/docs/i18n/hi/llm.txt
+++ b/docs/i18n/hi/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/hu/llm.txt b/docs/i18n/hu/llm.txt
index 2f6ad261a3..9f574945c0 100644
--- a/docs/i18n/hu/llm.txt
+++ b/docs/i18n/hu/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/id/llm.txt b/docs/i18n/id/llm.txt
index 4a31546f56..e05008dedb 100644
--- a/docs/i18n/id/llm.txt
+++ b/docs/i18n/id/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/in/llm.txt b/docs/i18n/in/llm.txt
index 6eee7c1d9a..6e91c869fd 100644
--- a/docs/i18n/in/llm.txt
+++ b/docs/i18n/in/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/it/llm.txt b/docs/i18n/it/llm.txt
index 5ab3252731..6db7b5f06a 100644
--- a/docs/i18n/it/llm.txt
+++ b/docs/i18n/it/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/ja/llm.txt b/docs/i18n/ja/llm.txt
index 6ce95eddb2..ab529087fe 100644
--- a/docs/i18n/ja/llm.txt
+++ b/docs/i18n/ja/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/ko/llm.txt b/docs/i18n/ko/llm.txt
index 8a8b338b57..8c0aeb75c6 100644
--- a/docs/i18n/ko/llm.txt
+++ b/docs/i18n/ko/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/mr/llm.txt b/docs/i18n/mr/llm.txt
index 7536b91276..cde497ddc3 100644
--- a/docs/i18n/mr/llm.txt
+++ b/docs/i18n/mr/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/ms/llm.txt b/docs/i18n/ms/llm.txt
index c33b36f427..daf937c1f3 100644
--- a/docs/i18n/ms/llm.txt
+++ b/docs/i18n/ms/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/nl/llm.txt b/docs/i18n/nl/llm.txt
index dcad1b15b1..38c2c89661 100644
--- a/docs/i18n/nl/llm.txt
+++ b/docs/i18n/nl/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/no/llm.txt b/docs/i18n/no/llm.txt
index 79b1d8c5dd..1d19c59c96 100644
--- a/docs/i18n/no/llm.txt
+++ b/docs/i18n/no/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/phi/llm.txt b/docs/i18n/phi/llm.txt
index dbb53b1aca..783034fdfb 100644
--- a/docs/i18n/phi/llm.txt
+++ b/docs/i18n/phi/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/pl/llm.txt b/docs/i18n/pl/llm.txt
index 5504d9e4d4..1072ad9f24 100644
--- a/docs/i18n/pl/llm.txt
+++ b/docs/i18n/pl/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/pt-BR/llm.txt b/docs/i18n/pt-BR/llm.txt
index bedcfae6e2..c117a31086 100644
--- a/docs/i18n/pt-BR/llm.txt
+++ b/docs/i18n/pt-BR/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/pt/llm.txt b/docs/i18n/pt/llm.txt
index c9cdf06e64..0624b72f3b 100644
--- a/docs/i18n/pt/llm.txt
+++ b/docs/i18n/pt/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/ro/llm.txt b/docs/i18n/ro/llm.txt
index d34991f191..2810dae83d 100644
--- a/docs/i18n/ro/llm.txt
+++ b/docs/i18n/ro/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/ru/llm.txt b/docs/i18n/ru/llm.txt
index 6065228f78..923ed9e785 100644
--- a/docs/i18n/ru/llm.txt
+++ b/docs/i18n/ru/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/sk/llm.txt b/docs/i18n/sk/llm.txt
index 35d7392e29..bf2646ae46 100644
--- a/docs/i18n/sk/llm.txt
+++ b/docs/i18n/sk/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/sv/llm.txt b/docs/i18n/sv/llm.txt
index 885a484dfd..9415c9010d 100644
--- a/docs/i18n/sv/llm.txt
+++ b/docs/i18n/sv/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/sw/llm.txt b/docs/i18n/sw/llm.txt
index 106571d579..f9ebdc2a3d 100644
--- a/docs/i18n/sw/llm.txt
+++ b/docs/i18n/sw/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/ta/llm.txt b/docs/i18n/ta/llm.txt
index ef2f4fc981..91f2022328 100644
--- a/docs/i18n/ta/llm.txt
+++ b/docs/i18n/ta/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/te/llm.txt b/docs/i18n/te/llm.txt
index 96d1bab868..1de33d1956 100644
--- a/docs/i18n/te/llm.txt
+++ b/docs/i18n/te/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/th/llm.txt b/docs/i18n/th/llm.txt
index 89e84411e9..cd0a37688c 100644
--- a/docs/i18n/th/llm.txt
+++ b/docs/i18n/th/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/tr/llm.txt b/docs/i18n/tr/llm.txt
index 32b0be9837..634d4bc259 100644
--- a/docs/i18n/tr/llm.txt
+++ b/docs/i18n/tr/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/uk-UA/llm.txt b/docs/i18n/uk-UA/llm.txt
index e21defcb6a..14cf3b6600 100644
--- a/docs/i18n/uk-UA/llm.txt
+++ b/docs/i18n/uk-UA/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/ur/llm.txt b/docs/i18n/ur/llm.txt
index cac8e8c752..c402cff2a1 100644
--- a/docs/i18n/ur/llm.txt
+++ b/docs/i18n/ur/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/vi/llm.txt b/docs/i18n/vi/llm.txt
index efe5b2c9cd..e21816296c 100644
--- a/docs/i18n/vi/llm.txt
+++ b/docs/i18n/vi/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/zh-CN/llm.txt b/docs/i18n/zh-CN/llm.txt
index 4d3f47bfef..090969a4f0 100644
--- a/docs/i18n/zh-CN/llm.txt
+++ b/docs/i18n/zh-CN/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/i18n/zh-TW/llm.txt b/docs/i18n/zh-TW/llm.txt
index ece4e5b336..891f389de1 100644
--- a/docs/i18n/zh-TW/llm.txt
+++ b/docs/i18n/zh-TW/llm.txt
@@ -18,7 +18,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -439,7 +439,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/docs/reference/ENVIRONMENT.md b/docs/reference/ENVIRONMENT.md
index efe32cff43..95bfa5bcf5 100644
--- a/docs/reference/ENVIRONMENT.md
+++ b/docs/reference/ENVIRONMENT.md
@@ -133,13 +133,14 @@ OmniRoute uses **SQLite** (via `better-sqlite3`) for all persistence. These vari
 | `OMNIROUTE_DISABLE_LIVE_WS`                 | `false`                         | `scripts/start-ws-server.mjs`                                            | CI/harness toggle that disables the standalone live WebSocket helper script.                                                                                   |
 | `RELAY_IP_PER_MINUTE`                       | `30`                            | `src/app/api/v1/relay/chat/completions/route.ts`                         | Per-(token, IP) relay rate limit, requests/minute. In-memory, per instance. `0` or negative disables the IP-dimension gate (per-token DB limit still applies). |
 | `NODE_ENV`                                  | `production`                    | Next.js core                                                             | Controls logging verbosity, caching, error detail exposure, and Next.js optimizations.                                                                         |
-| `OMNIROUTE_USE_TURBOPACK`                   | `1` (default in `.env.example`) | `package.json` / Next.js 16                                              | Toggles the Next.js 16 Turbopack bundler in `npm run dev` and `npm run build`. Set to `0` on Windows or when running into native binding incompatibilities.    |
+| `OMNIROUTE_USE_TURBOPACK`                   | `1` (Turbopack — code default)  | `package.json` / Next.js 16                                              | Turbopack is the default bundler for `npm run dev` and `npm run build` (2-3× faster builds, benchmarked). Set to `0` to fall back to webpack on Windows or when running into native binding / bundler-compat incompatibilities.    |
 | `OMNIROUTE_SKIP_DB_HEALTHCHECK`             | _(unset)_                       | `src/lib/db/core.ts` / `src/lib/db/healthCheck.ts`                       | Set to `1` to skip the SQLite integrity health check on startup. Useful for faster boot on large databases.                                                    |
 | `CREDENTIAL_HEALTH_CHECK_INTERVAL`          | `300000`                        | `open-sse/config/constants.ts` / `src/lib/credentialHealth/scheduler.ts` | Interval (ms) for the background credential health check scheduler. Minimum: 10000 (10s).                                                                      |
 | `CREDENTIAL_HEALTH_CACHE_TTL`               | `300000`                        | `open-sse/config/constants.ts` / `src/lib/credentialHealth/cache.ts`     | TTL (ms) for cached credential health status.                                                                                                                  |
 | `OMNIROUTE_DISABLE_CREDENTIAL_HEALTH_CHECK` | `false`                         | `src/lib/credentialHealth/scheduler.ts`                                  | Set to `1` or `true` to disable background periodic testing of provider connections.                                                                           |
 | `HOST`                                      | `0.0.0.0`                       | `scripts/dev/run-next.mjs`                                               | Bind address for the Next.js dev/start server. Overrides the default `0.0.0.0` when set.                                                                       |
-| `HOSTNAME`                                  | `127.0.0.1`                     | `scripts/dev/run-next-playwright.mjs`                                    | Bind address used by the Playwright runner when launching Next.js. Defaults to `127.0.0.1` for hermetic tests.                                                 |
+| `HOSTNAME`                                  | `127.0.0.1`                     | `scripts/dev/run-next-playwright.mjs`                                    | Bind address used by the Playwright runner when launching Next.js. Defaults to `127.0.0.1` for hermetic tests. **Do not use for `omniroute serve`** — use `OMNIROUTE_SERVER_HOST` instead (POSIX shells auto-set `HOSTNAME` to the machine name; `.env` cannot override it). |
+| `OMNIROUTE_SERVER_HOST`                     | `0.0.0.0`                       | `bin/cli/commands/serve.mjs`                                             | Bind address for `omniroute serve`. Avoids collision with the POSIX shell `HOSTNAME` variable (always set to the machine name by bash/zsh). Falls back to `0.0.0.0` when unset. (#6194) |
 
 ### Port Modes
 
@@ -835,6 +836,7 @@ Anthropic-compatible provider instead.
 | `PROXY_HEALTH_ENABLED`                          | `true`                  | `src/lib/proxyHealth/scheduler.ts`                                                      | Set `false` to disable the background proxy health scheduler that periodically probes registered proxies.                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
 | `PROXY_HEALTH_INTERVAL_MS`                      | `600000`                | `src/lib/proxyHealth/scheduler.ts`                                                      | Background health-scheduler sweep interval in ms (minimum `60000`).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
 | `PROXY_HEALTH_TEST_URL`                         | `https://httpbin.org/ip` | `src/lib/proxyHealth/scheduler.ts`                                                     | Reachability probe target used by the scheduler and the `/api/settings/proxies/auto-test` endpoint. Point it at an internal/self-hosted URL to avoid the public default.                                                                                                                                                                                                                                                                                                                                                                                                   |
+| `PROXY_HEALTH_AUTO_DEACTIVATE`                  | `false`                 | `src/lib/proxyHealth/statusPolicy.ts`                                                   | When `false` (default), automated reachability probes (the scheduler + the `/api/settings/proxies/auto-test` "Test All" button) are **read-only** and never write a proxy's status — only the operator sets active/inactive, so a flaky probe can't strand an assigned proxy (#6246). Set `true` to restore the legacy test-and-set behaviour.                                                                                                                                                                                                                              |
 | `PROXY_AUTO_REMOVE`                             | `false`                 | `src/lib/proxyHealth/scheduler.ts`                                                      | Set `true` to let the scheduler auto-remove proxies after repeated consecutive failures.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
 | `PROXY_AUTO_REMOVE_AFTER`                       | `3`                     | `src/lib/proxyHealth/scheduler.ts`                                                      | Consecutive failures before the scheduler auto-removes a proxy (when `PROXY_AUTO_REMOVE=true`).                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
 | `OMNIROUTE_CONTROL_PLANE_PROXY_DIRECT_FALLBACK` | `false`                 | `src/shared/constants/featureFlagDefinitions.ts`                                        | Allow OAuth and provider validation flows to bypass a pinned proxy and connect directly when proxy reachability pre-checks fail. Effective precedence is Feature Flags DB override > env var > default.                                                                                                                                                                                                                                                                                                                                                                   |
@@ -1007,6 +1009,7 @@ Provider quota endpoints, network tunnels (Tailscale, Ngrok, MITM debug proxy),
 | `MITM_DISABLE_TLS_VERIFY`                   | `0`                                                                         | `src/mitm/server.cjs`                                                     | Set `1` to disable upstream TLS verification (development only).                                                                                                                                                                                                                                                                                                      |
 | `MITM_IDLE_TIMEOUT_MS`                      | `60000`                                                                     | `src/mitm/socketTimeouts.ts`, `src/mitm/server.cjs`                       | Idle socket timeout (ms) for proxied connections; idle sockets past this are torn down to avoid leaking half-open tunnels.                                                                                                                                                                                                                                            |
 | `MITM_VERBOSE`                              | `1`                                                                         | `src/mitm/server.cjs`, `src/mitm/_internal/bypass.cjs`                    | Routing-decision log verbosity: `0` silences, higher values log more bypass/route decisions.                                                                                                                                                                                                                                                                          |
+| `OMNIROUTE_NO_SUDO`                         | `0`                                                                         | `src/mitm/systemCommands.ts`                                              | Set `1` (truthy) to strip the leading `sudo` from MITM cert-trust commands — for root-less / user-namespaced deployments where the operator trusts the CA manually (e.g. via Node's extra-CA-certs mechanism).                                                                                                                                                                  |
 | `ONEPROXY_ENABLED`                          | `true`                                                                      | `src/lib/oneproxySync.ts`                                                 | Enable the 1Proxy egress pool sync.                                                                                                                                                                                                                                                                                                                                   |
 | `ONEPROXY_API_URL`                          | `https://1proxy-api.aitradepulse.com`                                       | `src/lib/oneproxySync.ts`                                                 | 1Proxy service API URL override.                                                                                                                                                                                                                                                                                                                                      |
 | `ONEPROXY_MAX_PROXIES`                      | `500`                                                                       | `src/lib/oneproxySync.ts`                                                 | Maximum proxies imported per sync.                                                                                                                                                                                                                                                                                                                                    |
diff --git a/llm.txt b/llm.txt
index 8ba39f8e01..d2995c50a4 100644
--- a/llm.txt
+++ b/llm.txt
@@ -14,7 +14,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 - **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
 - **Framework:** Next.js 16 (App Router) with TypeScript 5.9
-- **Database:** SQLite via better-sqlite3 (local, zero-config, 55 migrations)
+- **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
 - **Auth:** OAuth 2.0 (PKCE) for providers, bcrypt for local user auth
@@ -102,7 +102,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (21 modules + migrations)
+│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -124,7 +124,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 16 SQL migration files
+│   │   │   └── migrations/       # 110+ versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -435,7 +435,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (45+ domain-specific files, 55 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
 6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
 
diff --git a/open-sse/config/audioRegistry.ts b/open-sse/config/audioRegistry.ts
index cbeaa789e5..144d0f563f 100644
--- a/open-sse/config/audioRegistry.ts
+++ b/open-sse/config/audioRegistry.ts
@@ -416,7 +416,6 @@ export const AUDIO_SPEECH_PROVIDERS: Record<string, AudioProvider> = {
       { id: "mimo-v2.5-tts", name: "MiMo V2.5 TTS" },
       { id: "mimo-v2.5-tts-voicedesign", name: "MiMo V2.5 Voice Design" },
       { id: "mimo-v2.5-tts-voiceclone", name: "MiMo V2.5 Voice Clone" },
-      { id: "mimo-v2-tts", name: "MiMo V2 TTS" },
     ],
   },
 };
@@ -512,10 +511,7 @@ export function parseSpeechModel(modelStr: string | null, dynamicProviders?: Aud
   return parseAudioModel(modelStr, AUDIO_SPEECH_PROVIDERS, dynamicProviders);
 }
 
-export function parseTranslationModel(
-  modelStr: string | null,
-  dynamicProviders?: AudioProvider[]
-) {
+export function parseTranslationModel(modelStr: string | null, dynamicProviders?: AudioProvider[]) {
   return parseAudioModel(modelStr, AUDIO_TRANSLATION_PROVIDERS, dynamicProviders);
 }
 
diff --git a/open-sse/config/freeModelCatalog.data.ts b/open-sse/config/freeModelCatalog.data.ts
index 7074fcb3dd..81cfb498a7 100644
--- a/open-sse/config/freeModelCatalog.data.ts
+++ b/open-sse/config/freeModelCatalog.data.ts
@@ -245,11 +245,7 @@ export const FREE_MODEL_BUDGETS: FreeModelBudget[] = [
   { provider: "kilo-gateway", modelId: "nvidia/nemotron-3-ultra-550b-a55b:free", displayName: "NVIDIA Nemotron 3 Ultra (free)", monthlyTokens: 0, creditTokens: 0, freeType: "recurring-uncapped", poolKey: "kilo-gateway-free", tos: "caution" },
   { provider: "kilo-gateway", modelId: "nvidia/nemotron-3-super-120b-a12b:free", displayName: "NVIDIA Nemotron 3 Super (free)", monthlyTokens: 0, creditTokens: 0, freeType: "recurring-uncapped", poolKey: "kilo-gateway-free", tos: "caution" },
   { provider: "kilo-gateway", modelId: "nex-agi/nex-n2-pro:free", displayName: "Nex-N2-Pro (free)", monthlyTokens: 0, creditTokens: 0, freeType: "recurring-uncapped", poolKey: "kilo-gateway-free", tos: "caution" },
-  { provider: "kiro", modelId: "auto-kiro", displayName: "Auto (Kiro picks best model)", monthlyTokens: 25000, creditTokens: 0, freeType: "recurring-monthly", poolKey: "kiro", tos: "avoid" },
-  { provider: "kiro", modelId: "claude-opus-4.8", displayName: "Claude Opus 4.8", monthlyTokens: 25000, creditTokens: 0, freeType: "recurring-monthly", poolKey: "kiro", tos: "avoid" },
-  { provider: "kiro", modelId: "claude-opus-4.7", displayName: "Claude Opus 4.7", monthlyTokens: 25000, creditTokens: 0, freeType: "recurring-monthly", poolKey: "kiro", tos: "avoid" },
-  { provider: "kiro", modelId: "claude-opus-4.6", displayName: "Claude Opus 4.6", monthlyTokens: 25000, creditTokens: 0, freeType: "recurring-monthly", poolKey: "kiro", tos: "avoid" },
-  { provider: "kiro", modelId: "claude-sonnet-4.6", displayName: "Claude Sonnet 4.6", monthlyTokens: 25000, creditTokens: 0, freeType: "recurring-monthly", poolKey: "kiro", tos: "avoid" },
+  { provider: "kiro", modelId: "claude-sonnet-4.5", displayName: "Claude Sonnet 4.5", monthlyTokens: 25000, creditTokens: 0, freeType: "recurring-monthly", poolKey: "kiro", tos: "avoid" },
   { provider: "kiro", modelId: "claude-haiku-4.5", displayName: "Claude Haiku 4.5", monthlyTokens: 25000, creditTokens: 0, freeType: "recurring-monthly", poolKey: "kiro", tos: "avoid" },
   { provider: "kiro", modelId: "deepseek-3.2", displayName: "DeepSeek V3.2", monthlyTokens: 25000, creditTokens: 0, freeType: "recurring-monthly", poolKey: "kiro", tos: "avoid" },
   { provider: "kiro", modelId: "minimax-m2.5", displayName: "MiniMax M2.5", monthlyTokens: 25000, creditTokens: 0, freeType: "recurring-monthly", poolKey: "kiro", tos: "avoid" },
diff --git a/open-sse/config/providers/index.ts b/open-sse/config/providers/index.ts
index aa733053e6..7627f79958 100644
--- a/open-sse/config/providers/index.ts
+++ b/open-sse/config/providers/index.ts
@@ -134,6 +134,7 @@ import { agentrouterProvider } from "./registry/agentrouter/index.ts";
 import { zaiProvider } from "./registry/zai/index.ts";
 import { waferProvider } from "./registry/wafer/index.ts";
 import { huggingchatProvider } from "./registry/huggingchat/index.ts";
+import { yuanbao_webProvider } from "./registry/yuanbao-web/index.ts";
 import { galadrielProvider } from "./registry/galadriel/index.ts";
 import { qianfanProvider } from "./registry/qianfan/index.ts";
 import { meta_llamaProvider } from "./registry/meta-llama/index.ts";
@@ -181,6 +182,7 @@ import { zenmux_freeProvider } from "./registry/zenmux-free/index.ts";
 import { sumopodProvider } from "./registry/sumopod/index.ts";
 import { x5labProvider } from "./registry/x5lab/index.ts";
 import { kenariProvider } from "./registry/kenari/index.ts";
+import { requestyProvider } from "./registry/requesty/index.ts";
 
 export const REGISTRY: Record<string, RegistryEntry> = {
   aimlapi: aimlapiProvider,
@@ -314,6 +316,7 @@ export const REGISTRY: Record<string, RegistryEntry> = {
   agentrouter: agentrouterProvider,
   zai: zaiProvider,
   huggingchat: huggingchatProvider,
+  "yuanbao-web": yuanbao_webProvider,
   galadriel: galadrielProvider,
   qianfan: qianfanProvider,
   "meta-llama": meta_llamaProvider,
@@ -364,4 +367,5 @@ export const REGISTRY: Record<string, RegistryEntry> = {
   sumopod: sumopodProvider,
   x5lab: x5labProvider,
   kenari: kenariProvider,
+  requesty: requestyProvider,
 };
diff --git a/open-sse/config/providers/registry/agentrouter/index.ts b/open-sse/config/providers/registry/agentrouter/index.ts
index a4156d76ca..ebe9d4598f 100644
--- a/open-sse/config/providers/registry/agentrouter/index.ts
+++ b/open-sse/config/providers/registry/agentrouter/index.ts
@@ -1,14 +1,4 @@
 import type { RegistryEntry } from "../../shared.ts";
-import {
-  getClaudeCliHeaders,
-  mapStainlessOs,
-  mapStainlessArch,
-  ANTHROPIC_BETA_CLAUDE_OAUTH,
-  ANTHROPIC_VERSION_HEADER,
-  CLAUDE_CLI_STAINLESS_PACKAGE_VERSION,
-  CLAUDE_CLI_STAINLESS_RUNTIME_VERSION,
-  CLAUDE_CLI_USER_AGENT,
-} from "../../shared.ts";
 
 export const agentrouterProvider: RegistryEntry = {
   id: "agentrouter",
@@ -19,7 +9,11 @@ export const agentrouterProvider: RegistryEntry = {
   authType: "apikey",
   authHeader: "x-api-key",
   defaultContextLength: 128000,
-  headers: getClaudeCliHeaders(),
+  // No static `headers` here: agentrouter now adopts the DYNAMIC Claude-Code
+  // wire image via CC_WIRE_IMAGE_BUILTINS (#6056) — the fingerprint/headers are
+  // applied by buildProviderHeaders + applyFingerprint, keeping this entry's
+  // own baseUrl + x-api-key auth. A static fingerprint here would drift and
+  // trip AgentRouter's WAF ("unauthorized client detected").
   models: [
     { id: "claude-opus-4-6", name: "Claude 4.6 Opus" },
     { id: "claude-haiku-4-5-20251001", name: "Claude 4.5 Haiku" },
diff --git a/open-sse/config/providers/registry/claude/web/index.ts b/open-sse/config/providers/registry/claude/web/index.ts
index ae5612822e..952b4f39fe 100644
--- a/open-sse/config/providers/registry/claude/web/index.ts
+++ b/open-sse/config/providers/registry/claude/web/index.ts
@@ -9,6 +9,7 @@ export const claude_webProvider: RegistryEntry = {
   authType: "apikey",
   authHeader: "cookie",
   models: [
+    { id: "claude-sonnet-5", name: "Claude 5 Sonnet (web)" },
     { id: "claude-sonnet-4-6", name: "Claude 4.6 Sonnet (web)" },
     { id: "claude-haiku-4-5", name: "Claude 4.5 Haiku (web)" },
   ],
diff --git a/open-sse/config/providers/registry/cline/index.ts b/open-sse/config/providers/registry/cline/index.ts
index d1467fdd9f..4913465d19 100644
--- a/open-sse/config/providers/registry/cline/index.ts
+++ b/open-sse/config/providers/registry/cline/index.ts
@@ -5,6 +5,11 @@ export const clineProvider: RegistryEntry = {
   alias: "cl",
   format: "openai",
   executor: "openai",
+  // Cline's API only implements streaming (streamText). A non-streaming request
+  // returns "generateText is not implemented" / an empty body, so force upstream
+  // streaming and let chatCore convert the SSE back to JSON for stream:false
+  // clients (e.g. the model-test button, non-streaming API callers).
+  forceStream: true,
   baseUrl: "https://api.cline.bot/api/v1/chat/completions",
   authType: "oauth",
   authHeader: "Authorization",
diff --git a/open-sse/config/providers/registry/clinepass/index.ts b/open-sse/config/providers/registry/clinepass/index.ts
index 3ea7dbcb3a..e6d3697a03 100644
--- a/open-sse/config/providers/registry/clinepass/index.ts
+++ b/open-sse/config/providers/registry/clinepass/index.ts
@@ -9,6 +9,11 @@ export const clinepassProvider: RegistryEntry = {
   alias: "clinepass",
   format: "openai",
   executor: "default",
+  // ClinePass shares Cline's streaming-only API — a non-streaming request returns
+  // "generateText is not implemented" / an empty body. Force upstream streaming;
+  // chatCore accumulates the SSE and converts it back to JSON for stream:false
+  // clients. (Same as the sibling `cline` provider.)
+  forceStream: true,
   baseUrl: "https://api.cline.bot/api/v1/chat/completions",
   authType: "apikey",
   authHeader: "bearer",
diff --git a/open-sse/config/providers/registry/codex/index.ts b/open-sse/config/providers/registry/codex/index.ts
index 2418a2bfb6..d739e09829 100644
--- a/open-sse/config/providers/registry/codex/index.ts
+++ b/open-sse/config/providers/registry/codex/index.ts
@@ -28,11 +28,17 @@ export const codexProvider: RegistryEntry = {
     // 1.05M). Public refs : openai/codex#19208, #19319, #19464 ;
     // opencode#24171. max_output_tokens is stripped server-side
     // (litellm#21193, codex#4138) so 128K is informational only.
+    // The usable INPUT budget is smaller than the 400K window (part is
+    // reserved for output), so max_input_tokens must be distinct from
+    // context_length or coding agents never auto-compact (#6191). OpenAI's
+    // own live catalog reports ~272K for gpt-5.5 in Codex.
     {
       id: "gpt-5.5",
       name: "GPT 5.5",
       ...GPT_5_5_CODEX_CAPABILITIES,
       contextLength: 400000,
+      // #6191: input cap per reporter; TODO confirm exact value
+      maxInputTokens: 272000,
       maxOutputTokens: 128000,
     },
     {
@@ -40,6 +46,8 @@ export const codexProvider: RegistryEntry = {
       name: "GPT 5.5 (xHigh)",
       ...GPT_5_5_CODEX_CAPABILITIES,
       contextLength: 400000,
+      // #6191: input cap per reporter; TODO confirm exact value
+      maxInputTokens: 272000,
       maxOutputTokens: 128000,
     },
     {
@@ -47,6 +55,8 @@ export const codexProvider: RegistryEntry = {
       name: "GPT 5.5 (High)",
       ...GPT_5_5_CODEX_CAPABILITIES,
       contextLength: 400000,
+      // #6191: input cap per reporter; TODO confirm exact value
+      maxInputTokens: 272000,
       maxOutputTokens: 128000,
     },
     {
@@ -54,6 +64,8 @@ export const codexProvider: RegistryEntry = {
       name: "GPT 5.5 (Medium)",
       ...GPT_5_5_CODEX_CAPABILITIES,
       contextLength: 400000,
+      // #6191: input cap per reporter; TODO confirm exact value
+      maxInputTokens: 272000,
       maxOutputTokens: 128000,
     },
     {
@@ -61,6 +73,8 @@ export const codexProvider: RegistryEntry = {
       name: "GPT 5.5 (Low)",
       ...GPT_5_5_CODEX_CAPABILITIES,
       contextLength: 400000,
+      // #6191: input cap per reporter; TODO confirm exact value
+      maxInputTokens: 272000,
       maxOutputTokens: 128000,
     },
     {
diff --git a/open-sse/config/providers/registry/doubao/web/index.ts b/open-sse/config/providers/registry/doubao/web/index.ts
index a51aaaaa4d..025d4b7e82 100644
--- a/open-sse/config/providers/registry/doubao/web/index.ts
+++ b/open-sse/config/providers/registry/doubao/web/index.ts
@@ -5,11 +5,11 @@ export const doubao_webProvider: RegistryEntry = {
   alias: "db",
   format: "openai",
   executor: "doubao-web",
-  baseUrl: "https://www.doubao.com/api/chat",
+  baseUrl: "https://www.dola.com/chat/completion",
   authType: "apikey",
   authHeader: "cookie",
   models: [
-    { id: "doubao-default", name: "Doubao Default" },
-    { id: "doubao-pro", name: "Doubao Pro" },
+    { id: "dola-speed", name: "Dola Speed" },
+    { id: "dola-pro", name: "Dola Pro" },
   ],
 };
diff --git a/open-sse/config/providers/registry/github/index.ts b/open-sse/config/providers/registry/github/index.ts
index f8c25d05a1..41673dcf7d 100644
--- a/open-sse/config/providers/registry/github/index.ts
+++ b/open-sse/config/providers/registry/github/index.ts
@@ -25,69 +25,137 @@ export const githubProvider: RegistryEntry = {
   defaultContextLength: 128000,
   headers: getGitHubCopilotChatHeaders(),
   models: [
-    // Copilot still serves the original GPT-4 via chat/completions; keep it
-    // alongside GPT-4o and the GPT-5.x family so apps that hard-code `gpt-4` resolve here.
-    { id: "gpt-4", name: "GPT-4", contextLength: 128000 },
-    // 9router#98 — Copilot still serves GPT-4o via chat/completions; keep it
-    // alongside the GPT-5.x family so apps that hard-code `gpt-4o` resolve here.
-    { id: "gpt-4o", name: "GPT-4o", contextLength: 128000 },
-    // Copilot also serves the cheaper GPT-4o mini via chat/completions; keep it
-    // alongside gpt-4o so apps that hard-code `gpt-4o-mini` resolve to the Copilot
-    // (`gh`) provider rather than only the github-models (`ghm`) marketplace entry.
-    { id: "gpt-4o-mini", name: "GPT-4o mini", contextLength: 128000 },
-    { id: "gpt-5-mini", name: "GPT-5 Mini", targetFormat: "openai-responses" },
-    { id: "gpt-5.3-codex", name: "GPT-5.3 Codex", targetFormat: "openai-responses" },
-    { id: "gpt-5.4-mini", name: "GPT-5.4 Mini", targetFormat: "openai-responses" },
     {
-      id: "gpt-5.4",
-      name: "GPT-5.4",
-      targetFormat: "openai-responses",
-      supportsXHighEffort: true,
+      id: "claude-fable-5",
+      name: "Claude Fable 5",
+      contextLength: 1000000,
+      maxOutputTokens: 64000,
     },
-    { id: "gpt-5.5", name: "GPT-5.5", ...GPT_5_5_CODEX_CAPABILITIES },
     {
-      id: "claude-haiku-4.5",
-      name: "Claude Haiku 4.5",
+      id: "claude-opus-4.8-fast",
+      name: "Claude Opus 4.8 (fast mode)",
+      contextLength: 1000000,
+      maxOutputTokens: 64000,
+      unsupportedParams: ["temperature", "top_p", "top_k"],
+    },
+    {
+      id: "claude-opus-4.8",
+      name: "Claude Opus 4.8",
+      contextLength: 1000000,
+      maxOutputTokens: 64000,
+      unsupportedParams: ["temperature", "top_p", "top_k"],
+    },
+    {
+      id: "claude-opus-4.7",
+      name: "Claude Opus 4.7",
+      contextLength: 1000000,
+      maxOutputTokens: 64000,
+    },
+    {
+      id: "claude-sonnet-4.6",
+      name: "Claude Sonnet 4.6",
+      contextLength: 1000000,
+      maxOutputTokens: 64000,
+    },
+    {
+      id: "claude-opus-4.5",
+      name: "Claude Opus 4.5",
       contextLength: 200000,
+      maxOutputTokens: 32000,
+    },
+    {
+      id: "claude-sonnet-5",
+      name: "Claude Sonnet 5",
+      contextLength: 1000000,
       maxOutputTokens: 64000,
     },
     {
       id: "claude-sonnet-4.5",
       name: "Claude Sonnet 4.5",
       contextLength: 200000,
-      maxOutputTokens: 64000,
+      maxOutputTokens: 32000,
     },
     {
-      id: "claude-sonnet-4.6",
-      name: "Claude Sonnet 4.6",
+      id: "claude-haiku-4.5",
+      name: "Claude Haiku 4.5",
       contextLength: 200000,
-      maxOutputTokens: 64000,
-    },
-    {
-      // #2911: GitHub Copilot's Responses API does not serve Claude/Gemini —
-      // route them via chat/completions (provider default) like claude-opus-4.6.
-      id: "claude-opus-4-5-20251101",
-      name: "Claude Opus 4.5 (Full ID)",
-      contextLength: 200000,
-      maxOutputTokens: 64000,
-    },
-    {
-      id: "claude-opus-4.6",
-      name: "Claude Opus 4.6",
-      contextLength: 1000000,
-      maxOutputTokens: 128000,
-    },
-    {
-      // #2911: Claude on Copilot must use chat/completions, not the Responses API.
-      id: "claude-opus-4.7",
-      name: "Claude Opus 4.7",
-      contextLength: 1000000,
-      maxOutputTokens: 128000,
+      maxOutputTokens: 32000,
     },
     // #2911: Gemini on Copilot must use chat/completions, not the Responses API.
-    { id: "gemini-3.1-pro-preview", name: "Gemini 3.1 Pro" },
-    { id: "gemini-3-flash-preview", name: "Gemini 3 Flash" },
-    { id: "oswe-vscode-prime", name: "Raptor Mini", targetFormat: "openai-responses" },
-    //{ id: "?", name: "Goldeneye" },
+    {
+      id: "gemini-3.1-pro-preview",
+      name: "Gemini 3.1 Pro",
+      contextLength: 1000000,
+      maxOutputTokens: 64000,
+    },
+    {
+      id: "gemini-3.5-flash",
+      name: "Gemini 3.5 Flash",
+      contextLength: 1000000,
+      maxOutputTokens: 64000,
+    },
+    { id: "gpt-5.5", name: "GPT-5.5", ...GPT_5_5_CODEX_CAPABILITIES, maxOutputTokens: 128000 },
+    {
+      id: "gpt-5.4",
+      name: "GPT-5.4",
+      targetFormat: "openai-responses",
+      supportsXHighEffort: true,
+      contextLength: 1050000,
+      maxOutputTokens: 128000,
+    },
+    {
+      id: "gpt-5.4-mini",
+      name: "GPT-5.4 mini",
+      targetFormat: "openai-responses",
+      contextLength: 400000,
+      maxOutputTokens: 128000,
+    },
+    {
+      id: "gpt-5.3-codex",
+      name: "GPT-5.3-Codex",
+      targetFormat: "openai-responses",
+      contextLength: 400000,
+      maxOutputTokens: 128000,
+    },
+    {
+      id: "gpt-5-mini",
+      name: "GPT-5 mini",
+      targetFormat: "openai-responses",
+      contextLength: 264000,
+      maxOutputTokens: 64000,
+    },
+    {
+      id: "gpt-4o-2024-11-20",
+      name: "GPT-4o",
+      contextLength: 128000,
+      maxOutputTokens: 16384,
+    },
+    { id: "gpt-4o-mini", name: "GPT-4o mini", contextLength: 128000, maxOutputTokens: 4096 },
+    {
+      id: "gpt-4-0125-preview",
+      name: "GPT 4 Turbo",
+      contextLength: 128000,
+      maxOutputTokens: 4096,
+    },
+    {
+      id: "kimi-k2.7-code",
+      name: "Kimi K2.7 Code",
+      contextLength: 256000,
+      maxOutputTokens: 32000,
+    },
+    {
+      id: "mai-code-1-flash",
+      name: "MAI-Code-1-Flash",
+      targetFormat: "openai-responses",
+      contextLength: 256000,
+      maxOutputTokens: 128000,
+    },
+    {
+      id: "oswe-vscode-prime",
+      name: "Raptor mini",
+      targetFormat: "openai-responses",
+      contextLength: 264000,
+      maxOutputTokens: 64000,
+    },
   ],
 };
diff --git a/open-sse/config/providers/registry/kiro/index.ts b/open-sse/config/providers/registry/kiro/index.ts
index 6c4d41cf6e..71262a4f09 100644
--- a/open-sse/config/providers/registry/kiro/index.ts
+++ b/open-sse/config/providers/registry/kiro/index.ts
@@ -15,32 +15,14 @@ export const kiroProvider: RegistryEntry = {
     tokenUrl: "https://prod.us-east-1.auth.desktop.kiro.dev/refreshToken",
     authUrl: "https://prod.us-east-1.auth.desktop.kiro.dev",
   },
+  // Model IDs must match Kiro's real upstream catalog exactly — an unknown id
+  // makes Kiro return `400 "Invalid model. Please select a different model"`.
+  // Fabricated ids (auto-kiro, claude-opus-4.x, claude-fable-5, claude-sonnet-4.6)
+  // were removed after live VPS validation: Kiro offers no Opus/Fable, its Sonnet
+  // is 4.5 (not 4.6), and there is no "auto" model id (it was sent verbatim and
+  // 400'd). claude-sonnet-5 is a real Kiro model but plan-gated per account —
+  // kept so entitled accounts can use it. See kiro cluster #6112/#6113/#6099.
   models: [
-    { id: "auto-kiro", name: "Auto (Kiro picks best model)" },
-    {
-      id: "claude-fable-5",
-      name: "Claude Fable 5",
-      contextLength: 1000000,
-      maxOutputTokens: 128000,
-    },
-    {
-      id: "claude-opus-4.8",
-      name: "Claude Opus 4.8",
-      contextLength: 1000000,
-      maxOutputTokens: 128000,
-    },
-    {
-      id: "claude-opus-4.7",
-      name: "Claude Opus 4.7",
-      contextLength: 1000000,
-      maxOutputTokens: 128000,
-    },
-    {
-      id: "claude-opus-4.6",
-      name: "Claude Opus 4.6",
-      contextLength: 1000000,
-      maxOutputTokens: 128000,
-    },
     {
       id: "claude-sonnet-5",
       name: "Claude Sonnet 5",
@@ -48,8 +30,8 @@ export const kiroProvider: RegistryEntry = {
       maxOutputTokens: 128000,
     },
     {
-      id: "claude-sonnet-4.6",
-      name: "Claude Sonnet 4.6",
+      id: "claude-sonnet-4.5",
+      name: "Claude Sonnet 4.5",
       contextLength: 200000,
       maxOutputTokens: 64000,
     },
diff --git a/open-sse/config/providers/registry/nvidia/index.ts b/open-sse/config/providers/registry/nvidia/index.ts
index 152c3279bf..c42f8da703 100644
--- a/open-sse/config/providers/registry/nvidia/index.ts
+++ b/open-sse/config/providers/registry/nvidia/index.ts
@@ -9,10 +9,12 @@ export const nvidiaProvider: RegistryEntry = {
   authType: "apikey",
   authHeader: "bearer",
   models: [
-    { id: "z-ai/glm-5.1", name: "GLM 5.1" },
-    // #3329: minimaxai/minimax-m3 removed — NVIDIA NIM does not host it yet
-    // (every request 404s), while minimax-m2.7 on the same provider works.
-    // Re-add only once NVIDIA actually serves it.
+    // #6108: z-ai/glm-5.1 EOL'd 2026-07-02 (direct probe returns 410) — dropped.
+    { id: "z-ai/glm-5.2", name: "GLM 5.2" },
+    // #3329/#6108: minimaxai/minimax-m3 stays excluded from the nvidia tier — it
+    // still 404s here for most callers; the single 200 probe in #6108 was not
+    // reproducible enough to override the #3329 guard. Re-add only once NVIDIA
+    // reliably serves it (and flip nvidia-minimax-m3-removed-3329.test.ts then).
     { id: "minimaxai/minimax-m2.7", name: "MiniMax M2.7" },
     { id: "google/gemma-4-31b-it", name: "Gemma 4 31B" },
     { id: "mistralai/mistral-small-4-119b-2603", name: "Mistral Small 4 2603" },
@@ -25,11 +27,10 @@ export const nvidiaProvider: RegistryEntry = {
     { id: "deepseek-ai/deepseek-v4-pro", name: "DeepSeek V4 Pro", supportsReasoning: true },
     { id: "deepseek-ai/deepseek-v4-flash", name: "DeepSeek V4 Flash", supportsReasoning: true },
     // Sweep 2026-06-19: verified present in the live NVIDIA NIM /v1/models catalog.
-    // minimaxai/minimax-m3 is now listed too, but left out per #3329 until inference
-    // (not just listing) is confirmed — re-add when a real request stops 404ing.
     { id: "moonshotai/kimi-k2.6", name: "Kimi K2.6" },
     { id: "openai/gpt-oss-120b", name: "GPT OSS 120B", toolCalling: false },
     { id: "openai/gpt-oss-20b", name: "GPT OSS 20B", toolCalling: false },
     { id: "nvidia/nemotron-3-super-120b-a12b", name: "Nemotron 3 Super 120B A12B" },
+    { id: "nvidia/nemotron-3-ultra-550b-a55b", name: "Nemotron 3 Ultra 550B" },
   ],
 };
diff --git a/open-sse/config/providers/registry/opencode/go/index.ts b/open-sse/config/providers/registry/opencode/go/index.ts
index b1c0b4f12e..c8e575b185 100644
--- a/open-sse/config/providers/registry/opencode/go/index.ts
+++ b/open-sse/config/providers/registry/opencode/go/index.ts
@@ -25,8 +25,6 @@ export const opencode_goProvider: RegistryEntry = {
     { id: "kimi-k2.5", name: "Kimi K2.5" },
     { id: "mimo-v2.5-pro", name: "MiMo-V2.5-Pro" },
     { id: "mimo-v2.5", name: "MiMo-V2.5" },
-    { id: "mimo-v2-pro", name: "MiMo-V2-Pro" },
-    { id: "mimo-v2-omni", name: "MiMo-V2-Omni" },
     // #3110: MiniMax M3 via OpenCode Go tier
     {
       id: "minimax-m3",
diff --git a/open-sse/config/providers/registry/requesty/index.ts b/open-sse/config/providers/registry/requesty/index.ts
new file mode 100644
index 0000000000..6fc063bce2
--- /dev/null
+++ b/open-sse/config/providers/registry/requesty/index.ts
@@ -0,0 +1,11 @@
+import type { RegistryEntry } from "../../shared.ts";
+import { buildOpenAiCompatibleRegistryEntry } from "../../shared.ts";
+
+export const requestyProvider: RegistryEntry = buildOpenAiCompatibleRegistryEntry({
+  id: "requesty",
+  alias: "requesty",
+  baseUrl: "https://router.requesty.ai/v1/chat/completions",
+  modelsUrl: "https://router.requesty.ai/v1/models",
+  models: [],
+  passthroughModels: true,
+});
diff --git a/open-sse/config/providers/registry/yuanbao-web/index.ts b/open-sse/config/providers/registry/yuanbao-web/index.ts
new file mode 100644
index 0000000000..c3dc4b1565
--- /dev/null
+++ b/open-sse/config/providers/registry/yuanbao-web/index.ts
@@ -0,0 +1,37 @@
+import type { RegistryEntry } from "../../shared.ts";
+
+export const yuanbao_webProvider: RegistryEntry = {
+  id: "yuanbao-web",
+  alias: "ybw",
+  format: "openai",
+  executor: "yuanbao-web",
+  baseUrl: "https://yuanbao.tencent.com/api/chat",
+  authType: "apikey",
+  authHeader: "cookie",
+  models: [
+    { id: "deepseek-v3", name: "DeepSeek V3 (via Yuanbao)", toolCalling: false },
+    {
+      id: "deepseek-r1",
+      name: "DeepSeek R1 (via Yuanbao)",
+      supportsReasoning: true,
+    },
+    { id: "hunyuan", name: "Hunyuan (via Yuanbao)" },
+    {
+      id: "hunyuan-t1",
+      name: "Hunyuan T1 (via Yuanbao)",
+      supportsReasoning: true,
+    },
+    { id: "deepseek-v3-search", name: "DeepSeek V3 + Web Search (via Yuanbao)" },
+    {
+      id: "deepseek-r1-search",
+      name: "DeepSeek R1 + Web Search (via Yuanbao)",
+      supportsReasoning: true,
+    },
+    { id: "hunyuan-search", name: "Hunyuan + Web Search (via Yuanbao)" },
+    {
+      id: "hunyuan-t1-search",
+      name: "Hunyuan T1 + Web Search (via Yuanbao)",
+      supportsReasoning: true,
+    },
+  ],
+};
diff --git a/open-sse/config/providers/registry/zenmux-free/index.ts b/open-sse/config/providers/registry/zenmux-free/index.ts
index 126e2bf203..21ff0139bd 100644
--- a/open-sse/config/providers/registry/zenmux-free/index.ts
+++ b/open-sse/config/providers/registry/zenmux-free/index.ts
@@ -9,7 +9,7 @@ import type { RegistryEntry } from "../../shared.ts";
  * for all API requests as a query parameter.
  *
  * Models available on the free tier (5 Flows/5h, 38.64 Flows/week):
- * DeepSeek V3.2, GLM 4.7 Flash Free, MiMo V2 Flash Free, and others.
+ * DeepSeek V3.2, GLM 4.7 Flash Free, and others.
  *
  * Short alias "zmf" is distinct from the paid "zenmux" (alias "zm") which
  * uses API-key auth against the OpenAI-compatible endpoint.
@@ -27,7 +27,6 @@ export const zenmux_freeProvider: RegistryEntry = {
     { id: "deepseek/deepseek-reasoner", name: "DeepSeek V3.2 (Thinking)", supportsReasoning: true },
     { id: "deepseek/deepseek-v4-pro", name: "DeepSeek V4 Pro", supportsReasoning: true },
     { id: "kuaishou/kat-coder-pro-v1-free", name: "KAT Coder Pro V1 Free" },
-    { id: "xiaomi/mimo-v2-flash-free", name: "MiMo V2 Flash Free" },
     { id: "z-ai/glm-4.7-flash-free", name: "GLM 4.7 Flash Free" },
     { id: "stepfun/step-3.5-flash-free", name: "Step 3.5 Flash Free" },
     { id: "inclusionai/ling-1t", name: "Ling 1T" },
diff --git a/open-sse/config/providers/shared.ts b/open-sse/config/providers/shared.ts
index ecc4fd088d..4059673697 100644
--- a/open-sse/config/providers/shared.ts
+++ b/open-sse/config/providers/shared.ts
@@ -56,6 +56,13 @@ export interface RegistryModel {
   unsupportedParams?: readonly string[];
   /** Maximum context window in tokens */
   contextLength?: number;
+  /**
+   * Explicit maximum input-token budget, when it is smaller than the full
+   * context window (e.g. OAuth backends that reserve part of the window for
+   * output). When set, catalog/capability builders prefer this over deriving
+   * max_input_tokens from contextLength (#6191).
+   */
+  maxInputTokens?: number;
   /**
    * Interleaved-reasoning signal, mirroring models.dev's `interleaved_field`.
    * Set to "reasoning_content" for models whose upstream runs DeepSeek thinking
@@ -428,9 +435,6 @@ export const CHAT_OPENAI_COMPAT_MODELS: Record<string, RegistryModel[]> = {
   "xiaomi-mimo": [
     { id: "mimo-v2.5-pro", name: "MiMo-V2.5-Pro", contextLength: 1048576, maxOutputTokens: 131072 },
     { id: "mimo-v2.5", name: "MiMo-V2.5", contextLength: 1048576, maxOutputTokens: 131072 },
-    { id: "mimo-v2-pro", name: "MiMo-V2-Pro", contextLength: 262144, maxOutputTokens: 131072 },
-    { id: "mimo-v2-omni", name: "MiMo-V2-Omni", contextLength: 262144, maxOutputTokens: 131072 },
-    { id: "mimo-v2-flash", name: "MiMo-V2-Flash", contextLength: 262144, maxOutputTokens: 65536 },
   ],
   gitlawb: [
     { id: "mimo-v2.5-pro", name: "MiMo-V2.5-Pro", contextLength: 1048576, maxOutputTokens: 131072 },
diff --git a/open-sse/executors/antigravity.ts b/open-sse/executors/antigravity.ts
index a66f58df06..5489e9fbb9 100644
--- a/open-sse/executors/antigravity.ts
+++ b/open-sse/executors/antigravity.ts
@@ -480,6 +480,46 @@ function sanitizeAntigravityGeminiRequest(
   return clean;
 }
 
+/**
+ * Ported from decolua/9router#2321 (anki1kr): Vertex AI (used by Antigravity for
+ * Claude-branded models) rejects a conversation ending on an assistant turn —
+ * "This model does not support assistant message prefill" — so the request must
+ * always end on a user turn. Upstream patched `openaiToClaudeRequestForAntigravity`
+ * (dead code here, zero callers — see `open-sse/translator/request/openai-to-claude.ts`);
+ * this relocates the same strip to the LIVE Antigravity dispatch path, where Claude
+ * requests are converted to Gemini `contents` (assistant role is `"model"`, not
+ * `"assistant"`). Mirrors the trailing-strip pop-loop already used for Mistral
+ * (#3396), Copilot (#5802), and the CC-bridge in `claudeCodeCompatible.ts`.
+ *
+ * Scoped strictly to the Claude path by the caller (`isClaude` branch only) — native
+ * Gemini models via Antigravity must be unaffected, since Vertex-Claude is the only
+ * documented rejection surface.
+ *
+ * Guard: never strip `contents` down to empty — an empty `contents` array is itself
+ * an invalid request, so at least one entry (even a lone trailing "model" turn) is
+ * always preserved.
+ */
+function stripTrailingAntigravityAssistantTurn(
+  request: Record<string, unknown>
+): Record<string, unknown> {
+  const contents = request.contents;
+  if (!Array.isArray(contents) || contents.length === 0) {
+    return request;
+  }
+
+  while (
+    contents.length > 1 &&
+    (contents[contents.length - 1] as AntigravityContent)?.role === "model"
+  ) {
+    contents.pop();
+  }
+
+  return request;
+}
+
+// Test-only export so the unit suite can exercise the strip logic directly.
+export const __test_stripTrailingAntigravityAssistantTurn = stripTrailingAntigravityAssistantTurn;
+
 export class AntigravityExecutor extends BaseExecutor {
   constructor() {
     super("antigravity", PROVIDERS.antigravity);
@@ -660,7 +700,7 @@ export class AntigravityExecutor extends BaseExecutor {
     };
 
     const transformedRequest = isClaude
-      ? sanitizeAntigravityGeminiRequest(rawTransformedRequest)
+      ? stripTrailingAntigravityAssistantTurn(sanitizeAntigravityGeminiRequest(rawTransformedRequest))
       : rawTransformedRequest;
 
     // Obfuscate sensitive client names in user content (e.g. "OpenCode", "Cursor")
diff --git a/open-sse/executors/chatgpt-web.ts b/open-sse/executors/chatgpt-web.ts
index 27085cf3c6..17125d4fcb 100644
--- a/open-sse/executors/chatgpt-web.ts
+++ b/open-sse/executors/chatgpt-web.ts
@@ -1579,6 +1579,21 @@ type ImageResolver = (
   parentMessageId?: string | null
 ) => Promise<string | null>;
 
+/**
+ * True when ChatGPT emitted an image asset pointer (the image WAS generated
+ * upstream) but none of the pointers could be resolved to a downloadable URL
+ * — so the assistant text carries no image markdown. Lets callers surface an
+ * accurate "generated but not retrievable" error instead of the misleading
+ * "no image was produced". Escalated mesh report: image visible in the ChatGPT
+ * chat but returned to OmniRoute as a bare "completed without image markdown".
+ */
+export function detectImageResolutionFailure(
+  pointerCount: number,
+  resolvedCount: number
+): boolean {
+  return pointerCount > 0 && resolvedCount === 0;
+}
+
 /** Build the final markdown block for a list of resolved image URLs. */
 function imageMarkdown(urls: string[]): string {
   if (urls.length === 0) return "";
@@ -2017,6 +2032,23 @@ async function buildNonStreamingResponse(
     log,
     parentCandidateMessageId
   );
+  // The image genuinely exists upstream but no pointer resolved to a URL
+  // (unknown asset scheme, download 403/expired, oversize). Flag it so the
+  // image-generation handler can report an accurate "generated but not
+  // retrievable" error instead of the misleading "no image markdown" 502.
+  const imageResolutionFailed = detectImageResolutionFailure(
+    imagePointers?.length ?? 0,
+    urls.length
+  );
+  if (imageResolutionFailed && log?.warn) {
+    const schemes = (imagePointers ?? [])
+      .map((p) => p.pointer.split("://")[0] || p.pointer.slice(0, 24))
+      .join(", ");
+    log.warn(
+      "CGPT-WEB",
+      `Image generated upstream but no asset pointer resolved (schemes: ${schemes}) — surfacing as unretrievable`
+    );
+  }
   fullAnswer += imageMarkdown(urls);
   const promptTokens = Math.ceil(currentMsg.length / 4);
   const completionTokens = Math.ceil(fullAnswer.length / 4);
@@ -2028,6 +2060,7 @@ async function buildNonStreamingResponse(
       created,
       model,
       system_fingerprint: null,
+      ...(imageResolutionFailed ? { x_image_resolution_failed: true } : {}),
       choices: [
         {
           index: 0,
diff --git a/open-sse/executors/doubao-web.ts b/open-sse/executors/doubao-web.ts
index 62c4a1ea80..10a9e395ea 100644
--- a/open-sse/executors/doubao-web.ts
+++ b/open-sse/executors/doubao-web.ts
@@ -1,155 +1,650 @@
 /**
- * DoubaoWebExecutor — ByteDance AI Chat via doubao.com
+ * DoubaoWebExecutor — Dola Global web chat via dola.com.
  *
- * Routes requests through Doubao's consumer chat API.
- * Chinese market provider with large model catalog.
+ * The provider id remains `doubao-web` for compatibility with existing saved
+ * provider connections, but the global consumer service now runs through Dola.
  *
- * Endpoint: POST https://www.doubao.com/api/chat
- * Auth: Session cookie from doubao.com
+ * Endpoint: POST https://www.dola.com/chat/completion
+ * Auth: Session cookies from www.dola.com
  */
+import { randomUUID } from "node:crypto";
 import { BaseExecutor, type ExecuteInput } from "./base.ts";
 import { makeExecutorErrorResult as makeErrorResult, normalizeCookie } from "../utils/error.ts";
 
-const BASE_URL = "https://www.doubao.com";
-const CHAT_URL = `${BASE_URL}/api/chat`;
+const BASE_URL = "https://www.dola.com";
+const CHAT_URL = `${BASE_URL}/chat/completion`;
+const DEFAULT_MODEL = "dola-speed";
+const DOLA_BOT_ID = "7339470689562525703";
 const USER_AGENT =
-  "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36";
+  "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36";
+
+type JsonRecord = Record<string, unknown>;
+
+export interface DolaTextExtractionState {
+  deferUntilAnswer: boolean;
+  answerStarted: boolean;
+  bufferedDeltas: string[];
+}
+
+function asRecord(value: unknown): JsonRecord {
+  return value && typeof value === "object" && !Array.isArray(value) ? (value as JsonRecord) : {};
+}
+
+function toString(value: unknown): string {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function toContentText(value: unknown): string {
+  return typeof value === "string" ? value : "";
+}
+
+function parseJsonRecord(raw: string): JsonRecord | null {
+  if (!raw.startsWith("{")) return null;
+  try {
+    return asRecord(JSON.parse(raw));
+  } catch {
+    return null;
+  }
+}
+
+function randomNumericId(length = 19): string {
+  let id = String(Math.floor(Math.random() * 9) + 1);
+  while (id.length < length) id += String(Math.floor(Math.random() * 10));
+  return id;
+}
+
+function contentToText(content: unknown): string {
+  if (typeof content === "string") return content;
+  if (Array.isArray(content)) {
+    return content
+      .map((part) => {
+        const item = asRecord(part);
+        if (item.type === "text") return toContentText(item.text);
+        if (typeof item.text === "string") return item.text;
+        return "";
+      })
+      .filter(Boolean)
+      .join("\n");
+  }
+  return "";
+}
+
+function isDolaReasoningModel(modelId: string): boolean {
+  return modelId === "dola-pro" || modelId === "dola-deep-think";
+}
+
+function createDolaTextExtractionState(modelId: string): DolaTextExtractionState {
+  const deferUntilAnswer = isDolaReasoningModel(modelId);
+  return {
+    deferUntilAnswer,
+    answerStarted: !deferUntilAnswer,
+    bufferedDeltas: [],
+  };
+}
+
+function isDolaAnswerBoundary(block: JsonRecord): boolean {
+  return block.block_type === 10040 && block.is_finish === true;
+}
+
+export function foldMessages(messages: unknown): string {
+  if (!Array.isArray(messages)) return "";
+  return messages
+    .map((message) => {
+      const item = asRecord(message);
+      const role = toString(item.role) || "user";
+      const text = contentToText(item.content);
+      return text ? `${role}: ${text}` : "";
+    })
+    .filter(Boolean)
+    .join("\n\n");
+}
+
+export function extractCookieValue(cookieHeader: string, name: string): string {
+  const pattern = new RegExp(`(?:^|;\\s*)${name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}=([^;]*)`);
+  const value = pattern.exec(cookieHeader)?.[1] ?? "";
+  try {
+    return decodeURIComponent(value).trim();
+  } catch {
+    return value.trim();
+  }
+}
+
+function extractQueryValue(raw: string, name: string): string {
+  if (!raw.includes("?") && !raw.includes("&")) return "";
+  try {
+    const url = raw.startsWith("http") ? new URL(raw) : new URL(`https://www.dola.com/?${raw}`);
+    return toString(url.searchParams.get(name));
+  } catch {
+    return "";
+  }
+}
+
+export function resolveDolaFingerprint(
+  cookieHeader: string,
+  providerSpecificData?: unknown,
+  rawCredential = ""
+): string {
+  const data = asRecord(providerSpecificData);
+  return (
+    toString(data.s_v_web_id) ||
+    toString(data.sVWebId) ||
+    extractCookieValue(cookieHeader, "s_v_web_id") ||
+    toString(data.fp) ||
+    extractCookieValue(cookieHeader, "fp") ||
+    extractQueryValue(rawCredential, "fp")
+  );
+}
+
+export function buildDolaCookieHeader(
+  rawCredential: string,
+  providerSpecificData?: unknown
+): string {
+  const providerData = asRecord(providerSpecificData);
+  const raw = normalizeCookie(rawCredential.trim());
+  const parsed = parseJsonRecord(raw);
+  const data = { ...providerData, ...(parsed ?? {}) };
+  const explicitCookie = normalizeCookie(toString(data.cookie));
+  const directCookie = raw && !parsed ? raw : "";
+  const cookieSource = explicitCookie || directCookie;
+
+  if (cookieSource.includes("=")) return cookieSource;
+
+  const cookieNames = [
+    "sessionid",
+    "ttwid",
+    "s_v_web_id",
+    "fp",
+    "sessionid_ss",
+    "sid_guard",
+    "sid_tt",
+    "uid_tt",
+    "uid_tt_ss",
+    "passport_auth_status",
+    "passport_auth_status_ss",
+    "odin_tt",
+  ];
+  const parts = cookieNames
+    .map((name) => {
+      const value = toString(data[name]);
+      return value ? `${name}=${value}` : "";
+    })
+    .filter(Boolean);
+
+  if (parts.length > 0) return parts.join("; ");
+  return raw ? `sessionid=${raw}` : "";
+}
+
+export function buildDolaQueryParams(
+  cookieHeader: string,
+  providerSpecificData?: unknown,
+  rawCredential = ""
+): URLSearchParams {
+  const data = asRecord(providerSpecificData);
+  const generatedId = randomNumericId();
+  const deviceId = toString(data.device_id) || toString(data.deviceId) || generatedId;
+  const fp = resolveDolaFingerprint(cookieHeader, providerSpecificData, rawCredential);
+
+  return new URLSearchParams({
+    aid: "495671",
+    real_aid: "495671",
+    device_platform: "web",
+    device_id: deviceId,
+    web_id: toString(data.web_id) || toString(data.webId) || deviceId,
+    tea_uuid: toString(data.tea_uuid) || toString(data.teaUuid) || deviceId,
+    web_tab_id: randomUUID(),
+    pc_version: toString(data.pc_version) || toString(data.pcVersion) || "3.25.3",
+    pkg_type: "release_version",
+    version_code: "20800",
+    samantha_web: "1",
+    web_platform: "browser",
+    "use-olympus-account": "1",
+    language: toString(data.language) || "en",
+    region: toString(data.region) || "US",
+    sys_region: toString(data.sys_region) || toString(data.sysRegion) || "US",
+    fp,
+  });
+}
+
+export function resolveDolaDeepThinkValue(modelId: string, providerSpecificData?: unknown): 0 | 3 {
+  const data = asRecord(providerSpecificData);
+  const configured = toString(data.use_deep_think) || toString(data.useDeepThink);
+  if (configured === "3") return 3;
+  if (configured === "0") return 0;
+  if (data.deepThink === true || modelId === "dola-pro" || modelId === "dola-deep-think") return 3;
+  return 0;
+}
+
+export function buildDolaPayload(
+  prompt: string,
+  modelId = DEFAULT_MODEL,
+  cookieHeader = "",
+  providerSpecificData?: unknown,
+  rawCredential = ""
+): JsonRecord {
+  const data = asRecord(providerSpecificData);
+  const localConversationId =
+    toString(data.local_conversation_id) ||
+    toString(data.localConversationId) ||
+    `local_${randomNumericId(16)}`;
+  const blockId = randomUUID();
+  const messageId = randomUUID();
+  const uniqueKey = randomUUID();
+  const now = Date.now();
+  const deepThinkValue = resolveDolaDeepThinkValue(modelId, providerSpecificData);
+  const fp = resolveDolaFingerprint(cookieHeader, providerSpecificData, rawCredential);
+
+  return {
+    client_meta: {
+      local_conversation_id: localConversationId,
+      conversation_id: "",
+      bot_id: toString(data.bot_id) || toString(data.botId) || DOLA_BOT_ID,
+      last_section_id: "",
+      last_message_index: null,
+    },
+    messages: [
+      {
+        local_message_id: messageId,
+        content_block: [
+          {
+            block_type: 10000,
+            content: {
+              text_block: {
+                text: prompt,
+                icon_url: "",
+                icon_url_dark: "",
+                summary: "",
+              },
+              pc_event_block: "",
+            },
+            block_id: blockId,
+            parent_id: "",
+            meta_info: [],
+            append_fields: [],
+          },
+        ],
+        message_status: 0,
+      },
+    ],
+    option: {
+      send_message_scene: "",
+      create_time_ms: now,
+      collect_id: "",
+      is_audio: false,
+      answer_with_suggest: false,
+      tts_switch: false,
+      need_deep_think: deepThinkValue,
+      click_clear_context: false,
+      from_suggest: false,
+      is_regen: false,
+      is_replace: false,
+      is_from_click_option: false,
+      is_from_click_softlink: false,
+      disable_sse_cache: false,
+      select_text_action: "",
+      is_select_text: false,
+      resend_for_regen: false,
+      scene_type: 0,
+      unique_key: uniqueKey,
+      start_seq: 0,
+      need_create_conversation: true,
+      conversation_init_option: { need_ack_conversation: true },
+      regen_query_id: [],
+      edit_query_id: [],
+      regen_instruction: "",
+      no_replace_for_regen: false,
+      message_from: 0,
+      shared_app_name: "",
+      shared_app_id: "",
+      sse_recv_event_options: { support_chunk_delta: true },
+      is_ai_playground: false,
+      is_old_user: false,
+      recovery_option: {
+        is_recovery: false,
+        req_create_time_sec: Math.floor(now / 1000),
+        append_sse_event_scene: 0,
+      },
+      message_storage_type: 0,
+    },
+    user_context: [],
+    ext: {
+      use_deep_think: String(deepThinkValue),
+      fp,
+      sub_conv_firstmet_type: "1",
+      collection_id: "",
+      conversation_init_option: JSON.stringify({ need_ack_conversation: true }),
+      commerce_credit_config_enable: "0",
+    },
+  };
+}
+
+function parseSseBlock(block: string): { event: string; data: unknown } | null {
+  const lines = block.split(/\r?\n/);
+  const event = lines
+    .find((line) => line.startsWith("event:"))
+    ?.slice(6)
+    .trim();
+  const dataLines = lines
+    .filter((line) => line.startsWith("data:"))
+    .map((line) => line.slice(5).trim());
+  if (dataLines.length === 0) return null;
+  const rawData = dataLines.join("\n");
+  if (rawData === "[DONE]") return { event: event || "done", data: "[DONE]" };
+  try {
+    return { event: event || "", data: JSON.parse(rawData) };
+  } catch {
+    return null;
+  }
+}
+
+function extractDolaBlockDeltas(blocks: unknown[], state?: DolaTextExtractionState): string[] {
+  const deltas: string[] = [];
+
+  for (const block of blocks) {
+    const blockRecord = asRecord(block);
+    if (state && isDolaAnswerBoundary(blockRecord)) {
+      state.answerStarted = true;
+      state.bufferedDeltas = [];
+      continue;
+    }
+
+    const text = toContentText(asRecord(asRecord(blockRecord.content).text_block).text);
+    if (!text) continue;
+
+    if (!state || state.answerStarted) {
+      deltas.push(text);
+    } else {
+      state.bufferedDeltas.push(text);
+    }
+  }
+
+  return deltas;
+}
+
+function flushDolaTextExtractionState(state: DolaTextExtractionState): string[] {
+  if (state.answerStarted) return [];
+  const fallback = state.bufferedDeltas;
+  state.bufferedDeltas = [];
+  state.answerStarted = true;
+  return fallback;
+}
+
+export function extractDolaTextDeltas(data: unknown, state?: DolaTextExtractionState): string[] {
+  const root = asRecord(data);
+  const payload = asRecord(root.data);
+  const content = asRecord(root.content);
+  const payloadContent = asRecord(payload.content);
+  const initialBlocks = Array.isArray(content.content_block)
+    ? content.content_block
+    : Array.isArray(payloadContent.content_block)
+      ? payloadContent.content_block
+      : [];
+  const patchOps = Array.isArray(root.patch_op)
+    ? root.patch_op
+    : Array.isArray(payload.patch_op)
+      ? payload.patch_op
+      : [];
+  const deltas = extractDolaBlockDeltas(initialBlocks, state);
+
+  for (const op of patchOps) {
+    const patchValue = asRecord(asRecord(op).patch_value);
+    const blocks = Array.isArray(patchValue.content_block) ? patchValue.content_block : [];
+    deltas.push(...extractDolaBlockDeltas(blocks, state));
+  }
+
+  return deltas;
+}
+
+function extractDolaError(data: unknown): string {
+  const root = asRecord(data);
+  const payload = asRecord(root.data);
+  return (
+    toString(root.message) ||
+    toString(payload.message) ||
+    toString(payload.error_msg) ||
+    toString(payload.errorMessage)
+  );
+}
+
+export function isDolaBusyMessage(content: string): boolean {
+  const normalized = content.trim().toLowerCase();
+  return (
+    normalized.includes("a lot of people are using the app right now") &&
+    normalized.includes("try again later")
+  );
+}
+
+function openAiChunk(modelId: string, content: string): JsonRecord {
+  return {
+    id: `chatcmpl-dola-${Date.now()}`,
+    object: "chat.completion.chunk",
+    created: Math.floor(Date.now() / 1000),
+    model: modelId,
+    choices: [{ index: 0, delta: { content }, finish_reason: null }],
+  };
+}
+
+function openAiCompletion(modelId: string, content: string): JsonRecord {
+  return {
+    id: `chatcmpl-dola-${Date.now()}`,
+    object: "chat.completion",
+    created: Math.floor(Date.now() / 1000),
+    model: modelId,
+    choices: [{ index: 0, message: { role: "assistant", content }, finish_reason: "stop" }],
+  };
+}
 
 export class DoubaoWebExecutor extends BaseExecutor {
   constructor() {
-    super("doubao-web", { id: "doubao-web", baseUrl: "https://www.doubao.com" });
+    super("doubao-web", { id: "doubao-web", baseUrl: BASE_URL });
   }
 
-  async execute(input: ExecuteInput) {
-    const { body, credentials, signal, stream: wantStream } = input;
-    const bodyObj = (body || {}) as Record<string, unknown>;
-    const rawCookie = normalizeCookie(String(credentials?.apiKey ?? "").trim());
-
-    const messages = (bodyObj.messages as Array<{ role: string; content: string }>) || [];
-    const modelId = (bodyObj.model as string) || "doubao-default";
-
-    const reqBody = {
-      messages: messages.map((m) => ({ role: m.role, content: m.content })),
-      model: modelId,
-      stream: wantStream,
-      max_tokens: (bodyObj.max_tokens as number) || 4096,
-    };
-
-    const reqHeaders: Record<string, string> = {
+  private createHeaders(cookieHeader: string): Record<string, string> {
+    const headers: Record<string, string> = {
       "Content-Type": "application/json",
       "User-Agent": USER_AGENT,
-      Accept: wantStream ? "text/event-stream" : "application/json",
-      Referer: `${BASE_URL}/`,
+      Accept: "text/event-stream",
+      Referer: `${BASE_URL}/chat/`,
       Origin: BASE_URL,
+      "Agw-Js-Conv": "str",
     };
-    if (rawCookie) reqHeaders.Cookie = rawCookie;
+    if (cookieHeader) headers.Cookie = cookieHeader;
+    return headers;
+  }
 
-    let upstream: Response;
-    try {
-      upstream = await fetch(CHAT_URL, {
-        method: "POST",
-        headers: reqHeaders,
-        body: JSON.stringify(reqBody),
-        signal,
-      });
-    } catch (err) {
-      return makeErrorResult(
-        502,
-        `Doubao fetch failed: ${err instanceof Error ? err.message : "unknown"}`,
-        body,
-        CHAT_URL
-      );
+  private async collectText(upstream: Response, modelId: string): Promise<string> {
+    const raw = await upstream.text();
+    const state = createDolaTextExtractionState(modelId);
+    const deltas: string[] = [];
+
+    for (const block of raw.split(/\r?\n\r?\n/)) {
+      const event = parseSseBlock(block);
+      if (event) deltas.push(...extractDolaTextDeltas(event.data, state));
     }
+    deltas.push(...flushDolaTextExtractionState(state));
 
-    if (!upstream.ok) {
-      const errText = await upstream.text().catch(() => "");
-      return makeErrorResult(upstream.status, `Doubao error: ${errText}`, body, CHAT_URL);
-    }
+    return deltas.join("");
+  }
 
-    if (!wantStream) {
-      const data = (await upstream.json()) as Record<string, unknown>;
-      const content =
-        (data?.choices as Array<{ message?: { content?: string } }>)?.[0]?.message?.content ||
-        (data?.content as string) ||
-        "";
-      return {
-        response: new Response(
-          JSON.stringify({
-            id: `chatcmpl-doubao-${Date.now()}`,
-            object: "chat.completion",
-            created: Math.floor(Date.now() / 1000),
-            model: modelId,
-            choices: [{ index: 0, message: { role: "assistant", content }, finish_reason: "stop" }],
-          }),
-          { headers: { "Content-Type": "application/json" } }
-        ),
-        url: CHAT_URL,
-        headers: reqHeaders,
-        transformedBody: reqBody,
-      };
-    }
-
-    // Streaming
+  private createStream(upstream: Response, modelId: string, signal?: AbortSignal | null) {
     const encoder = new TextEncoder();
     const decoder = new TextDecoder();
-    const stream = new ReadableStream({
+    const state = createDolaTextExtractionState(modelId);
+    let sentDone = false;
+
+    return new ReadableStream({
       async start(controller) {
         const reader = upstream.body?.getReader();
         if (!reader) {
+          controller.enqueue(encoder.encode("data: [DONE]\n\n"));
           controller.close();
           return;
         }
         let buffer = "";
+        let errored = false;
         try {
           while (true) {
             const { done, value } = await reader.read();
             if (done) break;
             buffer += decoder.decode(value, { stream: true });
-            const lines = buffer.split("\n");
-            buffer = lines.pop() || "";
-            for (const line of lines) {
-              if (!line.startsWith("data:")) continue;
-              const data = line.slice(5).trim();
-              if (data === "[DONE]") {
+            const blocks = buffer.split(/\r?\n\r?\n/);
+            buffer = blocks.pop() || "";
+
+            for (const block of blocks) {
+              const event = parseSseBlock(block);
+              if (!event) continue;
+              if (event.event === "STREAM_ERROR") {
+                const message = extractDolaError(event.data) || "Dola stream error";
+                errored = true;
+                controller.error(new Error(message));
+                return;
+              }
+              for (const text of extractDolaTextDeltas(event.data, state)) {
+                controller.enqueue(
+                  encoder.encode(`data: ${JSON.stringify(openAiChunk(modelId, text))}\n\n`)
+                );
+              }
+              if (event.event === "SSE_REPLY_END") {
+                sentDone = true;
                 controller.enqueue(encoder.encode("data: [DONE]\n\n"));
-                continue;
               }
-              try {
-                const parsed = JSON.parse(data);
-                const text = parsed.choices?.[0]?.delta?.content || "";
-                if (text) {
-                  const chunk = {
-                    id: `chatcmpl-doubao-${Date.now()}`,
-                    object: "chat.completion.chunk",
-                    created: Math.floor(Date.now() / 1000),
-                    model: modelId,
-                    choices: [{ index: 0, delta: { content: text }, finish_reason: null }],
-                  };
-                  controller.enqueue(encoder.encode(`data: ${JSON.stringify(chunk)}\n\n`));
-                }
-              } catch {}
             }
           }
         } catch (err) {
-          if (!signal?.aborted) controller.error(err);
+          if (!signal?.aborted) {
+            errored = true;
+            controller.error(err);
+          }
+          return;
         } finally {
-          controller.enqueue(encoder.encode("data: [DONE]\n\n"));
+          if (errored) return;
+          for (const text of flushDolaTextExtractionState(state)) {
+            controller.enqueue(
+              encoder.encode(`data: ${JSON.stringify(openAiChunk(modelId, text))}\n\n`)
+            );
+          }
+          if (!sentDone) controller.enqueue(encoder.encode("data: [DONE]\n\n"));
           controller.close();
         }
       },
     });
+  }
+
+  async execute(input: ExecuteInput) {
+    const { body, credentials, signal, stream: wantStream } = input;
+    const bodyObj = asRecord(body);
+    const providerSpecificData = credentials?.providerSpecificData;
+    const rawCredential = toString(credentials?.apiKey);
+    const cookieHeader = buildDolaCookieHeader(rawCredential, providerSpecificData);
+    const requestedModel = toString(bodyObj.model) || input.model || DEFAULT_MODEL;
+    const modelId = requestedModel.split("/").pop() || DEFAULT_MODEL;
+    const prompt = foldMessages(bodyObj.messages);
+    const fingerprint = resolveDolaFingerprint(cookieHeader, providerSpecificData, rawCredential);
+    const transformedBody = buildDolaPayload(
+      prompt,
+      modelId,
+      cookieHeader,
+      providerSpecificData,
+      rawCredential
+    );
+    const query = buildDolaQueryParams(cookieHeader, providerSpecificData, rawCredential);
+    const url = `${CHAT_URL}?${query.toString()}`;
+    const reqHeaders = this.createHeaders(cookieHeader);
+
+    if (!extractCookieValue(cookieHeader, "sessionid")) {
+      return {
+        ...makeErrorResult(
+          401,
+          "Dola Web requires a www.dola.com Cookie header containing at least sessionid, ttwid, and s_v_web_id.",
+          body,
+          url
+        ),
+        headers: reqHeaders,
+        transformedBody,
+      };
+    }
+    if (!fingerprint) {
+      return {
+        ...makeErrorResult(
+          401,
+          "Dola Web requires the browser fingerprint value from www.dola.com. Add s_v_web_id=... from Cookies or fp=verify_... from a Network chat/completion request URL.",
+          body,
+          url
+        ),
+        headers: reqHeaders,
+        transformedBody,
+      };
+    }
+
+    let upstream: Response;
+    try {
+      upstream = await fetch(url, {
+        method: "POST",
+        headers: reqHeaders,
+        body: JSON.stringify(transformedBody),
+        signal,
+      });
+    } catch (err) {
+      return {
+        ...makeErrorResult(
+          502,
+          `Dola fetch failed: ${err instanceof Error ? err.message : "unknown"}`,
+          body,
+          url
+        ),
+        headers: reqHeaders,
+        transformedBody,
+      };
+    }
+
+    if (!upstream.ok) {
+      const errText = await upstream.text().catch(() => "");
+      return {
+        ...makeErrorResult(upstream.status, `Dola error: ${errText}`, body, url),
+        headers: reqHeaders,
+        transformedBody,
+      };
+    }
+
+    const contentType = upstream.headers.get("Content-Type") || "";
+    if (!contentType.toLowerCase().includes("text/event-stream")) {
+      const text = await upstream.text().catch(() => "");
+      return {
+        ...makeErrorResult(502, `Dola returned non-SSE response: ${text}`, body, url),
+        headers: reqHeaders,
+        transformedBody,
+      };
+    }
+
+    if (!wantStream) {
+      const content = await this.collectText(upstream, modelId);
+      if (isDolaBusyMessage(content)) {
+        return {
+          ...makeErrorResult(429, "Dola is temporarily busy. Please try again later.", body, url),
+          headers: reqHeaders,
+          transformedBody,
+        };
+      }
+      return {
+        response: new Response(JSON.stringify(openAiCompletion(modelId, content)), {
+          headers: { "Content-Type": "application/json" },
+        }),
+        url,
+        headers: reqHeaders,
+        transformedBody,
+      };
+    }
 
     return {
-      response: new Response(stream, {
+      response: new Response(this.createStream(upstream, modelId, signal), {
         headers: {
           "Content-Type": "text/event-stream",
           "Cache-Control": "no-cache",
           Connection: "keep-alive",
         },
       }),
-      url: CHAT_URL,
+      url,
       headers: reqHeaders,
-      transformedBody: reqBody,
+      transformedBody,
     };
   }
 }
diff --git a/open-sse/executors/index.ts b/open-sse/executors/index.ts
index 5984fde2ee..a3ab06cc6f 100644
--- a/open-sse/executors/index.ts
+++ b/open-sse/executors/index.ts
@@ -41,6 +41,7 @@ import { T3ChatWebExecutor } from "./t3-chat-web.ts";
 import { ClaudeWebExecutor } from "./claude-web.ts";
 import { InnerAiExecutor } from "./inner-ai.ts";
 import { HuggingChatExecutor } from "./huggingchat.ts";
+import { YuanbaoWebExecutor } from "./yuanbao-web.ts";
 import { PoeWebExecutor } from "./poe-web.ts";
 import { VeniceWebExecutor } from "./venice-web.ts";
 import { V0VercelWebExecutor } from "./v0-vercel-web.ts";
@@ -129,6 +130,8 @@ const executors = {
   "in-ai": new InnerAiExecutor(), // Alias
   huggingchat: new HuggingChatExecutor(),
   hc: new HuggingChatExecutor(), // Alias
+  "yuanbao-web": new YuanbaoWebExecutor(),
+  ybw: new YuanbaoWebExecutor(), // Alias
   "poe-web": new PoeWebExecutor(),
   poe: new PoeWebExecutor(), // Alias
   "venice-web": new VeniceWebExecutor(),
@@ -212,6 +215,7 @@ export { ClaudeWebExecutor } from "./claude-web.ts";
 export { DeepSeekWebExecutor } from "./deepseek-web.ts";
 export { DeepSeekWebWithAutoRefreshExecutor } from "./deepseek-web-with-auto-refresh.ts";
 export { AdaptaWebExecutor } from "./adapta-web.ts";
+export { YuanbaoWebExecutor } from "./yuanbao-web.ts";
 export { T3ChatWebExecutor } from "./t3-chat-web.ts";
 export { InnerAiExecutor } from "./inner-ai.ts";
 export { QwenWebExecutor } from "./qwen-web.ts";
diff --git a/open-sse/executors/kiro.ts b/open-sse/executors/kiro.ts
index 26c3135257..7def296e39 100644
--- a/open-sse/executors/kiro.ts
+++ b/open-sse/executors/kiro.ts
@@ -214,6 +214,12 @@ export class KiroExecutor extends BaseExecutor {
     if (b.conversationState !== undefined) kiroPayload.conversationState = b.conversationState;
     if (b.profileArn !== undefined) kiroPayload.profileArn = b.profileArn;
     if (b.inferenceConfig !== undefined) kiroPayload.inferenceConfig = b.inferenceConfig;
+    // Thinking control: `additionalModelRequestFields` ({output_config.effort,
+    // thinking:{type:"adaptive"}, max_tokens}) is a recognized top-level field on
+    // GenerateAssistantResponse — it steers adaptive reasoning. Built by the
+    // openai-to-kiro translator only when the request asked for thinking.
+    if (b.additionalModelRequestFields !== undefined)
+      kiroPayload.additionalModelRequestFields = b.additionalModelRequestFields;
 
     // Fallback: if somehow conversationState isn't there, return the rest without model
     // (for backward compatibility if something else bypasses the translator)
@@ -382,6 +388,56 @@ export class KiroExecutor extends BaseExecutor {
             if (!state.totalContentLength) state.totalContentLength = 0;
             if (!state.contextUsagePercentage) state.contextUsagePercentage = 0;
 
+            // Native reasoning frames. Verified against the live CodeWhisperer
+            // stream (2026-07): with adaptive thinking enabled (via
+            // additionalModelRequestFields), Kiro streams reasoning as a dedicated
+            // `reasoningContentEvent` frame carrying `{ text, signature }` — NOT
+            // inline `<thinking>` tags and NOT `assistantResponseEvent`. Some
+            // models/variants instead use a `reasoningText` object or a flat
+            // `{ text }` (cf. javargasm/pi-kiro `src/event-parser.ts`). OmniRoute
+            // had no handler for this event, so the reasoning was silently dropped;
+            // route it to the OpenAI `reasoning_content` channel.
+            {
+              const rp = event.payload as Record<string, unknown> | undefined;
+              const rt = rp?.reasoningText;
+              if (eventType === "reasoningContentEvent" || rt !== undefined) {
+                let nativeReasoning = "";
+                if (rt && typeof rt === "object") {
+                  const rto = rt as { text?: unknown; Text?: unknown };
+                  nativeReasoning =
+                    typeof rto.text === "string"
+                      ? rto.text
+                      : typeof rto.Text === "string"
+                        ? rto.Text
+                        : "";
+                } else if (typeof rt === "string") {
+                  nativeReasoning = rt;
+                } else if (typeof rp?.text === "string") {
+                  nativeReasoning = rp.text as string;
+                }
+                if (nativeReasoning) {
+                  state.hasReasoningContent = true;
+                  const reasoningDelta: JsonRecord =
+                    (state.reasoningChunkCount ?? 0) === 0 && chunkIndex === 0
+                      ? { role: "assistant", reasoning_content: nativeReasoning }
+                      : { reasoning_content: nativeReasoning };
+                  const chunk: JsonRecord = {
+                    id: responseId,
+                    object: "chat.completion.chunk",
+                    created,
+                    model,
+                    choices: [{ index: 0, delta: reasoningDelta, finish_reason: null }],
+                  };
+                  chunkIndex++;
+                  state.reasoningChunkCount = (state.reasoningChunkCount ?? 0) + 1;
+                  controller.enqueue(TEXT_ENCODER.encode(`data: ${JSON.stringify(chunk)}\n\n`));
+                }
+                // Consume the reasoning frame (incl. signature-only) so it never
+                // falls through to the content handlers below.
+                continue;
+              }
+            }
+
             // Handle assistantResponseEvent
             if (eventType === "assistantResponseEvent") {
               const content =
diff --git a/open-sse/executors/yuanbao-web.ts b/open-sse/executors/yuanbao-web.ts
new file mode 100644
index 0000000000..20ef5662e0
--- /dev/null
+++ b/open-sse/executors/yuanbao-web.ts
@@ -0,0 +1,504 @@
+/**
+ * YuanbaoWebExecutor — Tencent Yuanbao (yuanbao.tencent.com) Web Provider
+ *
+ * Routes chat requests through the Tencent Yuanbao consumer web session.
+ * Requires the `hy_user` + `hy_token` cookies from a logged-in
+ * yuanbao.tencent.com browser session (paste the full Cookie header).
+ *
+ * API flow (verified against the reverse-engineered references below):
+ *   1. POST /api/user/agent/conversation/create  { agentId } -> { id }  (conversationId)
+ *   2. POST /api/chat/{conversationId}           (JSON body) -> SSE stream
+ *
+ * Streaming format (SSE, `data: {json}` lines):
+ *   - { type: "think", content: "..." }   -- reasoning tokens (DeepSeek-R1 / Hunyuan-T1)
+ *   - { type: "text",  msg: "..." }       -- answer tokens
+ *   - { ..., stopReason: "..." }          -- terminal marker
+ *
+ * References (endpoint/payload/session shape lifted + cross-checked):
+ *   - juzeon/yuanbao-chat2api (Rust)      — cookie-only auth: hy_user + hy_token + agentId
+ *   - chenwr727/yuanbao-free-api (Python) — endpoints, body shape, model map
+ */
+import {
+  BaseExecutor,
+  mergeAbortSignals,
+  mergeUpstreamExtraHeaders,
+  type ExecuteInput,
+} from "./base.ts";
+import { FETCH_TIMEOUT_MS } from "../config/constants.ts";
+import { buildErrorBody, sanitizeErrorMessage } from "../utils/error.ts";
+import { extractCookieValue, stripCookieInputPrefix } from "@/lib/providers/webCookieAuth";
+
+const YUANBAO_BASE = "https://yuanbao.tencent.com";
+const CREATE_URL = `${YUANBAO_BASE}/api/user/agent/conversation/create`;
+const CHAT_URL = `${YUANBAO_BASE}/api/chat`;
+
+// Public default DeepSeek agent id used by the Yuanbao web app. Not a secret —
+// it is the shared consumer agent every logged-in session addresses by default.
+const DEFAULT_AGENT_ID = "naQivTmsDa";
+
+const USER_AGENT =
+  "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 " +
+  "(KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36";
+
+const DEFAULT_MODEL = "deepseek-v3";
+
+// OmniRoute model id -> Yuanbao internal chatModelId + optional supportFunctions.
+const MODEL_MAP: Record<string, { chatModelId: string; supportFunctions?: string[] }> = {
+  "deepseek-v3": { chatModelId: "deep_seek_v3" },
+  "deepseek-r1": { chatModelId: "deep_seek" },
+  "deepseek-v3-search": {
+    chatModelId: "deep_seek_v3",
+    supportFunctions: ["supportInternetSearch"],
+  },
+  "deepseek-r1-search": {
+    chatModelId: "deep_seek",
+    supportFunctions: ["supportInternetSearch"],
+  },
+  hunyuan: { chatModelId: "hunyuan_gpt_175B_0404" },
+  "hunyuan-t1": { chatModelId: "hunyuan_t1" },
+  "hunyuan-search": {
+    chatModelId: "hunyuan_gpt_175B_0404",
+    supportFunctions: ["supportInternetSearch"],
+  },
+  "hunyuan-t1-search": {
+    chatModelId: "hunyuan_t1",
+    supportFunctions: ["supportInternetSearch"],
+  },
+};
+
+// ── Helpers ─────────────────────────────────────────────────────────────────
+
+function isEncryptedCredentialBlob(value: unknown): boolean {
+  return typeof value === "string" && value.trim().startsWith("enc:v1:");
+}
+
+function extractText(content: unknown): string {
+  if (typeof content === "string") return content;
+  if (!Array.isArray(content)) return String(content ?? "");
+  return content
+    .map((part: unknown) => {
+      if (!part || typeof part !== "object") return "";
+      const item = part as Record<string, unknown>;
+      if ((item.type === "text" || item.type === "input_text") && typeof item.text === "string") {
+        return item.text;
+      }
+      return "";
+    })
+    .filter((p: string) => p.length > 0)
+    .join("\n");
+}
+
+/** Flatten OpenAI messages into the single-prompt shape Yuanbao expects. */
+function buildPrompt(messages: Array<Record<string, unknown>>): string {
+  const parts: Array<{ role: string; content: string }> = [];
+  for (const msg of messages) {
+    const role = String(msg.role || "user");
+    const text = extractText(msg.content).trim();
+    if (!text) continue;
+    parts.push({ role, content: text });
+  }
+  if (parts.length === 0) return "";
+  if (parts.length === 1) return parts[0].content;
+  // Multi-turn: label each turn (matches the reference chat2api formatting).
+  return parts.map((p) => `#[${p.role.trim()}]\n${p.content}`).join("\n\n");
+}
+
+/** Build the `hy_source=web; hy_user=...; hy_token=...` cookie from the pasted header. */
+function buildYuanbaoCookie(rawApiKey: string): { cookie: string; hasToken: boolean } {
+  const raw = stripCookieInputPrefix(rawApiKey || "");
+  const hyUser = extractCookieValue(raw, "hy_user");
+  const hyToken = extractCookieValue(raw, "hy_token");
+
+  if (hyUser && hyToken) {
+    return { cookie: `hy_source=web; hy_user=${hyUser}; hy_token=${hyToken}`, hasToken: true };
+  }
+
+  // Fall back to forwarding whatever the user pasted (may already be a full
+  // Cookie header). Only usable if it plausibly carries the session token.
+  const hasToken = raw.includes("hy_token=");
+  return { cookie: raw, hasToken };
+}
+
+function estimateTokens(text: string): number {
+  return Math.max(1, Math.ceil((text || "").length / 4));
+}
+
+async function readUpstreamErrorDetails(response: Response): Promise<{
+  message: string | null;
+  details: unknown;
+}> {
+  const contentType = response.headers.get("content-type") || "";
+  const text = await response.text().catch(() => "");
+  if (!text) return { message: null, details: null };
+
+  if (contentType.includes("json")) {
+    try {
+      const parsed = JSON.parse(text) as Record<string, unknown>;
+      const message =
+        typeof parsed.message === "string"
+          ? parsed.message
+          : typeof parsed.error === "string"
+            ? parsed.error
+            : null;
+      return { message: message ? sanitizeErrorMessage(message) : null, details: parsed };
+    } catch {
+      // fall through
+    }
+  }
+  return { message: sanitizeErrorMessage(text), details: { body: text } };
+}
+
+// ── Executor ────────────────────────────────────────────────────────────────
+
+export class YuanbaoWebExecutor extends BaseExecutor {
+  constructor() {
+    super("yuanbao-web", { id: "yuanbao-web", baseUrl: CHAT_URL });
+  }
+
+  private errorResponse(status: number, message: string, url: string, details?: unknown) {
+    return {
+      response: new Response(JSON.stringify(buildErrorBody(status, message, details)), {
+        status,
+        headers: { "Content-Type": "application/json" },
+      }),
+      url,
+      headers: {},
+      transformedBody: undefined,
+    };
+  }
+
+  async execute(input: ExecuteInput): Promise<{
+    response: Response;
+    url: string;
+    headers: Record<string, string>;
+    transformedBody: unknown;
+  }> {
+    const { model, body, stream, credentials, signal, log, upstreamExtraHeaders } = input;
+    const messages = (body as Record<string, unknown>).messages as
+      | Array<Record<string, unknown>>
+      | undefined;
+
+    if (!messages || !Array.isArray(messages) || messages.length === 0) {
+      return this.errorResponse(400, "Missing or empty messages array", CHAT_URL);
+    }
+
+    if (isEncryptedCredentialBlob(credentials.apiKey)) {
+      return this.errorResponse(
+        401,
+        "Yuanbao credentials are encrypted but STORAGE_ENCRYPTION_KEY is not loaded. " +
+          "Restore the encryption key or re-save the Yuanbao cookie.",
+        CREATE_URL
+      );
+    }
+
+    const { cookie, hasToken } = buildYuanbaoCookie(credentials.apiKey || "");
+    if (!hasToken) {
+      return this.errorResponse(
+        401,
+        "Yuanbao requires a session cookie. Log in to yuanbao.tencent.com, open " +
+          "DevTools > Application > Cookies, and paste the full Cookie header " +
+          "(it must contain hy_user and hy_token).",
+        CREATE_URL
+      );
+    }
+
+    const resolvedModel = model && MODEL_MAP[model] ? model : DEFAULT_MODEL;
+    const modelSpec = MODEL_MAP[resolvedModel];
+    const prompt = buildPrompt(messages);
+    if (!prompt.trim()) {
+      return this.errorResponse(400, "Empty prompt after processing messages", CHAT_URL);
+    }
+
+    const baseHeaders: Record<string, string> = {
+      Cookie: cookie,
+      "User-Agent": USER_AGENT,
+      Origin: YUANBAO_BASE,
+      Referer: `${YUANBAO_BASE}/chat/${DEFAULT_AGENT_ID}`,
+      "X-Agentid": DEFAULT_AGENT_ID,
+    };
+
+    const timeoutSignal = AbortSignal.timeout(FETCH_TIMEOUT_MS);
+    const combinedSignal = signal ? mergeAbortSignals(signal, timeoutSignal) : timeoutSignal;
+
+    // ── Step 1: create conversation ─────────────────────────────────────────
+    let conversationId: string;
+    try {
+      const createRes = await fetch(CREATE_URL, {
+        method: "POST",
+        headers: { ...baseHeaders, "Content-Type": "application/json" },
+        body: JSON.stringify({ agentId: DEFAULT_AGENT_ID }),
+        signal: combinedSignal,
+      });
+
+      if (!createRes.ok) {
+        const status = createRes.status;
+        const upstreamError = await readUpstreamErrorDetails(createRes);
+        let message = `Yuanbao conversation creation failed (HTTP ${status})`;
+        if (status === 401 || status === 403) {
+          message =
+            "Yuanbao auth failed — your hy_user/hy_token cookies may be missing or expired. " +
+            "Log in to yuanbao.tencent.com and re-paste your Cookie header.";
+        } else if (status === 429) {
+          message = "Yuanbao rate limited. Wait a moment and retry.";
+        }
+        if (upstreamError.message) message = `${message}: ${upstreamError.message}`;
+        return this.errorResponse(status, message, CREATE_URL, upstreamError.details);
+      }
+
+      const createData = (await createRes.json()) as Record<string, unknown>;
+      conversationId = String(createData.id || "");
+      if (!conversationId) {
+        return this.errorResponse(
+          502,
+          "Yuanbao did not return a conversation id",
+          CREATE_URL
+        );
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      log?.error?.("YUANBAO-WEB", `Conversation creation failed: ${message}`);
+      return this.errorResponse(
+        502,
+        `Yuanbao connection failed: ${sanitizeErrorMessage(message)}`,
+        CREATE_URL
+      );
+    }
+
+    // ── Step 2: send message ────────────────────────────────────────────────
+    const messageUrl = `${CHAT_URL}/${conversationId}`;
+    const chatBody: Record<string, unknown> = {
+      model: "gpt_175B_0404",
+      prompt,
+      plugin: "Adaptive",
+      displayPrompt: prompt,
+      displayPromptType: 1,
+      options: {
+        imageIntention: {
+          needIntentionModel: true,
+          backendUpdateFlag: 2,
+          intentionStatus: true,
+        },
+      },
+      multimedia: [],
+      agentId: DEFAULT_AGENT_ID,
+      supportHint: 1,
+      version: "v2",
+      chatModelId: modelSpec.chatModelId,
+    };
+    if (modelSpec.supportFunctions) chatBody.supportFunctions = modelSpec.supportFunctions;
+
+    const chatHeaders: Record<string, string> = {
+      ...baseHeaders,
+      "Content-Type": "application/json",
+      Accept: "text/event-stream",
+    };
+    mergeUpstreamExtraHeaders(chatHeaders, upstreamExtraHeaders);
+
+    let upstreamResponse: Response;
+    try {
+      upstreamResponse = await fetch(messageUrl, {
+        method: "POST",
+        headers: chatHeaders,
+        body: JSON.stringify(chatBody),
+        signal: combinedSignal,
+      });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      log?.error?.("YUANBAO-WEB", `Message send failed: ${message}`);
+      return this.errorResponse(
+        502,
+        `Yuanbao connection failed: ${sanitizeErrorMessage(message)}`,
+        messageUrl
+      );
+    }
+
+    if (!upstreamResponse.ok) {
+      const status = upstreamResponse.status;
+      const upstreamError = await readUpstreamErrorDetails(upstreamResponse);
+      let message = `Yuanbao returned HTTP ${status}`;
+      if (status === 401 || status === 403) {
+        message = "Yuanbao auth failed — session cookie may be expired.";
+      } else if (status === 429) {
+        message = "Yuanbao rate limited. Wait a moment and retry.";
+      }
+      if (upstreamError.message) message = `${message}: ${upstreamError.message}`;
+      return this.errorResponse(status, message, messageUrl, upstreamError.details);
+    }
+
+    if (!upstreamResponse.body) {
+      return this.errorResponse(502, "Yuanbao returned empty response body", messageUrl);
+    }
+
+    // ── Step 3: translate SSE → OpenAI ──────────────────────────────────────
+    const id = `chatcmpl-yuanbao-${crypto.randomUUID().slice(0, 12)}`;
+    const created = Math.floor(Date.now() / 1000);
+
+    if (stream) {
+      return {
+        response: new Response(
+          transformYuanbaoStream(upstreamResponse.body, resolvedModel, id, created, signal, log),
+          {
+            status: 200,
+            headers: {
+              "Content-Type": "text/event-stream",
+              "Cache-Control": "no-cache",
+              "X-Accel-Buffering": "no",
+            },
+          }
+        ),
+        url: messageUrl,
+        headers: chatHeaders,
+        transformedBody: chatBody,
+      };
+    }
+
+    const { content, reasoning } = await collectYuanbaoResponse(upstreamResponse.body, signal);
+    const completionTokens = estimateTokens(content + reasoning);
+    const messagePayload: Record<string, unknown> = { role: "assistant", content };
+    if (reasoning) messagePayload.reasoning_content = reasoning;
+
+    return {
+      response: new Response(
+        JSON.stringify({
+          id,
+          object: "chat.completion",
+          created,
+          model: resolvedModel,
+          choices: [{ index: 0, message: messagePayload, finish_reason: "stop" }],
+          usage: {
+            prompt_tokens: estimateTokens(prompt),
+            completion_tokens: completionTokens,
+            total_tokens: estimateTokens(prompt) + completionTokens,
+          },
+        }),
+        { status: 200, headers: { "Content-Type": "application/json" } }
+      ),
+      url: messageUrl,
+      headers: chatHeaders,
+      transformedBody: chatBody,
+    };
+  }
+}
+
+// ── SSE translation helpers ───────────────────────────────────────────────────
+
+interface YuanbaoEvent {
+  type?: string;
+  content?: string;
+  msg?: string;
+  stopReason?: string;
+}
+
+function parseYuanbaoDataLine(line: string): YuanbaoEvent | null {
+  if (!line.startsWith("data: ")) return null;
+  const payload = line.slice(6).trim();
+  if (!payload || payload === "[DONE]" || !payload.startsWith("{")) return null;
+  try {
+    return JSON.parse(payload) as YuanbaoEvent;
+  } catch {
+    return null;
+  }
+}
+
+function transformYuanbaoStream(
+  upstream: ReadableStream<Uint8Array>,
+  model: string,
+  id: string,
+  created: number,
+  signal: AbortSignal | null | undefined,
+  log?: ExecuteInput["log"]
+): ReadableStream<Uint8Array> {
+  const encoder = new TextEncoder();
+  const decoder = new TextDecoder();
+  let roleEmitted = false;
+
+  return new ReadableStream({
+    async start(controller) {
+      const reader = upstream.getReader();
+      let buffer = "";
+
+      const emit = (delta: object, finish?: string | null) => {
+        controller.enqueue(
+          encoder.encode(
+            `data: ${JSON.stringify({
+              id,
+              object: "chat.completion.chunk",
+              created,
+              model,
+              choices: [{ index: 0, delta, finish_reason: finish ?? null }],
+            })}\n\n`
+          )
+        );
+      };
+
+      const ensureRole = () => {
+        if (!roleEmitted) {
+          roleEmitted = true;
+          emit({ role: "assistant", content: "" });
+        }
+      };
+
+      try {
+        while (true) {
+          if (signal?.aborted) break;
+          const { done, value } = await reader.read();
+          if (done) break;
+          buffer += decoder.decode(value, { stream: true });
+          const lines = buffer.split("\n");
+          buffer = lines.pop() ?? "";
+          for (const line of lines) {
+            const event = parseYuanbaoDataLine(line);
+            if (!event) continue;
+            if (event.type === "think" && event.content) {
+              ensureRole();
+              emit({ reasoning_content: event.content });
+            } else if (event.type === "text" && typeof event.msg === "string" && event.msg) {
+              ensureRole();
+              emit({ content: event.msg });
+            }
+          }
+        }
+      } catch (err) {
+        log?.error?.("YUANBAO-WEB", `Stream error: ${err}`);
+      } finally {
+        ensureRole();
+        emit({}, "stop");
+        controller.enqueue(encoder.encode("data: [DONE]\n\n"));
+        controller.close();
+        reader.releaseLock();
+      }
+    },
+  });
+}
+
+async function collectYuanbaoResponse(
+  upstream: ReadableStream<Uint8Array>,
+  signal: AbortSignal | null | undefined
+): Promise<{ content: string; reasoning: string }> {
+  const decoder = new TextDecoder();
+  const reader = upstream.getReader();
+  let buffer = "";
+  let content = "";
+  let reasoning = "";
+
+  try {
+    while (true) {
+      if (signal?.aborted) break;
+      const { done, value } = await reader.read();
+      if (done) break;
+      buffer += decoder.decode(value, { stream: true });
+      const lines = buffer.split("\n");
+      buffer = lines.pop() ?? "";
+      for (const line of lines) {
+        const event = parseYuanbaoDataLine(line);
+        if (!event) continue;
+        if (event.type === "think" && event.content) reasoning += event.content;
+        else if (event.type === "text" && typeof event.msg === "string") content += event.msg;
+      }
+    }
+  } finally {
+    reader.releaseLock();
+  }
+
+  return { content, reasoning };
+}
diff --git a/open-sse/handlers/chatCore.ts b/open-sse/handlers/chatCore.ts
index e6f7cb7391..3031483c0e 100644
--- a/open-sse/handlers/chatCore.ts
+++ b/open-sse/handlers/chatCore.ts
@@ -374,6 +374,7 @@ export async function handleChatCore({
   skipUpstreamRetry = false,
   createPiiTransform = null,
   correlationId = null,
+  modelPinned = false,
 }) {
   let { provider, model, extendedContext } = modelInfo;
   // ── Memory pressure guard ────────────────────────────────────────────
@@ -583,6 +584,7 @@ export async function handleChatCore({
     isResponsesEndpoint,
     nativeCodexPassthrough,
     isDroidCLI,
+    isOpencodeClient,
     copilotCompatibleReasoning,
     clientResponseFormat,
   } = resolveChatCoreRequestFormat({ clientRawRequest, body, provider, userAgent });
@@ -805,6 +807,7 @@ export async function handleChatCore({
       apiKeyInfo,
       noLogEnabled,
       correlationId,
+      modelPinned,
     });
 
   // Primary path: merge client model id + alias target so config on either key applies; resolved
@@ -873,9 +876,16 @@ export async function handleChatCore({
   // sourceFormat="claude" applies the Anthropic Messages spec default (stream=false
   // when body omits stream), preventing STREAM_EARLY_EOF on /v1/messages when
   // clients send Accept: */* without an explicit stream flag.
-  // providerRequiresStreaming: providers with forceStream:true reject stream:false
-  // upstream (HTTP 400); keep streaming so OmniRoute can convert the stream to JSON
-  // for the client via handleForcedSSEToJson. (#2081)
+  // providerRequiresStreaming: providers with forceStream:true (cline/clinepass)
+  // only implement upstream streaming — a non-streaming request returns
+  // "generateText is not implemented" / an empty body. This flag forces the
+  // UPSTREAM request to stream (see `upstreamStream` below), but it MUST NOT
+  // force the client-facing `stream` flag: a stream:false client (e.g. the
+  // model-test button, plain JSON API callers) still expects a JSON response.
+  // The client-side `if (!stream)` branch drains the forced upstream SSE and
+  // converts it back to JSON via readNonStreamingResponseBody. Passing this
+  // flag into resolveStreamFlag would force `stream=true` and skip that
+  // conversion, yielding STREAM_EARLY_EOF for JSON callers. (#2081, #6126)
   const providerRequiresStreaming = REGISTRY[provider]?.forceStream === true;
   const stream =
     nativeCodexPassthrough && isCompactResponsesEndpoint(endpointPath)
@@ -883,7 +893,6 @@ export async function handleChatCore({
       : resolveStreamFlag(body?.stream, acceptHeader, sourceFormat, {
           userAgent: streamUserAgent,
           streamDefaultMode: apiKeyInfo?.streamDefaultMode,
-          providerRequiresStreaming,
         });
 
   // `settings` is already consolidated once near the top of handleChatCore
@@ -1588,7 +1597,13 @@ export async function handleChatCore({
     headers: clientRawRequest?.headers,
     userAgent,
   });
-  const upstreamStream = stream || isClaudeCodeCompatible;
+  // `forceStream` providers (e.g. Cline / ClinePass) only implement upstream
+  // streaming — a non-streaming request returns "generateText is not implemented"
+  // / an empty body. Force the upstream request to stream even when the client
+  // wants JSON; the non-streaming branch below accumulates the SSE and converts
+  // it back to JSON (same mechanism already used for Claude-Code-compatible
+  // providers via isClaudeCodeCompatible).
+  const upstreamStream = stream || isClaudeCodeCompatible || providerRequiresStreaming;
   let ccSessionId: string | null = null;
   const stripTypes = getStripTypesForProviderModel(provider || "", model || "");
 
@@ -2224,6 +2239,7 @@ export async function handleChatCore({
         targetFormat,
         credentials,
         log,
+        bypassDefaultToolLimit: isOpencodeClient,
       });
 
       updatePendingScope(pendingScope, {
diff --git a/open-sse/handlers/chatCore/attemptLogging.ts b/open-sse/handlers/chatCore/attemptLogging.ts
index 8c7151e567..9db3efbc74 100644
--- a/open-sse/handlers/chatCore/attemptLogging.ts
+++ b/open-sse/handlers/chatCore/attemptLogging.ts
@@ -51,6 +51,7 @@ export type PersistAttemptLogsContext = {
   apiKeyInfo: { id?: string | null; name?: string | null } | null | undefined;
   noLogEnabled: unknown;
   correlationId?: string | null;
+  modelPinned?: boolean;
 };
 
 function toConnectionId(value: unknown): string | null {
@@ -108,6 +109,7 @@ export function persistAttemptLogs(args: PersistAttemptLogsArgs, ctx: PersistAtt
     apiKeyInfo,
     noLogEnabled,
     correlationId,
+    modelPinned,
   } = ctx;
   const initialConnectionId = toConnectionId(connectionId);
   const finalConnectionId = toConnectionId(credentials?.connectionId) || initialConnectionId;
@@ -203,5 +205,6 @@ export function persistAttemptLogs(args: PersistAttemptLogsArgs, ctx: PersistAtt
     noLog: noLogEnabled,
     pipelinePayloads,
     correlationId,
+    modelPinned: modelPinned || false,
   }).catch(() => {});
 }
diff --git a/open-sse/handlers/chatCore/requestFormat.ts b/open-sse/handlers/chatCore/requestFormat.ts
index 63ad12589b..fa9e9194fb 100644
--- a/open-sse/handlers/chatCore/requestFormat.ts
+++ b/open-sse/handlers/chatCore/requestFormat.ts
@@ -37,6 +37,33 @@ function isCopilotClient(
   return false;
 }
 
+function isOpencodeClient(
+  headers: Headers | Record<string, unknown> | null | undefined,
+  userAgent?: string | null
+): boolean {
+  const matchesUserAgent = (value: unknown) =>
+    typeof value === "string" && value.toLowerCase().includes("opencode");
+  const matchesHeaderKey = (key: string) => key.toLowerCase().startsWith("x-opencode-");
+
+  if (matchesUserAgent(userAgent)) return true;
+
+  if (headers instanceof Headers) {
+    for (const [key, value] of headers as unknown as Iterable<[string, string]>) {
+      if (matchesHeaderKey(key) || (key.toLowerCase() === "user-agent" && matchesUserAgent(value))) {
+        return true;
+      }
+    }
+  } else if (headers && typeof headers === "object") {
+    for (const [key, value] of Object.entries(headers)) {
+      if (matchesHeaderKey(key) || (key.toLowerCase() === "user-agent" && matchesUserAgent(value))) {
+        return true;
+      }
+    }
+  }
+
+  return false;
+}
+
 /**
  * Resolve the per-request endpoint/format facts at the top of handleChatCore. Pure: a function of
  * the inbound endpoint, the (possibly already-mutated) body, the resolved provider, and the
@@ -64,6 +91,7 @@ export function resolveChatCoreRequestFormat(opts: {
   const isDroidCLI =
     userAgent?.toLowerCase().includes("droid") || userAgent?.toLowerCase().includes("codex-cli");
   const copilotCompatibleReasoning = isCopilotClient(clientRawRequest?.headers, userAgent);
+  const isOpencodeClientRequest = isOpencodeClient(clientRawRequest?.headers, userAgent);
   const clientResponseFormat =
     sourceFormat === FORMATS.OPENAI_RESPONSES && !isResponsesEndpoint && !isDroidCLI
       ? FORMATS.OPENAI
@@ -75,6 +103,7 @@ export function resolveChatCoreRequestFormat(opts: {
     nativeCodexPassthrough,
     isDroidCLI,
     copilotCompatibleReasoning,
+    isOpencodeClient: isOpencodeClientRequest,
     clientResponseFormat,
   };
 }
diff --git a/open-sse/handlers/chatCore/upstreamBody.ts b/open-sse/handlers/chatCore/upstreamBody.ts
index 1a302552d8..c426b240a7 100644
--- a/open-sse/handlers/chatCore/upstreamBody.ts
+++ b/open-sse/handlers/chatCore/upstreamBody.ts
@@ -14,7 +14,7 @@ import {
   applyConfiguredPayloadRules,
   resolvePayloadRuleProtocols,
 } from "../../services/payloadRules.ts";
-import { getEffectiveToolLimit } from "../../services/toolLimitDetector.ts";
+import { getEffectiveToolLimit, getKnownToolLimit } from "../../services/toolLimitDetector.ts";
 import { providerSupportsCaching } from "../../utils/cacheControlPolicy.ts";
 import { FORMATS } from "../../translator/formats.ts";
 
@@ -41,15 +41,35 @@ function buildAppliedRulesSummary(
 function truncateToolList(
   bodyToSend: Body,
   provider: string | null | undefined,
+  bypassDefaultToolLimit: boolean,
   log?: LoggerLike
 ): Body {
+  if (!Array.isArray(bodyToSend.tools)) return bodyToSend;
+
+  const knownLimit = getKnownToolLimit(provider);
+  if (knownLimit !== null) {
+    if (bodyToSend.tools.length > knownLimit) {
+      const originalCount = bodyToSend.tools.length;
+      const truncatedTools = bodyToSend.tools.slice(0, knownLimit);
+      bodyToSend = { ...bodyToSend, tools: truncatedTools };
+      log?.debug?.(
+        "TOOL_LIMIT",
+        `Truncated ${originalCount} tools to ${knownLimit} for ${provider}`
+      );
+    }
+    return bodyToSend;
+  }
+
+  if (bypassDefaultToolLimit === true) return bodyToSend;
+
   const effectiveToolLimit = getEffectiveToolLimit(provider);
-  if (Array.isArray(bodyToSend.tools) && bodyToSend.tools.length > effectiveToolLimit) {
+  if (bodyToSend.tools.length > effectiveToolLimit) {
+    const originalCount = bodyToSend.tools.length;
     const truncatedTools = bodyToSend.tools.slice(0, effectiveToolLimit);
     bodyToSend = { ...bodyToSend, tools: truncatedTools };
     log?.debug?.(
       "TOOL_LIMIT",
-      `Truncated ${(bodyToSend.tools as unknown[]).length} tools to ${effectiveToolLimit} for ${provider}`
+      `Truncated ${originalCount} tools to ${effectiveToolLimit} for ${provider}`
     );
   }
   return bodyToSend;
@@ -104,9 +124,18 @@ export async function prepareUpstreamBody(opts: {
   provider: string | null | undefined;
   targetFormat: string;
   credentials: CredentialsLike;
+  bypassDefaultToolLimit?: boolean;
   log?: LoggerLike;
 }): Promise<Body> {
-  const { translatedBody, modelToCall, provider, targetFormat, credentials, log } = opts;
+  const {
+    translatedBody,
+    modelToCall,
+    provider,
+    targetFormat,
+    credentials,
+    bypassDefaultToolLimit = false,
+    log,
+  } = opts;
 
   let bodyToSend: Body =
     translatedBody.model === modelToCall
@@ -131,7 +160,7 @@ export async function prepareUpstreamBody(opts: {
     );
   }
 
-  bodyToSend = truncateToolList(bodyToSend, provider, log);
+  bodyToSend = truncateToolList(bodyToSend, provider, bypassDefaultToolLimit ?? false, log);
   bodyToSend = backfillQwenOAuthUser(bodyToSend, provider, credentials, log);
   bodyToSend = await injectPromptCacheKey(bodyToSend, provider, targetFormat);
 
diff --git a/open-sse/handlers/imageGeneration/providers/chatgptWeb.ts b/open-sse/handlers/imageGeneration/providers/chatgptWeb.ts
index 7faa531f5c..c6b9688b7a 100644
--- a/open-sse/handlers/imageGeneration/providers/chatgptWeb.ts
+++ b/open-sse/handlers/imageGeneration/providers/chatgptWeb.ts
@@ -43,6 +43,9 @@ export async function handleChatGptWebImageGeneration({
   log,
   signal,
   clientHeaders,
+  // Injectable so unit tests can drive the handler without a live ChatGPT
+  // session; production uses the real executor.
+  executorFactory = () => new ChatGptWebExecutor(),
 }) {
   const startTime = Date.now();
   const prompt = typeof body.prompt === "string" ? body.prompt.trim() : "";
@@ -98,7 +101,7 @@ export async function handleChatGptWebImageGeneration({
   };
 
   for (let i = 0; i < requestedCount; i++) {
-    const executor = new ChatGptWebExecutor();
+    const executor = executorFactory();
     const result = await executor.execute({
       model,
       body: {
@@ -124,21 +127,30 @@ export async function handleChatGptWebImageGeneration({
     }
 
     let content = "";
+    let imageResolutionFailed = false;
     try {
       const json = JSON.parse(responseText);
       content = String(json?.choices?.[0]?.message?.content || "");
+      imageResolutionFailed = json?.x_image_resolution_failed === true;
     } catch {
       content = responseText;
     }
 
     const urls = extractMarkdownImageUrls(content);
     if (urls.length === 0) {
+      // Distinguish "image was generated upstream but OmniRoute could not
+      // retrieve it" (executor flagged the unresolved asset pointer) from
+      // "no image was produced at all" — the former is our bug/limitation,
+      // not a failed prompt, so the message must not read as "no image made".
+      const error = imageResolutionFailed
+        ? `ChatGPT Web generated an image but OmniRoute could not retrieve it (the image asset could not be downloaded — the URL may have expired or ChatGPT changed its image delivery format). Please retry; if it persists, report it. Assistant text: ${content.slice(0, 200)}`
+        : `ChatGPT Web completed without returning image markdown: ${content.slice(0, 300)}`;
       return saveImageErrorResult({
         provider,
         model,
         status: 502,
         startTime,
-        error: `ChatGPT Web completed without returning image markdown: ${content.slice(0, 300)}`,
+        error,
         requestBody,
       });
     }
diff --git a/open-sse/mcp-server/server.ts b/open-sse/mcp-server/server.ts
index cbf95b1956..77ee0706b8 100644
--- a/open-sse/mcp-server/server.ts
+++ b/open-sse/mcp-server/server.ts
@@ -67,6 +67,7 @@ import { handlePickFastestModel } from "./tools/pickFastestModel.ts";
 import { memoryTools } from "./tools/memoryTools.ts";
 import { skillTools } from "./tools/skillTools.ts";
 import { agentSkillTools } from "./tools/agentSkillTools.ts";
+import { githubSkillTools } from "./tools/githubSkillTools.ts";
 import { skillRegistry } from "../../src/lib/skills/registry.ts";
 import { skillExecutor } from "../../src/lib/skills/executor.ts";
 import { pluginTools } from "./tools/pluginTools.ts";
@@ -102,6 +103,7 @@ const TOTAL_MCP_TOOL_COUNT =
   Object.keys(memoryTools).length +
   Object.keys(skillTools).length +
   Object.keys(agentSkillTools).length +
+  Object.keys(githubSkillTools).length +
   Object.keys(poolTools).length +
   gamificationTools.length +
   pluginTools.length +
@@ -996,11 +998,11 @@ export function createMcpServer(): McpServer {
       },
       withScopeEnforcement(
         toolDef.name,
-        async (args) => {
+        async (args, extra) => {
           try {
             const parsedArgs = toolDef.inputSchema.parse(args ?? {});
             // @ts-ignore - handler type lost through dynamic Object.values() access
-            const result = await toolDef.handler(parsedArgs);
+            const result = await toolDef.handler(parsedArgs, extra);
             return { content: [{ type: "text" as const, text: JSON.stringify(result, null, 2) }] };
           } catch (err) {
             const msg = err instanceof Error ? err.message : String(err);
@@ -1023,11 +1025,11 @@ export function createMcpServer(): McpServer {
       },
       withScopeEnforcement(
         toolDef.name,
-        async (args) => {
+        async (args, extra) => {
           try {
             const parsedArgs = toolDef.inputSchema.parse(args ?? {});
             // @ts-ignore - handler type lost through dynamic Object.values() access
-            const result = await toolDef.handler(parsedArgs);
+            const result = await toolDef.handler(parsedArgs, extra);
             return { content: [{ type: "text" as const, text: JSON.stringify(result, null, 2) }] };
           } catch (err) {
             const msg = err instanceof Error ? err.message : String(err);
@@ -1041,6 +1043,29 @@ export function createMcpServer(): McpServer {
 
   // ── Agent Skill Tools ─────────────────────────
   Object.values(agentSkillTools).forEach((toolDef) => {
+    server.registerTool(
+      toolDef.name,
+      {
+        description: toolDef.description,
+        // @ts-ignore: dynamic zod access
+        inputSchema: toolDef.inputSchema,
+      },
+      withScopeEnforcement(toolDef.name, async (args, extra) => {
+        try {
+          const parsedArgs = toolDef.inputSchema.parse(args ?? {});
+          // @ts-expect-error - handler type lost through dynamic Object.values() access
+          const result = await toolDef.handler(parsedArgs, extra);
+          return { content: [{ type: "text" as const, text: JSON.stringify(result, null, 2) }] };
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          return { content: [{ type: "text" as const, text: `Error: ${msg}` }], isError: true };
+        }
+      })
+    );
+  });
+
+  // ── GitHub Skill Tools ──────────────────────────
+  Object.values(githubSkillTools).forEach((toolDef) => {
     server.registerTool(
       toolDef.name,
       {
@@ -1058,7 +1083,7 @@ export function createMcpServer(): McpServer {
           const msg = err instanceof Error ? err.message : String(err);
           return { content: [{ type: "text" as const, text: `Error: ${msg}` }], isError: true };
         }
-      })
+      }, toolDef.scopes)
     );
   });
 
@@ -1073,11 +1098,11 @@ export function createMcpServer(): McpServer {
       },
       withScopeEnforcement(
         toolDef.name,
-        async (args) => {
+        async (args, extra) => {
           try {
             const parsedArgs = toolDef.inputSchema.parse(args ?? {});
             // @ts-ignore: handler expected specific object
-            const result = await toolDef.handler(parsedArgs);
+            const result = await toolDef.handler(parsedArgs, extra);
             return { content: [{ type: "text" as const, text: JSON.stringify(result, null, 2) }] };
           } catch (err) {
             const msg = err instanceof Error ? err.message : String(err);
@@ -1100,11 +1125,11 @@ export function createMcpServer(): McpServer {
       },
       withScopeEnforcement(
         toolDef.name,
-        async (args) => {
+        async (args, extra) => {
           try {
             const parsedArgs = toolDef.inputSchema.parse(args ?? {});
             // @ts-ignore - handler type lost through dynamic Object.values() access
-            const result = await toolDef.handler(parsedArgs);
+            const result = await toolDef.handler(parsedArgs, extra);
             return { content: [{ type: "text" as const, text: JSON.stringify(result, null, 2) }] };
           } catch (err) {
             const msg = err instanceof Error ? err.message : String(err);
@@ -1125,7 +1150,7 @@ export function createMcpServer(): McpServer {
       description: string;
       scopes: readonly string[];
       inputSchema: { parse: (input: unknown) => unknown };
-      handler: (parsedArgs: unknown) => Promise<unknown>;
+      handler: (parsedArgs: unknown, extra?: unknown) => Promise<unknown>;
     }) => {
       server.registerTool(
         toolDef.name,
@@ -1136,10 +1161,10 @@ export function createMcpServer(): McpServer {
         },
         withScopeEnforcement(
           toolDef.name,
-          async (args) => {
+          async (args, extra) => {
             try {
               const parsedArgs = toolDef.inputSchema.parse(args ?? {});
-              const result = await toolDef.handler(parsedArgs);
+              const result = await toolDef.handler(parsedArgs, extra);
               return {
                 content: [{ type: "text" as const, text: JSON.stringify(result, null, 2) }],
               };
@@ -1165,11 +1190,11 @@ export function createMcpServer(): McpServer {
       },
       withScopeEnforcement(
         toolDef.name,
-        async (args) => {
+        async (args, extra) => {
           try {
             const parsedArgs = toolDef.inputSchema.parse(args ?? {});
             // @ts-ignore: handler expected specific object
-            const result = await toolDef.handler(parsedArgs);
+            const result = await toolDef.handler(parsedArgs, extra);
             return { content: [{ type: "text" as const, text: JSON.stringify(result, null, 2) }] };
           } catch (err) {
             const msg = err instanceof Error ? err.message : String(err);
@@ -1192,11 +1217,11 @@ export function createMcpServer(): McpServer {
       },
       withScopeEnforcement(
         toolDef.name,
-        async (args) => {
+        async (args, extra) => {
           try {
             const parsedArgs = toolDef.inputSchema.parse(args ?? {});
             // @ts-ignore: handler expected specific object
-            const result = await toolDef.handler(parsedArgs);
+            const result = await toolDef.handler(parsedArgs, extra);
             return { content: [{ type: "text" as const, text: JSON.stringify(result, null, 2) }] };
           } catch (err) {
             const msg = err instanceof Error ? err.message : String(err);
@@ -1219,11 +1244,11 @@ export function createMcpServer(): McpServer {
       },
       withScopeEnforcement(
         toolDef.name,
-        async (args) => {
+        async (args, extra) => {
           try {
             const parsedArgs = toolDef.inputSchema.parse(args ?? {});
             // @ts-ignore: handler expected specific object
-            const result = await toolDef.handler(parsedArgs);
+            const result = await toolDef.handler(parsedArgs, extra);
             return { content: [{ type: "text" as const, text: JSON.stringify(result, null, 2) }] };
           } catch (err) {
             const msg = err instanceof Error ? err.message : String(err);
diff --git a/open-sse/mcp-server/tools/githubSkillTools.ts b/open-sse/mcp-server/tools/githubSkillTools.ts
new file mode 100644
index 0000000000..a67bd8ea5c
--- /dev/null
+++ b/open-sse/mcp-server/tools/githubSkillTools.ts
@@ -0,0 +1,140 @@
+/**
+ * githubSkillTools.ts — MCP tools for GitHub agent skill discovery and import.
+ *
+ * Provides tools to:
+ *   - Search GitHub for repos with SKILL.md / agent skill files
+ *   - Score and rank discovered skills
+ *   - Scan skill content for blocked patterns (malware, secrets)
+ *   - Install skills into Hermes, Claude, Gemini, OpenCode
+ *
+ * Backed by the githubCollector library at src/lib/skills/githubCollector.ts.
+ */
+
+import { z } from "zod";
+import {
+  searchGitHubSkills,
+  scanText,
+  resolveInstallPath,
+  GitHubSkillsSearchSchema,
+  GitHubSkillsScanSchema,
+  GitHubSkillsInstallSchema,
+  INSTALL_TARGETS,
+  type GitHubSkillRepo,
+  type SkillInstallResult,
+} from "@/lib/skills/githubCollector";
+
+// ── Handlers ─────────────────────────────────────────────────────────────────
+
+async function handleSearch(args: z.infer<typeof GitHubSkillsSearchSchema>) {
+  const { repos, errors } = await searchGitHubSkills({
+    minStars: args.minStars,
+    maxResults: args.maxResults,
+  });
+
+  let filtered = repos;
+  if (args.minScore > 0) filtered = filtered.filter((r) => r.score >= args.minScore);
+  if (args.query) {
+    const q = args.query.toLowerCase();
+    filtered = filtered.filter(
+      (r) => r.fullName.toLowerCase().includes(q) || r.description.toLowerCase().includes(q)
+    );
+  }
+
+  return {
+    skills: filtered.map((r: GitHubSkillRepo) => ({
+      fullName: r.fullName,
+      stars: r.stars,
+      score: r.score,
+      description: r.description.slice(0, 200),
+      topics: r.topics,
+      htmlUrl: r.htmlUrl,
+      hasSkillFile: r.hasSkillFile,
+      license: r.license,
+    })),
+    total: filtered.length,
+    errors: errors.length > 0 ? errors : undefined,
+  };
+}
+
+async function handleScan(args: z.infer<typeof GitHubSkillsScanSchema>) {
+  const findings = scanText(args.content, args.repoName);
+  return {
+    repoName: args.repoName,
+    clean: findings.length === 0,
+    findings: findings.map((f) => ({
+      pattern: f.pattern,
+      context: f.context,
+    })),
+  };
+}
+
+async function handleInstall(args: z.infer<typeof GitHubSkillsInstallSchema>) {
+  const results: SkillInstallResult[] = [];
+  const skillName = args.repoName.split("/").pop() || args.repoName;
+
+  for (const target of args.targets) {
+    try {
+      const dest = resolveInstallPath(target, skillName, args.description);
+      // In a real implementation, this would clone the repo and copy files.
+      // For now, we return the planned install path as a dry-run result.
+      results.push({
+        target,
+        ok: true,
+        action: "installed",
+        destDir: dest,
+      });
+    } catch (err) {
+      results.push({
+        target,
+        ok: false,
+        action: "error",
+        error: (err as Error).message,
+      });
+    }
+  }
+
+  return {
+    repoName: args.repoName,
+    skillName,
+    results,
+    allOk: results.every((r) => r.ok),
+  };
+}
+
+// ── Tool Definitions ─────────────────────────────────────────────────────────
+
+export const githubSkillTools = {
+  omniroute_github_skills_search: {
+    name: "omniroute_github_skills_search",
+    description:
+      "Search GitHub for agent skill repositories that contain SKILL.md, CLAUDE.md, .cursorrules, or similar agent configuration files. " +
+      "Returns scored results sorted by relevance. Scores are 0.0–1.0 based on stars, name signals, description keywords, and topic tags. " +
+      "Ideal for discovering community agent skills from GitHub.",
+    inputSchema: GitHubSkillsSearchSchema,
+    scopes: ["read:skills"],
+    handler: handleSearch,
+  },
+
+  omniroute_github_skills_scan: {
+    name: "omniroute_github_skills_scan",
+    description:
+      "Scan SKILL.md or README content from a GitHub repo for blocked patterns including eval(base64), " +
+      "hardcoded secrets (API keys, passwords, private keys), dangerous function calls (os.system, subprocess.Popen), " +
+      "and other malware indicators. Returns findings with context or 'clean' status.",
+    inputSchema: GitHubSkillsScanSchema,
+    scopes: ["read:skills"],
+    handler: handleScan,
+  },
+
+  omniroute_github_skills_install: {
+    name: "omniroute_github_skills_install",
+    description:
+      "Preview or plan the installation of a discovered GitHub skill into one or more agent directories " +
+      "(Hermes: ~/AppData/Local/hermes/skills/, Claude: ~/.claude/skills/, Gemini: ~/.gemini/skills/, " +
+      "OpenCode: ~/.opencode/skills/). Categorizes the skill based on its name and description. " +
+      "Returns the target paths where the skill would be installed.",
+    inputSchema: GitHubSkillsInstallSchema,
+    scopes: ["read:skills", "write:skills"],
+    handler: handleInstall,
+  },
+};
diff --git a/open-sse/services/ccWireImageBuiltins.ts b/open-sse/services/ccWireImageBuiltins.ts
new file mode 100644
index 0000000000..870e4f78f1
--- /dev/null
+++ b/open-sse/services/ccWireImageBuiltins.ts
@@ -0,0 +1,26 @@
+/**
+ * Built-in provider ids that must adopt the dynamic Claude-Code wire image
+ * (fingerprint headers/order + system transforms + `?beta=true` chat path)
+ * WITHOUT inheriting the Claude-Code-Compatible family's default anthropic
+ * baseUrl / Bearer auth.
+ *
+ * These providers keep their own registry `baseUrl` and auth scheme
+ * (e.g. `agentrouter` → `https://agentrouter.org/v1/messages` + `x-api-key`),
+ * while the two CC predicates (`isClaudeCodeCompatible` /
+ * `isClaudeCodeCompatibleProvider`) and `applyFingerprint` treat them as CC
+ * for the wire-image concerns only. The CC-baseUrl / CC-Bearer branches in
+ * `buildProviderUrl` / `buildProviderHeaders` are guarded so the registry
+ * baseUrl + auth are preserved.
+ *
+ * Single source of truth — imported by both predicates so they never diverge.
+ * See issue #6056.
+ */
+export const CC_WIRE_IMAGE_BUILTINS: ReadonlySet<string> = new Set(["agentrouter"]);
+
+/**
+ * True when `provider` is a built-in that adopts the dynamic Claude-Code wire
+ * image while keeping its own registry baseUrl + auth.
+ */
+export function usesCcWireImage(provider: unknown): boolean {
+  return typeof provider === "string" && CC_WIRE_IMAGE_BUILTINS.has(provider);
+}
diff --git a/open-sse/services/claudeCodeCompatible.ts b/open-sse/services/claudeCodeCompatible.ts
index 4fd5f22711..eff67c4203 100644
--- a/open-sse/services/claudeCodeCompatible.ts
+++ b/open-sse/services/claudeCodeCompatible.ts
@@ -15,6 +15,7 @@ import {
 import { applyClaudeCodeCompatibleThinkingDisplay } from "./claudeCodeCompatibleThinkingDisplay.ts";
 import { obfuscateInBody } from "./claudeCodeObfuscation.ts";
 import { applySystemTransformPipeline, PROVIDER_CC_BRIDGE } from "./systemTransforms.ts";
+import { usesCcWireImage } from "./ccWireImageBuiltins.ts";
 import {
   fixToolPairs,
   fixToolAdjacency,
@@ -95,7 +96,12 @@ function supportsClaudeXHighEffort(model: string | null | undefined): boolean {
 }
 
 export function isClaudeCodeCompatibleProvider(provider: string | null | undefined): boolean {
-  return typeof provider === "string" && provider.startsWith(CLAUDE_CODE_COMPATIBLE_PREFIX);
+  return (
+    (typeof provider === "string" && provider.startsWith(CLAUDE_CODE_COMPATIBLE_PREFIX)) ||
+    // Built-in providers (e.g. agentrouter) that adopt the dynamic CC wire image
+    // while keeping their own registry baseUrl + auth (#6056).
+    usesCcWireImage(provider)
+  );
 }
 
 export function stripAnthropicMessagesSuffix(baseUrl: string | null | undefined): string {
diff --git a/open-sse/services/combo.ts b/open-sse/services/combo.ts
index a86bf5d90f..c78970360d 100644
--- a/open-sse/services/combo.ts
+++ b/open-sse/services/combo.ts
@@ -12,6 +12,7 @@ import {
   formatRetryAfter,
   getModelLockoutInfo,
   getRuntimeProviderProfile,
+  hasPerModelQuota,
   isModelLocked,
   recordModelLockoutFailure,
   recordProviderFailure,
@@ -58,7 +59,11 @@ import { handlePipelineCombo, buildPipelineResponse } from "./autoCombo/pipeline
 import { type ProviderCandidate } from "./autoCombo/scoring.ts";
 import { estimateTokens } from "./contextManager.ts";
 import { getSessionConnection } from "./sessionManager.ts";
-import { applySessionStickiness, recordStickyBinding } from "./combo/sessionStickiness.ts";
+import {
+  applySessionStickiness,
+  recordStickyBinding,
+  resolveDisableSessionStickiness,
+} from "./combo/sessionStickiness.ts";
 import { selectQuotaShareTarget } from "./combo/quotaShareStrategy.ts";
 import { makeConnectionConcurrencyResolver, lookupPositiveCap } from "./combo/concurrencyCaps.ts";
 import { acquireQuotaShareConcurrencySlot } from "./combo/quotaShareConcurrency.ts";
@@ -103,7 +108,11 @@ import {
   getStickyWeightedExecutionKey,
   recordStickyWeightedSuccess,
 } from "./combo/rrState.ts";
-import { validateResponseQuality, toRetryAfterDisplayValue } from "./combo/validateQuality.ts";
+import {
+  validateResponseQuality,
+  releaseQualityClone,
+  toRetryAfterDisplayValue,
+} from "./combo/validateQuality.ts";
 import { resolveComboCooldownWaitDecision } from "./combo/comboCooldownRetry.ts";
 import {
   computeClosestRetryAfter,
@@ -701,7 +710,50 @@ export async function handleComboChat({
         "COMBO",
         `Bypassing strategy — routing directly to pinned context model: ${pinnedModel}`
       );
-      return handleSingleModelWithTimeout(body, pinnedModel);
+      let pinnedResult: Response | null = null;
+      try {
+        pinnedResult = await handleSingleModelWithTimeout(body, pinnedModel, {
+          modelPinned: true,
+        } as SingleModelTarget);
+      } catch (pinErr) {
+        log.warn(
+          "COMBO",
+          `Pinned model ${pinnedModel} threw error: ${pinErr instanceof Error ? pinErr.message : String(pinErr)}, falling through to combo retry/fallback`
+        );
+      }
+      if (pinnedResult) {
+        if (pinnedResult.ok) {
+          let pinnedClone: Response;
+          try {
+            pinnedClone = pinnedResult.clone();
+          } catch {
+            pinnedClone = pinnedResult;
+          }
+          const pinnedQuality = await validateResponseQuality(
+            pinnedClone,
+            clientRequestedStream,
+            log,
+            config.responseValidation
+          );
+          releaseQualityClone(pinnedClone, pinnedResult, pinnedQuality);
+          if (pinnedQuality.valid) return pinnedResult;
+          log.warn(
+            "COMBO",
+            `Pinned model ${pinnedModel} returned 200 but failed quality check: ${pinnedQuality.reason}, falling through to combo retry/fallback`
+          );
+        } else {
+          const pinnedStatus = pinnedResult.status || 500;
+          if (![408, 429, 500, 502, 503, 504].includes(pinnedStatus)) {
+            return pinnedResult;
+          }
+          log.warn(
+            "COMBO",
+            `Pinned model ${pinnedModel} failed (${pinnedStatus}), falling through to combo retry/fallback`
+          );
+        }
+      }
+      // Fall through to the target iteration loop below — retries and sibling
+      // models will be tried via the normal combo machinery.
     }
     log.warn(
       "COMBO",
@@ -709,7 +761,8 @@ export async function handleComboChat({
         ? `Context-cache pin "${pinnedModel}" provider durably unhealthy — dropping pin, using strategy`
         : `Stale context-cache pin "${pinnedModel}" not in combo "${combo.name}" targets — dropping pin, using strategy`
     );
-    return handleSingleModelWithTimeout(body, pinnedModel);
+    // Fall through to the normal target iteration loop below — the pin is
+    // dropped, so the combo strategy picks the best available target.
   }
 
   // Fusion strategy: parallel panel + judge synthesis. Handled in a separate module
@@ -1069,10 +1122,20 @@ export async function handleComboChat({
       apiKeyAllowedConnections,
     });
   }
-  const _sticky = await applySessionStickiness(
-    orderedTargets,
-    body.messages as Array<{ role?: string; content?: unknown }>
+  // #6168: session stickiness opt-out. Per-combo `config.disableSessionStickiness`
+  // overrides the global `settings.disableSessionStickiness` fallback (default false,
+  // preserving the #3825 prompt-cache/504 fix). When disabled, skip the reorder and
+  // treat the result as a no-op so the recordStickyBinding write-back below is skipped.
+  const disableSessionStickiness = resolveDisableSessionStickiness(
+    config as Record<string, unknown> | null | undefined,
+    settings as Record<string, unknown> | null | undefined
   );
+  const _sticky = disableSessionStickiness
+    ? ({ targets: orderedTargets, messageHash: null, stuck: false } as const)
+    : await applySessionStickiness(
+        orderedTargets,
+        body.messages as Array<{ role?: string; content?: unknown }>
+      );
   orderedTargets = _sticky.targets;
   orderedTargets = orderTargetsByEvalScores(orderedTargets, config.evalRouting, log);
   orderedTargets = filterTargetsByRequestCompatibility(orderedTargets, body, log);
@@ -1490,12 +1553,22 @@ export async function handleComboChat({
               undefined;
             const effectiveConnectionId = selectedConnectionId || target.connectionId || "";
 
+            // Clone BEFORE quality check — validateResponseQuality reads the body
+            // via getReader() which locks the stream. The clone's body is consumed
+            // by the quality check; the original stays unlocked for piping.
+            let qualityClone: Response;
+            try {
+              qualityClone = result.clone();
+            } catch {
+              qualityClone = result;
+            }
             const quality = await validateResponseQuality(
-              result,
+              qualityClone,
               clientRequestedStream,
               log,
               config.responseValidation
             );
+            releaseQualityClone(qualityClone, result, quality);
             if (!quality.valid) {
               log.warn(
                 "COMBO",
@@ -1730,7 +1803,7 @@ export async function handleComboChat({
               })();
             }
 
-            return { ok: true, response: quality.clonedResponse ?? result };
+            return { ok: true, response: result };
           }
 
           // Extract error info from response
@@ -2009,7 +2082,16 @@ export async function handleComboChat({
           }
           log.warn("COMBO", `Model ${modelStr} failed, trying next`, { status: result.status });
 
-          if (resilienceSettings.providerCooldown.enabled && provider && provider !== "unknown") {
+          // #5976: per-model-quota providers (Gemini, GitHub, etc.) multiplex models
+          // behind one connection. A model-level 500 must NOT cool down the entire
+          // provider — sibling models may still succeed. Skip cooldown recording for
+          // these providers on 500 errors so the next target can try.
+          if (
+            resilienceSettings.providerCooldown.enabled &&
+            provider &&
+            provider !== "unknown" &&
+            !(result.status === 500 && hasPerModelQuota(provider, rawModel))
+          ) {
             recordProviderCooldown(
               provider,
               targetWithConnection.connectionId ?? undefined,
@@ -2389,10 +2471,19 @@ async function handleRoundRobinCombo({
   // call — so sessionless RR combos rotated every turn, busting the upstream prompt-cache.
   // Reuse the SAME mechanism: start the rotation at the conversation's sticky connection
   // (the loop still falls through to the other targets on failure → failover preserved).
-  const _rrSessionSticky = await applySessionStickiness(
-    filteredTargets,
-    body?.messages as Array<{ role?: string; content?: unknown }>
+  // #6168: honor the session-stickiness opt-out here too, otherwise round-robin would
+  // still pin the conversation even when the flag is set. Per-combo `config` overrides
+  // the global `settings.disableSessionStickiness` fallback (default false).
+  const disableSessionStickiness = resolveDisableSessionStickiness(
+    config as Record<string, unknown> | null | undefined,
+    settings as Record<string, unknown> | null | undefined
   );
+  const _rrSessionSticky = disableSessionStickiness
+    ? ({ targets: filteredTargets, messageHash: null, stuck: false } as const)
+    : await applySessionStickiness(
+        filteredTargets,
+        body?.messages as Array<{ role?: string; content?: unknown }>
+      );
   let rrStartIndex = startIndex;
   if (_rrSessionSticky.stuck) {
     const stickyIdx = filteredTargets.findIndex(
@@ -2549,12 +2640,19 @@ async function handleRoundRobinCombo({
 
         // Success — validate response quality before returning
         if (result.ok) {
+          let rrClone: Response;
+          try {
+            rrClone = result.clone();
+          } catch {
+            rrClone = result;
+          }
           const quality = await validateResponseQuality(
-            result,
+            rrClone,
             clientRequestedStream,
             log,
             config.responseValidation
           );
+          releaseQualityClone(rrClone, result, quality);
           if (!quality.valid) {
             log.warn(
               "COMBO-RR",
@@ -2642,12 +2740,8 @@ async function handleRoundRobinCombo({
               }
             })();
           }
-          // validateResponseQuality peeks streaming bodies via getReader(),
-          // which locks `result.body`. It returns a clonedResponse that replays
-          // the buffered prefix and forwards the rest. Returning the original
-          // (now-locked) `result` makes Next.js throw "ReadableStream is locked"
-          // → 500. Mirror the priority strategy and return the replay response.
-          return quality.clonedResponse ?? result;
+          // Clone is consumed by quality check; original stays unlocked.
+          return result;
         }
 
         // Extract error info
@@ -2824,7 +2918,12 @@ async function handleRoundRobinCombo({
         if (offset > 0) fallbackCount++;
         log.warn("COMBO-RR", `${modelStr} failed, trying next model`, { status: result.status });
 
-        if (resilienceSettings.providerCooldown.enabled && provider && provider !== "unknown") {
+        if (
+          resilienceSettings.providerCooldown.enabled &&
+          provider &&
+          provider !== "unknown" &&
+          !(result.status === 500 && hasPerModelQuota(provider, parseModel(modelStr).model || modelStr))
+        ) {
           recordProviderCooldown(
             provider,
             targetWithConnection.connectionId ?? undefined,
diff --git a/open-sse/services/combo/runtimeUnits.ts b/open-sse/services/combo/runtimeUnits.ts
index 96951b81a2..d106ade336 100644
--- a/open-sse/services/combo/runtimeUnits.ts
+++ b/open-sse/services/combo/runtimeUnits.ts
@@ -2,7 +2,7 @@
 import { errorResponse } from "../../utils/error.ts";
 import { recordComboRequest } from "../comboMetrics.ts";
 import { resolveDelayMs } from "./comboPredicates.ts";
-import { validateResponseQuality } from "./validateQuality.ts";
+import { validateResponseQuality, releaseQualityClone } from "./validateQuality.ts";
 import type { ResponseValidationConfig } from "./responseValidation.ts";
 import type {
   ComboCollectionLike,
@@ -228,12 +228,19 @@ export async function executeRuntimeUnitCombo(args: {
           });
           return { response, unit };
         }
+        let unitClone: Response;
+        try {
+          unitClone = response.clone();
+        } catch {
+          unitClone = response;
+        }
         const quality = await validateResponseQuality(
-          response,
+          unitClone,
           clientRequestedStream,
           args.log,
           args.config.responseValidation as ResponseValidationConfig | undefined
         );
+        releaseQualityClone(unitClone, response, quality);
         if (quality.valid) {
           recordComboRequest(args.combo.name, unit.modelStr, {
             success: true,
@@ -242,7 +249,7 @@ export async function executeRuntimeUnitCombo(args: {
             strategy: effectiveStrategy,
             target: { executionKey: unit.executionKey, stepId: unit.stepId, label: unit.label },
           });
-          return { response: quality.clonedResponse ?? response, unit };
+          return { response, unit };
         }
       }
       if (![408, 429, 500, 502, 503, 504].includes(response.status)) break;
diff --git a/open-sse/services/combo/sessionStickiness.ts b/open-sse/services/combo/sessionStickiness.ts
index 1b81548106..5bb8779a94 100644
--- a/open-sse/services/combo/sessionStickiness.ts
+++ b/open-sse/services/combo/sessionStickiness.ts
@@ -191,6 +191,26 @@ export function clearAllStickyBindings(): void {
   stickyMap.clear();
 }
 
+/**
+ * #6168: resolve the session-stickiness opt-out for a combo request.
+ *
+ * Precedence (mirrors the `stickyRoundRobinLimit` resolution in combo.ts):
+ *   per-combo `config.disableSessionStickiness` (boolean) →
+ *   global `settings.disableSessionStickiness` (boolean) →
+ *   default `false`.
+ *
+ * Default `false` preserves the #3825 prompt-cache/504 fix — only an explicit
+ * `true` at either level disables stickiness.
+ */
+export function resolveDisableSessionStickiness(
+  config: Record<string, unknown> | null | undefined,
+  settings: Record<string, unknown> | null | undefined
+): boolean {
+  const perCombo = config?.disableSessionStickiness;
+  if (typeof perCombo === "boolean") return perCombo;
+  return settings?.disableSessionStickiness === true;
+}
+
 // ─── Core: apply stickiness to an ordered target list ────────────────────────
 
 export interface ApplyStickinessResult {
diff --git a/open-sse/services/combo/types.ts b/open-sse/services/combo/types.ts
index 766d6f71d9..290b0964d7 100644
--- a/open-sse/services/combo/types.ts
+++ b/open-sse/services/combo/types.ts
@@ -46,6 +46,8 @@ export type SingleModelTarget =
       allowRateLimitedConnection?: boolean;
       effectiveComboStrategy?: string | null;
       modelAbortSignal?: AbortSignal | null;
+      /** True when this target was selected via context-cache session pinning. */
+      modelPinned?: boolean;
     })
   | { modelAbortSignal: AbortSignal };
 
diff --git a/open-sse/services/combo/validateQuality.ts b/open-sse/services/combo/validateQuality.ts
index fe7b00313e..2bab070a21 100644
--- a/open-sse/services/combo/validateQuality.ts
+++ b/open-sse/services/combo/validateQuality.ts
@@ -10,10 +10,7 @@ import {
   createSSEDataLineNormalizer,
   isKnownNonClaudeStreamPayload,
 } from "../../utils/streamHelpers.ts";
-import {
-  evaluateResponseValidation,
-  type ResponseValidationConfig,
-} from "./responseValidation.ts";
+import { evaluateResponseValidation, type ResponseValidationConfig } from "./responseValidation.ts";
 import { getReasoningTokens } from "../../../src/lib/usage/tokenAccounting.ts";
 import type { ComboRetryAfter } from "./types.ts";
 
@@ -99,6 +96,8 @@ export async function validateResponseQuality(
     let hasMessageStart = false;
     let hasContentBlock = false;
     let hasLifecycleEnd = false;
+    let anyContentFound = false;
+    let sawAnyBytes = false;
     const sseLineNormalizer = createSSEDataLineNormalizer();
     let pendingEventType = "";
 
@@ -236,6 +235,20 @@ export async function validateResponseQuality(
             return { valid: false, reason: "streaming empty content block" };
           }
 
+          // Stream ended with a truly EMPTY body (e.g. Gemini returning HTTP
+          // 200 with zero bytes) — mark as invalid for combo failover so the
+          // sibling model gets tried. Streams that carried ANY SSE activity
+          // (an explicit `data: [DONE]`, ping/metadata events, an incomplete
+          // Claude lifecycle) keep the pass-through contract (#3399/#3685):
+          // those are handled by the stream-readiness timeout, not failover.
+          if (!anyContentFound && !hasContentBlock && !sawAnyBytes) {
+            log.warn?.(
+              "COMBO",
+              "Streaming response ended with no recognized content — marking as invalid for combo failover"
+            );
+            return { valid: false, reason: "streaming no recognized content" };
+          }
+
           // Incomplete lifecycle or non-Claude stream — replay all buffered
           // bytes. The reader is exhausted so the forwarding reader will
           // immediately signal done.
@@ -245,12 +258,14 @@ export async function validateResponseQuality(
 
         // Accumulate raw bytes for potential replay.
         bufferedChunks.push(value);
+        if (value && value.length > 0) sawAnyBytes = true;
 
         // Decode incrementally (stream:true keeps multi-byte char state).
         decodedSoFar += decoder.decode(value, { stream: true });
         const foundContent = parseAccumulatedSse();
 
         if (foundContent) {
+          anyContentFound = true;
           // A content_block_* event was found — stop peeking. Return a
           // clonedResponse that replays all buffered bytes (the current chunk
           // is already in bufferedChunks) and then forwards the remainder of
@@ -259,9 +274,23 @@ export async function validateResponseQuality(
           return { valid: true, clonedResponse };
         }
       }
-    } catch {
-      // If reading the stream fails, pass through — other mechanisms
-      // (stream readiness timeout) will catch truly broken streams.
+    } catch (streamErr) {
+      // If reading the stream fails due to a locked stream or pipe error,
+      // the content cannot be verified — mark as invalid for combo failover.
+      // A locked ReadableStream means the response body is already consumed
+      // or corrupted (e.g. "Invalid state: The ReadableStream is locked").
+      // Broad match: Chrome/V8 throws "body used already", Firefox throws
+      // "ReadableStream is locked", etc.
+      const errMsg = streamErr instanceof Error ? streamErr.message : String(streamErr);
+      if (
+        streamErr instanceof TypeError &&
+        (errMsg.includes("locked") ||
+          errMsg.includes("disturbed") ||
+          errMsg.includes("used already"))
+      ) {
+        return { valid: false, reason: "stream locked or disturbed" };
+      }
+      // Other read errors — pass through (stream readiness timeout will catch truly broken streams)
       return { valid: true };
     }
   }
@@ -308,7 +337,8 @@ export async function validateResponseQuality(
 
   const choices = json?.choices;
   if (json?.object === "response") {
-    if (!responsesApiOutputHasContent(json.output)) return { valid: false, reason: "empty_choices" };
+    if (!responsesApiOutputHasContent(json.output))
+      return { valid: false, reason: "empty_choices" };
     const status = typeof json.status === "string" ? json.status : "";
     if (status && !["completed", "done"].includes(status)) {
       return { valid: false, reason: "no_terminal" };
@@ -389,3 +419,27 @@ export async function validateResponseQuality(
     }),
   };
 }
+
+/**
+ * Release the peek-and-abandon clone used by {@link validateResponseQuality}.
+ *
+ * The quality check clones the upstream response, reads the clone only until the
+ * first content block, then hands back a `clonedResponse` that callers on the
+ * streaming path DISCARD (they forward the original, untouched response). Because
+ * a `Response.clone()` tees the body, that abandoned branch would otherwise buffer
+ * the entire remaining body in memory until the original finishes streaming.
+ *
+ * Cancelling the abandoned branch releases that buffer. Per the ReadableStream tee
+ * contract, cancelling one branch does NOT cancel the shared source while the other
+ * branch (the original response being streamed to the client) is still active, so
+ * this is safe. No-op when the clone fell back to the original (clone unsupported)
+ * or when quality reading already exhausted the body (no `clonedResponse`).
+ */
+export function releaseQualityClone(
+  clone: Response,
+  original: Response,
+  quality: { clonedResponse?: Response }
+): void {
+  if (clone === original) return;
+  void quality.clonedResponse?.body?.cancel().catch(() => {});
+}
diff --git a/open-sse/services/githubCopilotModels.ts b/open-sse/services/githubCopilotModels.ts
index b24a57c3e8..5ccbcb623b 100644
--- a/open-sse/services/githubCopilotModels.ts
+++ b/open-sse/services/githubCopilotModels.ts
@@ -20,6 +20,32 @@
 import { getGitHubCopilotChatHeaders } from "../config/providerHeaderProfiles.ts";
 
 export const GITHUB_COPILOT_MODELS_URL = "https://api.githubcopilot.com/models";
+export const GITHUB_COPILOT_MODEL_ALLOWLIST = [
+  "claude-fable-5",
+  "claude-opus-4.8-fast",
+  "claude-opus-4.8",
+  "claude-opus-4.7",
+  "claude-sonnet-4.6",
+  "claude-opus-4.5",
+  "claude-sonnet-5",
+  "claude-sonnet-4.5",
+  "claude-haiku-4.5",
+  "gemini-3.1-pro-preview",
+  "gemini-3.5-flash",
+  "gpt-5.5",
+  "gpt-5.4",
+  "gpt-5.4-mini",
+  "gpt-5.3-codex",
+  "gpt-5-mini",
+  "gpt-4o-2024-11-20",
+  "gpt-4o-mini",
+  "gpt-4-0125-preview",
+  "kimi-k2.7-code",
+  "mai-code-1-flash",
+  "oswe-vscode-prime",
+] as const;
+
+const GITHUB_COPILOT_MODEL_ALLOWLIST_SET = new Set<string>(GITHUB_COPILOT_MODEL_ALLOWLIST);
 
 export type GitHubCopilotModel = {
   id: string;
@@ -59,6 +85,7 @@ export function parseGitHubCopilotModels(data: unknown): GitHubCopilotModel[] {
     const item = asRecord(value);
     const id = toNonEmptyString(item.id) || toNonEmptyString(item.model);
     if (!id || seen.has(id)) continue;
+    if (!GITHUB_COPILOT_MODEL_ALLOWLIST_SET.has(id)) continue;
     seen.add(id);
     const name = toNonEmptyString(item.name) || toNonEmptyString(item.display_name) || id;
     models.push({ id, name, owned_by: "github" });
@@ -89,6 +116,7 @@ function toFallbackResult(
     .map((model) => {
       const id = toNonEmptyString(model.id);
       if (!id) return null;
+      if (!GITHUB_COPILOT_MODEL_ALLOWLIST_SET.has(id)) return null;
       return { id, name: toNonEmptyString(model.name) || id, owned_by: "github" };
     })
     .filter((model): model is GitHubCopilotModel => Boolean(model));
diff --git a/open-sse/services/provider.ts b/open-sse/services/provider.ts
index 9149c7e70b..9ba0a0acff 100644
--- a/open-sse/services/provider.ts
+++ b/open-sse/services/provider.ts
@@ -8,6 +8,7 @@ import {
 } from "./claudeCodeCompatible.ts";
 import { getClaudeCodeCompatibleRequestDefaults } from "@/lib/providers/requestDefaults";
 import { buildClineHeaders } from "@/shared/utils/clineAuth";
+import { usesCcWireImage } from "./ccWireImageBuiltins.ts";
 
 const OPENAI_COMPATIBLE_PREFIX = "openai-compatible-";
 const OPENAI_COMPATIBLE_DEFAULTS = {
@@ -29,7 +30,12 @@ function isAnthropicCompatible(provider) {
 }
 
 export function isClaudeCodeCompatible(provider) {
-  return typeof provider === "string" && provider.startsWith(CLAUDE_CODE_COMPATIBLE_PREFIX);
+  return (
+    (typeof provider === "string" && provider.startsWith(CLAUDE_CODE_COMPATIBLE_PREFIX)) ||
+    // Built-in providers (e.g. agentrouter) that adopt the dynamic CC wire image
+    // while keeping their own registry baseUrl + auth (#6056).
+    usesCcWireImage(provider)
+  );
 }
 
 export function getOpenAICompatibleType(
@@ -256,6 +262,15 @@ export function buildProviderUrl(
     providerSpecificData?: Record<string, unknown> | null;
   } = {}
 ) {
+  // Built-in CC-wire-image providers (e.g. agentrouter): keep the registry's
+  // OWN baseUrl (NOT the CC family's anthropic default) but adopt the CC chat
+  // path so the request still targets `<registry-baseUrl>?beta=true` (#6056).
+  if (usesCcWireImage(provider)) {
+    const entry = getRegistryEntry(provider);
+    const config = getProviderConfig(provider);
+    const baseUrl = options?.baseUrl || entry?.baseUrl || config.baseUrl;
+    return joinClaudeCodeCompatibleUrl(baseUrl, CLAUDE_CODE_COMPATIBLE_DEFAULT_CHAT_PATH);
+  }
   if (isOpenAICompatible(provider)) {
     const providerSpecificData = options?.providerSpecificData || null;
     const apiType = getOpenAICompatibleType(provider, providerSpecificData);
@@ -318,12 +333,27 @@ export function buildProviderHeaders(provider, credentials, stream = true, body
     const ccRequestDefaults = getClaudeCodeCompatibleRequestDefaults(
       credentials?.providerSpecificData
     );
-    return buildClaudeCodeCompatibleHeaders(
+    const ccHeaders = buildClaudeCodeCompatibleHeaders(
       token,
       stream,
       credentials?.providerSpecificData?.ccSessionId,
       { redactThinking: ccRequestDefaults.redactThinking === true }
     );
+    // Built-in CC-wire-image providers (e.g. agentrouter): adopt the CC wire
+    // image headers but keep the registry's OWN auth scheme (e.g. x-api-key)
+    // instead of the CC family's Bearer auth (#6056).
+    if (usesCcWireImage(provider)) {
+      delete ccHeaders["Authorization"];
+      const authHeader = entry?.authHeader || "bearer";
+      if (authHeader === "x-api-key") {
+        if (token) ccHeaders["x-api-key"] = token;
+      } else if (authHeader === "key") {
+        if (token) ccHeaders["Authorization"] = `Key ${token}`;
+      } else {
+        ccHeaders["Authorization"] = `Bearer ${token}`;
+      }
+    }
+    return ccHeaders;
   }
   if (isAnthropicCompatible(provider)) {
     if (credentials.apiKey) {
diff --git a/open-sse/services/tokenExtractionConfig.ts b/open-sse/services/tokenExtractionConfig.ts
index 7d141bacc1..8d7736f7e1 100644
--- a/open-sse/services/tokenExtractionConfig.ts
+++ b/open-sse/services/tokenExtractionConfig.ts
@@ -110,9 +110,7 @@ const RAW_CONFIGS: TokenExtractionConfig[] = [
     "ChatGPT Web",
     "https://chatgpt.com/auth/login",
     "https://chatgpt.com",
-    [
-      { type: "cookie", name: "__Secure-next-auth.session-token", domain: ".chatgpt.com" },
-    ],
+    [{ type: "cookie", name: "__Secure-next-auth.session-token", domain: ".chatgpt.com" }],
     "Log in to ChatGPT. The __Secure-next-auth.session-token cookie will be extracted after login."
   ),
 
@@ -146,9 +144,7 @@ const RAW_CONFIGS: TokenExtractionConfig[] = [
     "Perplexity Web",
     "https://www.perplexity.ai/login",
     "https://www.perplexity.ai",
-    [
-      { type: "cookie", name: "__Secure-next-auth.session-token", domain: ".perplexity.ai" },
-    ],
+    [{ type: "cookie", name: "__Secure-next-auth.session-token", domain: ".perplexity.ai" }],
     "Log in to Perplexity. The __Secure-next-auth.session-token cookie will be extracted.",
     { cookieDomain: ".perplexity.ai" }
   ),
@@ -195,9 +191,7 @@ const RAW_CONFIGS: TokenExtractionConfig[] = [
     "Kimi (Moonshot)",
     "https://www.kimi.com/",
     "https://www.kimi.com",
-    [
-      { type: "cookie", name: "kimi-auth", domain: ".kimi.com" },
-    ],
+    [{ type: "cookie", name: "kimi-auth", domain: ".kimi.com" }],
     "Log in to Kimi at www.kimi.com (international). The kimi-auth JWT cookie will be extracted.",
     { cookieDomain: ".kimi.com" }
   ),
@@ -222,9 +216,7 @@ const RAW_CONFIGS: TokenExtractionConfig[] = [
     "Poe (Quora)",
     "https://poe.com/login",
     "https://poe.com",
-    [
-      { type: "cookie", name: "p-b", domain: ".poe.com" },
-    ],
+    [{ type: "cookie", name: "p-b", domain: ".poe.com" }],
     "Log in to Poe at poe.com. The session cookie will be extracted.",
     { cookieDomain: ".poe.com" }
   ),
@@ -235,9 +227,7 @@ const RAW_CONFIGS: TokenExtractionConfig[] = [
     "Microsoft Copilot",
     "https://copilot.microsoft.com/",
     "https://copilot.microsoft.com",
-    [
-      { type: "cookie", name: "RPSCAuth", domain: ".microsoft.com" },
-    ],
+    [{ type: "cookie", name: "RPSCAuth", domain: ".microsoft.com" }],
     "Log in with your Microsoft account at copilot.microsoft.com. The session auth cookie will be extracted.",
     { cookieDomain: ".microsoft.com" }
   ),
@@ -248,9 +238,7 @@ const RAW_CONFIGS: TokenExtractionConfig[] = [
     "DuckDuckGo AI Chat",
     "https://duckduckgo.com/?q=DuckDuckGo+AI+Chat&ia=chat&duckai=1",
     "https://duckduckgo.com",
-    [
-      { type: "cookie", name: "duckai", domain: ".duckduckgo.com" },
-    ],
+    [{ type: "cookie", name: "duckai", domain: ".duckduckgo.com" }],
     "Open DuckDuckGo AI Chat. Some models may require a free account. The duckai cookie will be extracted.",
     {
       cookieDomain: ".duckduckgo.com",
@@ -258,17 +246,19 @@ const RAW_CONFIGS: TokenExtractionConfig[] = [
     }
   ),
 
-  // ── DouBao Web ────────────────────────────────────────────
+  // ── Dola Web ──────────────────────────────────────────────
   config(
     "doubao-web",
-    "DouBao (ByteDance)",
-    "https://www.doubao.com/",
-    "https://www.doubao.com",
+    "Dola (ByteDance)",
+    "https://www.dola.com/",
+    "https://www.dola.com",
     [
-      { type: "cookie", name: "sessionid", domain: ".doubao.com" },
+      { type: "cookie", name: "sessionid", domain: ".dola.com" },
+      { type: "cookie", name: "ttwid", domain: ".dola.com" },
+      { type: "cookie", name: "s_v_web_id", domain: ".dola.com" },
     ],
-    "Log in to DouBao at doubao.com with your ByteDance account. The sessionid will be extracted.",
-    { cookieDomain: ".doubao.com" }
+    "Log in to Dola at www.dola.com with your ByteDance account. sessionid, ttwid, and s_v_web_id will be extracted.",
+    { cookieDomain: ".dola.com" }
   ),
 
   // ── T3 Chat Web ───────────────────────────────────────────
@@ -277,9 +267,7 @@ const RAW_CONFIGS: TokenExtractionConfig[] = [
     "T3 Chat",
     "https://t3.chat/login",
     "https://t3.chat",
-    [
-      { type: "localStorage", key: "token" },
-    ],
+    [{ type: "localStorage", key: "token" }],
     "Log in to T3 Chat at t3.chat using Google/GitHub. The token from localStorage will be extracted.",
     { pollingConfig: QUICK_POLLING }
   ),
@@ -304,9 +292,7 @@ const RAW_CONFIGS: TokenExtractionConfig[] = [
     "v0 by Vercel",
     "https://v0.dev/login",
     "https://v0.dev",
-    [
-      { type: "cookie", name: "__Secure-next-auth.session-token", domain: ".v0.dev" },
-    ],
+    [{ type: "cookie", name: "__Secure-next-auth.session-token", domain: ".v0.dev" }],
     "Log in to v0.dev with your Vercel/Google/GitHub account. The session cookie will be extracted.",
     { cookieDomain: ".v0.dev" }
   ),
@@ -317,9 +303,7 @@ const RAW_CONFIGS: TokenExtractionConfig[] = [
     "Meta AI (Muse)",
     "https://www.meta.ai/",
     "https://www.meta.ai",
-    [
-      { type: "cookie", name: "session", domain: ".meta.ai" },
-    ],
+    [{ type: "cookie", name: "session", domain: ".meta.ai" }],
     "Log in to Meta AI at meta.ai with your Facebook/Instagram account. The session cookie will be extracted.",
     { cookieDomain: ".meta.ai" }
   ),
@@ -330,9 +314,7 @@ const RAW_CONFIGS: TokenExtractionConfig[] = [
     "Adapta AI",
     "https://agent.adapta.one/login",
     "https://agent.adapta.one",
-    [
-      { type: "cookie", name: "__session", domain: ".adapta.one" },
-    ],
+    [{ type: "cookie", name: "__session", domain: ".adapta.one" }],
     "Log in to Adapta at agent.adapta.one. The session token will be extracted.",
     { cookieDomain: ".adapta.one" }
   ),
@@ -343,9 +325,7 @@ const RAW_CONFIGS: TokenExtractionConfig[] = [
     "VeoAI Free",
     "https://veoaifree.com/",
     "https://veoaifree.com",
-    [
-      { type: "cookie", name: "wordpress_logged_in", domain: ".veoaifree.com" },
-    ],
+    [{ type: "cookie", name: "wordpress_logged_in", domain: ".veoaifree.com" }],
     "Log in to VeoAI Free at veoaifree.com. The WordPress session cookie will be extracted.",
     {
       cookieDomain: ".veoaifree.com",
diff --git a/open-sse/services/toolLimitDetector.ts b/open-sse/services/toolLimitDetector.ts
index 48969fcb12..b743aedb0b 100644
--- a/open-sse/services/toolLimitDetector.ts
+++ b/open-sse/services/toolLimitDetector.ts
@@ -6,6 +6,7 @@ const DEFAULT_LIMIT = MAX_TOOLS_LIMIT;
 
 const PROVIDER_TOOL_LIMITS: Record<string, number> = {
   "grok-cli": 200,
+  "nvidia": 1536,
 };
 
 const _detectedLimitsSweep = setInterval(() => {
@@ -18,7 +19,7 @@ if (typeof _detectedLimitsSweep === "object" && "unref" in _detectedLimitsSweep)
   (_detectedLimitsSweep as { unref?: () => void }).unref?.();
 }
 
-export function getEffectiveToolLimit(provider: string): number {
+export function getKnownToolLimit(provider: string | null | undefined): number | null {
   const proactiveLimit = PROVIDER_TOOL_LIMITS[provider];
   if (proactiveLimit !== undefined) {
     return proactiveLimit;
@@ -27,7 +28,11 @@ export function getEffectiveToolLimit(provider: string): number {
   if (cached && Date.now() - cached.timestamp < TTL_MS) {
     return cached.limit;
   }
-  return DEFAULT_LIMIT;
+  return null;
+}
+
+export function getEffectiveToolLimit(provider: string | null | undefined): number {
+  return getKnownToolLimit(provider) ?? DEFAULT_LIMIT;
 }
 
 export function setDetectedToolLimit(provider: string, limit: number): void {
diff --git a/open-sse/translator/paramSupport.ts b/open-sse/translator/paramSupport.ts
index 08e0e807a4..a0a3a70bab 100644
--- a/open-sse/translator/paramSupport.ts
+++ b/open-sse/translator/paramSupport.ts
@@ -29,6 +29,9 @@ const STRIP_RULES: StripRule[] = [
       /claude/i.test(m) && !/claude.*(opus|sonnet).*4\.6/i.test(m),
     drop: ["thinking", "reasoning_effort"],
   },
+  // NVIDIA NIM z-ai/glm-5.2: OpenAI-compatible wrapper rejects the `reasoning`
+  // body field → HTTP 400 "Unsupported parameter(s): `reasoning`". #6102 drop pattern.
+  { provider: "nvidia", match: /z-ai\/glm-5\.2\b/i, drop: ["reasoning"] },
   // NVIDIA NIM minimaxai/minimax-m2.7: NVIDIA's OpenAI-compatible wrapper
   // (format:"openai") does not accept the Claude-style `thinking` body field
   // and returns 400 "Unsupported parameter(s): thinking". Upstream #2268.
diff --git a/open-sse/translator/request/openai-to-kiro.ts b/open-sse/translator/request/openai-to-kiro.ts
index fc6d39abfd..8508fe54d0 100644
--- a/open-sse/translator/request/openai-to-kiro.ts
+++ b/open-sse/translator/request/openai-to-kiro.ts
@@ -5,6 +5,7 @@
 import { register } from "../registry.ts";
 import { FORMATS } from "../formats.ts";
 import { v4 as uuidv4, v5 as uuidv5 } from "uuid";
+import { capMaxOutputTokens, capThinkingBudget, supportsReasoning } from "@/lib/modelCapabilities";
 import {
   parseToolInput,
   normalizeKiroToolSchema,
@@ -57,9 +58,9 @@ function convertMessages(messages, tools, model) {
   let toolsAttached = false;
 
   // Only Claude models support images in Kiro. Kiro also routes non-Claude
-  // models (deepseek, minimax, glm, qwen3-coder-next, auto-kiro) that do not
-  // accept image attachments — gate image extraction behind a Claude check so
-  // we never attach images those models would reject.
+  // models (deepseek, minimax, glm, qwen3-coder-next) that do not accept image
+  // attachments — gate image extraction behind a Claude check so we never
+  // attach images those models would reject.
   const supportsImages = typeof model === "string" && model.toLowerCase().includes("claude");
 
   const flushPending = () => {
@@ -575,6 +576,80 @@ function convertMessages(messages, tools, model) {
   return { history: alternatingHistory, currentMessage, toolsAttached };
 }
 
+/** Kiro's accepted reasoning-effort levels (`output_config.effort`). */
+const KIRO_EFFORT_LEVELS = ["low", "medium", "high", "xhigh", "max"];
+
+/**
+ * Resolve the Kiro effort level for a request, or "" when no reasoning was asked
+ * for. Effort sources, in priority order:
+ *   1. OpenAI-style `reasoning_effort`
+ *   2. Anthropic adaptive-thinking `output_config.effort` (the canonical field)
+ *   3. Anthropic `thinking` block — `{type:"enabled", budget_tokens}` mapped to a
+ *      level via {@link effortFromBudget}; `{type:"adaptive"}` (no explicit
+ *      effort) defaults to `high`, matching Anthropic's documented default
+ *      (omitting `effort` ≡ `high`).
+ * OpenAI's `minimal` collapses to `low` (Kiro has no `minimal`).
+ */
+function resolveKiroEffort(body: Record<string, unknown>): string {
+  let effort = typeof body.reasoning_effort === "string" ? body.reasoning_effort.toLowerCase() : "";
+
+  if (!effort) {
+    const outputConfig = body.output_config as Record<string, unknown> | undefined;
+    if (
+      outputConfig &&
+      typeof outputConfig === "object" &&
+      typeof outputConfig.effort === "string"
+    ) {
+      effort = outputConfig.effort.toLowerCase();
+    }
+  }
+
+  if (!effort) {
+    const thinking = body.thinking as Record<string, unknown> | undefined;
+    if (thinking && typeof thinking === "object") {
+      if (thinking.type === "enabled") {
+        effort = effortFromBudget(Number(thinking.budget_tokens) || 0);
+      } else if (thinking.type === "adaptive") {
+        effort = "high";
+      }
+    }
+  }
+
+  if (effort === "minimal") effort = "low";
+  return KIRO_EFFORT_LEVELS.includes(effort) ? effort : "";
+}
+
+/** Map an Anthropic `thinking.budget_tokens` to a coarse Kiro effort level. */
+function effortFromBudget(budget: number): string {
+  if (budget >= 32000) return "high";
+  if (budget >= 16000) return "medium";
+  if (budget > 0) return "low";
+  return "";
+}
+
+/**
+ * Soft `<max_thinking_length>` budget for the Kiro prompt directive, per effort
+ * level. Anthropic publishes no effort→token mapping (effort is "a behavioral
+ * signal, not a strict token budget"), so this is a heuristic tuned against the
+ * live CodeWhisperer stream, where a larger budget measurably deepens reasoning
+ * up to the model cap. It is a hint the model may honor, not a hard cap (the hard
+ * enable signal is `<thinking_mode>`); the caller clamps it to the model's cap.
+ */
+function thinkingLengthForEffort(effort: string): number {
+  switch (effort) {
+    case "max":
+      return 120000;
+    case "xhigh":
+      return 64000;
+    case "high":
+      return 32000;
+    case "medium":
+      return 16000;
+    default:
+      return 8000; // low
+  }
+}
+
 /**
  * Build Kiro payload from OpenAI format
  */
@@ -683,6 +758,11 @@ export function buildKiroPayload(model, body, stream, credentials) {
       temperature?: number;
       topP?: number;
     };
+    additionalModelRequestFields?: {
+      thinking?: { type: string; display?: string };
+      output_config?: { effort: string };
+      max_tokens?: number;
+    };
   } = {
     conversationState: {
       chatTriggerType: "MANUAL",
@@ -754,6 +834,55 @@ export function buildKiroPayload(model, body, stream, credentials) {
     if (topP !== undefined) payload.inferenceConfig.topP = topP;
   }
 
+  // Thinking mode for Claude models on Kiro (ported from javargasm/pi-kiro).
+  // Two coordinated signals steer reasoning on the CodeWhisperer surface:
+  //   1. a `<thinking_mode>enabled</thinking_mode><max_thinking_length>N</...>`
+  //      directive prepended to the current user message — makes Claude emit its
+  //      reasoning INLINE as `<thinking>…</thinking>`, which the Kiro executor
+  //      splits back into the OpenAI `reasoning_content` channel (kiroThinking.ts);
+  //   2. top-level `additionalModelRequestFields` (output_config.effort +
+  //      thinking:{type:"adaptive"} + a clamped max_tokens), forwarded to AWS by
+  //      the Kiro executor's transformRequest allowlist — this is the graded
+  //      effort lever. Gated on models that advertise thinking support.
+  const kiroEffort = supportsReasoning(normalizedModel) ? resolveKiroEffort(body) : "";
+  if (kiroEffort) {
+    // `<thinking_mode>` / `<max_thinking_length>` are Kiro/CodeWhisperer prompt
+    // conventions (NOT Anthropic API params); the length is a soft hint (the hard
+    // enable signal is `<thinking_mode>`), clamped to the model's thinking cap.
+    const thinkingLength = capThinkingBudget(normalizedModel, thinkingLengthForEffort(kiroEffort));
+    const directive =
+      `<thinking_mode>enabled</thinking_mode>` +
+      `<max_thinking_length>${thinkingLength}</max_thinking_length>`;
+    payload.conversationState.currentMessage.userInputMessage.content = `${directive}\n\n${payload.conversationState.currentMessage.userInputMessage.content}`;
+
+    const fields: {
+      output_config: { effort: string };
+      thinking: { type: string; display: string };
+      max_tokens?: number;
+    } = {
+      output_config: { effort: kiroEffort },
+      thinking: { type: "adaptive", display: "summarized" },
+    };
+    // Forward max_tokens only when the client set one, clamped to the model's
+    // output window (floor 1024) — matches pi-kiro and avoids an over-budget reject.
+    if (maxTokens > 0) {
+      const capped = capMaxOutputTokens(normalizedModel, maxTokens) ?? maxTokens;
+      fields.max_tokens = Math.max(Math.floor(capped), 1024);
+    }
+    payload.additionalModelRequestFields = fields;
+
+    // Adaptive-only Claude models (Opus 4.7/4.8, Sonnet 5, Fable 5) reject a
+    // non-default temperature / top_p with a 400 while thinking is active, so
+    // strip both. Drop inferenceConfig entirely if nothing else remains.
+    if (payload.inferenceConfig) {
+      delete payload.inferenceConfig.temperature;
+      delete payload.inferenceConfig.topP;
+      if (Object.keys(payload.inferenceConfig).length === 0) {
+        delete payload.inferenceConfig;
+      }
+    }
+  }
+
   return payload;
 }
 
diff --git a/open-sse/utils/earlyStreamKeepalive.ts b/open-sse/utils/earlyStreamKeepalive.ts
index db2b98f194..c70180f927 100644
--- a/open-sse/utils/earlyStreamKeepalive.ts
+++ b/open-sse/utils/earlyStreamKeepalive.ts
@@ -54,6 +54,8 @@ export type EarlyStreamKeepaliveOptions = {
    * for their stream watchdog and only a real `event: ping` keeps them from aborting.
    */
   keepaliveFrame?: Uint8Array;
+  /** Extra headers to include in the keepalive response (e.g. X-Correlation-Id). */
+  extraHeaders?: Record<string, string>;
 };
 
 type SettledHandler = { ok: true; response: Response } | { ok: false; error: unknown };
@@ -66,6 +68,7 @@ export async function withEarlyStreamKeepalive(
   const intervalMs = Math.max(250, options.intervalMs ?? 2_500);
   const signal = options.signal ?? null;
   const keepaliveFrame = options.keepaliveFrame ?? KEEPALIVE_FRAME;
+  const extraHeaders = options.extraHeaders ?? {};
 
   // Settle into a tagged result so neither race branch leaves an unhandled
   // rejection when the threshold timer wins.
@@ -154,10 +157,25 @@ export async function withEarlyStreamKeepalive(
           if (response.body && isSse) {
             // Real SSE stream — forward it verbatim.
             upstreamReader = response.body.getReader();
-            while (true) {
-              const { done, value } = await upstreamReader.read();
-              if (done) break;
-              if (value) controller.enqueue(value);
+            let bytesForwarded = 0;
+            try {
+              while (true) {
+                const { done, value } = await upstreamReader.read();
+                if (done) break;
+                if (value) {
+                  controller.enqueue(value);
+                  bytesForwarded += value.byteLength;
+                }
+              }
+            } catch (readErr) {
+              // Upstream stream failed mid-flight. Only emit an error frame if
+              // NO content was forwarded yet — otherwise the client already
+              // received partial content and a late error frame would corrupt
+              // the SSE stream. Silently close instead; the client will see
+              // the stream end naturally.
+              if (bytesForwarded === 0) {
+                controller.enqueue(ERROR_FRAME);
+              }
             }
           } else {
             // Non-SSE response (e.g. a JSON error) reached us after we already
@@ -204,6 +222,7 @@ export async function withEarlyStreamKeepalive(
       "Content-Type": "text/event-stream; charset=utf-8",
       "Cache-Control": "no-cache, no-transform",
       Connection: "keep-alive",
+      ...extraHeaders,
     },
   });
 }
diff --git a/open-sse/utils/finishReason.ts b/open-sse/utils/finishReason.ts
index 79221ad07f..5d8ab33667 100644
--- a/open-sse/utils/finishReason.ts
+++ b/open-sse/utils/finishReason.ts
@@ -13,6 +13,7 @@ const SAFETY_FINISH_REASONS = new Set([
   "prohibited_content",
   "content_filtered",
   "policy_violation",
+  "malformed_response",
 ]);
 
 export function normalizeOpenAICompatibleFinishReason(value: unknown): unknown {
diff --git a/package-lock.json b/package-lock.json
index a9c4af7c2d..22a61ed804 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -103,7 +103,7 @@
         "@testing-library/react": "^16.3.2",
         "@types/better-sqlite3": "^7.6.13",
         "@types/bun": "latest",
-        "@types/node": "^26.0.0",
+        "@types/node": "^26.1.0",
         "@types/react": "^19.2.15",
         "@types/react-dom": "^19.2.3",
         "@types/safe-regex": "^1.1.6",
@@ -9500,9 +9500,9 @@
       "license": "MIT"
     },
     "node_modules/@types/node": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.0.1.tgz",
-      "integrity": "sha512-fc3KiUoBt6kie0N9bIW3E47vZsuaMf0PM2AaUpLCLT0s/LvX1nxAim6Fc049cNxODPpGm6qRAuUOB86SkRuPQw==",
+      "version": "26.1.0",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.1.0.tgz",
+      "integrity": "sha512-O0A1G3xPGy4w7AgQdAQYUlQ+BKk2Oovw8eRpofyp5KdBZULnbe+WqaOVNrm705SHphCiG4XHsACrSmPu1f+Kgw==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
diff --git a/package.json b/package.json
index 4b5e40b5f3..3105eecbe5 100644
--- a/package.json
+++ b/package.json
@@ -309,7 +309,7 @@
     "@testing-library/react": "^16.3.2",
     "@types/better-sqlite3": "^7.6.13",
     "@types/bun": "latest",
-    "@types/node": "^26.0.0",
+    "@types/node": "^26.1.0",
     "@types/react": "^19.2.15",
     "@types/react-dom": "^19.2.3",
     "@types/safe-regex": "^1.1.6",
diff --git a/scripts/build/build-next-isolated.mjs b/scripts/build/build-next-isolated.mjs
index 28681bb299..09dc26bb89 100644
--- a/scripts/build/build-next-isolated.mjs
+++ b/scripts/build/build-next-isolated.mjs
@@ -108,7 +108,12 @@ function runNextBuild() {
 }
 
 export function resolveNextBuildBundlerFlag(baseEnv = process.env) {
-  return baseEnv.OMNIROUTE_USE_TURBOPACK === "1" ? "--turbopack" : "--webpack";
+  // Turbopack is the default production bundler (Next 16 stable). Benchmarked on
+  // this codebase: 2-3x faster than the single-threaded webpack pass (17min -> 9min
+  // on a 32-core box; ~20min -> 7min on ubuntu-latest), artifact validated
+  // end-to-end (standalone smoke + e2e/package/electron CI jobs). Webpack stays as
+  // the explicit escape hatch (=0) for bundler-compat regressions.
+  return baseEnv.OMNIROUTE_USE_TURBOPACK === "0" ? "--webpack" : "--turbopack";
 }
 
 export function resolveNextBuildEnv(baseEnv = process.env) {
diff --git a/scripts/dev/run-next-playwright.mjs b/scripts/dev/run-next-playwright.mjs
index e4e800f26f..37a7055e8c 100644
--- a/scripts/dev/run-next-playwright.mjs
+++ b/scripts/dev/run-next-playwright.mjs
@@ -187,7 +187,8 @@ const testServerEnv = {
 };
 
 export function shouldUseWebpackForPlaywrightDev({ mode, env }) {
-  return mode === "dev" && env.OMNIROUTE_USE_TURBOPACK !== "1";
+  // Webpack only on the explicit escape hatch (=0) — turbopack is the default.
+  return mode === "dev" && env.OMNIROUTE_USE_TURBOPACK === "0";
 }
 
 function runChild(command, args, env) {
diff --git a/scripts/dev/run-next.mjs b/scripts/dev/run-next.mjs
index 5b8a9af0ce..38f914d2e3 100644
--- a/scripts/dev/run-next.mjs
+++ b/scripts/dev/run-next.mjs
@@ -68,7 +68,10 @@ process.env.NODE_ENV = dev ? "development" : "production";
 
 const { dashboardPort } = runtimePorts;
 const hostname = process.env.HOST || "0.0.0.0";
-const useTurbopack = dev && mergedEnv.OMNIROUTE_USE_TURBOPACK === "1";
+// Turbopack by default in dev (matches the Next 16 CLI default and the production
+// build default in build-next-isolated.mjs); OMNIROUTE_USE_TURBOPACK=0 is the
+// webpack escape hatch.
+const useTurbopack = dev && mergedEnv.OMNIROUTE_USE_TURBOPACK !== "0";
 process.env.OMNIROUTE_WS_BRIDGE_SECRET ||= randomUUID();
 // Per-process secret used to prove the trusted peer-IP stamp came from this
 // server (read by the authz middleware in the same process). See peer-stamp.mjs.
diff --git a/scripts/quality/validate-release-green.mjs b/scripts/quality/validate-release-green.mjs
index 78091ce8ab..3c1323b3d8 100644
--- a/scripts/quality/validate-release-green.mjs
+++ b/scripts/quality/validate-release-green.mjs
@@ -53,7 +53,9 @@ const npmCmd = process.platform === "win32" ? "npm.cmd" : "npm";
 /** Read the committed ratchet baseline value for a metric (null if unknown). */
 export function baselineValue(metric, root = ROOT) {
   try {
-    const raw = JSON.parse(readFileSync(join(root, "config/quality/quality-baseline.json"), "utf8"));
+    const raw = JSON.parse(
+      readFileSync(join(root, "config/quality/quality-baseline.json"), "utf8")
+    );
     const metrics = raw.metrics || raw;
     const v = metrics?.[metric]?.value;
     return typeof v === "number" ? v : null;
@@ -178,7 +180,13 @@ function main() {
   const hardCmd = (id, label, cmd, cmdArgs, opts) => {
     announce(label);
     const { code, out } = run(cmd, cmdArgs, opts);
-    record({ id, label, kind: "hard", ok: code === 0, detail: code === 0 ? "pass" : firstFailureLine(out) });
+    record({
+      id,
+      label,
+      kind: "hard",
+      ok: code === 0,
+      detail: code === 0 ? "pass" : firstFailureLine(out),
+    });
   };
 
   // A ratchet command (check:complexity, check:dead-code, …) exits 1 ONLY on a
@@ -189,7 +197,13 @@ function main() {
   const driftCmd = (id, label, cmd, cmdArgs, okDetail = "within baseline", opts) => {
     announce(label);
     const { code, out } = run(cmd, cmdArgs, opts);
-    record({ id, label, kind: "drift", ok: code === 0, detail: code === 0 ? okDetail : firstFailureLine(out) });
+    record({
+      id,
+      label,
+      kind: "drift",
+      ok: code === 0,
+      detail: code === 0 ? okDetail : firstFailureLine(out),
+    });
   };
 
   process.stderr.write("🔎 Release-green validation (current working tree)\n\n");
@@ -198,14 +212,41 @@ function main() {
 
   // ESLint: ONE pass → errors (hard) + warnings (drift)
   {
-    announce("ESLint (errors + warnings — ~3-6min)");
-    const { out } = run("npx", ["eslint", ".", "--format", "json"], { timeout: 15 * 60 * 1000 });
+    announce("ESLint (errors + warnings — ~5-15min)");
+    // Suppressions-aware, matching `npm run lint` (Pacote 4 no-new-warnings): the frozen
+    // pre-existing debt in config/quality/eslint-suppressions.json must not count as
+    // errors here — only NET-NEW violations are release reds. Timeout raised: a full
+    // repo pass takes ~14min alone and this pre-flight often runs alongside test suites.
+    const { out } = run(
+      "npx",
+      [
+        "eslint",
+        ".",
+        "--format",
+        "json",
+        "--suppressions-location",
+        "config/quality/eslint-suppressions.json",
+      ],
+      { timeout: 30 * 60 * 1000 }
+    );
     const parsed = parseEslintJson(out);
     if (!parsed) {
-      record({ id: "lint", label: "ESLint", kind: "hard", ok: false, detail: "could not parse eslint json" });
+      record({
+        id: "lint",
+        label: "ESLint",
+        kind: "hard",
+        ok: false,
+        detail: "could not parse eslint json",
+      });
     } else {
       const { errors, warnings } = eslintCounts(parsed);
-      record({ id: "lint-errors", label: "ESLint errors", kind: "hard", ok: errors === 0, detail: `${errors} error(s)` });
+      record({
+        id: "lint-errors",
+        label: "ESLint errors",
+        kind: "hard",
+        ok: errors === 0,
+        detail: `${errors} error(s)`,
+      });
       const base = baselineValue("eslintWarnings");
       const over = isDrift(warnings, base);
       record({
@@ -283,9 +324,20 @@ function main() {
   driftCmd("complexity", "Cyclomatic complexity (ratchet)", npmCmd, ["run", "check:complexity"]);
   driftCmd("dead-code", "Dead-code (ratchet)", npmCmd, ["run", "check:dead-code"]);
   driftCmd("type-coverage", "Type coverage (ratchet)", npmCmd, ["run", "check:type-coverage"]);
-  driftCmd("compression-budget", "Compression budget (ratchet)", npmCmd, ["run", "check:compression-budget"]);
-  driftCmd("openapi-coverage", "OpenAPI route coverage (ratchet)", npmCmd, ["run", "check:openapi-coverage"]);
-  driftCmd("workflow-lint", "Workflow lint (zizmor ratchet)", npmCmd, ["run", "check:workflows", "--", "--ratchet"]);
+  driftCmd("compression-budget", "Compression budget (ratchet)", npmCmd, [
+    "run",
+    "check:compression-budget",
+  ]);
+  driftCmd("openapi-coverage", "OpenAPI route coverage (ratchet)", npmCmd, [
+    "run",
+    "check:openapi-coverage",
+  ]);
+  driftCmd("workflow-lint", "Workflow lint (zizmor ratchet)", npmCmd, [
+    "run",
+    "check:workflows",
+    "--",
+    "--ratchet",
+  ]);
   driftCmd("codeql-ratchet", "CodeQL alerts (ratchet)", npmCmd, ["run", "check:codeql-ratchet"]);
 
   // Docs sync + fabricated-docs (strict) is a real-defect gate (invented env vars /
@@ -298,15 +350,35 @@ function main() {
     // with 15 such reds). They run SILENTLY for many minutes; the announce line above + these
     // hard ceilings keep a long-but-healthy run from being mistaken for a hang (the ceiling also
     // converts a genuine DB-handle hang into a visible failure instead of an infinite block).
-    hardCmd("unit", "Unit tests (full suite, CI concurrency — runs ~20-35min silently)", npmCmd, ["run", "test:unit:ci"], { timeout: 45 * 60 * 1000 });
-    hardCmd("vitest", "Vitest (MCP / autoCombo / cache — ~3-8min)", npmCmd, ["run", "test:vitest"], { timeout: 15 * 60 * 1000 });
+    hardCmd(
+      "unit",
+      "Unit tests (full suite, CI concurrency — runs ~20-35min silently)",
+      npmCmd,
+      ["run", "test:unit:ci"],
+      { timeout: 45 * 60 * 1000 }
+    );
+    hardCmd(
+      "vitest",
+      "Vitest (MCP / autoCombo / cache — ~3-8min)",
+      npmCmd,
+      ["run", "test:vitest"],
+      { timeout: 15 * 60 * 1000 }
+    );
     // Integration tests run ONLY on the release PR full CI (PR→main), so an assertion
     // regression here (e.g. a contributor flipping a Codex fingerprint key order) is
     // invisible until release — run them in the pre-flight as a HARD gate.
-    hardCmd("integration", "Integration tests (~3-10min)", npmCmd, ["run", "test:integration"], { timeout: 20 * 60 * 1000 });
+    hardCmd("integration", "Integration tests (~3-10min)", npmCmd, ["run", "test:integration"], {
+      timeout: 20 * 60 * 1000,
+    });
   }
   if (WITH_BUILD) {
-    hardCmd("pack-artifact", "Package artifact (npm pack policy)", npmCmd, ["run", "check:pack-artifact"], { timeout: 20 * 60 * 1000 });
+    hardCmd(
+      "pack-artifact",
+      "Package artifact (npm pack policy)",
+      npmCmd,
+      ["run", "check:pack-artifact"],
+      { timeout: 20 * 60 * 1000 }
+    );
   }
 
   const { releaseGreen, hardFailures, drift } = computeVerdict(results);
diff --git a/scripts/vps/release-runner-down.sh b/scripts/vps/release-runner-down.sh
new file mode 100755
index 0000000000..dd27087cad
--- /dev/null
+++ b/scripts/vps/release-runner-down.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Desliga a VM self-hosted (VPS 113) ao fim do release e volta o CI para o GitHub-hosted.
+# Idempotente: seguro chamar mesmo que a VM já esteja desligada.
+#
+# Uso:  scripts/vps/release-runner-down.sh
+set -uo pipefail
+
+PVE_HOST="${PVE_HOST:-192.168.0.100}"
+VM_ID="${VM_ID:-113}"
+REPO="${REPO:-diegosouzapw/OmniRoute}"
+SSH="ssh -o BatchMode=yes -o ConnectTimeout=8"
+
+# 1) Volta o CI para ubuntu-latest ANTES de derrubar a VM (evita jobs presos).
+echo "[release-runner] USE_VPS_RUNNER=false (CI volta ao GitHub-hosted)."
+gh variable set USE_VPS_RUNNER --repo "$REPO" --body "false" >/dev/null 2>&1 || true
+
+# 2) Shutdown graceful da VM (libera os 32 cores / 24GB de volta ao host).
+echo "[release-runner] desligando VM $VM_ID (graceful)..."
+$SSH "root@$PVE_HOST" "qm shutdown $VM_ID --timeout 120" 2>/dev/null \
+  || $SSH "root@$PVE_HOST" "qm stop $VM_ID" 2>/dev/null \
+  || echo "[release-runner] ⚠️  não consegui desligar a VM $VM_ID — verifique manualmente."
+echo "[release-runner] pronto."
diff --git a/scripts/vps/release-runner-up.sh b/scripts/vps/release-runner-up.sh
new file mode 100755
index 0000000000..8f35066d33
--- /dev/null
+++ b/scripts/vps/release-runner-up.sh
@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# Liga a VM self-hosted (VPS 113) e aguarda seus runners ficarem online, para a fase
+# de release usar runners dedicados (anti-fila). Falha => o caller cai no GitHub-hosted.
+#
+# Uso:  scripts/vps/release-runner-up.sh [timeout_seg]
+# Saída: exit 0 + seta a repo-var USE_VPS_RUNNER=true  quando >=1 runner omni-release online
+#        exit 1 + seta USE_VPS_RUNNER=false            em qualquer falha/timeout (fallback)
+#
+# Pré-requisitos no host que roda o /generate-release:
+#   - chave SSH autorizada em root@$PVE_HOST (Proxmox) e root@$VPS_HOST (a VM)
+#   - gh autenticado com admin no repo (para ler runners + setar a variable)
+set -uo pipefail
+
+PVE_HOST="${PVE_HOST:-192.168.0.100}"   # Proxmox host
+VPS_HOST="${VPS_HOST:-192.168.0.113}"   # a VM dos runners
+VM_ID="${VM_ID:-113}"
+REPO="${REPO:-diegosouzapw/OmniRoute}"
+LABEL="${RUNNER_LABEL:-omni-release}"
+TIMEOUT="${1:-120}"
+SSH="ssh -o BatchMode=yes -o ConnectTimeout=8"
+
+fallback() {
+  echo "[release-runner] ⚠️  $1 — usando GitHub-hosted (fallback)."
+  gh variable set USE_VPS_RUNNER --repo "$REPO" --body "false" >/dev/null 2>&1 || true
+  exit 1
+}
+
+echo "[release-runner] ligando VM $VM_ID no Proxmox $PVE_HOST..."
+$SSH "root@$PVE_HOST" "qm start $VM_ID" 2>/dev/null || true   # ok se já estiver rodando
+
+echo "[release-runner] aguardando runners '$LABEL' ficarem online (timeout ${TIMEOUT}s)..."
+deadline=$(( $(date +%s) + TIMEOUT ))
+while [ "$(date +%s)" -lt "$deadline" ]; do
+  online=$(gh api "repos/$REPO/actions/runners" \
+    --jq "[.runners[] | select(.status==\"online\") | select(.labels[].name==\"$LABEL\")] | length" \
+    2>/dev/null || echo 0)
+  if [ "${online:-0}" -ge 1 ]; then
+    echo "[release-runner] ✅ $online runner(s) '$LABEL' online — usando a VPS."
+    gh variable set USE_VPS_RUNNER --repo "$REPO" --body "true" >/dev/null 2>&1 \
+      || fallback "não consegui setar USE_VPS_RUNNER"
+    exit 0
+  fi
+  sleep 6
+done
+fallback "runners não ficaram online a tempo"
diff --git a/skills/omni-github-skills/SKILL.md b/skills/omni-github-skills/SKILL.md
new file mode 100644
index 0000000000..da835d38e1
--- /dev/null
+++ b/skills/omni-github-skills/SKILL.md
@@ -0,0 +1,22 @@
+---
+name: omni-github-skills
+description: Search, score, scan, and import agent skills from GitHub repositories that contain SKILL.md, CLAUDE.md, .cursorrules, and similar agent skill files. Discover community skills across 160+ provider categories, evaluate relevance with heuristic scoring, check for malware or hardcoded secrets, and install into Hermes, Claude Code, Gemini CLI, or OpenCode agent directories.
+---
+
+<!-- generated by src/lib/agentSkills/generator.ts; manual edits will be overwritten -->
+
+## Overview
+
+Search, score, scan, and import agent skills from GitHub repositories that contain SKILL.md, CLAUDE.md, .cursorrules, and similar agent skill files. Discover community skills across 160+ provider categories, evaluate relevance with heuristic scoring, check for malware or hardcoded secrets, and install into Hermes, Claude Code, Gemini CLI, or OpenCode agent directories.
+
+## Authentication
+
+All requests require a valid Bearer token or session cookie. Obtain a token via `POST /api/auth/login` or configure `REQUIRE_API_KEY=false` for local development.
+
+## Endpoints
+
+_No endpoints mapped for this area yet._
+
+## Payloads
+
+See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
diff --git a/src/app/(dashboard)/dashboard/combos/WeightTotalBar.tsx b/src/app/(dashboard)/dashboard/combos/WeightTotalBar.tsx
index 3d0a6cbe65..bacb890994 100644
--- a/src/app/(dashboard)/dashboard/combos/WeightTotalBar.tsx
+++ b/src/app/(dashboard)/dashboard/combos/WeightTotalBar.tsx
@@ -20,6 +20,20 @@ const WEIGHT_COLORS = [
   "bg-indigo-500",
 ];
 
+/**
+ * #6147 — effective routing share of a weighted target.
+ *
+ * The per-target `weight` values do not have to sum to 100; at routing time each
+ * target is picked with probability `weight / Σweights`. So a raw weight of 30
+ * with a total of 60 is an *effective* 50% share. This pure helper computes that
+ * share (0-100) and guards the `total === 0` case so the UI never renders NaN.
+ */
+export function effectiveSharePercent(weight: number, total: number): number {
+  if (!weight || weight <= 0) return 0;
+  if (!total || total <= 0) return 0;
+  return (weight / total) * 100;
+}
+
 export default function WeightTotalBar({ models }: WeightTotalBarProps) {
   const total = models.reduce((sum, m) => sum + (m.weight || 0), 0);
   const isValid = total === 100;
@@ -49,6 +63,16 @@ export default function WeightTotalBar({ models }: WeightTotalBarProps) {
                     className={`inline-block w-1.5 h-1.5 rounded-full ${WEIGHT_COLORS[i % WEIGHT_COLORS.length]}`}
                   />
                   {m.weight}%
+                  {/* #6147 — show the *effective* routing share when weights don't sum to 100 */}
+                  {total > 0 && total !== 100 && (
+                    <span
+                      className="text-text-muted/70"
+                      title="Effective routing share (weight ÷ total)"
+                    >
+                      {" → "}
+                      {Math.round(effectiveSharePercent(m.weight, total))}%
+                    </span>
+                  )}
                 </span>
               )
           )}
diff --git a/src/app/(dashboard)/dashboard/combos/page.tsx b/src/app/(dashboard)/dashboard/combos/page.tsx
index 5f546db165..c5c068000c 100644
--- a/src/app/(dashboard)/dashboard/combos/page.tsx
+++ b/src/app/(dashboard)/dashboard/combos/page.tsx
@@ -3972,6 +3972,54 @@ function ComboFormModal({ isOpen, combo, onClose, onSave, activeProviders, combo
                         <option value="execute">Execute nested combos as targets</option>
                       </select>
                     </div>
+                    {/* #6168: per-combo session-stickiness override (tri-state so it can
+                        force ON or OFF regardless of the global default; blank = inherit). */}
+                    <div>
+                      <FieldLabelWithHelp
+                        label={getI18nOrFallback(
+                          t,
+                          "disableSessionStickiness",
+                          "Disable session stickiness"
+                        )}
+                        help={getI18nOrFallback(
+                          t,
+                          "advancedHelp.disableSessionStickiness",
+                          "Rotate to a different connection on every request instead of pinning a whole conversation to one connection by the first-message hash. Overrides the global default. Leave on Inherit to preserve prompt-cache hits for multi-turn chats."
+                        )}
+                        showHelp={!isExpertMode}
+                      />
+                      <select
+                        value={
+                          config.disableSessionStickiness === true
+                            ? "disabled"
+                            : config.disableSessionStickiness === false
+                              ? "enabled"
+                              : "inherit"
+                        }
+                        onChange={(e) =>
+                          setConfig({
+                            ...config,
+                            disableSessionStickiness:
+                              e.target.value === "disabled"
+                                ? true
+                                : e.target.value === "enabled"
+                                  ? false
+                                  : undefined,
+                          })
+                        }
+                        className="w-full text-xs py-1.5 px-2 rounded border border-black/10 dark:border-white/10 bg-surface-1 focus:border-primary focus:outline-none"
+                      >
+                        <option value="inherit">
+                          {getI18nOrFallback(t, "stickyLimitInherit", "inherit")}
+                        </option>
+                        <option value="enabled">
+                          {getI18nOrFallback(t, "sessionStickinessEnabled", "Stickiness on")}
+                        </option>
+                        <option value="disabled">
+                          {getI18nOrFallback(t, "sessionStickinessDisabled", "Stickiness off")}
+                        </option>
+                      </select>
+                    </div>
                   </div>
                   {strategy === "context-relay" && (
                     <div className="grid grid-cols-1 md:grid-cols-3 gap-2 pt-2 border-t border-black/5 dark:border-white/5">
diff --git a/src/app/(dashboard)/dashboard/free-provider-rankings/page.tsx b/src/app/(dashboard)/dashboard/free-provider-rankings/page.tsx
index a112f299d5..a4689b1569 100644
--- a/src/app/(dashboard)/dashboard/free-provider-rankings/page.tsx
+++ b/src/app/(dashboard)/dashboard/free-provider-rankings/page.tsx
@@ -60,14 +60,21 @@ export default function FreeProviderRankingsPage() {
   const [loading, setLoading] = useState(true);
   const [error, setError] = useState("");
   const [filter, setFilter] = useState<string>("");
+  const [configuredOnly, setConfiguredOnly] = useState(false);
+  const [availableOnly, setAvailableOnly] = useState(false);
 
   const fetchRankings = useCallback(
-    async (category?: string) => {
+    async (category?: string, opts?: { configuredOnly?: boolean; availableOnly?: boolean }) => {
       setLoading(true);
       setError("");
       try {
-        const url = category
-          ? `/api/free-provider-rankings?category=${category}`
+        const params = new URLSearchParams();
+        if (category) params.set("category", category);
+        if (opts?.configuredOnly) params.set("configuredOnly", "1");
+        if (opts?.availableOnly) params.set("availableOnly", "1");
+        const qs = params.toString();
+        const url = qs
+          ? `/api/free-provider-rankings?${qs}`
           : "/api/free-provider-rankings";
         const res = await fetch(url);
         if (!res.ok) throw new Error(`HTTP ${res.status}`);
@@ -83,8 +90,8 @@ export default function FreeProviderRankingsPage() {
   );
 
   useEffect(() => {
-    fetchRankings(filter || undefined);
-  }, [filter, fetchRankings]);
+    fetchRankings(filter || undefined, { configuredOnly, availableOnly });
+  }, [filter, configuredOnly, availableOnly, fetchRankings]);
 
   return (
     <div className="flex flex-col gap-6">
@@ -113,6 +120,33 @@ export default function FreeProviderRankingsPage() {
         ))}
       </div>
 
+      {/* Availability toggles (default off → show all providers) */}
+      <div className="flex items-center gap-2 flex-wrap">
+        <button
+          onClick={() => setConfiguredOnly((v) => !v)}
+          aria-pressed={configuredOnly}
+          className={`px-4 py-2 text-sm font-medium rounded-lg border transition-colors ${
+            configuredOnly
+              ? "bg-emerald-500 border-emerald-500 text-white"
+              : "border-border text-text-muted hover:text-text-main hover:border-emerald-500/50"
+          }`}
+        >
+          {t("filterConfiguredOnly")}
+        </button>
+        <button
+          onClick={() => setAvailableOnly((v) => !v)}
+          aria-pressed={availableOnly}
+          title={t("filterAvailableOnlyHelp")}
+          className={`px-4 py-2 text-sm font-medium rounded-lg border transition-colors ${
+            availableOnly
+              ? "bg-emerald-500 border-emerald-500 text-white"
+              : "border-border text-text-muted hover:text-text-main hover:border-emerald-500/50"
+          }`}
+        >
+          {t("filterAvailableOnly")}
+        </button>
+      </div>
+
       {error && <div className="p-3 rounded-lg bg-red-500/10 text-red-400 text-sm">{error}</div>}
 
       {loading ? (
diff --git a/src/app/(dashboard)/dashboard/providers/[id]/__tests__/phase1e.test.tsx b/src/app/(dashboard)/dashboard/providers/[id]/__tests__/phase1e.test.tsx
index fb0562c8a8..a65bad6019 100644
--- a/src/app/(dashboard)/dashboard/providers/[id]/__tests__/phase1e.test.tsx
+++ b/src/app/(dashboard)/dashboard/providers/[id]/__tests__/phase1e.test.tsx
@@ -15,6 +15,7 @@ import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 import {
   buildCompatMap,
   isModelHiddenFn,
+  getDisplayModelAlias,
   effectiveNormalizeForProtocol,
   effectivePreserveForProtocol,
   anyNormalizeCompatBadge,
@@ -35,10 +36,7 @@ vi.mock("next/navigation", () => ({
 vi.mock("next-intl", () => ({
   useTranslations: () => (key: string, values?: Record<string, unknown>) => {
     if (values) {
-      return Object.entries(values).reduce(
-        (acc, [k, v]) => acc.replace(`{${k}}`, String(v)),
-        key
-      );
+      return Object.entries(values).reduce((acc, [k, v]) => acc.replace(`{${k}}`, String(v)), key);
     }
     return key;
   },
@@ -85,6 +83,22 @@ describe("providerPageHelpers — model-compat pure functions", () => {
     expect(isModelHiddenFn("unknown-model", customMap, overrideMap)).toBe(false);
   });
 
+  it("isModelHiddenFn ignores deleted tombstones when reading visibility", () => {
+    const customMap = buildCompatMap([]);
+    const overrideMap = buildCompatMap([
+      { id: "gpt-4o-2024-11-20", isHidden: true, isDeleted: true },
+      { id: "gpt-5-mini", isHidden: true },
+    ]);
+
+    expect(isModelHiddenFn("gpt-4o-2024-11-20", customMap, overrideMap)).toBe(false);
+    expect(isModelHiddenFn("gpt-5-mini", customMap, overrideMap)).toBe(true);
+  });
+
+  it("getDisplayModelAlias ignores provider-scoped identity aliases", () => {
+    expect(getDisplayModelAlias("gpt-4o-2024-11-20", "gpt-4o-2024-11-20")).toBeNull();
+    expect(getDisplayModelAlias("gpt-5-mini", "fast-mini")).toBe("fast-mini");
+  });
+
   it("effectiveNormalizeForProtocol returns correct flag", () => {
     const customMap = buildCompatMap(customModels);
     const overrideMap = buildCompatMap(overrideModels);
@@ -115,10 +129,10 @@ describe("providerPageHelpers — model-compat pure functions", () => {
   });
 
   it("formatProviderModelsErrorResponse extracts error.message", async () => {
-    const mockRes = new Response(
-      JSON.stringify({ error: { message: "Model not found" } }),
-      { status: 422, statusText: "Unprocessable Entity" }
-    );
+    const mockRes = new Response(JSON.stringify({ error: { message: "Model not found" } }), {
+      status: 422,
+      statusText: "Unprocessable Entity",
+    });
     const detail = await formatProviderModelsErrorResponse(mockRes);
     expect(detail).toBe("Model not found");
   });
@@ -185,7 +199,9 @@ describe("PassthroughModelRow — render smoke test", () => {
   });
 
   afterEach(() => {
-    act(() => { root.unmount(); });
+    act(() => {
+      root.unmount();
+    });
     container.remove();
   });
 
@@ -222,7 +238,9 @@ describe("ModelVisibilityToolbar — render smoke test", () => {
   });
 
   afterEach(() => {
-    act(() => { root.unmount(); });
+    act(() => {
+      root.unmount();
+    });
     container.remove();
   });
 
@@ -259,7 +277,9 @@ describe("useModelCompatState — hook unit test via component wrapper", () => {
   });
 
   afterEach(() => {
-    act(() => { root.unmount(); });
+    act(() => {
+      root.unmount();
+    });
     container.remove();
   });
 
@@ -267,7 +287,12 @@ describe("useModelCompatState — hook unit test via component wrapper", () => {
     const { useModelCompatState } = await import("../hooks/useModelCompatState");
 
     const customModels = [
-      { id: "gpt-4o", normalizeToolCallId: true, preserveOpenAIDeveloperRole: false, isHidden: true },
+      {
+        id: "gpt-4o",
+        normalizeToolCallId: true,
+        preserveOpenAIDeveloperRole: false,
+        isHidden: true,
+      },
     ];
     const modelCompatOverrides: any[] = [];
 
@@ -281,7 +306,9 @@ describe("useModelCompatState — hook unit test via component wrapper", () => {
         compat.effectiveModelPreserveDeveloper("gpt-4o"),
         compat.anyNormalizeCompatBadge("gpt-4o"),
         compat.anyNoPreserveCompatBadge("gpt-4o"),
-      ].map(String).join(",");
+      ]
+        .map(String)
+        .join(",");
       return <span data-testid="results">{results}</span>;
     }
 
@@ -291,8 +318,9 @@ describe("useModelCompatState — hook unit test via component wrapper", () => {
 
     const span = container.querySelector("[data-testid='results']");
     expect(span).not.toBeNull();
-    const [hidden, notHidden, normalize, preserve, anyNorm, anyNoPreserve] =
-      (span!.textContent ?? "").split(",");
+    const [hidden, notHidden, normalize, preserve, anyNorm, anyNoPreserve] = (
+      span!.textContent ?? ""
+    ).split(",");
 
     expect(hidden).toBe("true");
     expect(notHidden).toBe("false");
diff --git a/src/app/(dashboard)/dashboard/providers/[id]/components/CompatibleModelsSection.tsx b/src/app/(dashboard)/dashboard/providers/[id]/components/CompatibleModelsSection.tsx
index 94c1307175..7a8542265b 100644
--- a/src/app/(dashboard)/dashboard/providers/[id]/components/CompatibleModelsSection.tsx
+++ b/src/app/(dashboard)/dashboard/providers/[id]/components/CompatibleModelsSection.tsx
@@ -17,6 +17,7 @@ import { resolveManagedModelAlias } from "@/shared/utils/providerModelAliases";
 import { useNotificationStore } from "@/store/notificationStore";
 import {
   buildCompatMap,
+  getDisplayModelAlias,
   providerText,
   type CompatModelRow,
 } from "../providerPageHelpers";
@@ -57,10 +58,7 @@ export interface CompatibleModelsSectionProps {
   effectiveModelNormalize: (alias: string) => boolean;
   effectiveModelPreserveDeveloper: (alias: string) => boolean;
   getUpstreamHeadersRecord: (modelId: string, protocol: string) => Record<string, string>;
-  saveModelCompatFlags: (
-    modelId: string,
-    flags: CompatibleModelsSaveFlags
-  ) => Promise<void>;
+  saveModelCompatFlags: (modelId: string, flags: CompatibleModelsSaveFlags) => Promise<void>;
   compatSavingModelId?: string;
   onModelsChanged?: () => void;
   isModelHidden: (modelId: string) => boolean;
@@ -155,7 +153,8 @@ export default function CompatibleModelsSection({
     for (const [alias, fullModel] of providerAliases) {
       const fmStr = fullModel as string;
       const modelId = fmStr.startsWith(prefix) ? fmStr.slice(prefix.length) : fmStr;
-      aliasByModelId.set(modelId, alias as string);
+      const displayAlias = getDisplayModelAlias(modelId, alias as string);
+      if (displayAlias) aliasByModelId.set(modelId, displayAlias);
     }
 
     const addModel = (model: CompatModelRow, source: string) => {
@@ -194,11 +193,13 @@ export default function CompatibleModelsSection({
       const fmStr = fullModel as string;
       const modelId = fmStr.startsWith(prefix) ? fmStr.slice(prefix.length) : fmStr;
       if (!modelId || seenModelIds.has(modelId)) continue;
+      const displayAlias = getDisplayModelAlias(modelId, alias as string);
+      if (!displayAlias) continue;
       const customModel = customModelMap.get(modelId);
       rows.push({
         modelId,
-        alias: alias as string,
-        displayName: alias as string,
+        alias: displayAlias,
+        displayName: displayAlias,
         source: customModel ? customModel.source || "custom" : "alias",
         isFree:
           modelId.endsWith(":free") ||
diff --git a/src/app/(dashboard)/dashboard/providers/[id]/components/PassthroughModelsSection.tsx b/src/app/(dashboard)/dashboard/providers/[id]/components/PassthroughModelsSection.tsx
index e3dda0a620..fb0d2b6e62 100644
--- a/src/app/(dashboard)/dashboard/providers/[id]/components/PassthroughModelsSection.tsx
+++ b/src/app/(dashboard)/dashboard/providers/[id]/components/PassthroughModelsSection.tsx
@@ -21,6 +21,7 @@ import {
 import { useNotificationStore } from "@/store/notificationStore";
 import {
   buildCompatMap,
+  getDisplayModelAlias,
   providerText,
   testAllResultsText,
   evaluateTestAllEntry,
@@ -228,7 +229,8 @@ export default function PassthroughModelsSection({
     for (const [alias, fullModel] of providerAliases) {
       const fmStr = fullModel as string;
       const modelId = fmStr.startsWith(prefix) ? fmStr.slice(prefix.length) : fmStr;
-      aliasByModelId.set(modelId, alias as string);
+      const displayAlias = getDisplayModelAlias(modelId, alias as string);
+      if (displayAlias) aliasByModelId.set(modelId, displayAlias);
       fullModelByModelId.set(modelId, fmStr);
     }
 
@@ -266,12 +268,14 @@ export default function PassthroughModelsSection({
       const fmStr = fullModel as string;
       const modelId = fmStr.startsWith(prefix) ? fmStr.slice(prefix.length) : fmStr;
       if (!modelId || seenModelIds.has(modelId)) continue;
+      const displayAlias = getDisplayModelAlias(modelId, alias as string);
+      if (!displayAlias) continue;
       const customModel = customModelMap.get(modelId);
       rows.push({
         modelId,
         fullModel: fmStr,
-        alias: alias as string,
-        displayName: alias as string,
+        alias: displayAlias,
+        displayName: displayAlias,
         source: customModel ? customModel.source || "custom" : "alias",
         isFree:
           modelId.endsWith(":free") ||
diff --git a/src/app/(dashboard)/dashboard/providers/[id]/components/ProviderModelsSection.tsx b/src/app/(dashboard)/dashboard/providers/[id]/components/ProviderModelsSection.tsx
index c2edb4b633..1b252b209e 100644
--- a/src/app/(dashboard)/dashboard/providers/[id]/components/ProviderModelsSection.tsx
+++ b/src/app/(dashboard)/dashboard/providers/[id]/components/ProviderModelsSection.tsx
@@ -15,7 +15,11 @@ import { useState } from "react";
 import { Button } from "@/shared/components";
 import { matchesModelCatalogQuery } from "@/shared/utils/modelCatalogSearch";
 import { isFreeModel, sortModelsFreeFirst } from "@/shared/utils/freeModels";
-import { providerText, type ProviderMessageTranslator } from "../providerPageHelpers";
+import {
+  getDisplayModelAlias,
+  providerText,
+  type ProviderMessageTranslator,
+} from "../providerPageHelpers";
 import ModelRow, { ModelVisibilityToolbar } from "./ModelRow";
 import PassthroughModelsSection from "./PassthroughModelsSection";
 import CompatibleModelsSection from "./CompatibleModelsSection";
@@ -86,11 +90,7 @@ export interface ProviderModelsSectionProps {
   setAutoHideFailed: (v: boolean) => void;
   setVisibilityFilter: (v: "all" | "visible" | "hidden") => void;
   saveModelCompatFlags: (modelId: string, patch: ModelCompatSavePatch) => Promise<void>;
-  handleToggleModelHidden: (
-    providerKey: string,
-    modelId: string,
-    hidden: boolean
-  ) => Promise<void>;
+  handleToggleModelHidden: (providerKey: string, modelId: string, hidden: boolean) => Promise<void>;
   handleBulkToggleModelHidden: (
     providerKey: string,
     modelIds: string[],
@@ -187,8 +187,7 @@ export default function ProviderModelsSection({
     </button>
   );
 
-  const clearAllButton = (modelMeta.customModels.length > 0 ||
-    providerAliasEntries.length > 0) && (
+  const clearAllButton = (modelMeta.customModels.length > 0 || providerAliasEntries.length > 0) && (
     <button
       onClick={handleClearAllModels}
       disabled={clearingModels}
@@ -251,9 +250,7 @@ export default function ProviderModelsSection({
           onModelsChanged={fetchProviderModelMeta}
           allowImport={compatibleSupportsModelImport}
           isModelHidden={effectiveModelHidden}
-          onToggleHidden={(modelId, hidden) =>
-            handleToggleModelHidden(providerId, modelId, hidden)
-          }
+          onToggleHidden={(modelId, hidden) => handleToggleModelHidden(providerId, modelId, hidden)}
           onBulkToggleHidden={(modelIds, hidden) =>
             handleBulkToggleModelHidden(providerId, modelIds, hidden)
           }
@@ -325,9 +322,7 @@ export default function ProviderModelsSection({
           saveModelCompatFlags={saveModelCompatFlags}
           compatSavingModelId={compatSavingModelId}
           isModelHidden={effectiveModelHidden}
-          onToggleHidden={(modelId, hidden) =>
-            handleToggleModelHidden(providerId, modelId, hidden)
-          }
+          onToggleHidden={(modelId, hidden) => handleToggleModelHidden(providerId, modelId, hidden)}
           onBulkToggleHidden={(modelIds, hidden) =>
             handleBulkToggleModelHidden(providerId, modelIds, hidden)
           }
@@ -377,7 +372,9 @@ export default function ProviderModelsSection({
     (acc, [alias, fullModel]) => {
       const prefix = `${providerDisplayAlias}/`;
       if (fullModel.startsWith(prefix)) {
-        acc[fullModel.slice(prefix.length)] = alias;
+        const modelId = fullModel.slice(prefix.length);
+        const displayAlias = getDisplayModelAlias(modelId, alias);
+        if (displayAlias) acc[modelId] = displayAlias;
       }
       return acc;
     },
@@ -467,9 +464,7 @@ export default function ProviderModelsSection({
               onCopy={onCopy}
               onSetAlias={(a) => onSetAlias(model.id, a, providerDisplayAlias)}
               onDeleteAlias={
-                aliasByModelId[model.id]
-                  ? () => onDeleteAlias(aliasByModelId[model.id])
-                  : undefined
+                aliasByModelId[model.id] ? () => onDeleteAlias(aliasByModelId[model.id]) : undefined
               }
               t={t}
               showDeveloperToggle
diff --git a/src/app/(dashboard)/dashboard/providers/[id]/components/modals/AddApiKeyModal.tsx b/src/app/(dashboard)/dashboard/providers/[id]/components/modals/AddApiKeyModal.tsx
index fd112a3b0c..ef0c741b89 100644
--- a/src/app/(dashboard)/dashboard/providers/[id]/components/modals/AddApiKeyModal.tsx
+++ b/src/app/(dashboard)/dashboard/providers/[id]/components/modals/AddApiKeyModal.tsx
@@ -348,7 +348,7 @@ export default function AddApiKeyModal({
 
   const handleBulkSubmit = async () => {
     if (!provider) return;
-    const parsed = parseBulkApiKeys(bulkText);
+    const parsed = parseBulkApiKeys(bulkText, { withAccountId: isCloudflare });
     setBulkWarnings(parsed.warnings);
     if (parsed.entries.length === 0) return;
 
@@ -378,7 +378,11 @@ export default function AddApiKeyModal({
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
           provider,
-          entries: parsed.entries.map((e) => ({ name: e.name, apiKey: e.apiKey })),
+          entries: parsed.entries.map((e) => ({
+            name: e.name,
+            apiKey: e.apiKey,
+            ...(e.accountId ? { accountId: e.accountId } : {}),
+          })),
           priority: formData.priority || 1,
           providerSpecificData,
           validateKeys: bulkValidateKeys,
@@ -457,12 +461,18 @@ export default function AddApiKeyModal({
 
         {bulkSupported && mode === "bulk" && (
           <div className="flex flex-col gap-3">
-            <p className="text-xs text-text-muted">{t("bulkAddFormatHint")}</p>
+            <p className="text-xs text-text-muted">
+              {isCloudflare ? t("bulkAddFormatHintCloudflare") : t("bulkAddFormatHint")}
+            </p>
             {openRouterPreset.input}
             {freeModelsToggle}
             <textarea
               className="w-full rounded border border-border bg-background p-2 text-sm font-mono resize-y min-h-[140px] focus:outline-none focus:ring-1 focus:ring-primary"
-              placeholder={"name1|sk-key1\nname2|sk-key2\nsk-key-only-auto-named"}
+              placeholder={
+                isCloudflare
+                  ? "name1|account-id-1|cf-token-1\nname2|account-id-2|cf-token-2"
+                  : "name1|sk-key1\nname2|sk-key2\nsk-key-only-auto-named"
+              }
               value={bulkText}
               onChange={(e) => setBulkText(e.target.value)}
             />
diff --git a/src/app/(dashboard)/dashboard/providers/[id]/components/modals/EditConnectionModal.tsx b/src/app/(dashboard)/dashboard/providers/[id]/components/modals/EditConnectionModal.tsx
index d4a7d3ea6c..ff373cf5ca 100644
--- a/src/app/(dashboard)/dashboard/providers/[id]/components/modals/EditConnectionModal.tsx
+++ b/src/app/(dashboard)/dashboard/providers/[id]/components/modals/EditConnectionModal.tsx
@@ -23,6 +23,7 @@ import { isClaudeExtraUsageBlockEnabled } from "@/lib/providers/claudeExtraUsage
 import { resolveDashboardProviderInfo } from "../../../providerPageUtils";
 import {
   isBaseUrlConfigurableProvider,
+  isBaseUrlOverrideEligibleProvider,
   getProviderBaseUrlDefault,
   getProviderBaseUrlHint,
   getProviderBaseUrlPlaceholder,
@@ -153,7 +154,19 @@ export default function EditConnectionModal({
   const [showAdvanced, setShowAdvanced] = useState(false);
   const showEmail = useEmailPrivacyStore((state) => state.emailsVisible);
 
-  const usesBaseUrl = isBaseUrlConfigurableProvider(provider);
+  // #6147 — built-in providers can opt in to an advanced base-URL override.
+  // OAuth connections are excluded: their save path does not persist
+  // providerSpecificData.baseUrl.
+  const isConfigurableBaseUrl = isBaseUrlConfigurableProvider(provider);
+  const isBaseUrlOverrideEligible =
+    connection?.authType !== "oauth" && isBaseUrlOverrideEligibleProvider(provider);
+  const [showBaseUrlOverride, setShowBaseUrlOverride] = useState(
+    () =>
+      typeof connection?.providerSpecificData?.baseUrl === "string" &&
+      connection.providerSpecificData.baseUrl.trim().length > 0
+  );
+  const usesBaseUrl =
+    isConfigurableBaseUrl || (isBaseUrlOverrideEligible && showBaseUrlOverride);
   const defaultBaseUrl = getProviderBaseUrlDefault(provider);
   const isVertex = provider === "vertex" || provider === "vertex-partner";
   const isBedrock = provider === "bedrock";
@@ -441,12 +454,18 @@ export default function EditConnectionModal({
 
       let validatedBaseUrl = null;
       if (usesBaseUrl) {
-        const checked = normalizeAndValidateHttpBaseUrl(formData.baseUrl, defaultBaseUrl);
-        if (checked.error) {
-          setSaveError(checked.error);
-          return;
+        // #6147 — an opt-in override left blank clears it (no default to fall
+        // back to). Configurable providers keep their existing default-fallback.
+        if (!isConfigurableBaseUrl && !formData.baseUrl.trim()) {
+          validatedBaseUrl = null;
+        } else {
+          const checked = normalizeAndValidateHttpBaseUrl(formData.baseUrl, defaultBaseUrl);
+          if (checked.error) {
+            setSaveError(checked.error);
+            return;
+          }
+          validatedBaseUrl = checked.value;
         }
-        validatedBaseUrl = checked.value;
       }
 
       if (!isOAuth && formData.apiKey) {
@@ -937,13 +956,33 @@ export default function EditConnectionModal({
           </>
         )}
 
+        {/* #6147 — opt-in "Advanced → override base URL" for eligible built-ins */}
+        {!usesBaseUrl && isBaseUrlOverrideEligible && (
+          <button
+            type="button"
+            onClick={() => setShowBaseUrlOverride(true)}
+            className="self-start text-xs text-primary hover:underline"
+          >
+            {providerText(t, "overrideBaseUrlAdvanced", "Advanced: override base URL")}
+          </button>
+        )}
+
         {usesBaseUrl && (
           <Input
             label={t("baseUrlLabel")}
             value={formData.baseUrl}
             onChange={(e) => setFormData({ ...formData, baseUrl: e.target.value })}
             placeholder={getProviderBaseUrlPlaceholder(provider)}
-            hint={getProviderBaseUrlHint(provider, t)}
+            hint={
+              getProviderBaseUrlHint(provider, t) ||
+              (isBaseUrlOverrideEligible
+                ? providerText(
+                    t,
+                    "overrideBaseUrlHint",
+                    "Advanced: point this built-in provider at a custom endpoint. Leave blank to use the default."
+                  )
+                : undefined)
+            }
           />
         )}
 
diff --git a/src/app/(dashboard)/dashboard/providers/[id]/hooks/useModelVisibilityHandlers.ts b/src/app/(dashboard)/dashboard/providers/[id]/hooks/useModelVisibilityHandlers.ts
index e9283d1b77..3fd4b67529 100644
--- a/src/app/(dashboard)/dashboard/providers/[id]/hooks/useModelVisibilityHandlers.ts
+++ b/src/app/(dashboard)/dashboard/providers/[id]/hooks/useModelVisibilityHandlers.ts
@@ -31,6 +31,7 @@ import {
   type CompatByProtocolMap,
 } from "../providerPageHelpers";
 import { useNotificationStore } from "@/store/notificationStore";
+import { extractApiErrorMessage } from "@/shared/http/apiErrorMessage";
 
 type NotifyStore = ReturnType<typeof useNotificationStore>;
 
@@ -312,7 +313,10 @@ export function useModelVisibilityHandlers({
         );
         setModelTestStatus((prev) => ({ ...prev, [modelId]: "ok" }));
       } else {
-        notify.error(data.error || "Model test failed");
+        // extractApiErrorMessage coerces any object-shaped `error` (e.g. a Zod
+        // format object) to a string so notify.error never hands the toast a
+        // non-string child (React #31 → frozen page).
+        notify.error(extractApiErrorMessage(data, "Model test failed"));
         setModelTestStatus((prev) => ({ ...prev, [modelId]: "error" }));
       }
     } catch (err) {
diff --git a/src/app/(dashboard)/dashboard/providers/[id]/providerPageHelpers.ts b/src/app/(dashboard)/dashboard/providers/[id]/providerPageHelpers.ts
index 8dd1bbc8f7..aa8499e839 100644
--- a/src/app/(dashboard)/dashboard/providers/[id]/providerPageHelpers.ts
+++ b/src/app/(dashboard)/dashboard/providers/[id]/providerPageHelpers.ts
@@ -70,6 +70,7 @@ export type CompatModelRow = {
   normalizeToolCallId?: boolean;
   preserveOpenAIDeveloperRole?: boolean;
   isHidden?: boolean;
+  isDeleted?: boolean;
   upstreamHeaders?: Record<string, string>;
   compatByProtocol?: CompatByProtocolMap;
   /** #2905: per-model upstream wire-format override. */ targetFormat?: string;
@@ -256,6 +257,25 @@ export function isBaseUrlConfigurableProvider(providerId?: string | null) {
   );
 }
 
+/**
+ * #6147 — whether a built-in provider is eligible for an OPT-IN "Advanced →
+ * override base URL" affordance in the edit-connection modal.
+ *
+ * This does NOT widen the always-on base-URL field: providers already covered by
+ * `isBaseUrlConfigurableProvider` (the configurable set + self-hosted) keep their
+ * existing dedicated field and return `false` here. Every *other* provider id is
+ * eligible to opt in per-connection so an operator can hot-fix a broken built-in
+ * preset by pointing it at a custom endpoint. The field stays hidden until the
+ * user explicitly reveals it (or an override was already saved), so nothing is
+ * exposed by default. OAuth connections are excluded at the call site, since
+ * their save path does not persist `providerSpecificData.baseUrl`.
+ */
+export function isBaseUrlOverrideEligibleProvider(providerId?: string | null): boolean {
+  if (!providerId) return false;
+  if (isBaseUrlConfigurableProvider(providerId)) return false;
+  return true;
+}
+
 export function getProviderBaseUrlDefault(providerId?: string | null) {
   const localProvider = getLocalProviderMetadata(providerId);
   if (typeof localProvider?.localDefault === "string" && localProvider.localDefault.trim()) {
@@ -557,19 +577,31 @@ export function buildCompatMap(rows: CompatModelRow[]): CompatModelMap {
   return m;
 }
 
+export function getDisplayModelAlias(modelId: string, alias?: string | null): string | null {
+  const trimmed = typeof alias === "string" ? alias.trim() : "";
+  if (!trimmed || trimmed === modelId) return null;
+  return trimmed;
+}
+
+function readActiveHiddenFlag(row: CompatModelRow | undefined): boolean | undefined {
+  if (!row || row.isDeleted === true) return undefined;
+  if (Object.prototype.hasOwnProperty.call(row, "isHidden")) {
+    return Boolean(row.isHidden);
+  }
+  return undefined;
+}
+
 export function isModelHiddenFn(
   modelId: string,
   customMap: CompatModelMap,
   overrideMap: CompatModelMap
 ): boolean {
-  const c = customMap.get(modelId);
-  if (c && Object.prototype.hasOwnProperty.call(c, "isHidden")) {
-    return Boolean(c.isHidden);
-  }
-  const o = overrideMap.get(modelId);
-  if (o && Object.prototype.hasOwnProperty.call(o, "isHidden")) {
-    return Boolean(o.isHidden);
-  }
+  const customHidden = readActiveHiddenFlag(customMap.get(modelId));
+  if (customHidden !== undefined) return customHidden;
+
+  const overrideHidden = readActiveHiddenFlag(overrideMap.get(modelId));
+  if (overrideHidden !== undefined) return overrideHidden;
+
   return false;
 }
 
diff --git a/src/app/(dashboard)/dashboard/providers/components/onboarding/ProviderOnboardingWizard.tsx b/src/app/(dashboard)/dashboard/providers/components/onboarding/ProviderOnboardingWizard.tsx
index 65510ef0ce..4a44da1a89 100644
--- a/src/app/(dashboard)/dashboard/providers/components/onboarding/ProviderOnboardingWizard.tsx
+++ b/src/app/(dashboard)/dashboard/providers/components/onboarding/ProviderOnboardingWizard.tsx
@@ -22,6 +22,7 @@ import {
   getWizardOAuthProviderOptions,
   type WizardProviderOption,
 } from "./providerOnboardingCatalog";
+import { buildProviderDetailsHref } from "./providerOnboardingHref";
 import {
   createCompatibleProviderNode,
   createOnboardingConnection,
@@ -260,14 +261,19 @@ function ResultSummary({
         )}
 
         <div className="flex flex-wrap gap-2">
-          {connection?.id && (
-            <Link
-              href={`/dashboard/providers/${connection.id}`}
-              className="inline-flex items-center justify-center rounded-lg bg-primary px-4 py-2 text-sm font-medium text-white transition-colors hover:bg-primary/90"
-            >
-              {providerText(t, "onboardingOpenProviderDetails", "Open provider details")}
-            </Link>
-          )}
+          {(() => {
+            const detailsHref = buildProviderDetailsHref(connection);
+            return (
+              detailsHref && (
+                <Link
+                  href={detailsHref}
+                  className="inline-flex items-center justify-center rounded-lg bg-primary px-4 py-2 text-sm font-medium text-white transition-colors hover:bg-primary/90"
+                >
+                  {providerText(t, "onboardingOpenProviderDetails", "Open provider details")}
+                </Link>
+              )
+            );
+          })()}
           <Link
             href="/dashboard/providers"
             className="inline-flex items-center justify-center rounded-lg border border-border bg-bg-subtle px-4 py-2 text-sm font-medium text-text-main transition-colors hover:bg-bg-card"
diff --git a/src/app/(dashboard)/dashboard/providers/components/onboarding/providerOnboardingHref.ts b/src/app/(dashboard)/dashboard/providers/components/onboarding/providerOnboardingHref.ts
new file mode 100644
index 0000000000..46885cc35f
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/providers/components/onboarding/providerOnboardingHref.ts
@@ -0,0 +1,33 @@
+import type { OnboardingConnection } from "./providerOnboardingApi";
+
+export interface OnboardingSummaryAction {
+  href: string | null;
+  label: string;
+}
+
+/**
+ * Minimum surface area required to compute the dashboard details href.
+ * Accepts either a full {@link OnboardingConnection} or any partial that
+ * exposes the server-assigned UUID under `id`.
+ */
+export type HrefConnection = Pick<OnboardingConnection, "id"> & {
+  provider?: string;
+};
+
+/**
+ * Build the "open provider details" link target for the onboarding wizard
+ * success card. The dashboard detail route is keyed by the connection's
+ * server-assigned UUID (`OnboardingConnection.id`), not by the provider
+ * category (`connection.provider` is e.g. "openai-compatible" and is shared
+ * across many connections).
+ *
+ * Returns `null` if no usable id is present so callers can hide the action
+ * entirely rather than linking to a 404.
+ */
+export function buildProviderDetailsHref(
+  connection: HrefConnection | null | undefined
+): string | null {
+  const id = connection?.id?.trim();
+  if (!id) return null;
+  return `/dashboard/providers/${encodeURIComponent(id)}`;
+}
\ No newline at end of file
diff --git a/src/app/(dashboard)/dashboard/providers/page.tsx b/src/app/(dashboard)/dashboard/providers/page.tsx
index 112e46fa47..2393ac6046 100644
--- a/src/app/(dashboard)/dashboard/providers/page.tsx
+++ b/src/app/(dashboard)/dashboard/providers/page.tsx
@@ -25,6 +25,7 @@ import {
   shouldFilterProviderEntriesForDisplayMode,
   shouldShowFirstProviderHint,
   upsertProviderNodeById,
+  loadProviderPageData,
 } from "./providerPageUtils";
 import type { ProviderEntry } from "./providerPageUtils";
 import {
@@ -235,26 +236,16 @@ export default function ProvidersPage() {
   useEffect(() => {
     const fetchData = async () => {
       try {
-        const [connectionsRes, nodesRes, expirationsRes, settingsRes] = await Promise.all([
-          fetch("/api/providers"),
-          fetch("/api/provider-nodes"),
-          fetch("/api/providers/expiration"),
-          fetch("/api/settings", { cache: "no-store" }),
-        ]);
-        const connectionsData = await connectionsRes.json();
-        const nodesData = await nodesRes.json();
-        const expirationsData = await expirationsRes.json();
-        const settingsData = settingsRes.ok ? await settingsRes.json() : null;
-        if (connectionsRes.ok) setConnections(connectionsData.connections || []);
-        if (nodesRes.ok) {
-          setProviderNodes(nodesData.nodes || []);
-          setCcCompatibleProviderEnabled(nodesData.ccCompatibleProviderEnabled === true);
-        }
-        if (expirationsRes.ok && expirationsData) setExpirations(expirationsData);
-        if (settingsData && Array.isArray(settingsData.blockedProviders)) {
-          setBlockedProviders(settingsData.blockedProviders);
-        }
-        setCodexGlobalServiceMode(getCodexGlobalServiceMode(settingsData));
+        // Each request is time-bounded (see loadProviderPageData); a single
+        // stalled connection can no longer wedge `loading` on `true` and freeze
+        // the page on its skeleton forever.
+        const data = await loadProviderPageData();
+        setConnections(data.connections);
+        setProviderNodes(data.providerNodes);
+        setCcCompatibleProviderEnabled(data.ccCompatibleProviderEnabled);
+        if (data.expirations) setExpirations(data.expirations);
+        if (data.blockedProviders) setBlockedProviders(data.blockedProviders);
+        setCodexGlobalServiceMode(getCodexGlobalServiceMode(data.settings));
       } catch (error) {
         console.log("Error fetching data:", error);
       } finally {
diff --git a/src/app/(dashboard)/dashboard/providers/providerPageUtils.ts b/src/app/(dashboard)/dashboard/providers/providerPageUtils.ts
index f1ea2cc66f..b7b9f4d354 100644
--- a/src/app/(dashboard)/dashboard/providers/providerPageUtils.ts
+++ b/src/app/(dashboard)/dashboard/providers/providerPageUtils.ts
@@ -14,6 +14,7 @@ import {
 import { getModelsByProviderId } from "@/shared/constants/models";
 import { providerHasServiceKind } from "@/lib/providers/serviceKindIndex";
 import { compareTr, matchesSearch } from "@/shared/utils/turkishText";
+import { fetchWithTimeout } from "@/shared/utils/fetchTimeout";
 import type { ProviderDisplayMode } from "./providerPageStorage";
 
 export interface ProviderStatsSnapshot {
@@ -331,3 +332,67 @@ export function upsertProviderNodeById<T extends { id?: string | null }>(prev: T
   next[idx] = node;
   return next;
 }
+
+/** Parsed payload the providers dashboard renders its first paint from. */
+export interface ProviderPageData {
+  connections: any[];
+  providerNodes: any[];
+  ccCompatibleProviderEnabled: boolean;
+  expirations: any | null;
+  blockedProviders: string[] | null;
+  settings: any | null;
+}
+
+// Bound each first-paint request so a single stalled connection cannot freeze
+// the page on its skeleton. 20s is generous for a loopback dashboard API while
+// still guaranteeing the skeleton clears in bounded time.
+const PROVIDER_PAGE_FETCH_TIMEOUT_MS = 20_000;
+
+/**
+ * Load the four data sources the providers dashboard renders from, each bounded
+ * by an AbortSignal timeout and independently degrading to a default.
+ *
+ * Why this exists (infinite-skeleton bug): the page used to gate its `loading`
+ * flag on `await Promise.all([fetch(...) x4])` with **no** timeout. A bare
+ * `fetch()` that never *settles* — e.g. the browser's 6-connection HTTP/1.1 pool
+ * starved by the dashboard's RSC `<Link>` prefetch storm, or any stalled
+ * connection — leaves `Promise.all` pending forever, so `setLoading(false)`
+ * (which lives in the effect's `finally`) never runs and the Suspense skeleton
+ * shows indefinitely. A `try/catch` cannot rescue a promise that never settles;
+ * only a timeout/abort can. Here every request is time-bounded and failures
+ * degrade to a default, so the loader always resolves within the timeout and the
+ * page paints from whatever data arrived (matching the fast `/api/providers`).
+ */
+export async function loadProviderPageData(
+  fetchImpl: typeof fetch = (globalThis.fetch as typeof fetch),
+  timeoutMs: number = PROVIDER_PAGE_FETCH_TIMEOUT_MS
+): Promise<ProviderPageData> {
+  const safeJson = async (url: string, init?: RequestInit): Promise<any | null> => {
+    try {
+      const res = await fetchWithTimeout(url, { ...init, timeoutMs, fetchFn: fetchImpl });
+      if (!res.ok) return null;
+      return await res.json();
+    } catch {
+      // Timeout/abort/network error → degrade to the default; never hang.
+      return null;
+    }
+  };
+
+  const [connectionsData, nodesData, expirationsData, settingsData] = await Promise.all([
+    safeJson("/api/providers"),
+    safeJson("/api/provider-nodes"),
+    safeJson("/api/providers/expiration"),
+    safeJson("/api/settings", { cache: "no-store" }),
+  ]);
+
+  return {
+    connections: Array.isArray(connectionsData?.connections) ? connectionsData.connections : [],
+    providerNodes: Array.isArray(nodesData?.nodes) ? nodesData.nodes : [],
+    ccCompatibleProviderEnabled: nodesData?.ccCompatibleProviderEnabled === true,
+    expirations: expirationsData ?? null,
+    blockedProviders: Array.isArray(settingsData?.blockedProviders)
+      ? settingsData.blockedProviders
+      : null,
+    settings: settingsData ?? null,
+  };
+}
diff --git a/src/app/(dashboard)/dashboard/providers/services/[name]/embed/[...path]/route.ts b/src/app/(dashboard)/dashboard/providers/services/[name]/embed/[[...path]]/route.ts
similarity index 81%
rename from src/app/(dashboard)/dashboard/providers/services/[name]/embed/[...path]/route.ts
rename to src/app/(dashboard)/dashboard/providers/services/[name]/embed/[[...path]]/route.ts
index dd4e690820..9630180710 100644
--- a/src/app/(dashboard)/dashboard/providers/services/[name]/embed/[...path]/route.ts
+++ b/src/app/(dashboard)/dashboard/providers/services/[name]/embed/[[...path]]/route.ts
@@ -1,7 +1,11 @@
 /**
  * Reverse-proxy handler for embedded service UIs.
  *
- * Route: /dashboard/providers/services/[name]/embed/[...path]
+ * Route: /dashboard/providers/services/[name]/embed/[[...path]]
+ *
+ * Optional catch-all ([[...path]]) so the segment-less prefix
+ * `/embed/` (the panel root — #6205) also matches; a required catch-all
+ * ([...path]) does not match a zero-segment path and falls through to 404.
  *
  * Thin wrapper — all proxy logic lives in @/lib/services/reverseProxy.ts.
  *
@@ -17,11 +21,12 @@ import { proxyRequest } from "@/lib/services/reverseProxy";
 
 export const dynamic = "force-dynamic";
 
-type RouteParams = { name: string; path: string[] };
+// Optional catch-all: `path` is `undefined` for the segment-less `/embed/` root.
+type RouteParams = { name: string; path?: string[] };
 
 async function handleProxy(request: Request, params: RouteParams): Promise<Response> {
   const { name, path } = params;
-  return proxyRequest(request, path, {
+  return proxyRequest(request, path ?? [], {
     name,
     publicPrefix: `/dashboard/providers/services/${name}/embed`,
     htmlRewrite: true,
diff --git a/src/app/(dashboard)/dashboard/settings/components/ComboDefaultsTab.tsx b/src/app/(dashboard)/dashboard/settings/components/ComboDefaultsTab.tsx
index bf83cbd4aa..8544506287 100644
--- a/src/app/(dashboard)/dashboard/settings/components/ComboDefaultsTab.tsx
+++ b/src/app/(dashboard)/dashboard/settings/components/ComboDefaultsTab.tsx
@@ -3,6 +3,7 @@
 import { useState, useEffect, useRef } from "react";
 import { Card, Button, Input, Toggle } from "@/shared/components";
 import { cn } from "@/shared/utils/cn";
+import { matchesSearch } from "@/shared/utils/turkishText";
 import FusionDefaultsFields from "./FusionDefaultsFields";
 import {
   ROUTING_STRATEGIES,
@@ -97,6 +98,7 @@ export default function ComboDefaultsTab() {
     handoffModel: "",
     maxMessagesForSummary: 30,
     stickyRoundRobinLimit: 3,
+    disableSessionStickiness: false,
     resetAwareQuotaCacheTtlMs: 0,
     resetAwareQuotaCacheMaxStaleMs: 0,
     zeroLatencyOptimizationsEnabled: false,
@@ -168,6 +170,10 @@ export default function ComboDefaultsTab() {
             settingsData.stickyRoundRobinLimit ??
             comboData.comboDefaults?.stickyRoundRobinLimit ??
             prev.stickyRoundRobinLimit,
+          disableSessionStickiness:
+            settingsData.disableSessionStickiness ??
+            comboData.comboDefaults?.disableSessionStickiness ??
+            prev.disableSessionStickiness,
         }));
         if (comboData.providerOverrides) {
           setProviderOverrides(sanitizeProviderOverrides(comboData.providerOverrides));
@@ -214,10 +220,14 @@ export default function ComboDefaultsTab() {
   const saveComboDefaults = async () => {
     setSaving(true);
     try {
-      const { stickyRoundRobinLimit, ...comboDefaultsPayload } = comboDefaults;
+      const { stickyRoundRobinLimit, disableSessionStickiness, ...comboDefaultsPayload } =
+        comboDefaults;
       const settingsPatch = {
         ...toGlobalRoutingPatch(comboDefaults.strategy, stickyRoundRobinLimit),
         codexSessionAffinityTtlMs,
+        // #6168: global session-stickiness opt-out — persisted top-level on settings
+        // (mirrors stickyRoundRobinLimit) so combo.ts resolution reads settings.disableSessionStickiness.
+        disableSessionStickiness: disableSessionStickiness === true,
       };
 
       const comboDefaultsRes = await fetch("/api/settings/combo-defaults", {
@@ -283,7 +293,7 @@ export default function ComboDefaultsTab() {
   // Filtered provider list — excludes already-added ones, filtered by search query
   const filteredProviders = availableProviders.filter(
     (p) =>
-      !providerOverrides[p.provider] && p.provider.toLowerCase().includes(searchQuery.toLowerCase())
+      !providerOverrides[p.provider] && matchesSearch(p.provider, searchQuery)
   );
 
   const handleDropdownKeyDown = (e: React.KeyboardEvent) => {
@@ -712,6 +722,29 @@ export default function ComboDefaultsTab() {
               }
             />
           </div>
+          <div className="flex items-center justify-between">
+            <div>
+              <p className="font-medium text-sm">
+                {translateOrFallback(t, "disableSessionStickiness", "Disable session stickiness")}
+              </p>
+              <p className="text-xs text-text-muted">
+                {translateOrFallback(
+                  t,
+                  "disableSessionStickinessDesc",
+                  "Round-robin and random combos rotate to a different connection on every request instead of pinning a whole conversation to one connection by the first-message hash. Leave off to preserve prompt-cache hits for multi-turn chats. Per-combo overrides take precedence."
+                )}
+              </p>
+            </div>
+            <Toggle
+              checked={comboDefaults.disableSessionStickiness === true}
+              onChange={() =>
+                setComboDefaults((prev) => ({
+                  ...prev,
+                  disableSessionStickiness: prev.disableSessionStickiness !== true,
+                }))
+              }
+            />
+          </div>
         </div>
 
         {/* Provider Overrides */}
diff --git a/src/app/(dashboard)/dashboard/settings/components/ProxyBatchActions.tsx b/src/app/(dashboard)/dashboard/settings/components/ProxyBatchActions.tsx
index a9e537a884..dd90571427 100644
--- a/src/app/(dashboard)/dashboard/settings/components/ProxyBatchActions.tsx
+++ b/src/app/(dashboard)/dashboard/settings/components/ProxyBatchActions.tsx
@@ -7,7 +7,9 @@ interface ProxyBatchActionsProps {
   selectedCount: number;
   batchDeleting: boolean;
   autoTesting: boolean;
+  batchActivating: boolean;
   onBatchDelete: () => void;
+  onBatchActivate: () => void;
   onAutoTestAll: () => void;
 }
 
@@ -15,7 +17,9 @@ export function ProxyBatchActions({
   selectedCount,
   batchDeleting,
   autoTesting,
+  batchActivating,
   onBatchDelete,
+  onBatchActivate,
   onAutoTestAll,
 }: ProxyBatchActionsProps) {
   const t = useTranslations("proxyRegistry");
@@ -27,6 +31,16 @@ export function ProxyBatchActions({
           <span className="text-xs text-text-muted">
             {t("batchSelectedCount", { count: selectedCount })}
           </span>
+          <Button
+            size="sm"
+            variant="secondary"
+            icon="check_circle"
+            onClick={onBatchActivate}
+            loading={batchActivating}
+            data-testid="proxy-registry-batch-activate"
+          >
+            {t("batchActivateSelected", { count: selectedCount })}
+          </Button>
           <Button
             size="sm"
             variant="secondary"
diff --git a/src/app/(dashboard)/dashboard/settings/components/ProxyRegistryManager.tsx b/src/app/(dashboard)/dashboard/settings/components/ProxyRegistryManager.tsx
index 62b562c9f6..e7673e7ca3 100644
--- a/src/app/(dashboard)/dashboard/settings/components/ProxyRegistryManager.tsx
+++ b/src/app/(dashboard)/dashboard/settings/components/ProxyRegistryManager.tsx
@@ -267,9 +267,11 @@ export default function ProxyRegistryManager() {
     setSelectedIds,
     batchDeleting,
     autoTesting,
+    batchActivating,
     toggleSelectAll: hookToggleSelectAll,
     toggleSelect,
     handleBatchDelete: hookHandleBatchDelete,
+    handleBatchActivate: hookHandleBatchActivate,
     handleAutoTestAll: hookHandleAutoTestAll,
   } = useProxyBatchOperations(load);
 
@@ -279,6 +281,10 @@ export default function ProxyRegistryManager() {
     hookHandleBatchDelete(setError);
   }, [hookHandleBatchDelete, setError]);
 
+  const handleBatchActivate = useCallback(() => {
+    hookHandleBatchActivate(setError, "active");
+  }, [hookHandleBatchActivate, setError]);
+
   const handleAutoTestAll = useCallback(() => {
     hookHandleAutoTestAll(setError, setTestById);
   }, [hookHandleAutoTestAll, setError, setTestById]);
@@ -636,7 +642,9 @@ export default function ProxyRegistryManager() {
               selectedCount={selectedIds.size}
               batchDeleting={batchDeleting}
               autoTesting={autoTesting}
+              batchActivating={batchActivating}
               onBatchDelete={handleBatchDelete}
+              onBatchActivate={handleBatchActivate}
               onAutoTestAll={handleAutoTestAll}
             />
             <Button
diff --git a/src/app/(dashboard)/dashboard/settings/components/useProxyBatchOperations.ts b/src/app/(dashboard)/dashboard/settings/components/useProxyBatchOperations.ts
index b336431158..1d8ab2d031 100644
--- a/src/app/(dashboard)/dashboard/settings/components/useProxyBatchOperations.ts
+++ b/src/app/(dashboard)/dashboard/settings/components/useProxyBatchOperations.ts
@@ -19,6 +19,7 @@ export function useProxyBatchOperations(load: () => Promise<void>) {
   const [selectedIds, setSelectedIds] = useState<Set<string>>(new Set());
   const [batchDeleting, setBatchDeleting] = useState(false);
   const [autoTesting, setAutoTesting] = useState(false);
+  const [batchActivating, setBatchActivating] = useState(false);
 
   const toggleSelectAll = useCallback(
     (allSelected: boolean, items: Array<{ id: string }>) => {
@@ -63,6 +64,34 @@ export function useProxyBatchOperations(load: () => Promise<void>) {
     [selectedIds, load]
   );
 
+  // #6246: bulk enable/disable — the only automated path that writes proxy
+  // status (an explicit operator action). Health probes are read-only by default.
+  const handleBatchActivate = useCallback(
+    async (setError: (msg: string | null) => void, status: "active" | "inactive" = "active") => {
+      if (selectedIds.size === 0) return;
+      setBatchActivating(true);
+      try {
+        const res = await fetch("/api/settings/proxies/batch-activate", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ ids: Array.from(selectedIds), status }),
+        });
+        const data: { error?: { message?: string } } = await res.json().catch(() => ({}));
+        if (res.ok) {
+          setSelectedIds(new Set());
+          await load();
+        } else {
+          setError(data?.error?.message || "Batch update failed");
+        }
+      } catch (e: unknown) {
+        setError(e instanceof Error ? e.message : "Batch update failed");
+      } finally {
+        setBatchActivating(false);
+      }
+    },
+    [selectedIds, load]
+  );
+
   const handleAutoTestAll = useCallback(
     async (
       setError: (msg: string | null) => void,
@@ -106,9 +135,11 @@ export function useProxyBatchOperations(load: () => Promise<void>) {
     setSelectedIds,
     batchDeleting,
     autoTesting,
+    batchActivating,
     toggleSelectAll,
     toggleSelect,
     handleBatchDelete,
+    handleBatchActivate,
     handleAutoTestAll,
   };
 }
diff --git a/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/index.tsx b/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/index.tsx
index f977b2fedc..4acdb798bd 100644
--- a/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/index.tsx
+++ b/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/index.tsx
@@ -25,6 +25,14 @@ import { useVisibleQuotaData } from "./useVisibleQuotaData";
 import { formatAutoRefreshCountdown } from "./formatters";
 import { translateUsageOrFallback, type UsageTranslationValues } from "./i18nFallback";
 import { compareTr } from "@/shared/utils/turkishText";
+import { fetchWithTimeout } from "@/shared/utils/fetchTimeout";
+
+// Bound the two first-paint requests so a stalled connection cannot wedge
+// `initialLoading` on `true` and freeze the quota page on its skeleton forever
+// (same infinite-skeleton class as the providers page). A `try/catch` degrades a
+// *rejection* to a default, but only a timeout/abort can rescue a `fetch()` that
+// never settles (browser connection-pool starvation under the RSC prefetch storm).
+const PROVIDER_LIMITS_FETCH_TIMEOUT_MS = 20_000;
 
 const LS_PURCHASE_FILTER = "omniroute:limits:purchaseFilter";
 const LS_STATUS_FILTER = "omniroute:limits:statusFilter";
@@ -311,7 +319,9 @@ export default function ProviderLimits({
 
   const fetchConnections = useCallback(async () => {
     try {
-      const response = await fetch("/api/providers/client");
+      const response = await fetchWithTimeout("/api/providers/client", {
+        timeoutMs: PROVIDER_LIMITS_FETCH_TIMEOUT_MS,
+      });
       if (!response.ok) throw new Error("Failed");
       const data = await response.json();
       const list = data.connections || [];
@@ -382,7 +392,9 @@ export default function ProviderLimits({
 
   const fetchCachedProviderLimits = useCallback(async () => {
     try {
-      const response = await fetch("/api/usage/provider-limits");
+      const response = await fetchWithTimeout("/api/usage/provider-limits", {
+        timeoutMs: PROVIDER_LIMITS_FETCH_TIMEOUT_MS,
+      });
       if (!response.ok) throw new Error("Failed");
       const data = await response.json();
       return data.caches || {};
diff --git a/src/app/(dashboard)/home/page.tsx b/src/app/(dashboard)/home/page.tsx
index 0e27614634..b6c0796ad3 100644
--- a/src/app/(dashboard)/home/page.tsx
+++ b/src/app/(dashboard)/home/page.tsx
@@ -3,7 +3,6 @@ import { getMachineId } from "@/shared/utils/machine";
 import { getSettings } from "@/lib/localDb";
 import HomePageClient from "../dashboard/HomePageClient";
 import BootstrapBanner from "../dashboard/BootstrapBanner";
-import AutoRoutingBanner from "@/shared/components/AutoRoutingBanner";
 
 export const dynamic = "force-dynamic";
 
@@ -17,7 +16,6 @@ export default async function HomePage() {
   return (
     <>
       {isBootstrapped && <BootstrapBanner />}
-      <AutoRoutingBanner />
       <HomePageClient machineId={machineId} />
     </>
   );
diff --git a/src/app/api/cloud/credentials/update/route.ts b/src/app/api/cloud/credentials/update/route.ts
index 25b492e082..ad58f5fbd4 100644
--- a/src/app/api/cloud/credentials/update/route.ts
+++ b/src/app/api/cloud/credentials/update/route.ts
@@ -1,10 +1,17 @@
 import { NextResponse } from "next/server";
-import { validateApiKey, getProviderConnections, updateProviderConnection } from "@/models";
+import { getProviderConnections, updateProviderConnection } from "@/models";
+import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
 import { cloudCredentialUpdateSchema } from "@/shared/validation/schemas";
 import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
 
 // Update provider credentials (for cloud token refresh)
 export async function PUT(request: Request) {
+  const authError = await requireManagementAuth(request, {
+    alwaysRequireAuth: true,
+    invalidApiKeyStatus: 401,
+  });
+  if (authError) return authError;
+
   let rawBody;
   try {
     rawBody = await request.json();
@@ -16,24 +23,12 @@ export async function PUT(request: Request) {
   }
 
   try {
-    const authHeader = request.headers.get("Authorization");
-    if (!authHeader?.startsWith("Bearer ")) {
-      return NextResponse.json({ error: "Missing API key" }, { status: 401 });
-    }
-
-    const apiKey = authHeader.slice(7);
     const validation = validateBody(cloudCredentialUpdateSchema, rawBody);
     if (isValidationFailure(validation)) {
       return NextResponse.json({ error: validation.error }, { status: 400 });
     }
     const { provider, credentials } = validation.data;
 
-    // Validate API key
-    const isValid = await validateApiKey(apiKey);
-    if (!isValid) {
-      return NextResponse.json({ error: "Invalid API key" }, { status: 401 });
-    }
-
     // Find active connection for provider
     const connections = await getProviderConnections({ provider, isActive: true });
     const connection = connections[0];
diff --git a/src/app/api/cloud/models/alias/route.ts b/src/app/api/cloud/models/alias/route.ts
index cbc7a2923f..1f2ae36ad5 100644
--- a/src/app/api/cloud/models/alias/route.ts
+++ b/src/app/api/cloud/models/alias/route.ts
@@ -1,5 +1,6 @@
 import { NextResponse } from "next/server";
 import { validateApiKey, getModelAliases, setModelAlias, isCloudEnabled } from "@/models";
+import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
 import { getConsistentMachineId } from "@/shared/utils/machineId";
 import { syncToCloud } from "@/lib/cloudSync";
 import { cloudModelAliasUpdateSchema } from "@/shared/validation/schemas";
@@ -7,6 +8,12 @@ import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
 
 // PUT /api/cloud/models/alias - Set model alias (for cloud/CLI)
 export async function PUT(request: Request) {
+  const authError = await requireManagementAuth(request, {
+    alwaysRequireAuth: true,
+    invalidApiKeyStatus: 401,
+  });
+  if (authError) return authError;
+
   let rawBody;
   try {
     rawBody = await request.json();
@@ -18,18 +25,6 @@ export async function PUT(request: Request) {
   }
 
   try {
-    const authHeader = request.headers.get("authorization");
-    const apiKey = authHeader?.replace("Bearer ", "");
-
-    if (!apiKey) {
-      return NextResponse.json({ error: "Missing API key" }, { status: 401 });
-    }
-
-    const isValid = await validateApiKey(apiKey);
-    if (!isValid) {
-      return NextResponse.json({ error: "Invalid API key" }, { status: 401 });
-    }
-
     const validation = validateBody(cloudModelAliasUpdateSchema, rawBody);
     if (isValidationFailure(validation)) {
       return NextResponse.json({ error: validation.error }, { status: 400 });
diff --git a/src/app/api/free-provider-rankings/route.ts b/src/app/api/free-provider-rankings/route.ts
index 73b21dde8a..e493e179a0 100644
--- a/src/app/api/free-provider-rankings/route.ts
+++ b/src/app/api/free-provider-rankings/route.ts
@@ -3,6 +3,12 @@ import { z } from "zod";
 import { CORS_HEADERS, handleCorsOptions } from "@/shared/utils/cors";
 import { computeFreeProviderRankings } from "@/lib/freeProviderRankings";
 
+// Coerce common truthy query-string forms ("1", "true", "yes") to a boolean.
+const boolParam = z
+  .string()
+  .optional()
+  .transform((val) => val === "1" || val === "true" || val === "yes");
+
 const QuerySchema = z.object({
   category: z.string().min(1).max(50).optional(),
   limit: z
@@ -13,6 +19,9 @@ const QuerySchema = z.object({
       const n = Number(val);
       return Number.isFinite(n) && n >= 1 ? Math.min(Math.round(n), 100) : 50;
     }),
+  // Additive filters (default off → current behavior). `availableOnly` implies configured.
+  configuredOnly: boolParam,
+  availableOnly: boolParam,
 });
 
 export async function OPTIONS() {
@@ -24,6 +33,8 @@ export async function GET(request: NextRequest) {
   const parsed = QuerySchema.safeParse({
     category: url.searchParams.get("category") || undefined,
     limit: url.searchParams.get("limit") || undefined,
+    configuredOnly: url.searchParams.get("configuredOnly") || undefined,
+    availableOnly: url.searchParams.get("availableOnly") || undefined,
   });
 
   if (!parsed.success) {
@@ -33,8 +44,11 @@ export async function GET(request: NextRequest) {
     );
   }
 
-  const { category, limit } = parsed.data;
-  const rankings = computeFreeProviderRankings(category, limit);
+  const { category, limit, configuredOnly, availableOnly } = parsed.data;
+  const rankings = await computeFreeProviderRankings(category, limit, {
+    configuredOnly,
+    availableOnly,
+  });
 
   return NextResponse.json({ rankings }, { headers: CORS_HEADERS });
 }
diff --git a/src/app/api/github-skills/route.ts b/src/app/api/github-skills/route.ts
new file mode 100644
index 0000000000..303d92568b
--- /dev/null
+++ b/src/app/api/github-skills/route.ts
@@ -0,0 +1,97 @@
+/**
+ * GET/POST /api/github-skills
+ *
+ * GitHub agent skill discovery and import.
+ *
+ * GET:  Search GitHub for repos containing SKILL.md / agent skill files
+ *       Query params: minStars, maxResults, minScore, query
+ *
+ * POST: Install a discovered GitHub skill into target agent directories
+ *       Body: { repoName, targets, description }
+ */
+import { NextRequest, NextResponse } from "next/server";
+import { searchGitHubSkills } from "@/lib/skills/githubCollector";
+import { matchesSearch } from "@/shared/utils/turkishText";
+import { buildErrorBody, sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
+
+export const dynamic = "force-dynamic";
+
+export async function GET(request: NextRequest) {
+  try {
+    const { searchParams } = new URL(request.url);
+    const minStars = parseInt(searchParams.get("minStars") ?? "1", 10);
+    const maxResults = Math.min(parseInt(searchParams.get("maxResults") ?? "50", 10), 200);
+    const minScore = parseFloat(searchParams.get("minScore") ?? "0");
+    const query = searchParams.get("query") || "";
+
+    const { repos, errors } = await searchGitHubSkills({
+      minStars: isNaN(minStars) ? 1 : minStars,
+      maxResults: isNaN(maxResults) ? 5 : maxResults,
+    });
+
+    let filtered = repos;
+    if (minScore > 0) filtered = filtered.filter((r) => r.score >= minScore);
+    if (query) {
+      filtered = filtered.filter(
+        (r) => matchesSearch(r.fullName, query) || matchesSearch(r.description, query)
+      );
+    }
+
+    return NextResponse.json({
+      skills: filtered.map((r) => ({
+        fullName: r.fullName,
+        stars: r.stars,
+        score: r.score,
+        description: r.description.slice(0, 300),
+        hasSkillFile: r.hasSkillFile,
+        license: r.license,
+      })),
+      total: filtered.length,
+      ...(errors.length > 0 ? { errors } : {}),
+    });
+  } catch (err) {
+    const msg = sanitizeErrorMessage(err instanceof Error ? err.message : String(err));
+    return NextResponse.json({ error: msg, skills: [], total: 0 }, { status: 500 });
+  }
+}
+
+export async function POST(request: NextRequest) {
+  try {
+    const body = await request.json();
+    const {
+      repoName,
+      targets = ["hermes"],
+      description = "",
+    } = body as {
+      repoName?: string;
+      targets?: string[];
+      description?: string;
+    };
+
+    if (!repoName || typeof repoName !== "string") {
+      return NextResponse.json(buildErrorBody(400, "repoName is required"), { status: 400 });
+    }
+
+    const { resolveInstallPath, INSTALL_TARGETS } = await import("@/lib/skills/githubCollector");
+    const skillName = repoName.split("/").pop() || repoName;
+
+    const results = targets.map((target) => {
+      try {
+        const dest = resolveInstallPath(target as any, skillName, description);
+        return { target, ok: true, action: "planned", destDir: dest };
+      } catch (err) {
+        return { target, ok: false, action: "error", error: (err as Error).message };
+      }
+    });
+
+    return NextResponse.json({
+      repoName,
+      skillName,
+      results,
+      allOk: results.every((r) => r.ok),
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return NextResponse.json(buildErrorBody(500, msg), { status: 500 });
+  }
+}
diff --git a/src/app/api/models/test/route.ts b/src/app/api/models/test/route.ts
index 376b050610..8044d51d20 100644
--- a/src/app/api/models/test/route.ts
+++ b/src/app/api/models/test/route.ts
@@ -20,21 +20,23 @@ export async function POST(request: Request) {
   try {
     rawBody = await request.json();
   } catch {
-    return NextResponse.json(
-      {
-        error: {
-          message: "Invalid request",
-          details: [{ field: "body", message: "Invalid JSON body" }],
-        },
-      },
-      { status: 400 }
-    );
+    // Keep `error` a plain string — the dashboard renders it directly in a toast,
+    // and an object here throws React #31 ("Objects are not valid as a React
+    // child"), freezing the whole page instead of showing the message.
+    return NextResponse.json({ status: "error", error: "Invalid JSON body" }, { status: 400 });
   }
 
   try {
     const validation = testModelSchema.safeParse(rawBody);
     if (!validation.success) {
-      return NextResponse.json({ error: validation.error.format() }, { status: 400 });
+      // Flatten the Zod issues to a string (never return the object — see above).
+      const detail = validation.error.issues
+        .map((i) => `${i.path.join(".") || "body"}: ${i.message}`)
+        .join("; ");
+      return NextResponse.json(
+        { status: "error", error: `Invalid request: ${detail}` },
+        { status: 400 }
+      );
     }
     const { providerId, modelId, connectionId } = validation.data;
 
diff --git a/src/app/api/oauth/[provider]/[action]/keychainImportOnly.ts b/src/app/api/oauth/[provider]/[action]/keychainImportOnly.ts
new file mode 100644
index 0000000000..0ee954f54a
--- /dev/null
+++ b/src/app/api/oauth/[provider]/[action]/keychainImportOnly.ts
@@ -0,0 +1,50 @@
+import { NextResponse } from "next/server";
+
+/**
+ * Providers that have NO browser OAuth flow at all — their credentials are read
+ * from the OS keychain via a dedicated Import button, not an OAuth
+ * authorize/exchange. They are listed in the OAuth provider *catalog*
+ * (so the dashboard shows them) but have no entry in the OAuth provider
+ * *handler* registry, so hitting the generic OAuth route for them threw an
+ * unhandled `Unknown provider: <id>` 500 (#6041). Return a clear, actionable
+ * response pointing at the Import flow instead.
+ *
+ * Extracted from the OAuth route handler into this leaf module so the route
+ * stays under its frozen file-size cap (#6155 base-red follow-up).
+ */
+export const KEYCHAIN_IMPORT_ONLY_PROVIDERS = new Set(["zed"]);
+
+/** GET/POST OAuth actions that don't apply to keychain-import-only providers. */
+export const OAUTH_FLOW_ACTIONS = new Set([
+  "authorize",
+  "device-code",
+  "start-callback-server",
+  "poll-callback",
+  "exchange",
+  "poll",
+  "device-complete",
+]);
+
+function keychainImportOnlyResponse(provider: string) {
+  return NextResponse.json(
+    {
+      error:
+        `${provider} has no browser OAuth flow — it imports LLM credentials from the ` +
+        `OS keychain. Use the "Import" button on the ${provider} provider card in the ` +
+        `dashboard to discover and import them automatically.`,
+    },
+    { status: 400 }
+  );
+}
+
+/**
+ * If `provider` is keychain-import-only and `action` is an OAuth-flow action,
+ * return the graceful 400 response; otherwise return null so the caller falls
+ * through to normal OAuth handling.
+ */
+export function keychainImportOnlyGuard(provider: string, action: string): NextResponse | null {
+  if (KEYCHAIN_IMPORT_ONLY_PROVIDERS.has(provider) && OAUTH_FLOW_ACTIONS.has(action)) {
+    return keychainImportOnlyResponse(provider);
+  }
+  return null;
+}
diff --git a/src/app/api/oauth/[provider]/[action]/route.ts b/src/app/api/oauth/[provider]/[action]/route.ts
index 373f572b01..270372eb0e 100755
--- a/src/app/api/oauth/[provider]/[action]/route.ts
+++ b/src/app/api/oauth/[provider]/[action]/route.ts
@@ -35,6 +35,7 @@ import {
 import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
 import { isAuthRequired, isAuthenticated } from "@/shared/utils/apiAuth";
 import { sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
+import { keychainImportOnlyGuard } from "./keychainImportOnly";
 
 // Use globalThis to persist callback server state across Next.js HMR reloads
 if (!globalThis.__codexCallbackState) {
@@ -68,40 +69,6 @@ const RETIRED_PKCE_PROVIDERS = new Set(["windsurf", "devin-cli"]);
 /** Providers that allow direct import of a raw API token (no OAuth exchange). */
 const IMPORT_TOKEN_PROVIDERS = new Set(["windsurf", "devin-cli", "grok-cli"]);
 
-/**
- * Providers that have NO browser OAuth flow at all — their credentials are read
- * from the OS keychain via a dedicated Import button, not an OAuth
- * authorize/exchange. They are listed in the OAuth provider *catalog*
- * (so the dashboard shows them) but have no entry in the OAuth provider
- * *handler* registry, so hitting the generic OAuth route for them threw an
- * unhandled `Unknown provider: <id>` 500 (#6041). Return a clear, actionable
- * response pointing at the Import flow instead.
- */
-const KEYCHAIN_IMPORT_ONLY_PROVIDERS = new Set(["zed"]);
-
-/** GET/POST OAuth actions that don't apply to keychain-import-only providers. */
-const OAUTH_FLOW_ACTIONS = new Set([
-  "authorize",
-  "device-code",
-  "start-callback-server",
-  "poll-callback",
-  "exchange",
-  "poll",
-  "device-complete",
-]);
-
-function keychainImportOnlyResponse(provider: string) {
-  return NextResponse.json(
-    {
-      error:
-        `${provider} has no browser OAuth flow — it imports LLM credentials from the ` +
-        `OS keychain. Use the "Import" button on the ${provider} provider card in the ` +
-        `dashboard to discover and import them automatically.`,
-    },
-    { status: 400 }
-  );
-}
-
 /**
  * Constant-time string comparison to prevent timing-oracle attacks (CWE-208).
  * Handles null/undefined safely and different-length strings.
@@ -172,12 +139,8 @@ export async function GET(
     }
     // Keychain-import-only providers (e.g. zed) have no OAuth flow — return a
     // clear 400 pointing at the Import button instead of a 500 (#6041).
-    if (
-      KEYCHAIN_IMPORT_ONLY_PROVIDERS.has(earlyParams.provider) &&
-      OAUTH_FLOW_ACTIONS.has(earlyParams.action)
-    ) {
-      return keychainImportOnlyResponse(earlyParams.provider);
-    }
+    const kio = keychainImportOnlyGuard(earlyParams.provider, earlyParams.action);
+    if (kio) return kio;
   } catch {
     /* fall through to normal handling */
   }
@@ -399,12 +362,8 @@ export async function POST(
       );
     }
     // Keychain-import-only providers (e.g. zed) have no OAuth flow (#6041).
-    if (
-      KEYCHAIN_IMPORT_ONLY_PROVIDERS.has(earlyParams.provider) &&
-      OAUTH_FLOW_ACTIONS.has(earlyParams.action)
-    ) {
-      return keychainImportOnlyResponse(earlyParams.provider);
-    }
+    const kio = keychainImportOnlyGuard(earlyParams.provider, earlyParams.action);
+    if (kio) return kio;
   } catch {
     /* fall through to normal handling */
   }
diff --git a/src/app/api/providers/[id]/models/route.ts b/src/app/api/providers/[id]/models/route.ts
index 6d1448d803..d16dcc26a7 100755
--- a/src/app/api/providers/[id]/models/route.ts
+++ b/src/app/api/providers/[id]/models/route.ts
@@ -92,6 +92,7 @@ import {
   normalizeSapModelsResponse,
 } from "./discovery/normalizers";
 import { isNamedOpenAIStyleProvider } from "./discovery/providerSets";
+import { buildStaleEncryptionKeyResponse } from "./staleEncryptionGuard";
 import {
   type ProviderModelsConfigEntry,
   PROVIDER_MODELS_CONFIG,
@@ -193,6 +194,13 @@ export async function GET(
       return NextResponse.json({ error: "Connection not found" }, { status: 404 });
     }
 
+    // #6148 — short-circuit when a stored credential is encrypted but no longer
+    // decrypts (STORAGE_ENCRYPTION_KEY changed/unset). Otherwise the null key is
+    // coerced to "", an empty-Bearer probe is sent, and the operator sees a
+    // misleading "Auth failed: 401" instead of the real cause.
+    const staleEncryptionResponse = buildStaleEncryptionKeyResponse(connection);
+    if (staleEncryptionResponse) return staleEncryptionResponse;
+
     const provider =
       typeof connection.provider === "string" && connection.provider.trim().length > 0
         ? connection.provider
diff --git a/src/app/api/providers/[id]/models/staleEncryptionGuard.ts b/src/app/api/providers/[id]/models/staleEncryptionGuard.ts
new file mode 100644
index 0000000000..ea05fd023f
--- /dev/null
+++ b/src/app/api/providers/[id]/models/staleEncryptionGuard.ts
@@ -0,0 +1,30 @@
+import { NextResponse } from "next/server";
+import { buildErrorBody } from "@omniroute/open-sse/utils/error";
+
+/**
+ * #6148 — Stale STORAGE_ENCRYPTION_KEY guard for model-discovery.
+ *
+ * `decryptConnectionFields` (src/lib/db/encryption.ts) flags a connection with
+ * `credentialDecryptFailed: true` when a stored credential is still encrypted
+ * (`enc:v1:…`) but no longer decrypts — the signature of a changed or unset
+ * STORAGE_ENCRYPTION_KEY. Without this guard the null credential is coerced to
+ * an empty string, an empty-Bearer request is sent upstream, and the operator
+ * sees a misleading "Auth failed: 401" that hides the real cause.
+ *
+ * Returns a 424 (Failed Dependency) response with a clear, sanitized message
+ * when the connection carries that flag; otherwise null (proceed normally).
+ */
+const STALE_ENCRYPTION_MESSAGE =
+  "Stored API key cannot be decrypted (STORAGE_ENCRYPTION_KEY changed or unset). Re-enter the API key.";
+
+export function buildStaleEncryptionKeyResponse(
+  connection: { credentialDecryptFailed?: unknown } | null | undefined
+): NextResponse | null {
+  if (!connection || connection.credentialDecryptFailed !== true) return null;
+
+  // buildErrorBody sanitizes the message (Rule #12); override the type so the
+  // client can key off the specific stale-encryption cause.
+  const body = buildErrorBody(424, STALE_ENCRYPTION_MESSAGE);
+  body.error.type = "storage_encryption_stale";
+  return NextResponse.json(body, { status: 424 });
+}
diff --git a/src/app/api/providers/bulk/route.ts b/src/app/api/providers/bulk/route.ts
index ce8e2aa491..2929a9ec1d 100644
--- a/src/app/api/providers/bulk/route.ts
+++ b/src/app/api/providers/bulk/route.ts
@@ -109,6 +109,15 @@ export async function POST(request: Request) {
   for (let i = 0; i < entries.length; i++) {
     const entry = entries[i];
     try {
+      // Per-entry copy so each connection gets its own providerSpecificData. Cloudflare
+      // Workers AI carries a per-key accountId (name|accountId|apiKey) that must NOT bleed
+      // across entries — never mutate/reuse the shared base object here.
+      const entryProviderSpecificData: Record<string, unknown> = {
+        ...(baseProviderSpecificData || {}),
+        ...(entry.accountId ? { accountId: entry.accountId } : {}),
+      };
+      const hasEntryPsd = Object.keys(entryProviderSpecificData).length > 0;
+
       let testStatus: "active" | "unknown" | "failed" = "unknown";
 
       if (validateKeys) {
@@ -116,7 +125,7 @@ export async function POST(request: Request) {
           validateProviderApiKey({
             provider,
             apiKey: entry.apiKey,
-            providerSpecificData: baseProviderSpecificData || {},
+            providerSpecificData: entryProviderSpecificData,
           })
         );
         testStatus = probe?.valid ? "active" : "failed";
@@ -130,7 +139,7 @@ export async function POST(request: Request) {
         priority: priority || 1,
         globalPriority: globalPriority || null,
         defaultModel: null,
-        providerSpecificData: baseProviderSpecificData,
+        providerSpecificData: hasEntryPsd ? entryProviderSpecificData : baseProviderSpecificData,
         isActive: true,
         testStatus,
       });
diff --git a/src/app/api/settings/proxies/auto-test/route.ts b/src/app/api/settings/proxies/auto-test/route.ts
index 1f657d3b1f..81efd771ac 100644
--- a/src/app/api/settings/proxies/auto-test/route.ts
+++ b/src/app/api/settings/proxies/auto-test/route.ts
@@ -4,6 +4,7 @@ import { createErrorResponseFromUnknown } from "@/lib/api/errorResponse";
 import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
 import { createProxyDispatcher } from "@omniroute/open-sse/utils/proxyDispatcher";
 import { fetch as undiciFetch } from "undici";
+import { resolveHealthCheckStatusWrite } from "@/lib/proxyHealth/statusPolicy";
 import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
 import { createErrorResponse } from "@/lib/api/errorResponse";
 
@@ -43,11 +44,16 @@ async function testSingleProxy(proxy: { id: string; type: string; host: string;
     });
     const latencyMs = Date.now() - start;
     const alive = resp.status < 500;
-    await updateProxy(proxy.id, { status: alive ? "active" : "inactive" }).catch(() => {});
+    // #6246: "Test All" is a test, not test-and-set. By default an automated probe
+    // never mutates a proxy's status (only the operator does). Opt back into the
+    // legacy write with PROXY_HEALTH_AUTO_DEACTIVATE=true.
+    const statusWrite = resolveHealthCheckStatusWrite(alive);
+    if (statusWrite) await updateProxy(proxy.id, { status: statusWrite }).catch(() => {});
     return { proxyId: proxy.id, host: proxy.host, port: proxy.port, alive, latencyMs };
   } catch (err) {
     const latencyMs = Date.now() - start;
-    await updateProxy(proxy.id, { status: "inactive" }).catch(() => {});
+    const statusWrite = resolveHealthCheckStatusWrite(false);
+    if (statusWrite) await updateProxy(proxy.id, { status: statusWrite }).catch(() => {});
     return {
       proxyId: proxy.id,
       host: proxy.host,
diff --git a/src/app/api/settings/proxies/batch-activate/route.ts b/src/app/api/settings/proxies/batch-activate/route.ts
new file mode 100644
index 0000000000..9bc11f1999
--- /dev/null
+++ b/src/app/api/settings/proxies/batch-activate/route.ts
@@ -0,0 +1,72 @@
+import { z } from "zod";
+import { updateProxy } from "@/lib/localDb";
+import { createErrorResponse, createErrorResponseFromUnknown } from "@/lib/api/errorResponse";
+import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
+import { clearDispatcherCache } from "@omniroute/open-sse/utils/proxyDispatcher";
+import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
+
+const batchActivateSchema = z.object({
+  ids: z.array(z.string()).min(1).max(500),
+  // "active" (bulk enable) or "inactive" (bulk disable). Defaults to enable —
+  // the #6246 ask was a way to re-enable proxies an operator had disabled.
+  status: z.enum(["active", "inactive"]).optional().default("active"),
+});
+
+/**
+ * POST /api/settings/proxies/batch-activate
+ *
+ * Bulk-set the status of multiple proxies in one request (#6246). This is the
+ * ONLY automated path allowed to change proxy status — it is an explicit
+ * operator action, unlike the reachability probes which are read-only by
+ * default (see src/lib/proxyHealth/statusPolicy.ts).
+ */
+export async function POST(request: Request) {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
+  let rawBody: unknown;
+  try {
+    rawBody = await request.json();
+  } catch {
+    return createErrorResponse({ status: 400, message: "Invalid JSON body", type: "invalid_request" });
+  }
+
+  const validation = validateBody(batchActivateSchema, rawBody);
+  if (isValidationFailure(validation)) {
+    return createErrorResponse({ status: 400, message: validation.error.message, type: "invalid_request" });
+  }
+
+  const { ids, status } = validation.data;
+
+  try {
+    const results: Array<{ id: string; success: boolean; error?: string }> = [];
+    let updatedCount = 0;
+
+    for (const id of ids) {
+      try {
+        if (await updateProxy(id, { status })) {
+          results.push({ id, success: true });
+          updatedCount++;
+        } else {
+          results.push({ id, success: false, error: "Proxy not found" });
+        }
+      } catch (err) {
+        results.push({ id, success: false, error: err instanceof Error ? err.message : "Unknown error" });
+      }
+    }
+
+    if (updatedCount > 0) {
+      try { clearDispatcherCache(); } catch { /* non-critical */ }
+    }
+
+    return Response.json({
+      success: updatedCount > 0,
+      status,
+      updated: updatedCount,
+      failed: ids.length - updatedCount,
+      results,
+    });
+  } catch (error) {
+    return createErrorResponseFromUnknown(error, "Failed to batch update proxy status");
+  }
+}
diff --git a/src/app/api/settings/proxy/deno-deploy/route.ts b/src/app/api/settings/proxy/deno-deploy/route.ts
index 8b305770fa..7ec8764d87 100644
--- a/src/app/api/settings/proxy/deno-deploy/route.ts
+++ b/src/app/api/settings/proxy/deno-deploy/route.ts
@@ -74,8 +74,11 @@ export function resolveRelayTarget(
 // SAME source used by the server and by the unit tests — embedded here via
 // Function#toString so the worker enforces byte-for-byte the audited policy.
 // Mirrors the Vercel-relay guard so a future audit can diff the two.
+// The guard is bound to a LITERAL const name (not a bare declaration) so the
+// hardcoded call site below resolves even when the SWC-minified standalone build
+// mangles the source function's own name in `.toString()` output (#6149).
 function buildRelayWorker(relayAuth: string): string {
-  return `${resolveRelayTarget.toString()}
+  return `const resolveRelayTarget = ${resolveRelayTarget.toString()};
 
 function isPrivateHostname(h) {
   if (!h) return true;
diff --git a/src/app/api/settings/proxy/vercel-deploy/route.ts b/src/app/api/settings/proxy/vercel-deploy/route.ts
index eb46cfb336..42f432f2c6 100644
--- a/src/app/api/settings/proxy/vercel-deploy/route.ts
+++ b/src/app/api/settings/proxy/vercel-deploy/route.ts
@@ -20,10 +20,13 @@ function buildRelayFunction(relayAuth: string): string {
   // Node-side helpers from the Edge runtime); it blocks RFC1918, loopback,
   // link-local, IPv6 ULA, and embedded credentials on the x-relay-target host.
   // `resolveRelayTarget` (shared with the Deno worker) closes the x-relay-path
-  // host-confusion hole and is embedded verbatim via Function#toString.
+  // host-confusion hole and is embedded verbatim via Function#toString. It is
+  // bound to a LITERAL const name (not a bare declaration) so the hardcoded
+  // call site below resolves even when the SWC-minified standalone build mangles
+  // the source function's own name in `.toString()` output (#6149).
   return `export const config = { runtime: "edge" };
 
-${resolveRelayTarget.toString()}
+const resolveRelayTarget = ${resolveRelayTarget.toString()};
 
 function isPrivateHostname(h) {
   if (!h) return true;
diff --git a/src/app/api/usage/call-logs/route.ts b/src/app/api/usage/call-logs/route.ts
index e59ab37e0b..90ff750e4f 100644
--- a/src/app/api/usage/call-logs/route.ts
+++ b/src/app/api/usage/call-logs/route.ts
@@ -3,6 +3,7 @@ import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
 import { getCallLogs } from "@/lib/usageDb";
 import { getCompletedDetails, getPendingById } from "@/lib/usage/usageHistory";
 import { getProviderConnections } from "@/lib/localDb";
+import { matchesSearch } from "@/shared/utils/turkishText";
 
 type CallLogListRowsInput = {
   logs: any[];
@@ -148,7 +149,7 @@ export async function GET(request: Request) {
     // the DB rows but activeEntries/completedEntries bypass it.
     if (filter.correlationId) {
       const cid = filter.correlationId;
-      return NextResponse.json(rows.filter((r: any) => r.correlationId === cid));
+      return NextResponse.json(rows.filter((r: any) => matchesSearch(r.correlationId || "", cid)));
     }
 
     return NextResponse.json(rows);
diff --git a/src/app/api/v1/chat/completions/route.ts b/src/app/api/v1/chat/completions/route.ts
index 9fd7c5452c..0bc62035d7 100644
--- a/src/app/api/v1/chat/completions/route.ts
+++ b/src/app/api/v1/chat/completions/route.ts
@@ -1,6 +1,7 @@
 import { CORS_HEADERS, handleCorsOptions } from "@/shared/utils/cors";
 import { callCloudWithMachineId } from "@/shared/utils/cloud";
 import { handleChat } from "@/sse/handlers/chat";
+import { generateRequestId } from "@/shared/utils/requestId";
 import { initTranslators } from "@omniroute/open-sse/translator/index.ts";
 import { createInjectionGuard } from "@/middleware/promptInjectionGuard";
 import { acceptHeaderForcesStream } from "@omniroute/open-sse/utils/aiSdkCompat.ts";
@@ -99,9 +100,11 @@ export async function POST(request) {
   const wantsStreaming = (parsedBodyIsRecord && parsedBody.stream === true) || acceptForcesStream;
 
   if (wantsStreaming) {
-    return await withEarlyStreamKeepalive(handleChat(request, null, parsedBody), {
+    const reqId = generateRequestId();
+    return await withEarlyStreamKeepalive(handleChat(request, null, parsedBody, reqId), {
       signal: request.signal,
       thresholdMs: resolveKeepaliveThreshold(parsedBody?.model),
+      extraHeaders: { "X-Correlation-Id": reqId },
     });
   }
 
diff --git a/src/app/api/v1/messages/count_tokens/route.ts b/src/app/api/v1/messages/count_tokens/route.ts
index df37669ba5..6a92bebed5 100644
--- a/src/app/api/v1/messages/count_tokens/route.ts
+++ b/src/app/api/v1/messages/count_tokens/route.ts
@@ -99,6 +99,59 @@ export async function POST(request) {
   }
 }
 
+function safeStringify(value) {
+  if (typeof value === "string") return value;
+  try {
+    return JSON.stringify(value) ?? "";
+  } catch {
+    return "";
+  }
+}
+
+// Estimate tokens for a single Anthropic content block. Real agentic
+// conversations carry most of their tokens in `tool_use` inputs, `tool_result`
+// content, and `thinking` blocks — counting only `text` (as before) reported
+// near-zero for those messages and silently broke Claude Code's auto-compaction
+// (#2337). Image / redacted_thinking blocks are not text-estimable and count 0.
+function estimateContentBlockTokens(part) {
+  if (!part || typeof part !== "object") return 0;
+  let tokens = 0;
+  switch (part.type) {
+    case "text":
+      if (typeof part.text === "string") tokens += countTextTokens(part.text);
+      break;
+    case "tool_use":
+      if (typeof part.name === "string") tokens += countTextTokens(part.name);
+      if (part.input !== undefined) tokens += countTextTokens(safeStringify(part.input));
+      break;
+    case "tool_result":
+      tokens += estimateToolResultTokens(part.content);
+      break;
+    case "thinking":
+      if (typeof part.thinking === "string") tokens += countTextTokens(part.thinking);
+      break;
+    default:
+      break;
+  }
+  return tokens;
+}
+
+// A `tool_result` content can be a plain string or an array of nested blocks
+// (text / image). Count string content and nested text blocks.
+function estimateToolResultTokens(content) {
+  if (typeof content === "string") return countTextTokens(content);
+  if (Array.isArray(content)) {
+    let tokens = 0;
+    for (const block of content) {
+      if (block?.type === "text" && typeof block.text === "string") {
+        tokens += countTextTokens(block.text);
+      }
+    }
+    return tokens;
+  }
+  return 0;
+}
+
 function buildEstimatedCountResponse(body) {
   const messages = Array.isArray(body?.messages) ? body.messages : [];
   let inputTokens = 0;
@@ -111,15 +164,19 @@ function buildEstimatedCountResponse(body) {
 
     if (Array.isArray(msg?.content)) {
       for (const part of msg.content) {
-        if (part?.type === "text" && typeof part.text === "string") {
-          inputTokens += countTextTokens(part.text);
-        }
+        inputTokens += estimateContentBlockTokens(part);
       }
     }
   }
 
   if (typeof body?.system === "string") {
     inputTokens += countTextTokens(body.system);
+  } else if (Array.isArray(body?.system)) {
+    for (const block of body.system) {
+      if (block?.type === "text" && typeof block.text === "string") {
+        inputTokens += countTextTokens(block.text);
+      }
+    }
   }
 
   return new Response(
diff --git a/src/app/api/v1/models/catalog.ts b/src/app/api/v1/models/catalog.ts
index 664cc0087a..73733107af 100644
--- a/src/app/api/v1/models/catalog.ts
+++ b/src/app/api/v1/models/catalog.ts
@@ -292,9 +292,13 @@ export async function getUnifiedModelsResponse(
         registryContext ??
         specContext ??
         (getTokenLimit(providerId, modelId) || undefined);
-      const maxInputTokens = isPositiveFiniteNumber(synced?.limit_input)
+      const registryInputLimit = isPositiveFiniteNumber(registryModel?.maxInputTokens)
+        ? registryModel.maxInputTokens
+        : undefined;
+      const syncedInputLimit = isPositiveFiniteNumber(synced?.limit_input)
         ? synced.limit_input
-        : contextLength;
+        : undefined;
+      const maxInputTokens = registryInputLimit ?? syncedInputLimit ?? contextLength;
       const maxOutputTokens = isPositiveFiniteNumber(synced?.limit_output)
         ? synced.limit_output
         : isPositiveFiniteNumber(spec?.maxOutputTokens)
diff --git a/src/i18n/messages/en.json b/src/i18n/messages/en.json
index 8fdd6ac761..3df936b09b 100644
--- a/src/i18n/messages/en.json
+++ b/src/i18n/messages/en.json
@@ -2514,7 +2514,8 @@
       "queueTimeout": "How long a request can wait in queue before timing out.",
       "failoverBeforeRetry": "When enabled, any upstream error triggers immediate failover to the next combo target, skipping all retries and fallback URLs.",
       "maxSetRetries": "Number of times to retry the full target set when every target fails. 0 = no set-level retry.",
-      "setRetryDelayMs": "Delay between set-level retry attempts, giving transient issues time to resolve."
+      "setRetryDelayMs": "Delay between set-level retry attempts, giving transient issues time to resolve.",
+      "disableSessionStickiness": "Rotate to a different connection on every request instead of pinning a whole conversation to one connection by the first-message hash. Overrides the global default. Leave on Inherit to preserve prompt-cache hits for multi-turn chats."
     },
     "templatesTitle": "Quick templates",
     "templatesDescription": "Apply a starting profile, then adjust models and config.",
@@ -2828,7 +2829,10 @@
     "agentFeaturesContextLengthErrorInteger": "Context length must be a valid integer",
     "agentFeaturesContextLengthErrorRange": "Context length must be between 1000 and 2000000",
     "compressionOverride": "Compression Override",
-    "modePack": "Mode Pack"
+    "modePack": "Mode Pack",
+    "disableSessionStickiness": "Disable session stickiness",
+    "sessionStickinessEnabled": "Stickiness on",
+    "sessionStickinessDisabled": "Stickiness off"
   },
   "costs": {
     "title": "Costs",
@@ -4847,8 +4851,11 @@
     "v0VercelWebDesc": "AI code generation via v0.dev",
     "kimiWebLabel": "Kimi Web",
     "kimiWebDesc": "Moonshot AI consumer chat via www.kimi.com (international, Connect-RPC API)",
-    "doubaoWebLabel": "Doubao Web",
-    "doubaoWebDesc": "ByteDance AI chat via doubao.com"
+    "doubaoWebLabel": "Dola Web",
+    "doubaoWebDesc": "ByteDance AI chat via dola.com",
+    "overrideBaseUrlAdvanced": "Advanced: override base URL",
+    "overrideBaseUrlHint": "Advanced: point this built-in provider at a custom endpoint. Leave blank to use the default.",
+    "bulkAddFormatHintCloudflare": "One key per line. Format: name|accountId|apiKey (Cloudflare account ID + API token)."
   },
   "settings": {
     "title": "Settings",
@@ -6149,7 +6156,9 @@
     "modelLockoutExponentialBackoff": "Exponential Backoff",
     "modelLockoutExponentialBackoffDescription": "When enabled, each consecutive failure increases the cooldown duration exponentially.",
     "modelLockoutMaxBackoffSteps": "Max Backoff Steps",
-    "modelLockoutMaxBackoffStepsDescription": "Maximum number of backoff steps before the cooldown stops growing. The Max Cooldown cap is reached first in most configurations, making this a safety ceiling for when Max Cooldown is raised."
+    "modelLockoutMaxBackoffStepsDescription": "Maximum number of backoff steps before the cooldown stops growing. The Max Cooldown cap is reached first in most configurations, making this a safety ceiling for when Max Cooldown is raised.",
+    "disableSessionStickiness": "Disable session stickiness",
+    "disableSessionStickinessDesc": "Round-robin and random combos rotate to a different connection on every request instead of pinning a whole conversation to one connection by the first-message hash. Leave off to preserve prompt-cache hits for multi-turn chats. Per-combo overrides take precedence."
   },
   "contextRtk": {
     "title": "RTK Engine",
@@ -7931,6 +7940,7 @@
     "errorTestFailed": "Failed to test proxies",
     "batchSelectedCount": "{count} selected",
     "batchDeleteSelected": "Delete {count} selected",
+    "batchActivateSelected": "Enable {count} selected",
     "testPassed": "✓ OK"
   },
   "playground": {
@@ -9030,7 +9040,14 @@
     "colScore": "Score",
     "colAvgScore": "Avg Score",
     "colModels": "Models",
-    "colType": "Type"
+    "colType": "Type",
+    "filterConfiguredOnly": "Configured only",
+    "filterAvailableOnly": "Available only",
+    "filterAvailableOnlyHelp": "Hide providers whose connections are all rate-limited or out of quota.",
+    "configuredOnly": "Configured Only",
+    "configuredOnlyHint": "Show only providers with active connections",
+    "noConfiguredProviders": "No configured providers found. Add a provider connection first.",
+    "colConfigured": "Status"
   },
   "discovery": {
     "title": "Provider Discovery",
diff --git a/src/i18n/messages/it.json b/src/i18n/messages/it.json
index 751b0b4bb8..f10799a667 100644
--- a/src/i18n/messages/it.json
+++ b/src/i18n/messages/it.json
@@ -841,7 +841,9 @@
     "batchDetailCancelConfirm": "Cancel this batch? In-progress requests will stop.",
     "batchActionCancelError": "Failed to cancel batch. Try again.",
     "batchActionRetryError": "Failed to retry failed requests. Try again.",
-    "batchConceptRetentionNote": "Results and error files are retained for 30 days (Anthropic: 29 days)"
+    "batchConceptRetentionNote": "Results and error files are retained for 30 days (Anthropic: 29 days)",
+    "manualConfig": "Configurazione manuale",
+    "unknownProvider": "Provider sconosciuto"
   },
   "featureFlagOmnirouteEmergencyFallbackDescription": "__MISSING__:Route budget-exhausted requests to the emergency free fallback provider/model.",
   "featureFlagArenaEloSyncEnabledDescription": "__MISSING__:Enable periodic Arena AI leaderboard ELO sync for model intelligence rankings.",
@@ -1114,7 +1116,9 @@
     "dragReorderItem": "__MISSING__:Drag to reorder",
     "cannotHide": "__MISSING__:This item cannot be hidden",
     "alwaysVisible": "__MISSING__:Always visible",
-    "groupSeparatorLabel": "__MISSING__:Separator"
+    "groupSeparatorLabel": "__MISSING__:Separator",
+    "discovery": "Discovery",
+    "discoverySubtitle": "Scansiona provider per accesso gratuito"
   },
   "webhooks": {
     "title": "Webhook",
@@ -1806,7 +1810,9 @@
     "normalKeysSection": "__MISSING__:Normal keys",
     "quotaKeysSection": "__MISSING__:Quota keys",
     "quotaPill": "__MISSING__:QUOTA",
-    "quotaModeOnly": "__MISSING__:qtSd-only"
+    "quotaModeOnly": "__MISSING__:qtSd-only",
+    "devicesCount": "{count, plural, one {# dispositivo} other {# dispositivi}}",
+    "devicesTooltip": "{count, plural, one {# IP/User-Agent distinto visto con questa chiave (ultimi 30 min)} other {# IP/User-Agent distinti visti con questa chiave (ultimi 30 min)}}"
   },
   "auditLog": {
     "title": "Registro di controllo",
@@ -1853,14 +1859,16 @@
       "webSearch": "__MISSING__:Web Search",
       "webFetch": "__MISSING__:Web Fetch",
       "video": "__MISSING__:Video",
-      "music": "__MISSING__:Music"
+      "music": "__MISSING__:Music",
+      "ocr": "OCR"
     },
     "noProviders": "__MISSING__:No providers configured for this kind yet.",
     "addConnection": "__MISSING__:Add Connection",
     "backToProviders": "__MISSING__:Back to Providers",
     "connections": "__MISSING__:{count} Connections",
     "noConnections": "__MISSING__:No connections yet — add one from the provider page.",
-    "loading": "__MISSING__:Loading..."
+    "loading": "__MISSING__:Loading...",
+    "suggestedModels": "Modelli suggeriti dal provider"
   },
   "search": {
     "searchQuery": "Search Query",
@@ -2804,7 +2812,22 @@
     "agentFeaturesContextLengthErrorInteger": "La lunghezza del contesto deve essere un numero intero valido",
     "agentFeaturesContextLengthErrorRange": "La lunghezza del contesto deve essere compresa tra 1.000 e 2.000.000",
     "compressionOverride": "Sostituzione della compressione",
-    "modePack": "Pacchetto modalità"
+    "modePack": "Pacchetto modalità",
+    "fusionJudgeModel": "Modello giudice",
+    "fusionJudgeModelHelp": "Modello che sintetizza le risposte del panel in un'unica risposta finale. Lascia vuoto per usare il primo modello del panel.",
+    "fusionMinPanel": "Panel minimo",
+    "fusionMinPanelHelp": "Risposte del panel necessarie prima che i ritardatari ricevano una finestra di grazia (default 2).",
+    "fusionPanelHardTimeoutMs": "Timeout massimo panel (ms)",
+    "fusionPanelHardTimeoutMsHelp": "Limite assoluto per evitare che un modello bloccato fermi l'intero panel (default 90000).",
+    "fusionStragglerGraceMs": "Grazia ritardatari (ms)",
+    "fusionStragglerGraceMsHelp": "Quanto attendere i modelli lenti del panel una volta raggiunto il quorum (default 8000).",
+    "responseValidationAddCheck": "+ Aggiungi controllo",
+    "responseValidationForbidden": "Sottostringhe vietate (una per riga)",
+    "responseValidationHelp": "Passa al prossimo target quando un corpo 200 OK non supera questi controlli (contenuto dell'assistente).",
+    "responseValidationJsonPaths": "Controlli JSON-path",
+    "responseValidationMinLength": "Lunghezza minima contenuto (caratteri)",
+    "responseValidationRequired": "Sottostringhe richieste (una per riga)",
+    "responseValidationTitle": "Validazione risposta"
   },
   "costs": {
     "title": "Costi",
@@ -3432,7 +3455,11 @@
       "cleaning": "__MISSING__:Cleaning...",
       "cleanNow": "__MISSING__:Clean now",
       "cleanupSuccess": "__MISSING__:{count} point(s) removed",
-      "cleanupFailed": "__MISSING__:Cleanup failed"
+      "cleanupFailed": "__MISSING__:Cleanup failed",
+      "banner": "Vector store Tier 2 — un'alternativa esterna e scalabile al sqlite-vec integrato (Tier 1). Attivalo solo se hai un insieme di memorie molto grande o vuoi memoria condivisa tra istanze; la maggior parte degli utenti sta bene con sqlite-vec. Quando attivato diventa lo store primario e fa automaticamente fallback a sqlite-vec se non raggiungibile.",
+      "collectionHelp": "Qualsiasi nome — OmniRoute lo crea al primo utilizzo",
+      "embeddingModelHelp": "Imposta automaticamente la dimensione del vettore al primo utilizzo. Le memorie esistenti non vengono popolate retroattivamente, e cambiare modello dopo aver inserito dati richiede una nuova collezione.",
+      "hostHelp": "Docker locale: http://localhost:6333 · Qdrant Cloud: l'URL del tuo cluster"
     },
     "rerank": {
       "enableLabel": "__MISSING__:Enable Rerank",
@@ -3538,7 +3565,8 @@
     "installSkillModalDesc": "__MISSING__:Paste a skill manifest JSON or upload a .json file.",
     "uploadJson": "__MISSING__:Upload JSON",
     "cancel": "__MISSING__:Cancel",
-    "installSkill": "Installa abilità"
+    "installSkill": "Installa abilità",
+    "delete": "Elimina"
   },
   "health": {
     "title": "Salute del sistema",
@@ -4813,7 +4841,13 @@
     "kimiWebLabel": "__MISSING__:Kimi Web",
     "kimiWebDesc": "__MISSING__:Moonshot AI consumer chat via www.kimi.com (international, Connect-RPC API)",
     "doubaoWebLabel": "__MISSING__:Doubao Web",
-    "doubaoWebDesc": "__MISSING__:ByteDance AI chat via doubao.com"
+    "doubaoWebDesc": "__MISSING__:ByteDance AI chat via doubao.com",
+    "clientIdentityHint": "Opzionale. Aggiunge header di fingerprint client (es. User-Agent) corrispondenti a una CLI nota per gateway compatibili che li richiedono.",
+    "clientIdentityLabel": "Identità Client",
+    "compatibleDefaultModelHint": "Inserisci l'ID modello esattamente come lo aspetta il tuo endpoint compatibile. Questo modello verrà salvato come default della connessione.",
+    "compatibleDefaultModelLabel": "Modello Predefinito",
+    "iconUrlHint": "Opzionale. URL dell'immagine mostrata come icona di questo provider.",
+    "iconUrlLabel": "URL Icona"
   },
   "settings": {
     "title": "Impostazioni",
@@ -5955,6 +5989,12 @@
         "INSUFFICIENT_SCOPE": "__MISSING__:API key lacks the manage scope.",
         "BYPASS_PREFIX_NOT_ALLOWED": "__MISSING__:One or more prefixes target spawn-capable routes and cannot be bypassed.",
         "GENERIC": "__MISSING__:Failed to update authz settings."
+      },
+      "cors": {
+        "wildcard": {
+          "desc": "Qualsiasi sito web può chiamare l'API di questo server dal browser di un visitatore. Usa solo su reti fidate — imposta origini esplicite in ALLOWED_ORIGINS e disabilita CORS_ALLOW_ALL in produzione.",
+          "title": "CORS è aperto a tutte le origini (CORS_ALLOW_ALL=true)"
+        }
       }
     },
     "resilienceBaseCooldownLabel": "Tempo di recupero della base",
@@ -6059,7 +6099,56 @@
     "modelLockoutExponentialBackoff": "__MISSING__:Exponential Backoff",
     "modelLockoutExponentialBackoffDescription": "__MISSING__:When enabled, each consecutive failure increases the cooldown duration exponentially.",
     "modelLockoutMaxBackoffSteps": "__MISSING__:Max Backoff Steps",
-    "modelLockoutMaxBackoffStepsDescription": "__MISSING__:Maximum number of backoff steps before the cooldown stops growing. The Max Cooldown cap is reached first in most configurations, making this a safety ceiling for when Max Cooldown is raised."
+    "modelLockoutMaxBackoffStepsDescription": "__MISSING__:Maximum number of backoff steps before the cooldown stops growing. The Max Cooldown cap is reached first in most configurations, making this a safety ceiling for when Max Cooldown is raised.",
+    "compressionCavemanPanelHint": "L'attivazione e il livello si impostano nel panel:",
+    "compressionPreserveSystemAlways": "Sempre",
+    "compressionPreserveSystemNever": "Mai",
+    "compressionPreserveSystemWhenNoCache": "Quando nessuna cache",
+    "description": "Descrizione",
+    "disable": "Disabilita",
+    "enable": "Abilita",
+    "logToolSourcesDescription": "Emette una riga di log diagnostico per richiesta che riepiloga il conteggio tool e la suddivisione per sorgente MCP/hosted/client.",
+    "logToolSourcesToggle": "Log Sorgenti Tool",
+    "logsDeleted": "{count, plural, =0 {Nessun log scaduto eliminato} one {Eliminato # log scaduto} other {Eliminati # log scaduti}}",
+    "queueDepth": "Profondità Coda",
+    "redisLauncherContainer": "Container",
+    "redisLauncherDesc": "Avvia con un clic un container Redis 7 (Podman o Docker) per cache risposte, tracciamento quote e rate limiting.",
+    "redisLauncherError": "Errore: {message}",
+    "redisLauncherHint": "Equivalente a eseguire `omniroute redis up`. Il container si chiama `omniroute-redis` e ascolta su 127.0.0.1:6379.",
+    "redisLauncherLaunch": "Avvia Redis",
+    "redisLauncherLaunching": "Avvio in corso...",
+    "redisLauncherReachable": "Raggiungibile",
+    "redisLauncherRefresh": "Aggiorna",
+    "redisLauncherRunning": "In esecuzione",
+    "redisLauncherStop": "Ferma",
+    "redisLauncherTitle": "Redis Locale",
+    "reset": "Ripristina",
+    "resetUsageData": "Ripristina Dati di Utilizzo",
+    "resetUsageDataDesc": "Seleziona fino a quando eliminare i dati di utilizzo. Questa azione non può essere annullata.",
+    "resetUsageFailed": "Ripristino dati di utilizzo fallito",
+    "resetUsagePeriod_12h": "12 ore",
+    "resetUsagePeriod_1d": "1 giorno",
+    "resetUsagePeriod_1h": "1 ora",
+    "resetUsagePeriod_30d": "30 giorni",
+    "resetUsagePeriod_3h": "3 ore",
+    "resetUsagePeriod_5m": "5 minuti",
+    "resetUsagePeriod_6h": "6 ore",
+    "resetUsagePeriod_7d": "7 giorni",
+    "resetUsagePeriod_all": "Tutto",
+    "resetUsageSuccess": "{count, plural, =0 {Nessuna riga dati utilizzo eliminata} one {Ripristinati dati utilizzo (# riga eliminata)} other {Ripristinati dati utilizzo (# righe eliminate)}}",
+    "resetting": "Ripristino in corso...",
+    "resilienceComboCooldownBudgetMs": "Budget attesa totale",
+    "resilienceComboCooldownMaxWaitMs": "Attesa massima per tentativo",
+    "resilienceComboCooldownWaitDesc": "Solo per combo quota-share: attende un breve cooldown transitorio e reinoltra invece di restituire subito un 429. Non attende mai su quota_exhausted.",
+    "resilienceComboCooldownWaitTitle": "Attesa cooldown combo quota-share",
+    "resilienceComboCooldownWaitToggleDesc": "Solo combo quota-share; non attende mai su quota_exhausted.",
+    "resilienceQuotaShareConcurrencyDesc": "Solo per combo quota-share: quando una connessione imposta un limite Max Concurrent, serializza le richieste concorrenti verso quell'account di sottoscrizione in modo che non venga mai inondato oltre il suo tetto. Le richieste in eccesso aspettano in coda invece di ricevere un 429. Il limite deriva dal campo Max Concurrent di ogni connessione; questo interruttore abilita o disabilita solo il suo rispetto.",
+    "resilienceQuotaShareConcurrencyTitle": "Concorrenza per connessione quota-share",
+    "resilienceQuotaShareConcurrencyToggleDesc": "Solo combo quota-share; rispetta il limite Max Concurrent di ogni connessione.",
+    "searchProviderAria": "Provider di ricerca",
+    "searchProviderPlaceholder": "Cerca provider...",
+    "selectProviderPlaceholder": "Seleziona provider...",
+    "update": "Aggiorna"
   },
   "contextRtk": {
     "title": "RTK Engine",
@@ -6837,7 +6926,9 @@
     "updatedShort": "__MISSING__:Updated",
     "lastRefreshed": "__MISSING__:Last refreshed",
     "providerQuota": "__MISSING__:Provider Quota",
-    "providerQuotaHomeHint": "__MISSING__:Live status across connected accounts"
+    "providerQuotaHomeHint": "__MISSING__:Live status across connected accounts",
+    "showLessQuotas": "Mostra meno",
+    "showMoreQuotas": "Mostra {count} altri"
   },
   "modals": {
     "waitingAuth": "In attesa di autorizzazione",
@@ -7834,7 +7925,12 @@
     "bulkImportMaxExceeded": "Massimo 100 proxy per importazione",
     "bulkImportPreview": "Anteprima",
     "clearAssignment": "(incarico chiaro)",
-    "bulkProxyAssignment": "Assegnazione di proxy in blocco"
+    "bulkProxyAssignment": "Assegnazione di proxy in blocco",
+    "batchDeleteSelected": "Elimina {count} selezionati",
+    "batchSelectedCount": "{count} selezionati",
+    "errorTestFailed": "Test dei proxy fallito",
+    "testAll": "Testa tutti",
+    "testPassed": "✓ OK"
   },
   "playground": {
     "title": "Title",
@@ -8376,7 +8472,8 @@
     "verified": "__MISSING__:Verified",
     "install": "__MISSING__:Install",
     "installedFromMarketplace": "__MISSING__:Plugin {name} installed!",
-    "hooks": "Hooks"
+    "hooks": "Hooks",
+    "marketplaceInstallComingSoon": "Le installazioni dal marketplace saranno presto disponibili."
   },
   "quotaPlans": {
     "title": "__MISSING__:Plans & Quotas",
@@ -8606,7 +8703,8 @@
       "goNow": "__MISSING__:Go now",
       "message": "__MISSING__:The MITM Proxy now lives under AgentBridge.",
       "title": "__MISSING__:This page has moved"
-    }
+    },
+    "certManualTitle": "Il certificato non può essere installato automaticamente (es. dentro un container). Il bridge può comunque funzionare — aggiungi la CA manualmente:"
   },
   "trafficInspector": {
     "title": "__MISSING__:Traffic Inspector",
@@ -8932,5 +9030,31 @@
     "colAvgScore": "__MISSING__:Avg Score",
     "colModels": "__MISSING__:Models",
     "colType": "__MISSING__:Type"
+  },
+  "disabled": "Disabilitato",
+  "discovery": {
+    "title": "Provider Discovery",
+    "subtitle": "Scansiona i provider per metodi di accesso gratuiti/illimitati e rivedi i risultati. Opt-in, solo locale.",
+    "scanLabel": "Provider da scansionare",
+    "scanPlaceholder": "es. huggingchat",
+    "scan": "Scansiona",
+    "scanning": "Scansione in corso…",
+    "scanQueued": "Scansione accodata per {provider}.",
+    "scanFailed": "Scansione fallita.",
+    "loadFailed": "Caricamento risultati discovery fallito.",
+    "localOnlyNote": "Questo strumento è solo locale (loopback). Le scansioni vengono eseguite da questa macchina e non sono mai raggiungibili da remoto.",
+    "verify": "Verifica",
+    "verifyFailed": "Verifica del risultato fallita.",
+    "delete": "Elimina",
+    "deleteFailed": "Eliminazione del risultato fallita.",
+    "deleteTitle": "Elimina risultato discovery",
+    "deleteConfirm": "Eliminare il risultato discovery per {provider}? L'operazione non può essere annullata.",
+    "emptyTitle": "Nessun risultato discovery",
+    "emptyDescription": "Esegui una scansione qui sopra per cercare metodi di accesso gratuiti su un provider.",
+    "risk": "Rischio",
+    "method": "Metodo",
+    "auth": "Auth",
+    "feasibility": "Fattibilità",
+    "models": "Modelli"
   }
-}
+}
\ No newline at end of file
diff --git a/src/i18n/messages/ko.json b/src/i18n/messages/ko.json
index 98ceae49a2..d0a83de791 100644
--- a/src/i18n/messages/ko.json
+++ b/src/i18n/messages/ko.json
@@ -4812,8 +4812,8 @@
     "v0VercelWebDesc": "__MISSING__:AI code generation via v0.dev",
     "kimiWebLabel": "__MISSING__:Kimi Web",
     "kimiWebDesc": "__MISSING__:Moonshot AI consumer chat via www.kimi.com (international, Connect-RPC API)",
-    "doubaoWebLabel": "__MISSING__:Doubao Web",
-    "doubaoWebDesc": "__MISSING__:ByteDance AI chat via doubao.com"
+    "doubaoWebLabel": "Dola Web",
+    "doubaoWebDesc": "dola.com을 통한 ByteDance AI 채팅"
   },
   "settings": {
     "title": "설정",
diff --git a/src/i18n/messages/zh-CN.json b/src/i18n/messages/zh-CN.json
index a3126e466f..c404df3866 100644
--- a/src/i18n/messages/zh-CN.json
+++ b/src/i18n/messages/zh-CN.json
@@ -4668,8 +4668,8 @@
     "v0VercelWebDesc": "通过 v0.dev 的 AI 代码生成",
     "kimiWebLabel": "Kimi Web",
     "kimiWebDesc": "通过 www.kimi.com 访问 Moonshot AI 聊天（国际版，Connect-RPC API）",
-    "doubaoWebLabel": "豆包网",
-    "doubaoWebDesc": "字节跳动 AI 聊天通过 doubao.com",
+    "doubaoWebLabel": "Dola Web",
+    "doubaoWebDesc": "通过 dola.com 访问字节跳动 AI 聊天",
     "Account Deactivated": "账户已停用",
     "distributeProxies": "分配代理",
     "distributing": "分配中...",
diff --git a/src/instrumentation-node.ts b/src/instrumentation-node.ts
index 6c005b1c51..ad132b51f8 100755
--- a/src/instrumentation-node.ts
+++ b/src/instrumentation-node.ts
@@ -379,5 +379,23 @@ export async function registerNodejs(): Promise<void> {
       const msg = err instanceof Error ? err.message : String(err);
       console.warn("[STARTUP] memory decay sweep failed to start (non-fatal):", msg);
     }
+
+    // Real-time dashboard WebSocket daemon (port 20129): powers Combo Studio Live,
+    // the Home live-pulse, and Live Compression. liveServer.ts auto-starts the
+    // daemon on import (gated by OMNIROUTE_ENABLE_LIVE_WS, default ON) — but NOTHING
+    // imported it in the packaged standalone/PM2 runtime. Only the unused
+    // `server-init.ts` and a dev-only helper script (`scripts/start-ws-server.mjs`)
+    // ever pulled it into a module graph, so in the published `omniroute` bin the
+    // daemon never bound its port and every live dashboard reported "Live disabled —
+    // WebSocket disconnected". Importing it here (the instrumentation hook that DOES
+    // run in standalone) fires that flag-gated auto-start. Side-effect import + the
+    // module's own `.catch` keep it non-fatal.
+    try {
+      await import("@/server/ws/liveServer");
+      console.log("[STARTUP] Live dashboard WebSocket daemon bootstrap invoked");
+    } catch (err: unknown) {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.warn("[STARTUP] Live dashboard WebSocket daemon failed to start (non-fatal):", msg);
+    }
   }
 }
diff --git a/src/lib/agentSkills/catalog.ts b/src/lib/agentSkills/catalog.ts
index 63957f5bb3..af1a9be0d1 100644
--- a/src/lib/agentSkills/catalog.ts
+++ b/src/lib/agentSkills/catalog.ts
@@ -8,7 +8,11 @@
 import fs from "node:fs";
 import path from "node:path";
 import type { AgentSkill, SkillCoverage, SkillMarkdown } from "./types";
-import { CURATED_SKILLS, getAgentSkillRawUrl, getAgentSkillBlobUrl } from "@/shared/constants/agentSkills";
+import {
+  CURATED_SKILLS,
+  getAgentSkillRawUrl,
+  getAgentSkillBlobUrl,
+} from "@/shared/constants/agentSkills";
 
 // ── Canonical ID lists (D28) ────────────────────────────────────────────────
 
@@ -36,12 +40,11 @@ export const API_SKILL_IDS: readonly string[] = [
   "omni-agents-a2a",
   "omni-version-manager",
   "omni-inference",
+  "omni-github-skills",
 ] as const;
 
 /** Config skill IDs. */
-export const CONFIG_SKILL_IDS: readonly string[] = [
-  "config-codex-cli",
-] as const;
+export const CONFIG_SKILL_IDS: readonly string[] = ["config-codex-cli"] as const;
 
 /** 20 canonical CLI skill IDs, in spec order. */
 export const CLI_SKILL_IDS: readonly string[] = [
@@ -73,9 +76,7 @@ let _cache: AgentSkill[] | null = null;
 
 // ── Helpers ─────────────────────────────────────────────────────────────────
 
-function buildFullSkill(
-  curated: (typeof CURATED_SKILLS)[number],
-): AgentSkill {
+function buildFullSkill(curated: (typeof CURATED_SKILLS)[number]): AgentSkill {
   return {
     ...curated,
     endpoints: curated.category === "api" ? [] : undefined,
@@ -134,7 +135,7 @@ export function computeCoverage(): SkillCoverage {
       entries
         .filter((e) => e.isDirectory())
         .filter((e) => fs.existsSync(path.join(skillsDir, e.name, "SKILL.md")))
-        .map((e) => e.name),
+        .map((e) => e.name)
     );
   } catch {
     // Directory doesn't exist yet — zero coverage
@@ -147,7 +148,7 @@ export function computeCoverage(): SkillCoverage {
   const configHave = catalog.filter((s) => s.category === "config" && presentIds.has(s.id)).length;
 
   return {
-    api: { have: apiHave, total: 22 },
+    api: { have: apiHave, total: 23 },
     cli: { have: cliHave, total: 20 },
     config: { have: configHave, total: configTotal },
     totalSkills: apiHave + cliHave + configHave,
@@ -197,10 +198,9 @@ export async function fetchSkillMarkdown(id: string): Promise<SkillMarkdown> {
     throw new Error(`Skill not found in catalog: ${id}`);
   }
 
-  const response = await fetch(
-    skill.rawUrl,
-    { next: { revalidate: 3600 } } as unknown as RequestInit
-  );
+  const response = await fetch(skill.rawUrl, {
+    next: { revalidate: 3600 },
+  } as unknown as RequestInit);
 
   if (!response.ok) {
     throw new Error(`GitHub raw fetch failed: HTTP ${response.status} for ${skill.rawUrl}`);
diff --git a/src/lib/agentSkills/types.ts b/src/lib/agentSkills/types.ts
index 75f43fcdc3..61aa865bae 100644
--- a/src/lib/agentSkills/types.ts
+++ b/src/lib/agentSkills/types.ts
@@ -24,6 +24,8 @@ export type SkillArea =
   | "agents-a2a"
   | "version-manager"
   | "inference"
+  // GitHub skills
+  | "github-skills"
   // Config skills
   | "config-codex-cli"
   // CLI families (20)
@@ -64,7 +66,7 @@ export interface AgentSkill {
 }
 
 export interface SkillCoverage {
-  api: { have: number; total: 22 };
+  api: { have: number; total: 23 };
   cli: { have: number; total: 20 };
   config: { have: number; total: number };
   totalSkills: number; // sum
diff --git a/src/lib/api/modelTestRunner.ts b/src/lib/api/modelTestRunner.ts
index a2eeaeae3c..175a46b167 100644
--- a/src/lib/api/modelTestRunner.ts
+++ b/src/lib/api/modelTestRunner.ts
@@ -9,6 +9,9 @@ import { withRateLimit } from "@omniroute/open-sse/services/rateLimitManager";
 
 const INTERNAL_ORIGIN = "http://omniroute.internal";
 const DEFAULT_TEST_TIMEOUT_MS = 10_000;
+const DOLA_PRO_TEST_TIMEOUT_MS = 90_000;
+const DOUBAO_WEB_PROVIDER_ID = "doubao-web";
+const SLOW_WEB_TEST_MODELS = new Set(["dola-pro"]);
 
 function asRecord(value: unknown): Record<string, unknown> {
   return value && typeof value === "object" && !Array.isArray(value)
@@ -70,6 +73,26 @@ function stripFirstSegment(modelId: string): string | null {
   return slashIdx > 0 ? modelId.slice(slashIdx + 1) : null;
 }
 
+function getModelLeafId(modelId: string): string {
+  const segments = modelId.trim().toLowerCase().split("/").filter(Boolean);
+  return segments[segments.length - 1] || "";
+}
+
+export function resolveModelTestTimeoutMs(
+  providerId: string,
+  modelId: string,
+  requestedTimeoutMs: number = DEFAULT_TEST_TIMEOUT_MS
+) {
+  if (
+    providerId.trim().toLowerCase() === DOUBAO_WEB_PROVIDER_ID &&
+    SLOW_WEB_TEST_MODELS.has(getModelLeafId(modelId))
+  ) {
+    return Math.max(requestedTimeoutMs, DOLA_PRO_TEST_TIMEOUT_MS);
+  }
+
+  return requestedTimeoutMs;
+}
+
 async function findCustomModelMetadata(providerId: string, modelId: string) {
   try {
     const customModels = await getCustomModels(providerId);
@@ -198,6 +221,7 @@ export async function runSingleModelTest(
   if (!fullModelStr.includes("/")) {
     fullModelStr = `${providerId}/${modelId}`;
   }
+  const effectiveTimeoutMs = resolveModelTestTimeoutMs(providerId, fullModelStr, timeoutMs);
 
   const startTime = Date.now();
   const customModel = await findCustomModelMetadata(providerId, fullModelStr);
@@ -224,7 +248,7 @@ export async function runSingleModelTest(
   const timeoutHandle = setTimeout(() => {
     timedOut = true;
     controller.abort();
-  }, timeoutMs);
+  }, effectiveTimeoutMs);
 
   const runInner = async (signal: AbortSignal): Promise<Response> => {
     if (isEmbedding) {
@@ -262,7 +286,7 @@ export async function runSingleModelTest(
           status: "error",
           latencyMs,
           httpStatus: 500,
-          error: `Timeout (${Math.round(timeoutMs / 1000)}s)`,
+          error: `Timeout (${Math.round(effectiveTimeoutMs / 1000)}s)`,
           isTimeout: true,
         };
       }
diff --git a/src/lib/api/requireManagementAuth.ts b/src/lib/api/requireManagementAuth.ts
index 90b4fa7dd5..8540d17c20 100644
--- a/src/lib/api/requireManagementAuth.ts
+++ b/src/lib/api/requireManagementAuth.ts
@@ -21,8 +21,25 @@ export function hasManageScope(scopes: string[] = []): boolean {
   return hasManageScopeShared(scopes);
 }
 
-export async function requireManagementAuth(request: Request): Promise<Response | null> {
-  if (!(await isAuthRequired(request))) {
+interface RequireManagementAuthOptions {
+  alwaysRequireAuth?: boolean;
+  invalidApiKeyStatus?: 401 | 403;
+}
+
+function invalidManagementTokenResponse(options: RequireManagementAuthOptions): Response {
+  const status = options.invalidApiKeyStatus ?? 403;
+  return createErrorResponse({
+    status,
+    message: status === 401 ? "Invalid API key" : "Invalid management token",
+    type: "invalid_request",
+  });
+}
+
+export async function requireManagementAuth(
+  request: Request,
+  options: RequireManagementAuthOptions = {}
+): Promise<Response | null> {
+  if (!options.alwaysRequireAuth && !(await isAuthRequired(request))) {
     return null;
   }
 
@@ -73,11 +90,7 @@ export async function requireManagementAuth(request: Request): Promise<Response
     let meta: Awaited<ReturnType<typeof getApiKeyMetadata>>;
     try {
       if (!(await isValidApiKey(apiKey))) {
-        return createErrorResponse({
-          status: 403,
-          message: "Invalid management token",
-          type: "invalid_request",
-        });
+        return invalidManagementTokenResponse(options);
       }
       meta = await getApiKeyMetadata(apiKey);
     } catch {
diff --git a/src/lib/cli-helper/claudeProfileAutoSync.ts b/src/lib/cli-helper/claudeProfileAutoSync.ts
index 19a515695a..431f0a1013 100644
--- a/src/lib/cli-helper/claudeProfileAutoSync.ts
+++ b/src/lib/cli-helper/claudeProfileAutoSync.ts
@@ -1,7 +1,7 @@
 import path from "node:path";
-import { ensureCliConfigWriteAllowed, getCliConfigPaths } from "@/shared/services/cliRuntime";
-import { getModelSyncInternalBaseUrl } from "@/shared/services/modelSyncScheduler";
-import { isFeatureFlagEnabled } from "@/shared/utils/featureFlags";
+import { ensureCliConfigWriteAllowed, getCliConfigPaths } from "../../shared/services/cliRuntime";
+import { getModelSyncInternalBaseUrl } from "../../shared/services/modelSyncScheduler";
+import { isFeatureFlagEnabled } from "../../shared/utils/featureFlags";
 
 type SyncResult =
   | {
diff --git a/src/lib/cli-helper/codexProfileAutoSync.ts b/src/lib/cli-helper/codexProfileAutoSync.ts
index c3040ed09d..023da5d899 100644
--- a/src/lib/cli-helper/codexProfileAutoSync.ts
+++ b/src/lib/cli-helper/codexProfileAutoSync.ts
@@ -1,7 +1,7 @@
 import path from "node:path";
-import { ensureCliConfigWriteAllowed, getCliConfigPaths } from "@/shared/services/cliRuntime";
-import { getModelSyncInternalBaseUrl } from "@/shared/services/modelSyncScheduler";
-import { isFeatureFlagEnabled } from "@/shared/utils/featureFlags";
+import { ensureCliConfigWriteAllowed, getCliConfigPaths } from "../../shared/services/cliRuntime";
+import { getModelSyncInternalBaseUrl } from "../../shared/services/modelSyncScheduler";
+import { isFeatureFlagEnabled } from "../../shared/utils/featureFlags";
 
 type SyncResult =
   | {
diff --git a/src/lib/cli-helper/config-generator/opencode.ts b/src/lib/cli-helper/config-generator/opencode.ts
index 265246e6d5..4081cc32a2 100644
--- a/src/lib/cli-helper/config-generator/opencode.ts
+++ b/src/lib/cli-helper/config-generator/opencode.ts
@@ -5,7 +5,7 @@ import {
   parseOutboundUrl,
   isCloudMetadataHost,
   OutboundUrlGuardError,
-} from "@/shared/network/outboundUrlGuard";
+} from "../../../shared/network/outboundUrlGuard";
 
 const CONFIG_PATH = path.join(os.homedir(), ".config", "opencode", "opencode.json");
 
diff --git a/src/lib/cli-helper/tool-detector.ts b/src/lib/cli-helper/tool-detector.ts
index 3dbfdb0ac7..b6463132ca 100644
--- a/src/lib/cli-helper/tool-detector.ts
+++ b/src/lib/cli-helper/tool-detector.ts
@@ -3,7 +3,7 @@ import path from "node:path";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { getCurrentHermesAgentRoles } from "./config-generator/hermes-agent";
-import { getCachedLoginShellPath, mergeShellPath } from "@/shared/services/loginShellPath";
+import { getCachedLoginShellPath, mergeShellPath } from "../../shared/services/loginShellPath";
 
 const execFileAsync = promisify(execFile);
 let execFileImpl = execFileAsync;
diff --git a/src/lib/db/combos.ts b/src/lib/db/combos.ts
index b24f6e7e9b..d582e6184f 100644
--- a/src/lib/db/combos.ts
+++ b/src/lib/db/combos.ts
@@ -7,6 +7,7 @@ import { getDbInstance } from "./core";
 import { backupDbFile } from "./backup";
 import { invalidateDbCache } from "./readCache";
 import { normalizeComboRecord } from "@/lib/combos/steps";
+import { clearSessionModelHistoryForCombo } from "./contextHandoffs";
 
 type JsonRecord = Record<string, unknown>;
 
@@ -93,7 +94,9 @@ function getNextSortOrder() {
 export async function getCombos() {
   const db = getDbInstance();
   const rawCombos = db
-    .prepare("SELECT data, sort_order, context_cache_protection FROM combos ORDER BY sort_order ASC, name COLLATE NOCASE ASC")
+    .prepare(
+      "SELECT data, sort_order, context_cache_protection FROM combos ORDER BY sort_order ASC, name COLLATE NOCASE ASC"
+    )
     .all()
     .map((row) => parseComboRow(row))
     .filter((row): row is JsonRecord => row !== null);
@@ -111,7 +114,9 @@ export async function getCombos() {
 
 export async function getComboById(id: string) {
   const db = getDbInstance();
-  const row = db.prepare("SELECT data, sort_order, context_cache_protection FROM combos WHERE id = ?").get(id);
+  const row = db
+    .prepare("SELECT data, sort_order, context_cache_protection FROM combos WHERE id = ?")
+    .get(id);
   const combo = parseComboRow(row);
   if (!combo) return null;
   return normalizeStoredCombo(combo, db, typeof combo.name === "string" ? [combo.name] : []);
@@ -119,7 +124,9 @@ export async function getComboById(id: string) {
 
 export async function getComboByName(name: string) {
   const db = getDbInstance();
-  const row = db.prepare("SELECT data, sort_order, context_cache_protection FROM combos WHERE name = ?").get(name);
+  const row = db
+    .prepare("SELECT data, sort_order, context_cache_protection FROM combos WHERE name = ?")
+    .get(name);
   const combo = parseComboRow(row);
   if (!combo) return null;
   return normalizeStoredCombo(combo, db, [name]);
@@ -177,7 +184,9 @@ export async function createCombo(data: JsonRecord) {
 
 export async function updateCombo(id: string, data: JsonRecord) {
   const db = getDbInstance();
-  const existing = db.prepare("SELECT data, sort_order, context_cache_protection FROM combos WHERE id = ?").get(id);
+  const existing = db
+    .prepare("SELECT data, sort_order, context_cache_protection FROM combos WHERE id = ?")
+    .get(id);
   if (!existing) return null;
 
   const current = parseComboRow(existing);
@@ -210,7 +219,26 @@ export async function updateCombo(id: string, data: JsonRecord) {
 
   db.prepare(
     "UPDATE combos SET name = ?, data = ?, sort_order = ?, updated_at = ?, context_cache_protection = ? WHERE id = ?"
-  ).run(nextName, JSON.stringify(normalizedMerged), sortOrder, normalizedMerged.updatedAt, contextCacheProtection, id);
+  ).run(
+    nextName,
+    JSON.stringify(normalizedMerged),
+    sortOrder,
+    normalizedMerged.updatedAt,
+    contextCacheProtection,
+    id
+  );
+
+  // Invalidate stale context-cache pins when combo targets change.
+  // Without this, sessions pinned to removed models keep routing there forever.
+  if (data.models !== undefined) {
+    const cleared = clearSessionModelHistoryForCombo(currentName);
+    if (cleared > 0) {
+      // Also clear under the new name if the combo was renamed
+      if (nextName !== currentName) {
+        clearSessionModelHistoryForCombo(nextName);
+      }
+    }
+  }
 
   invalidateDbCache("combos");
   backupDbFile("pre-write");
diff --git a/src/lib/db/contextHandoffs.ts b/src/lib/db/contextHandoffs.ts
index ea7f2f36b0..56575d5530 100644
--- a/src/lib/db/contextHandoffs.ts
+++ b/src/lib/db/contextHandoffs.ts
@@ -216,3 +216,18 @@ export function getLastSessionModel(sessionId: string, comboName: string): strin
 
   return row?.model_str ?? null;
 }
+
+/**
+ * Clear all session model history entries for a given combo name.
+ * Called when a combo's model targets are changed to invalidate stale context-cache pins.
+ *
+ * @param comboName - The combo name whose pins should be cleared.
+ * @returns The number of deleted entries.
+ */
+export function clearSessionModelHistoryForCombo(comboName: string): number {
+  const db = getDbInstance() as unknown as DbLike;
+  const result = db
+    .prepare("DELETE FROM session_model_history WHERE combo_name = ?")
+    .run(comboName);
+  return result.changes ?? 0;
+}
diff --git a/src/lib/db/encryption.ts b/src/lib/db/encryption.ts
index 1559c14bb5..af81a40dde 100644
--- a/src/lib/db/encryption.ts
+++ b/src/lib/db/encryption.ts
@@ -102,6 +102,16 @@ export function isEncryptionEnabled(): boolean {
   return !!process.env.STORAGE_ENCRYPTION_KEY;
 }
 
+/**
+ * True when `value` is a stored ciphertext (carries the `enc:v1:` prefix).
+ * Lets callers tell "credential present but undecryptable" (stale/changed
+ * STORAGE_ENCRYPTION_KEY) apart from "credential genuinely empty" — decrypt()
+ * collapses both to null otherwise. See #6148.
+ */
+export function looksEncrypted(value: unknown): boolean {
+  return typeof value === "string" && value.startsWith(PREFIX);
+}
+
 /**
  * Encrypt a plaintext string using the STATIC salt key.
  * If encryption is not configured, returns plaintext unchanged.
@@ -232,12 +242,28 @@ export function decryptConnectionFields<T extends ConnectionFields | null | unde
   if (!row) return row;
   if (!isEncryptionEnabled()) return row;
 
+  const apiKey = decrypt(row.apiKey);
+  const accessToken = decrypt(row.accessToken);
+  const refreshToken = decrypt(row.refreshToken);
+  const idToken = decrypt(row.idToken);
+
+  // #6148 — a stored credential that is still encrypted (`enc:v1:…`) but
+  // decrypts to null means the STORAGE_ENCRYPTION_KEY changed or was unset.
+  // Flag it so callers surface a clear error instead of coercing the null to
+  // "" and firing an empty-Bearer request that upstream rejects as 401.
+  const credentialDecryptFailed =
+    (looksEncrypted(row.apiKey) && apiKey === null) ||
+    (looksEncrypted(row.accessToken) && accessToken === null) ||
+    (looksEncrypted(row.refreshToken) && refreshToken === null) ||
+    (looksEncrypted(row.idToken) && idToken === null);
+
   return {
     ...row,
-    apiKey: decrypt(row.apiKey),
-    accessToken: decrypt(row.accessToken),
-    refreshToken: decrypt(row.refreshToken),
-    idToken: decrypt(row.idToken),
+    apiKey,
+    accessToken,
+    refreshToken,
+    idToken,
+    ...(credentialDecryptFailed ? { credentialDecryptFailed: true } : {}),
   };
 }
 
diff --git a/src/lib/db/migrations/116_call_logs_reasoning_source.sql b/src/lib/db/migrations/116_call_logs_reasoning_source.sql
new file mode 100644
index 0000000000..8cd507985c
--- /dev/null
+++ b/src/lib/db/migrations/116_call_logs_reasoning_source.sql
@@ -0,0 +1,13 @@
+-- #6187: reasoning-token accounting is blind to reasoning_content / <think> models.
+-- Some providers (e.g. stepfun step-3.7-flash) emit reasoning content in the
+-- assistant message but report reasoning_tokens=0 in usage, so the usage-derived
+-- tokens_reasoning column under-represents reasoning.
+--
+-- These two columns record reasoning PRESENCE/SOURCE and the raw CHARACTER count
+-- of observed reasoning content. They are deliberately SEPARATE from the priced
+-- tokens_reasoning column: reasoning_chars is a character count, NOT a token
+-- count, and must never enter cost math.
+--   reasoning_source: NULL | 'usage' | 'content' | 'think'
+--   reasoning_chars : NULL when unknown, else raw char count of observed reasoning
+ALTER TABLE call_logs ADD COLUMN reasoning_source TEXT DEFAULT NULL;
+ALTER TABLE call_logs ADD COLUMN reasoning_chars INTEGER DEFAULT NULL;
diff --git a/src/lib/db/proxies.ts b/src/lib/db/proxies.ts
index ffe0b85a5b..754259e82f 100755
--- a/src/lib/db/proxies.ts
+++ b/src/lib/db/proxies.ts
@@ -632,6 +632,59 @@ export async function resolveProxyForScopeFromRegistry(scope: string, scopeId?:
   }
 }
 
+/**
+ * #6246 fail-closed guard. Returns true when a connection would egress DIRECTLY
+ * ONLY because its ASSIGNED proxy (account/provider/global scope) is dead/inactive
+ * — i.e. the request must be BLOCKED, not silently sent on the real IP.
+ *
+ * Callers use this after `resolveProxyForConnection` returns a direct result: if
+ * the operator assigned a proxy but every assigned proxy is dead, leaking the IP
+ * is worse than failing the request. An explicit "proxy off" (global or per
+ * connection) is a deliberate direct choice and is NOT treated as a leak. Read-only
+ * and best-effort: any DB error fails OPEN (returns false) so a guard never breaks
+ * the request path.
+ */
+export function hasBlockingProxyAssignment(connectionId: string): boolean {
+  try {
+    const db = getDbInstance();
+
+    // Explicit global "proxy off" → direct is intended, never a leak.
+    const globalRow = db
+      .prepare("SELECT value FROM key_value WHERE namespace = 'settings' AND key = 'proxyEnabled'")
+      .get() as { value?: string } | undefined;
+    if (globalRow?.value) {
+      try {
+        if (JSON.parse(globalRow.value) === false) return false;
+      } catch {
+        /* malformed → treat as enabled */
+      }
+    }
+
+    // Explicit per-connection "proxy off" → direct is intended.
+    const conn = db
+      .prepare("SELECT provider, proxy_enabled FROM provider_connections WHERE id = ?")
+      .get(connectionId) as { provider?: string | null; proxy_enabled?: number } | undefined;
+    if (conn && conn.proxy_enabled === 0) return false;
+    const provider = conn?.provider ?? null;
+
+    // A proxy is assigned to this connection at some scope, but every assigned
+    // proxy is dead (the alive filter would have resolved a live one already).
+    const dead = db
+      .prepare(
+        `SELECT 1 FROM proxy_assignments a JOIN proxy_registry p ON p.id = a.proxy_id
+           WHERE ((a.scope = 'account' AND a.scope_id = ?)
+               OR (a.scope = 'provider' AND a.scope_id = ?)
+               OR (a.scope = 'global'))
+             AND NOT ${PROXY_ALIVE_PREDICATE}
+           LIMIT 1`
+      )
+      .get(connectionId, provider);
+    return !!dead;
+  } catch {
+    return false;
+  }
+}
+
 export async function migrateLegacyProxyConfigToRegistry(options?: { force?: boolean }) {
   const force = options?.force === true;
   const db = getDbInstance();
diff --git a/src/lib/db/schemaColumns.ts b/src/lib/db/schemaColumns.ts
index 762c1b9084..ab8ec16525 100644
--- a/src/lib/db/schemaColumns.ts
+++ b/src/lib/db/schemaColumns.ts
@@ -183,6 +183,10 @@ export function ensureCallLogsColumns(db: SqliteDatabase) {
       db.exec("ALTER TABLE call_logs ADD COLUMN correlation_id TEXT DEFAULT NULL");
       console.log("[DB] Added call_logs.correlation_id column");
     }
+    if (!columnNames.has("model_pinned")) {
+      db.exec("ALTER TABLE call_logs ADD COLUMN model_pinned INTEGER DEFAULT 0");
+      console.log("[DB] Added call_logs.model_pinned column");
+    }
 
     db.exec(
       "CREATE INDEX IF NOT EXISTS idx_call_logs_requested_model ON call_logs(requested_model)"
diff --git a/src/lib/db/settings.ts b/src/lib/db/settings.ts
index c6aa4bb832..dd88911355 100644
--- a/src/lib/db/settings.ts
+++ b/src/lib/db/settings.ts
@@ -96,6 +96,7 @@ export async function getSettings() {
     tailscaleEnabled: false,
     tailscaleUrl: "",
     stickyRoundRobinLimit: 3,
+    disableSessionStickiness: false,
     requestRetry: 3,
     maxRetryIntervalSec: 30,
     antigravitySignatureCacheMode: "enabled",
@@ -156,7 +157,11 @@ export async function getSettings() {
     const key = typeof record.key === "string" ? record.key : null;
     const rawValue = typeof record.value === "string" ? record.value : null;
     if (!key || rawValue === null) continue;
-    settings[key] = JSON.parse(rawValue);
+    try {
+      settings[key] = JSON.parse(rawValue);
+    } catch {
+      settings[key] = rawValue;
+    }
   }
 
   // Auto-complete onboarding for pre-configured deployments (Docker/VM)
diff --git a/src/lib/freeProviderRankings.ts b/src/lib/freeProviderRankings.ts
index c717d5c474..dfa58fab82 100644
--- a/src/lib/freeProviderRankings.ts
+++ b/src/lib/freeProviderRankings.ts
@@ -11,6 +11,7 @@
 import { NOAUTH_PROVIDERS, OAUTH_PROVIDERS, APIKEY_PROVIDERS } from "@/shared/constants/providers";
 import { REGISTRY } from "@omniroute/open-sse/config/providerRegistry";
 import { listModelIntelligence } from "./db/modelIntelligence";
+import { getProviderConnections } from "./db/providers";
 
 export interface ProviderModelScore {
   modelId: string;
@@ -160,16 +161,108 @@ export function findMatchingIntelligence(
   return bestPrefixMatch;
 }
 
+/**
+ * Minimal shape of a provider connection needed to decide "configured" /
+ * "non-exhausted". Matches the camelCase columns returned by
+ * `getProviderConnections()` (`provider`, `testStatus`, `rateLimitedUntil`).
+ */
+export interface ConnectionState {
+  provider: string;
+  testStatus?: string | null;
+  rateLimitedUntil?: string | null;
+}
+
+/**
+ * Options controlling the additive "configured" / "available" filters.
+ * Both default off (undefined/false) → output identical to current behavior.
+ */
+export interface FreeProviderRankingFilterOptions {
+  /** Keep only providers that have ≥1 (active) connection configured. */
+  configuredOnly?: boolean;
+  /** Keep only providers that have ≥1 non-exhausted, non-rate-limited connection (implies configured). */
+  availableOnly?: boolean;
+}
+
+// Terminal connection statuses — mirrors `isTerminalConnectionStatus`
+// (`src/sse/services/auth.ts`). A connection in one of these states stays
+// unavailable until credentials/settings change; it never self-recovers.
+const TERMINAL_CONNECTION_STATUSES = new Set(["credits_exhausted", "banned", "expired"]);
+
+/**
+ * Pure predicate: is at least one of a provider's connections usable *right now*?
+ *
+ * A connection is usable when it is neither terminal (`testStatus` ∉
+ * {credits_exhausted, banned, expired}) nor currently rate-limited
+ * (`rateLimitedUntil` null or in the past — lazy recovery, matching the
+ * Connection Cooldown rule in CLAUDE.md).
+ *
+ * NOTE: granularity is PROVIDER-level (connection = provider+account). Per-model
+ * quota lockout (model lockout, `open-sse/services/accountFallback.ts`) is a
+ * deferred Phase 3 and is intentionally NOT consulted here.
+ */
+export function isProviderUsable(connections: ConnectionState[], now: number = Date.now()): boolean {
+  return connections.some((conn) => {
+    const status = (conn.testStatus || "").trim().toLowerCase();
+    if (TERMINAL_CONNECTION_STATUSES.has(status)) return false;
+    if (conn.rateLimitedUntil) {
+      const until = new Date(conn.rateLimitedUntil).getTime();
+      if (Number.isFinite(until) && until > now) return false;
+    }
+    return true;
+  });
+}
+
+/**
+ * Pure filter over a ranking list + a snapshot of provider connections.
+ *
+ * - `configuredOnly`: keep only providers whose `id` appears in `connections`.
+ * - `availableOnly` (implies configured): additionally require ≥1 usable
+ *   connection per `isProviderUsable`.
+ *
+ * With both flags off/absent the input list is returned unchanged.
+ * Fully synchronous + side-effect-free so it can be unit-tested without a DB.
+ */
+export function filterFreeProviderRankings(
+  rankings: FreeProviderRanking[],
+  connections: ConnectionState[],
+  opts: FreeProviderRankingFilterOptions = {},
+  now: number = Date.now()
+): FreeProviderRanking[] {
+  const { configuredOnly, availableOnly } = opts;
+  if (!configuredOnly && !availableOnly) return rankings;
+
+  const byProvider = new Map<string, ConnectionState[]>();
+  for (const conn of connections) {
+    const list = byProvider.get(conn.provider);
+    if (list) {
+      list.push(conn);
+    } else {
+      byProvider.set(conn.provider, [conn]);
+    }
+  }
+
+  return rankings.filter((ranking) => {
+    const conns = byProvider.get(ranking.id);
+    if (!conns || conns.length === 0) return false; // not configured
+    if (availableOnly) return isProviderUsable(conns, now);
+    return true; // configuredOnly
+  });
+}
+
 /**
  * Compute rankings for free providers based on ELO scores.
  *
  * @param category - Optional filter for task category (e.g., "coding", "default")
  * @param limit - Maximum number of providers to return
+ * @param opts - Optional additive filters (configured-only / available-only).
+ *   When set, live provider-connection state is read from the DB and providers
+ *   with no configured / no usable connection are dropped. Both default off.
  */
-export function computeFreeProviderRankings(
+export async function computeFreeProviderRankings(
   category?: string,
-  limit: number = 50
-): FreeProviderRanking[] {
+  limit: number = 50,
+  opts: FreeProviderRankingFilterOptions = {}
+): Promise<FreeProviderRanking[]> {
   const freeProviders = getFreeProviders();
   const intelligenceEntries = listModelIntelligence({
     source: "arena_elo",
@@ -235,5 +328,13 @@ export function computeFreeProviderRankings(
     return b.averageScore - a.averageScore;
   });
 
-  return rankings.slice(0, limit);
+  // Apply the additive configured/available filters (if requested) BEFORE the
+  // limit slice, so `limit` counts providers that survive the filter.
+  let filtered = rankings;
+  if (opts.configuredOnly || opts.availableOnly) {
+    const connections = (await getProviderConnections({ isActive: true })) as ConnectionState[];
+    filtered = filterFreeProviderRankings(rankings, connections, opts);
+  }
+
+  return filtered.slice(0, limit);
 }
diff --git a/src/lib/memory/injection.ts b/src/lib/memory/injection.ts
index b9a6199bb5..5eaa918ed8 100644
--- a/src/lib/memory/injection.ts
+++ b/src/lib/memory/injection.ts
@@ -56,6 +56,29 @@ export function providerSupportsSystemMessage(provider: string | null | undefine
   return !PROVIDERS_WITHOUT_SYSTEM_MESSAGE.has(normalized);
 }
 
+/**
+ * Providers that accept a system-role message ONLY at index 0 (a `system`
+ * message at any later position is rejected with HTTP 400). For these, the
+ * cache-safe mid-array splice (which inserts memory just before the last user
+ * turn) is unsafe in multi-turn conversations, so memory must be merged into /
+ * prepended as the leading system message instead. See #6135.
+ *
+ * Populated with the Xiaomi MiMo endpoint (provider id `xiaomi-mimo`, registry
+ * alias `mimo`, serving mimo-v2.5) confirmed live to 400 on a non-first system
+ * message. Add other providers here only when they are documented as strict.
+ */
+const PROVIDERS_SYSTEM_MUST_BE_FIRST = new Set(["xiaomi-mimo", "mimo"]);
+
+/**
+ * Returns true when the given provider requires the system message to be first.
+ * Falls back to false for unknown/null providers (preserves current behavior).
+ */
+export function systemMessageMustBeFirst(provider: string | null | undefined): boolean {
+  if (!provider) return false;
+  const normalized = provider.toLowerCase().trim();
+  return PROVIDERS_SYSTEM_MUST_BE_FIRST.has(normalized);
+}
+
 /**
  * Format memories into a single labeled context string.
  * Format: "Memory context: <content1>\n<content2>..."
@@ -92,6 +115,46 @@ export interface InjectMemoryOptions {
   cacheSafe?: boolean;
 }
 
+/**
+ * #6135: place the memory as a leading system message for providers that reject
+ * a non-first system role — merging into an existing index-0 system message when
+ * present, else prepending. Split out of injectMemory to keep it flat.
+ */
+function injectSystemFirst(
+  request: ChatRequest,
+  messages: ChatMessage[],
+  memoryText: string,
+  count: number
+): ChatRequest {
+  log.info("memory.injection.injected", { count, strategy: "system-first", model: request.model });
+  const first = messages[0];
+  if (first && first.role === "system") {
+    const merged: ChatMessage = { ...first, content: `${memoryText}\n${first.content}` };
+    return { ...request, messages: [merged, ...messages.slice(1)] };
+  }
+  const memorySystemMessage: ChatMessage = { role: "system", content: memoryText };
+  return { ...request, messages: [memorySystemMessage, ...messages] };
+}
+
+/**
+ * Place a memory message at the #3890 cache-safe anchor (just before the last
+ * user turn) when one exists, else prepend it. Shared by the system and user
+ * injection strategies to keep injectMemory flat.
+ */
+function placeMessage(
+  request: ChatRequest,
+  messages: ChatMessage[],
+  msg: ChatMessage,
+  cacheSafeIndex: number
+): ChatRequest {
+  if (cacheSafeIndex >= 0) {
+    const next = [...messages];
+    next.splice(cacheSafeIndex, 0, msg);
+    return { ...request, messages: next };
+  }
+  return { ...request, messages: [msg, ...messages] };
+}
+
 export function injectMemory(
   request: ChatRequest,
   memories: Memory[],
@@ -116,38 +179,27 @@ export function injectMemory(
   // back to a leading message when caching is off or there is no user turn to anchor on.
   const cacheSafeIndex = options.cacheSafe ? messages.findLastIndex((m) => m.role === "user") : -1;
 
-  if (providerSupportsSystemMessage(provider)) {
-    // Strategy 1: inject as a system message.
-    // Prepending before any existing system messages keeps memory context
-    // accessible without overriding the caller's own system instructions.
-    const memorySystemMessage: ChatMessage = { role: "system", content: memoryText };
-    log.info("memory.injection.injected", {
-      count: memories.length,
-      strategy: cacheSafeIndex >= 0 ? "system-cache-safe" : "system",
-      model: request.model,
-    });
-    if (cacheSafeIndex >= 0) {
-      const next = [...messages];
-      next.splice(cacheSafeIndex, 0, memorySystemMessage);
-      return { ...request, messages: next };
-    }
-    return { ...request, messages: [memorySystemMessage, ...messages] };
-  } else {
-    // Strategy 2 (fallback): inject as a user message.
-    // Used for providers like o1-mini that reject the system role.
-    const memoryUserMessage: ChatMessage = { role: "user", content: memoryText };
-    log.info("memory.injection.injected", {
-      count: memories.length,
-      strategy: cacheSafeIndex >= 0 ? "user-cache-safe" : "user",
-      model: request.model,
-    });
-    if (cacheSafeIndex >= 0) {
-      const next = [...messages];
-      next.splice(cacheSafeIndex, 0, memoryUserMessage);
-      return { ...request, messages: next };
-    }
-    return { ...request, messages: [memoryUserMessage, ...messages] };
+  const supportsSystem = providerSupportsSystemMessage(provider);
+
+  // #6135: strict providers reject a system message at a non-zero index. Never
+  // apply the cache-safe mid-array splice for these — keep the system message
+  // first (extracted to injectSystemFirst to keep this function flat).
+  if (supportsSystem && systemMessageMustBeFirst(provider)) {
+    return injectSystemFirst(request, messages, memoryText, memories.length);
   }
+
+  // Strategy 1 (system): prepend before existing system messages, preserving the
+  // caller's own instructions. Strategy 2 (user, e.g. o1-mini): inject as a user
+  // message. Both honor the #3890 cache-safe anchor via placeMessage.
+  const role: ChatMessage["role"] = supportsSystem ? "system" : "user";
+  const memoryMessage: ChatMessage = { role, content: memoryText };
+  const base = supportsSystem ? "system" : "user";
+  log.info("memory.injection.injected", {
+    count: memories.length,
+    strategy: cacheSafeIndex >= 0 ? `${base}-cache-safe` : base,
+    model: request.model,
+  });
+  return placeMessage(request, messages, memoryMessage, cacheSafeIndex);
 }
 
 /**
diff --git a/src/lib/modelCapabilities.ts b/src/lib/modelCapabilities.ts
index 866d073643..cae1173042 100644
--- a/src/lib/modelCapabilities.ts
+++ b/src/lib/modelCapabilities.ts
@@ -406,7 +406,11 @@ export function getResolvedModelCapabilities(input: CapabilityInput): ResolvedMo
     structuredOutput: synced?.structured_output ?? null,
     temperature: synced?.temperature ?? null,
     contextWindow,
-    maxInputTokens: authoritativeContextWindow ?? synced?.limit_input ?? contextWindow,
+    maxInputTokens:
+      (typeof registryModel?.maxInputTokens === "number" ? registryModel.maxInputTokens : null) ??
+      authoritativeContextWindow ??
+      synced?.limit_input ??
+      contextWindow,
     maxOutputTokens:
       synced?.limit_output ??
       (typeof registryModel?.maxOutputTokens === "number" ? registryModel.maxOutputTokens : null) ??
diff --git a/src/lib/oauth/constants/oauth.ts b/src/lib/oauth/constants/oauth.ts
index 4f279e4d70..055808d5d5 100644
--- a/src/lib/oauth/constants/oauth.ts
+++ b/src/lib/oauth/constants/oauth.ts
@@ -429,6 +429,17 @@ export const WINDSURF_CONFIG = {
   extensionVersion: "3.14.0",
 };
 
+// Zed IDE credential import — no standard OAuth flow.
+// Credentials are extracted from the OS keychain via POST /api/providers/zed/import.
+// Docker environments fall back to manual token paste via POST /api/providers/zed/manual-import.
+// This config is a placeholder so that getProvider("zed") doesn't throw
+// "Unknown provider: zed" when the UI probes the OAuth capability endpoint.
+export const ZED_CONFIG = {
+  importUrl: "/api/providers/zed/import",
+  discoverUrl: "/api/providers/zed/discover",
+  manualImportUrl: "/api/providers/zed/manual-import",
+};
+
 // OAuth timeout (5 minutes)
 export const OAUTH_TIMEOUT = 300000;
 
@@ -455,4 +466,5 @@ export const PROVIDERS = {
   TRAE: "trae",
   CODEBUDDY_CN: "codebuddy-cn",
   GROK_CLI: "grok-cli",
+  ZED: "zed",
 };
diff --git a/src/lib/oauth/providers.ts b/src/lib/oauth/providers.ts
index 0a3ff407ec..9cd77b557d 100644
--- a/src/lib/oauth/providers.ts
+++ b/src/lib/oauth/providers.ts
@@ -113,10 +113,18 @@ export function generateAuthData(providerName, redirectUri) {
   const { codeVerifier, codeChallenge, state } = generatePKCE();
 
   if (provider.flowType === "import_token") {
-    const error =
-      providerName === "windsurf" || providerName === "devin-cli"
-        ? "Browser login disabled — paste token from https://windsurf.com/show-auth-token instead. Phase 2 will restore Firebase OAuth via app.devin.ai successor."
-        : `Browser login is disabled for ${providerName}. Use the import-token flow instead.`;
+    let error: string;
+    if (providerName === "windsurf" || providerName === "devin-cli") {
+      error =
+        "Browser login disabled — paste token from https://windsurf.com/show-auth-token instead. Phase 2 will restore Firebase OAuth via app.devin.ai successor.";
+    } else if (providerName === "zed") {
+      error =
+        "Zed does not use a browser OAuth flow. Use the Zed provider page to import credentials " +
+        "directly from the OS keychain (POST /api/providers/zed/import), or paste a token manually " +
+        "via POST /api/providers/zed/manual-import for Docker environments.";
+    } else {
+      error = `Browser login is disabled for ${providerName}. Use the import-token flow instead.`;
+    }
     return {
       authUrl: undefined,
       state: undefined,
diff --git a/src/lib/oauth/providers/index.ts b/src/lib/oauth/providers/index.ts
index 534f42a1a1..54f87a94fd 100644
--- a/src/lib/oauth/providers/index.ts
+++ b/src/lib/oauth/providers/index.ts
@@ -27,6 +27,7 @@ import { cline } from "./cline";
 import { windsurf } from "./windsurf";
 import { grokCli } from "./grok-cli";
 import { codebuddyCn } from "./codebuddy-cn";
+import { zed } from "./zed";
 
 export const PROVIDERS = {
   claude,
@@ -49,6 +50,8 @@ export const PROVIDERS = {
   "devin-cli": windsurf,
   "grok-cli": grokCli,
   "codebuddy-cn": codebuddyCn,
+  // Zed IDE credential bridge — uses keychain import, not standard OAuth
+  zed,
 };
 
 export default PROVIDERS;
diff --git a/src/lib/oauth/providers/zed.ts b/src/lib/oauth/providers/zed.ts
new file mode 100644
index 0000000000..d01389a787
--- /dev/null
+++ b/src/lib/oauth/providers/zed.ts
@@ -0,0 +1,35 @@
+import { ZED_CONFIG } from "../constants/oauth";
+
+/**
+ * Zed IDE credential bridge — import_token flow only.
+ *
+ * Zed stores AI provider API keys (Anthropic, OpenAI, Google, …) in the OS
+ * keychain. OmniRoute reads them via POST /api/providers/zed/import (keychain)
+ * or POST /api/providers/zed/manual-import (Docker / paste fallback).
+ *
+ * There is no standard OAuth browser flow for "zed" itself.  Registering it
+ * here with flowType "import_token" prevents getProvider("zed") from throwing
+ * "Unknown provider: zed" when the OAuth capability endpoint is probed, and
+ * lets generateAuthData() return a clean { supported: false, error } instead
+ * of a 500.  The actual import UI lives at
+ *   /dashboard/providers/zed  →  ZedImportCard component.
+ */
+export const zed = {
+  config: ZED_CONFIG,
+  flowType: "import_token" as const,
+
+  validateImportToken(token: string): { valid: boolean; reason?: string } {
+    const trimmed = (token ?? "").trim();
+    if (!trimmed) return { valid: false, reason: "Token is empty" };
+    if (trimmed.length < 8) return { valid: false, reason: "Token is too short" };
+    return { valid: true };
+  },
+
+  mapTokens(tokens: { accessToken: string }) {
+    return {
+      accessToken: tokens.accessToken,
+      refreshToken: null,
+      expiresIn: null as number | null,
+    };
+  },
+};
diff --git a/src/lib/proxyHealth/decision.ts b/src/lib/proxyHealth/decision.ts
new file mode 100644
index 0000000000..341d404290
--- /dev/null
+++ b/src/lib/proxyHealth/decision.ts
@@ -0,0 +1,77 @@
+/**
+ * Pure, network-free decision for the proxy health scheduler (#6246).
+ *
+ * Separated from the sweep so the status/removal policy can be unit-tested
+ * exhaustively without any I/O. The sweep classifies each probe into a tri-state
+ * {@link ProxyProbeOutcome} and applies the returned {@link ProxyHealthDecision}.
+ *
+ * Policy (agreed for #6246):
+ *   A — downgrade only after `removeAfter` CONSECUTIVE conclusive failures.
+ *   B — an `inconclusive` probe (our own timeout/abort, or the probe TARGET
+ *       erroring) never penalizes: it neither counts nor changes status.
+ *   C — by DEFAULT (auto-remove off) the health check NEVER mutates a proxy's
+ *       status. It only counts failures for logging. A proxy is downgraded to
+ *       `inactive` (and removed) only when the operator opts in via
+ *       PROXY_AUTO_REMOVE=true. This mirrors how accounts are only auto-disabled
+ *       when the operator allows it — the operator owns their (often paid) proxies.
+ */
+
+export type ProxyProbeOutcome = "ok" | "fail" | "inconclusive";
+
+export interface ProxyHealthDecisionInput {
+  /** Tri-state result of the reachability probe for this proxy. */
+  outcome: ProxyProbeOutcome;
+  /** Consecutive failure count recorded BEFORE this probe. */
+  priorFailures: number;
+  /** PROXY_AUTO_REMOVE === "true" — operator opted into status management. */
+  autoRemove: boolean;
+  /** Consecutive conclusive failures required before a downgrade/removal. */
+  removeAfter: number;
+}
+
+export interface ProxyHealthDecision {
+  /** New consecutive-failure count to persist for this proxy. */
+  failures: number;
+  /** Whether to drop this proxy from the consecutive-failure map. */
+  clearFailures: boolean;
+  /** Status to write, or `null` to leave the operator-controlled status untouched. */
+  setStatus: "active" | "inactive" | null;
+  /** Whether to auto-remove the proxy (only ever true when autoRemove is on). */
+  remove: boolean;
+}
+
+export function decideProxyHealthAction(input: ProxyHealthDecisionInput): ProxyHealthDecision {
+  const { outcome, priorFailures, autoRemove, removeAfter } = input;
+  const threshold = Number.isFinite(removeAfter) && removeAfter > 0 ? removeAfter : 3;
+
+  // B: inconclusive probes are neutral — do not touch count or status.
+  if (outcome === "inconclusive") {
+    return { failures: priorFailures, clearFailures: false, setStatus: null, remove: false };
+  }
+
+  // Success: reset the streak. Only (re)assert "active" when the operator has
+  // opted into status management; otherwise never touch the user's status (C).
+  if (outcome === "ok") {
+    return {
+      failures: 0,
+      clearFailures: true,
+      setStatus: autoRemove ? "active" : null,
+      remove: false,
+    };
+  }
+
+  // Conclusive failure.
+  const failures = priorFailures + 1;
+
+  // C: default mode only counts/logs — never downgrades.
+  if (!autoRemove) {
+    return { failures, clearFailures: false, setStatus: null, remove: false };
+  }
+
+  // A: downgrade + remove only once the consecutive threshold is reached.
+  if (failures >= threshold) {
+    return { failures, clearFailures: false, setStatus: "inactive", remove: true };
+  }
+
+  return { failures, clearFailures: false, setStatus: null, remove: false };
+}
diff --git a/src/lib/proxyHealth/scheduler.ts b/src/lib/proxyHealth/scheduler.ts
index 2e6c291125..0921a909a7 100644
--- a/src/lib/proxyHealth/scheduler.ts
+++ b/src/lib/proxyHealth/scheduler.ts
@@ -14,8 +14,16 @@
 import { deleteProxyById, listProxies, updateProxy } from "@/lib/localDb";
 import { createProxyDispatcher, clearDispatcherCache } from "@omniroute/open-sse/utils/proxyDispatcher";
 import { fetch as undiciFetch } from "undici";
+import {
+  decideProxyHealthAction,
+  type ProxyProbeOutcome,
+} from "./decision.ts";
 
-const TEST_TIMEOUT_MS = 5000;
+// #6246: a HEAD to the public probe target through a legit (often loaded) proxy
+// can exceed a few seconds; the old 5s ceiling produced false negatives that
+// flipped healthy proxies to inactive. Raise it and treat our own timeout as
+// inconclusive (see testOneProxy) rather than a proxy failure.
+const TEST_TIMEOUT_MS = 15000;
 // Reachability probe target for proxy health checks. Configurable so operators
 // can point it at an internal/self-hosted endpoint instead of the public default.
 const TEST_URL = process.env.PROXY_HEALTH_TEST_URL || "https://httpbin.org/ip";
@@ -65,7 +73,21 @@ function isBackgroundServicesDisabled(): boolean {
   return ["1", "true", "yes", "on"].includes(raw.trim().toLowerCase());
 }
 
-async function testOneProxy(proxy: { id: string; type: string; host: string; port: number }): Promise<boolean> {
+/**
+ * Reachability probe for one proxy, classified into a tri-state so the pure
+ * decision layer can apply the #6246 policy:
+ *   - "ok"           — the proxy relayed and the target answered (<500).
+ *   - "inconclusive" — NOT the proxy's fault: our own timeout/abort, or the probe
+ *                      TARGET returned a 5xx (the proxy connected fine). Never
+ *                      penalizes the proxy.
+ *   - "fail"         — a proxy-level connection error (refused/unreachable/TLS).
+ */
+async function testOneProxy(proxy: {
+  id: string;
+  type: string;
+  host: string;
+  port: number;
+}): Promise<ProxyProbeOutcome> {
   const proxyUrl = `${proxy.type}://${proxy.host}:${proxy.port}`;
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), TEST_TIMEOUT_MS);
@@ -77,9 +99,13 @@ async function testOneProxy(proxy: { id: string; type: string; host: string; por
       dispatcher,
       headers: { "User-Agent": "OmniRoute/1.0" },
     });
-    return resp.status < 500;
+    // A 5xx from the probe target means the proxy DID relay — the target is at
+    // fault, not the proxy. Do not penalize the proxy for that.
+    return resp.status < 500 ? "ok" : "inconclusive";
   } catch {
-    return false;
+    // Our own deadline elapsed → inconclusive (slow, not necessarily dead).
+    // Any other error is a genuine proxy-level connection failure.
+    return controller.signal.aborted ? "inconclusive" : "fail";
   } finally {
     clearTimeout(timeout);
   }
@@ -95,44 +121,54 @@ async function sweep(): Promise<void> {
 
   let tested = 0;
   let alive = 0;
+  let inconclusive = 0;
   let removed = 0;
 
   for (let i = 0; i < proxies.length; i += CONCURRENCY) {
     const batch = proxies.slice(i, i + CONCURRENCY);
     const results = await Promise.allSettled(
       batch.map(async (proxy) => {
-        const ok = await testOneProxy(proxy);
-        return { id: proxy.id, ok };
+        const outcome = await testOneProxy(proxy);
+        return { id: proxy.id, outcome };
       })
     );
 
     for (const result of results) {
       if (result.status !== "fulfilled") continue;
-      const { id, ok } = result.value;
+      const { id, outcome } = result.value;
       tested++;
+      if (outcome === "ok") alive++;
+      else if (outcome === "inconclusive") inconclusive++;
 
-      if (ok) {
-        alive++;
-        failureMap.delete(id);
-        await updateProxy(id, { status: "active" }).catch(() => {});
-      } else {
-        const failures = (failureMap.get(id) ?? 0) + 1;
-        failureMap.set(id, failures);
-        await updateProxy(id, { status: "inactive" }).catch(() => {});
+      const decision = decideProxyHealthAction({
+        outcome,
+        priorFailures: failureMap.get(id) ?? 0,
+        autoRemove,
+        removeAfter,
+      });
 
-        if (autoRemove && failures >= removeAfter) {
-          if (await deleteProxyById(id, { force: true }).catch(() => false)) {
-            failureMap.delete(id);
-            removed++;
-            try { clearDispatcherCache(); } catch { /* non-critical */ }
-          }
+      if (decision.clearFailures) failureMap.delete(id);
+      else failureMap.set(id, decision.failures);
+
+      // #6246 (policy C): only mutate the operator-owned status when the decision
+      // explicitly asks for it. By default (auto-remove off) setStatus is null, so
+      // a transient probe failure never flips a healthy proxy to inactive.
+      if (decision.setStatus) {
+        await updateProxy(id, { status: decision.setStatus }).catch(() => {});
+      }
+
+      if (decision.remove) {
+        if (await deleteProxyById(id, { force: true }).catch(() => false)) {
+          failureMap.delete(id);
+          removed++;
+          try { clearDispatcherCache(); } catch { /* non-critical */ }
         }
       }
     }
   }
 
   console.log(
-    `${LOG_PREFIX} Sweep complete: ${tested} tested, ${alive} alive, ${removed} auto-removed`
+    `${LOG_PREFIX} Sweep complete: ${tested} tested, ${alive} alive, ${inconclusive} inconclusive, ${removed} auto-removed`
   );
 }
 
diff --git a/src/lib/proxyHealth/statusPolicy.ts b/src/lib/proxyHealth/statusPolicy.ts
new file mode 100644
index 0000000000..aaa7521603
--- /dev/null
+++ b/src/lib/proxyHealth/statusPolicy.ts
@@ -0,0 +1,41 @@
+/**
+ * Proxy health-check status-write policy (#6246).
+ *
+ * The manual "Test All" reachability probe (`/api/settings/proxies/auto-test`)
+ * used to flip a proxy's `status` to `inactive` on a single failed probe. Because
+ * the egress selector excludes `inactive` proxies (PROXY_ALIVE_PREDICATE), a flaky
+ * external probe (an unreachable httpbin.org, a proxy that blocks HEAD, or a slow
+ * paid proxy) silently disabled every proxy that failed — "Test All" is a test,
+ * not test-and-set.
+ *
+ * Policy: automated reachability probes are **read-only by default** — they never
+ * write a proxy's status. Only the operator sets a proxy active/inactive (same
+ * contract as provider accounts, which are auto-disabled only when the operator
+ * opts in). Set `PROXY_HEALTH_AUTO_DEACTIVATE=true` to restore the legacy
+ * test-and-set behavior (probe result writes `active`/`inactive`).
+ */
+
+/**
+ * Resolve the status an automated health probe should WRITE for a proxy, or
+ * `null` to leave the status untouched (the default). Pure + unit-testable.
+ *
+ * @param alive whether the reachability probe succeeded
+ * @param env   environment source (defaults to process.env)
+ */
+export function resolveHealthCheckStatusWrite(
+  alive: boolean,
+  env: { PROXY_HEALTH_AUTO_DEACTIVATE?: string } = process.env
+): "active" | "inactive" | null {
+  if ((env.PROXY_HEALTH_AUTO_DEACTIVATE ?? "").trim().toLowerCase() !== "true") {
+    // Default: never let an automated probe change a proxy's status.
+    return null;
+  }
+  return alive ? "active" : "inactive";
+}
+
+/** True when automated probes are allowed to write proxy status (opt-in). */
+export function isProxyHealthAutoDeactivateEnabled(
+  env: { PROXY_HEALTH_AUTO_DEACTIVATE?: string } = process.env
+): boolean {
+  return (env.PROXY_HEALTH_AUTO_DEACTIVATE ?? "").trim().toLowerCase() === "true";
+}
diff --git a/src/lib/services/ServiceSupervisor.ts b/src/lib/services/ServiceSupervisor.ts
index 395fdd64fe..0125bd2056 100644
--- a/src/lib/services/ServiceSupervisor.ts
+++ b/src/lib/services/ServiceSupervisor.ts
@@ -7,6 +7,7 @@ import { sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
 import { getServiceRow, updateServiceField, setToolStatus } from "@/lib/db/versionManager";
 import { RingBuffer } from "./ringBuffer";
 import { HealthChecker } from "./healthCheck";
+import { decidePreSpawn, probeBeforeSpawn } from "./portProbe";
 import type { ServiceConfig, ServiceState, ServiceStatus, LogLine, HealthState } from "./types";
 
 const CRASH_FAST_THRESHOLD_MS = 5_000;
@@ -61,6 +62,32 @@ export class ServiceSupervisor extends EventEmitter {
       this.setState("starting");
       this.lastError = null;
 
+      // Pre-spawn probe (#6205): avoid a raw EADDRINUSE crash when a prior
+      // instance is still holding the port. A healthy instance is adopted; a
+      // held-but-unhealthy port surfaces a clear error instead of a stack.
+      // Opt-in per ServiceConfig so the default spawn path is unchanged.
+      if (this.config.probeBeforeSpawn) {
+        const probe = await probeBeforeSpawn(this.config.healthUrl(), this.config.port);
+        const decision = decidePreSpawn(probe, this.config.port);
+
+        if (decision.action === "adopt") {
+          // Something healthy already serves this port — treat it as running
+          // rather than spawning a duplicate that would die with EADDRINUSE.
+          this.checker.start();
+          this.startedAt = new Date().toISOString();
+          this.setState("running");
+          await setToolStatus(this.config.tool, "running");
+          return this.getStatus();
+        }
+
+        if (decision.action === "error") {
+          this.lastError = sanitizeErrorMessage(decision.message);
+          this.setState("error");
+          await setToolStatus(this.config.tool, "error", undefined, this.lastError);
+          return this.getStatus();
+        }
+      }
+
       const { command, args, env, cwd } = this.config.spawnArgs();
 
       const child = spawn(command, args, {
diff --git a/src/lib/services/bootstrap.ts b/src/lib/services/bootstrap.ts
index 5dea02e9d4..fd5ff475e8 100644
--- a/src/lib/services/bootstrap.ts
+++ b/src/lib/services/bootstrap.ts
@@ -105,6 +105,10 @@ export async function bootstrapEmbeddedServices(): Promise<void> {
       healthIntervalMs: cfg.healthIntervalMs,
       stopTimeoutMs: cfg.stopTimeoutMs,
       logsBufferBytes: cfg.logsBufferBytes,
+      // #6205: embedded services bind a fixed port — probe before spawning so
+      // an orphaned prior instance yields adopt/clear-error instead of a raw
+      // EADDRINUSE crash.
+      probeBeforeSpawn: true,
     });
 
     registerSupervisor(supervisor);
diff --git a/src/lib/services/embedPath.ts b/src/lib/services/embedPath.ts
new file mode 100644
index 0000000000..1b669035df
--- /dev/null
+++ b/src/lib/services/embedPath.ts
@@ -0,0 +1,19 @@
+/**
+ * Pure helpers for the embedded-service reverse proxy path handling.
+ *
+ * Kept dependency-free so the behavior can be unit-tested without pulling in
+ * the registry / DB / htmlRewriter that `reverseProxy.ts` imports.
+ */
+
+/**
+ * Map the `[[...path]]` catch-all segments to an upstream request path.
+ *
+ * The segment-less panel root (`/embed/`, matched only because the route is an
+ * OPTIONAL catch-all — #6205) yields an empty segment array, which must map to
+ * `"/"` so the embedded service serves its index page instead of `/undefined`.
+ *
+ * @param pathSegments The catch-all segments, e.g. `["ui", "index.html"]` or `[]`.
+ */
+export function toUpstreamPath(pathSegments: string[]): string {
+  return pathSegments.length > 0 ? "/" + pathSegments.join("/") : "/";
+}
diff --git a/src/lib/services/portProbe.ts b/src/lib/services/portProbe.ts
new file mode 100644
index 0000000000..99405462a8
--- /dev/null
+++ b/src/lib/services/portProbe.ts
@@ -0,0 +1,104 @@
+/**
+ * Pre-spawn port/health probe for embedded services (#6205).
+ *
+ * Before the supervisor spawns a service child, it probes the service's port
+ * and health endpoint. This turns two failure modes into graceful outcomes
+ * instead of a raw `EADDRINUSE` stack trace crashing the child:
+ *
+ *   - A healthy prior instance is already answering  → ADOPT it (skip spawn).
+ *   - The port is held but nothing healthy answers    → surface a CLEAR error.
+ *   - The port is free                                → SPAWN normally.
+ *
+ * `decidePreSpawn` is a pure function so the decision logic is unit-testable
+ * without binding a real port or spawning a process.
+ */
+
+import { createConnection } from "node:net";
+
+/** Result of probing the service before spawning. */
+export interface PreSpawnProbe {
+  /** true when the service's healthUrl answered with a 2xx. */
+  healthy: boolean;
+  /** true when something is already listening on the service's port. */
+  portInUse: boolean;
+}
+
+/** Outcome of the pre-spawn decision. */
+export type PreSpawnDecision =
+  | { action: "spawn" }
+  | { action: "adopt" }
+  | { action: "error"; message: string };
+
+const HEALTH_PROBE_TIMEOUT_MS = 3_000;
+const PORT_PROBE_TIMEOUT_MS = 1_000;
+
+/**
+ * Decide what to do before spawning, given a probe of the port + health.
+ *
+ * Pure — no I/O — so it can be exhaustively unit-tested.
+ */
+export function decidePreSpawn(probe: PreSpawnProbe, port: number): PreSpawnDecision {
+  // A healthy instance is already serving on the port — adopt it rather than
+  // spawn a duplicate that would immediately die with EADDRINUSE.
+  if (probe.healthy) {
+    return { action: "adopt" };
+  }
+  // Port is held but nothing healthy answers: an orphaned or unrelated process
+  // is squatting on it. Surface a clear, actionable error instead of letting
+  // the child crash with a raw EADDRINUSE stack.
+  if (probe.portInUse) {
+    return {
+      action: "error",
+      message:
+        `Port ${port} is already in use but the service did not respond to a health ` +
+        `check. An orphaned previous instance or an unrelated process may be holding ` +
+        `the port — stop it (or free the port) and try starting the service again.`,
+    };
+  }
+  // Port is free and nothing is answering — safe to spawn.
+  return { action: "spawn" };
+}
+
+/** TCP connect check: resolves true when something accepts a connection. */
+function isPortInUse(port: number, timeoutMs: number): Promise<boolean> {
+  return new Promise<boolean>((resolve) => {
+    const socket = createConnection({ host: "127.0.0.1", port }, () => {
+      socket.destroy();
+      resolve(true);
+    });
+    socket.setTimeout(timeoutMs);
+    socket.on("error", () => resolve(false));
+    socket.on("timeout", () => {
+      socket.destroy();
+      resolve(false);
+    });
+  });
+}
+
+/** Health check: resolves true when healthUrl answers with a 2xx. */
+async function isHealthy(healthUrl: string, timeoutMs: number): Promise<boolean> {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetch(healthUrl, { signal: controller.signal });
+    return res.ok;
+  } catch {
+    return false;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+/**
+ * Probe the service's port + health endpoint before spawning.
+ *
+ * @param healthUrl The service's health endpoint URL.
+ * @param port      The service's registered port.
+ */
+export async function probeBeforeSpawn(healthUrl: string, port: number): Promise<PreSpawnProbe> {
+  const [healthy, portInUse] = await Promise.all([
+    isHealthy(healthUrl, HEALTH_PROBE_TIMEOUT_MS),
+    isPortInUse(port, PORT_PROBE_TIMEOUT_MS),
+  ]);
+  return { healthy, portInUse };
+}
diff --git a/src/lib/services/reverseProxy.ts b/src/lib/services/reverseProxy.ts
index 2e04c8db15..7cf047425d 100644
--- a/src/lib/services/reverseProxy.ts
+++ b/src/lib/services/reverseProxy.ts
@@ -21,6 +21,7 @@
 import { getSupervisor } from "@/lib/services/registry";
 import { getOrCreateApiKey } from "@/lib/services/apiKey";
 import { rewriteHtml } from "@/lib/services/htmlRewriter";
+import { toUpstreamPath } from "@/lib/services/embedPath";
 import { createErrorResponse } from "@/lib/api/errorResponse";
 import { sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
 
@@ -90,7 +91,7 @@ export interface ReverseProxyConfig {
  * security-conflicting headers stripped.
  *
  * @param request      The incoming Next.js route Request.
- * @param pathSegments The `[...path]` catch-all segments, e.g. `["ui", "index.html"]`.
+ * @param pathSegments The `[[...path]]` catch-all segments, e.g. `["ui", "index.html"]` or `[]`.
  * @param config       Proxy configuration (service name + public prefix).
  */
 export async function proxyRequest(
@@ -114,7 +115,7 @@ export async function proxyRequest(
   }
 
   const incomingUrl = new URL(request.url);
-  const upstreamPath = pathSegments.length > 0 ? "/" + pathSegments.join("/") : "/";
+  const upstreamPath = toUpstreamPath(pathSegments);
   const upstreamUrl = `http://127.0.0.1:${port}${upstreamPath}${incomingUrl.search}`;
 
   // Build forwarded headers: strip hop-by-hop AND sensitive client headers.
diff --git a/src/lib/services/types.ts b/src/lib/services/types.ts
index 2d6285cd45..7e1df54598 100644
--- a/src/lib/services/types.ts
+++ b/src/lib/services/types.ts
@@ -13,6 +13,14 @@ export interface ServiceConfig {
   healthIntervalMs: number;
   stopTimeoutMs: number;
   logsBufferBytes: number;
+  /**
+   * When true (#6205), the supervisor probes the port + health endpoint before
+   * spawning: a healthy prior instance is adopted, a held-but-unhealthy port
+   * yields a clear error instead of a raw EADDRINUSE stack. Opt-in so the
+   * default spawn path (and existing supervisor tests) stays byte-identical —
+   * enabled for services that bind a fixed port (e.g. 9router).
+   */
+  probeBeforeSpawn?: boolean;
 }
 
 export type ServiceState =
diff --git a/src/lib/skills/githubCollector.ts b/src/lib/skills/githubCollector.ts
new file mode 100644
index 0000000000..48a8deb867
--- /dev/null
+++ b/src/lib/skills/githubCollector.ts
@@ -0,0 +1,426 @@
+/**
+ * githubCollector.ts — GitHub agent skill discovery, scoring, and import.
+ *
+ * Mirrors the logic from the Skill Collector Python tool:
+ *   - Searches GitHub for repos with SKILL.md / agent skill files
+ *   - Scores repos by relevance (stars, name/desc signals, topics)
+ *   - Scans for blocked patterns (malware, secrets)
+ *   - Installs SKILL.md into agent directories (Hermes, Claude, etc.)
+ *
+ * This is the backend library consumed by the MCP tools and REST API.
+ */
+
+import { z } from "zod";
+
+// ── Types ────────────────────────────────────────────────────────────────────
+
+export interface GitHubSkillRepo {
+  fullName: string;
+  htmlUrl: string;
+  description: string;
+  stars: number;
+  forks: number;
+  topics: string[];
+  score: number;
+  hasSkillFile: boolean;
+  isAwesome: boolean;
+  updatedAt: string | null;
+  license: string | null;
+}
+
+export interface ScanFinding {
+  file: string;
+  pattern: string;
+  context: string;
+}
+
+export interface SkillInstallResult {
+  target: string;
+  ok: boolean;
+  action: "installed" | "already_up_to_date" | "skipped" | "error";
+  error?: string;
+  destDir?: string;
+}
+
+// ── Constants ────────────────────────────────────────────────────────────────
+
+const BLOCKED_PATTERNS: { regex: RegExp; description: string }[] = [
+  { regex: /eval\s*\(base64/i, description: "eval(base64) — dangerous code execution" },
+  { regex: /exec\s*\(base64/i, description: "exec(base64) — dangerous code execution" },
+  { regex: /os\.system\(/i, description: "os.system() — shell injection risk" },
+  { regex: /subprocess\.Popen\(/i, description: "subprocess.Popen() — shell spawn" },
+  { regex: /invoke-expression/i, description: "PowerShell Invoke-Expression" },
+  { regex: /-----BEGIN.*PRIVATE KEY-----/i, description: "Private key leaked" },
+  { regex: /id_rsa/i, description: "SSH private key reference" },
+  { regex: /password\s*[=:]\s*['"]/, description: "Hardcoded password" },
+  { regex: /api_key\s*[=:]\s*['"]/, description: "Hardcoded API key" },
+  { regex: /secret\s*[=:]\s*['"]/, description: "Hardcoded secret" },
+  { regex: /sk-[a-zA-Z0-9]{20,}/i, description: "OpenAI API key pattern" },
+  { regex: /ghp_[a-zA-Z0-9]{36,}/i, description: "GitHub PAT token" },
+];
+
+const SKILL_FILE_SIGNALS = [
+  "skill.md",
+  "skills.md",
+  "agents.md",
+  "claude.md",
+  "codex.md",
+  "cursor.md",
+  "copilot.md",
+  ".cursorrules",
+  ".clauderules",
+  ".windsurfrules",
+  "copilot-instructions",
+  "agent.md",
+  "context.md",
+  "instructions.md",
+  "rules.md",
+  "conventions.md",
+];
+
+const HIGH_VALUE_KEYWORDS = [
+  "agent",
+  "skill",
+  "cursor",
+  "copilot",
+  "claude",
+  "codex",
+  "gemini",
+  "opencode",
+  "hermes",
+  "windsurf",
+  "mcp",
+  "llm",
+  "autonomous",
+  "orchestrat",
+  "workflow",
+];
+
+const AGENT_TOPICS = new Set([
+  "agent",
+  "ai-agent",
+  "llm-agent",
+  "agentic-ai",
+  "agent-framework",
+  "autonomous-agent",
+  "multi-agent",
+  "mcp",
+  "mcp-server",
+  "mcp-tool",
+  "claude",
+  "claude-code",
+  "cursor-ai",
+  "copilot",
+  "codex",
+  "prompt-engineering",
+  "context-engineering",
+  "ai-toolkit",
+]);
+
+const KNOWN_GOLD_REPOS = new Set([
+  "addyosmani/agent-skills",
+  "K-Dense-AI/scientific-agent-skills",
+  "modelcontextprotocol/servers",
+  "continuedev/continue",
+  "aider-ai/aider",
+  "Significant-Gravitas/AutoGPT",
+  "crewAIInc/crewAI",
+  "microsoft/autogen",
+  "langchain-ai/langchain",
+  "openai/codex",
+]);
+
+export const INSTALL_TARGETS = ["hermes", "claude", "gemini", "opencode"] as const;
+export type InstallTarget = (typeof INSTALL_TARGETS)[number];
+
+const INSTALL_PATHS: Record<InstallTarget, string> = {
+  hermes: "~/AppData/Local/hermes/skills/{category}",
+  claude: "~/.claude/skills/{category}",
+  gemini: "~/.gemini/skills/{category}",
+  opencode: "~/.opencode/skills/{category}",
+};
+
+// ── Scoring ──────────────────────────────────────────────────────────────────
+
+/**
+ * Score a GitHub repo for agent-skill relevance (0.0 – 1.0).
+ * Uses metadata only — no extra GitHub API calls.
+ */
+export function scoreRepo(params: {
+  fullName: string;
+  description: string;
+  stars: number;
+  forks: number;
+  hasLicense: boolean;
+  topics: string[];
+}): number {
+  const { fullName, description, stars: rawStars, forks, hasLicense, topics } = params;
+  const name = fullName.toLowerCase();
+  const desc = description.toLowerCase();
+  let stars = rawStars;
+
+  let points = 0.0;
+  let bonus = 0.0;
+  let isAwesome = false;
+  let hasSkillFile = false;
+
+  // Gold repos get max score
+  if (KNOWN_GOLD_REPOS.has(fullName)) return 0.98;
+
+  // Awesome-list detection (curated, not skill repos)
+  if (name.includes("awesome") || desc.includes("curated list") || desc.includes("awesome list")) {
+    isAwesome = true;
+    points += 0.3;
+  }
+
+  // Skill-file name signals
+  for (const sig of SKILL_FILE_SIGNALS) {
+    if (name.includes(sig)) {
+      points += 0.22;
+      hasSkillFile = true;
+      break;
+    }
+  }
+
+  // Loose keyword matches
+  for (const sig of [".md", "skill", "agent", "rules", "instructions"]) {
+    if (name.includes(sig)) points += 0.02;
+    if (desc.includes(sig)) points += 0.01;
+  }
+
+  // High-value keywords
+  for (const kw of HIGH_VALUE_KEYWORDS) {
+    if (name.includes(kw)) points += 0.04;
+    if (desc.includes(kw)) points += 0.02;
+  }
+
+  // Topic matches
+  const topicMatch = topics.filter((t) => AGENT_TOPICS.has(t)).length;
+  points += topicMatch * 0.06;
+
+  // Stars bonus (logarithmic, capped for awesome lists)
+  if (isAwesome) stars = Math.min(stars, 1000);
+  if (stars > 20000) bonus = Math.min(0.7, stars / 30000);
+  else if (stars > 5000) bonus = stars / 15000;
+  else if (stars > 1000) bonus = stars / 10000;
+  else if (stars > 300) bonus = stars / 8000;
+  else if (stars > 100) bonus = stars / 12000;
+  else if (stars > 50) bonus = stars / 15000;
+
+  if (forks > 500) bonus += 0.05;
+  else if (forks > 100) bonus += 0.03;
+
+  if (hasLicense) points += 0.03;
+  if (stars < 300 && !isAwesome) points += 0.06;
+
+  const base = isAwesome ? (hasSkillFile ? 0.38 : 0.16) : hasSkillFile ? 0.38 : 0.28;
+  let score = Math.min(1.0, (points + bonus) * 0.48 + base);
+  if (isAwesome && !hasSkillFile) score = Math.min(score, 0.82);
+
+  return Math.round(score * 10000) / 10000;
+}
+
+// ── Scanning ─────────────────────────────────────────────────────────────────
+
+const DOC_FILES = new Set([
+  "readme.md",
+  "changelog.md",
+  "security.md",
+  "contributing.md",
+  "code_of_conduct.md",
+  "license",
+  "authors.md",
+  "credits.md",
+]);
+
+/**
+ * Scan text content for blocked patterns.
+ */
+export function scanText(text: string, label = ""): ScanFinding[] {
+  const findings: ScanFinding[] = [];
+  for (const { regex, description } of BLOCKED_PATTERNS) {
+    const match = regex.exec(text);
+    if (match) {
+      const start = Math.max(0, match.index - 10);
+      const context = text.slice(start, match.index + match[0].length + 20).replace(/\n/g, " ");
+      findings.push({ file: label, pattern: description, context: `...${context}...` });
+    }
+  }
+  return findings;
+}
+
+/**
+ * Categorize a skill repo into a target directory category.
+ */
+export function inferCategory(fullName: string, description: string): string {
+  const text = `${fullName} ${description}`.toLowerCase();
+  const mapping: Record<string, string[]> = {
+    security: ["security", "pentest", "exploit", "malware", "forensics", "vulnerability"],
+    "data-science": ["data", "analytics", "pandas", "ml", "model", "train"],
+    devops: ["deploy", "docker", "k8s", "terraform", "ci/cd", "pipeline"],
+    creative: ["design", "image", "video", "art", "music"],
+    productivity: ["email", "doc", "slide", "report", "calendar"],
+    research: ["paper", "arxiv", "academic", "literature"],
+    "software-development": ["code", "refactor", "test", "lint", "review", "debug"],
+    media: ["youtube", "transcript", "gif", "video", "audio"],
+  };
+  for (const [cat, keywords] of Object.entries(mapping)) {
+    if (keywords.some((k) => text.includes(k))) return cat;
+  }
+  return "imported-github";
+}
+
+/**
+ * Resolve install path for a target + skill name.
+ */
+export function resolveInstallPath(
+  target: InstallTarget,
+  skillName: string,
+  description: string
+): string {
+  const category = inferCategory(skillName, description);
+  let template = INSTALL_PATHS[target];
+  if (!template) throw new Error(`Unknown install target: ${target}`);
+  template = template.replace("{category}", category);
+  const home =
+    typeof process !== "undefined" && process.env?.HOME
+      ? process.env.HOME
+      : typeof process !== "undefined" && process.env?.USERPROFILE
+        ? process.env.USERPROFILE
+        : "";
+  return template.replace("~", home).replace("{name}", skillName);
+}
+
+// ── GitHub API Search ────────────────────────────────────────────────────────
+
+export const QUERY_STRATEGIES = {
+  file: [
+    "filename:SKILL.md stars:>=1",
+    "filename:CLAUDE.md stars:>=1",
+    "filename:CODEX.md stars:>=1",
+    "filename:CURSOR.md stars:>=1",
+    "filename:.cursorrules stars:>=1",
+    "filename:AGENTS.md stars:>=1",
+    "filename:COPILOT.md stars:>=1",
+    "filename:.clauderules stars:>=1",
+    "filename:copilot-instructions.md stars:>=1",
+    "filename:INSTRUCTIONS.md stars:>=1",
+  ],
+  name: [
+    "agent skill in:name stars:>=3",
+    "skill-pack in:name stars:>=3",
+    "cursor rules in:name stars:>=3",
+    "claude rules in:name stars:>=3",
+    "agent codex in:name stars:>=3",
+    "mcp server in:name,topic stars:>=3",
+    "llm agent in:name stars:>=5",
+  ],
+  description: [
+    "agent skill in:description stars:>=5",
+    "SKILL.md in:description stars:>=3",
+    "LLM agent tool in:description stars:>=5",
+  ],
+} as const;
+
+export interface SearchOptions {
+  token?: string;
+  minStars?: number;
+  maxResults?: number;
+}
+
+/**
+ * Search GitHub for agent skill repos.
+ * Returns scored results sorted by score descending.
+ */
+export async function searchGitHubSkills(
+  options: SearchOptions = {}
+): Promise<{ repos: GitHubSkillRepo[]; errors: string[] }> {
+  const { token = process.env.GITHUB_TOKEN || "", minStars = 1, maxResults = 100 } = options;
+  const seen = new Set<string>();
+  const repos: GitHubSkillRepo[] = [];
+  const errors: string[] = [];
+
+  const headers: Record<string, string> = {
+    Accept: "application/vnd.github+json",
+    ...(token ? { Authorization: `Bearer ${token}` } : {}),
+  };
+
+  const allQueries = [
+    ...QUERY_STRATEGIES.file,
+    ...QUERY_STRATEGIES.name,
+    ...QUERY_STRATEGIES.description,
+  ];
+
+  for (const query of allQueries) {
+    if (repos.length >= maxResults) break;
+    try {
+      const url = `https://api.github.com/search/repositories?q=${encodeURIComponent(query)}&sort=stars&per_page=30`;
+      const res = await fetch(url, { headers, signal: AbortSignal.timeout(10000) });
+      if (!res.ok) {
+        if (res.status === 403) {
+          errors.push("GitHub API rate limited — add a GITHUB_TOKEN");
+          break;
+        }
+        if (res.status === 422) continue; // bad query, skip
+        errors.push(`GitHub API ${res.status} for query: ${query.slice(0, 40)}`);
+        continue;
+      }
+      const data = (await res.json()) as { items?: any[] };
+      for (const item of data.items || []) {
+        if (repos.length >= maxResults) break;
+        if (seen.has(item.full_name)) continue;
+        if ((item.stargazers_count ?? 0) < minStars) continue;
+        seen.add(item.full_name);
+
+        repos.push({
+          fullName: item.full_name,
+          htmlUrl: item.html_url,
+          description: item.description || "",
+          stars: item.stargazers_count ?? 0,
+          forks: item.forks_count ?? 0,
+          topics: item.topics || [],
+          score: scoreRepo({
+            fullName: item.full_name,
+            description: item.description || "",
+            stars: item.stargazers_count ?? 0,
+            forks: item.forks_count ?? 0,
+            hasLicense: !!item.license,
+            topics: item.topics || [],
+          }),
+          hasSkillFile: SKILL_FILE_SIGNALS.some((s) => item.full_name.toLowerCase().includes(s)),
+          isAwesome: item.full_name.toLowerCase().includes("awesome"),
+          updatedAt: item.updated_at || null,
+          license: item.license?.spdx_id || null,
+        });
+      }
+    } catch (err) {
+      errors.push(`Query "${query.slice(0, 30)}…" failed: ${(err as Error).message}`);
+    }
+  }
+
+  repos.sort((a, b) => b.score - a.score);
+  return { repos, errors };
+}
+
+// ── Zod Schemas for MCP tools ────────────────────────────────────────────────
+
+export const GitHubSkillsSearchSchema = z.object({
+  query: z.string().optional().describe("Optional search text to filter results"),
+  minStars: z.number().min(0).max(100000).default(1).describe("Minimum GitHub stars"),
+  maxResults: z.number().min(1).max(500).default(50).describe("Max repos to return"),
+  minScore: z.number().min(0).max(1).default(0).describe("Minimum relevance score filter"),
+});
+
+export const GitHubSkillsScanSchema = z.object({
+  repoName: z.string().describe("Full repo name (e.g. 'user/repo')"),
+  content: z.string().describe("SKILL.md or README content to scan"),
+});
+
+export const GitHubSkillsInstallSchema = z.object({
+  repoName: z.string().describe("Full repo name to install"),
+  targets: z
+    .array(z.enum(INSTALL_TARGETS))
+    .default(["hermes"])
+    .describe("Where to install the skill"),
+  description: z.string().default("").describe("Repo description for category inference"),
+});
diff --git a/src/lib/usage/callLogs.ts b/src/lib/usage/callLogs.ts
index 3c0cc5deb9..f5fdb7cca4 100644
--- a/src/lib/usage/callLogs.ts
+++ b/src/lib/usage/callLogs.ts
@@ -18,6 +18,7 @@ import {
   getPromptCacheReadTokensOrNull,
   getPromptCacheCreationTokensOrNull,
   getReasoningTokensOrNull,
+  getObservedReasoning,
 } from "./tokenAccounting";
 import { isNoLog } from "../compliance/noLog";
 import { protectPayloadForLog, parseStoredPayload } from "../logPayloads";
@@ -90,6 +91,7 @@ type CallLogSummaryRow = {
   provider_node_prefix?: string | null;
   resolved_account?: string | null;
   correlation_id?: string | null;
+  model_pinned?: number | null;
 };
 
 const RESOLVED_ACCOUNT_SQL = "COALESCE(NULLIF(pc.name, ''), NULLIF(pc.email, ''), cl.account)";
@@ -240,6 +242,37 @@ function buildArtifact(
   };
 }
 
+// #6187: extract the assistant message from a chat-completion-shaped response
+// body so we can inspect its reasoning_content / <think> content.
+function extractAssistantMessage(responseBody: unknown): unknown {
+  if (!responseBody || typeof responseBody !== "object") return responseBody;
+  const choices = (responseBody as JsonRecord).choices;
+  if (Array.isArray(choices) && choices.length > 0) {
+    const first = choices[0] as JsonRecord;
+    return first?.message ?? first?.delta ?? first;
+  }
+  return responseBody;
+}
+
+// #6187: decide the reasoning SOURCE and (char-only) count recorded alongside
+// the usage-derived tokens_reasoning. Usage is authoritative when it reports
+// non-zero reasoning tokens; otherwise we fall back to observed reasoning
+// content so "reasoned but metered 0" stays distinguishable. reasoning_chars is
+// a CHARACTER count, never a token count — it must not touch cost math.
+function resolveReasoningObservation(
+  usageReasoning: number | null,
+  responseBody: unknown
+): { source: string | null; chars: number | null } {
+  if (usageReasoning != null && usageReasoning > 0) {
+    return { source: "usage", chars: null };
+  }
+  const observed = getObservedReasoning(extractAssistantMessage(responseBody));
+  if (observed.chars > 0) {
+    return { source: observed.source, chars: observed.chars };
+  }
+  return { source: null, chars: null };
+}
+
 function hasTable(tableName: string): boolean {
   const db = getDbInstance();
   return Boolean(
@@ -481,6 +514,7 @@ function mapSummaryRow(row: CallLogSummaryRow) {
     hasResponseBody: toNumber(row.has_response_body) === 1,
     hasPipelineDetails: toNumber(row.has_pipeline_details) === 1,
     correlationId: row.correlation_id || null,
+    modelPinned: toNumber(row.model_pinned) === 1,
   };
 }
 
@@ -534,6 +568,10 @@ export async function saveCallLog(entry: any) {
       const nodePrefix = await resolveProviderPrefix(rawProvider);
       resolvedRequestedModel = applyNodePrefix(rawRequestedModel, rawProvider, nodePrefix);
     }
+    // #6187: usage-derived reasoning tokens stay UNCHANGED (cost math reads this),
+    // while reasoning source/char-count are recorded separately for observability.
+    const tokensReasoning = getReasoningTokensOrNull(entry.tokens);
+    const reasoningObservation = resolveReasoningObservation(tokensReasoning, entry.responseBody);
     const logEntry = {
       id: typeof entry.id === "string" && entry.id.length > 0 ? entry.id : generateLogId(),
       timestamp: typeof entry.timestamp === "string" ? entry.timestamp : new Date().toISOString(),
@@ -550,7 +588,9 @@ export async function saveCallLog(entry: any) {
       tokensOut: toNumber(getLoggedOutputTokens(entry.tokens)),
       tokensCacheRead: getPromptCacheReadTokensOrNull(entry.tokens),
       tokensCacheCreation: getPromptCacheCreationTokensOrNull(entry.tokens),
-      tokensReasoning: getReasoningTokensOrNull(entry.tokens),
+      tokensReasoning,
+      reasoningSource: reasoningObservation.source,
+      reasoningChars: reasoningObservation.chars,
       tokensCompressed: entry.tokensCompressed != null ? toNumber(entry.tokensCompressed) : null,
       cacheSource: entry.cacheSource === "semantic" ? "semantic" : "upstream",
       requestType: entry.requestType || null,
@@ -563,6 +603,7 @@ export async function saveCallLog(entry: any) {
       comboExecutionKey:
         toStringOrNull(entry.comboExecutionKey) || toStringOrNull(entry.comboStepId),
       correlationId: entry.correlationId || null,
+      modelPinned: entry.modelPinned ? 1 : 0,
     };
 
     const requestSummary = noLogEnabled
@@ -606,21 +647,23 @@ export async function saveCallLog(entry: any) {
         id, timestamp, method, path, status, model, requested_model, provider,
         account, connection_id, duration, tokens_in, tokens_out,
         tokens_cache_read, tokens_cache_creation, tokens_reasoning, tokens_compressed,
+        reasoning_source, reasoning_chars,
         cache_source, request_type, source_format, target_format, api_key_id, api_key_name,
         combo_name, combo_step_id, combo_execution_key, error_summary, detail_state,
         artifact_relpath, artifact_size_bytes, artifact_sha256,
         has_request_body, has_response_body, has_pipeline_details, request_summary,
-        correlation_id
+        correlation_id, model_pinned
       )
       VALUES (
         @id, @timestamp, @method, @path, @status, @model, @requestedModel, @provider,
         @account, @connectionId, @duration, @tokensIn, @tokensOut,
         @tokensCacheRead, @tokensCacheCreation, @tokensReasoning, @tokensCompressed,
+        @reasoningSource, @reasoningChars,
         @cacheSource, @requestType, @sourceFormat, @targetFormat, @apiKeyId, @apiKeyName,
         @comboName, @comboStepId, @comboExecutionKey, @errorSummary, @detailState,
         @artifactRelPath, @artifactSizeBytes, @artifactSha256,
         @hasRequestBody, @hasResponseBody, @hasPipelineDetails, @requestSummary,
-        @correlationId
+        @correlationId, @modelPinned
       )
     `
     ).run({
@@ -738,8 +781,8 @@ export async function getCallLogs(filter: any = {}) {
     params.apiKeyQ = `%${filter.apiKey}%`;
   }
   if (filter.correlationId) {
-    conditions.push("cl.correlation_id = @correlationId");
-    params.correlationId = filter.correlationId;
+    conditions.push("cl.correlation_id LIKE @correlationId");
+    params.correlationId = `%${filter.correlationId}%`;
   }
   if (filter.combo) {
     conditions.push("cl.combo_name IS NOT NULL");
diff --git a/src/lib/usage/tokenAccounting.ts b/src/lib/usage/tokenAccounting.ts
index 92dd83f21c..4131107902 100644
--- a/src/lib/usage/tokenAccounting.ts
+++ b/src/lib/usage/tokenAccounting.ts
@@ -93,6 +93,48 @@ export function getReasoningTokens(tokens: unknown): number {
   );
 }
 
+// Non-greedy, single-capture, no nested variable-length quantifiers → ReDoS-safe.
+const THINK_BLOCK_RE = /<think>([\s\S]*?)<\/think>/gi;
+
+/**
+ * Inspect an assistant message for reasoning/thinking content that the usage
+ * object may not have metered (#6187 — e.g. stepfun step-3.7-flash emits
+ * `reasoning_content` but reports `reasoning_tokens=0`).
+ *
+ * Returns the reasoning SOURCE and the raw CHARACTER count of the observed
+ * reasoning text.
+ *
+ * IMPORTANT: `chars` is a CHARACTER count, NOT a token count. It must NEVER be
+ * fed into cost math (`costCalculator` prices `tokens.reasoning`). It exists
+ * only so call logs can distinguish "reasoned but metered 0" from
+ * "did not reason at all" without corrupting billing.
+ */
+export function getObservedReasoning(message: unknown): {
+  source: "content" | "think" | null;
+  chars: number;
+} {
+  const record = asRecord(message);
+
+  // Explicit reasoning field: `reasoning_content` is the raw provider field;
+  // `reasoning` is what sseTextTransform maps it to.
+  const explicit = record.reasoning_content ?? record.reasoning;
+  if (typeof explicit === "string" && explicit.trim().length > 0) {
+    return { source: "content", chars: explicit.length };
+  }
+
+  // Inline <think>...</think> blocks embedded in message content.
+  const content = record.content;
+  if (typeof content === "string" && content.length > 0) {
+    let chars = 0;
+    for (const match of content.matchAll(THINK_BLOCK_RE)) {
+      chars += (match[1] ?? "").length;
+    }
+    if (chars > 0) return { source: "think", chars };
+  }
+
+  return { source: null, chars: 0 };
+}
+
 // ─── Nullable variants ──────────────────────────────────────────────────
 // Return `null` when the provider simply doesn't report the field,
 // vs `0` when the provider explicitly reported zero.
diff --git a/src/mitm/cert/install.ts b/src/mitm/cert/install.ts
index 7a8506ef38..74dcf62d45 100644
--- a/src/mitm/cert/install.ts
+++ b/src/mitm/cert/install.ts
@@ -122,6 +122,19 @@ export async function checkCertInstalled(certPath: string): Promise<boolean> {
   return checkCertInstalledLinux(certPath);
 }
 
+/**
+ * macOS `security find-certificate -a -Z` prints the SHA-1 as a colon-less
+ * hex string (e.g. `SHA-1 hash: ABCDEF…`), while {@link getCertFingerprint}
+ * returns a colon-separated one (`AB:CD:EF…`). A raw substring check therefore
+ * never matched and the cert was reported as not-installed on every run,
+ * re-prompting for the sudo install. Normalize both sides (strip `:`,
+ * upper-case) before comparing.
+ */
+export function macCertOutputHasFingerprint(securityOutput: string, fingerprint: string): boolean {
+  const normalize = (value: string) => value.replace(/:/g, "").toUpperCase();
+  return normalize(securityOutput).includes(normalize(fingerprint));
+}
+
 async function checkCertInstalledMac(certPath: string): Promise<boolean> {
   try {
     const fingerprint = getCertFingerprint(certPath);
@@ -131,7 +144,7 @@ async function checkCertInstalledMac(certPath: string): Promise<boolean> {
       "-Z",
       "/Library/Keychains/System.keychain",
     ]);
-    return output.toUpperCase().includes(fingerprint);
+    return macCertOutputHasFingerprint(output, fingerprint);
   } catch {
     return false;
   }
diff --git a/src/mitm/systemCommands.ts b/src/mitm/systemCommands.ts
index 7048616a76..a2c539b5e3 100644
--- a/src/mitm/systemCommands.ts
+++ b/src/mitm/systemCommands.ts
@@ -59,21 +59,49 @@ export function execFileText(command: string, args: string[]): Promise<string> {
   });
 }
 
-export function execFileWithPassword(
+/**
+ * Truthy-env check for `OMNIROUTE_NO_SUDO`. Inlined (not imported from
+ * `src/lib/db/apiKeys/modelPermissions.ts`) because that module pulls in the DB
+ * read-cache graph and importing it here — into a low-level MITM primitive that
+ * is loaded during cert bootstrap — would create a module cycle. The same tiny
+ * helper is already duplicated locally in `runtimeSettings.ts` / `db/settings.ts`
+ * for exactly this reason; behavior matches `isTruthyEnvFlag` byte-for-byte
+ * (`1|true|yes|on`, case-insensitive, trimmed).
+ */
+export function isNoSudoEnv(): boolean {
+  const value = process.env.OMNIROUTE_NO_SUDO;
+  return typeof value === "string" && /^(1|true|yes|on)$/i.test(value.trim());
+}
+
+export interface ResolvedSpawn {
+  finalCommand: string;
+  finalArgs: string[];
+  stripSudo: boolean;
+  needsPassword: boolean;
+}
+
+/**
+ * Pure resolver for the sudo-stripping decision. Extracted so tests can assert
+ * the resulting argv (and whether a password is written to stdin) WITHOUT
+ * spawning a real `sudo`. `root`/`sudoAvailable` default to the live probes and
+ * can be injected for deterministic tests; `noSudo` defaults to the
+ * `OMNIROUTE_NO_SUDO` env flag.
+ *
+ * Strips the leading `sudo -S` (running the underlying command directly, same
+ * user, no elevation) when running as root, when `sudo` is unavailable, OR when
+ * the operator opts into root-less mode via `OMNIROUTE_NO_SUDO` (#6122). No
+ * runtime value is ever interpolated into a shell — the argv array is preserved
+ * and only the leading `sudo`/`-S` tokens are dropped (Hard Rule #13).
+ */
+export function resolveSudoSpawn(
   command: string,
   args: string[],
-  password: string,
-  stdinAfterPassword = ""
-): Promise<string> {
-  // When running as root, OR when `sudo` is not installed on the host (slim
-  // Docker images / containerized non-root runtime), skip `sudo -S` and run
-  // the underlying command directly — same user, no elevation. This lets MITM
-  // operations triggered from inside `node:*-slim` containers succeed for any
-  // command that does not actually require root (everything but writing to
-  // /etc/hosts or the system trust store).
-  const root = isRoot();
-  const sudoAvailable = isSudoAvailable();
-  const stripSudo = command === "sudo" && (root || !sudoAvailable);
+  overrides: { root?: boolean; sudoAvailable?: boolean; noSudo?: boolean } = {}
+): ResolvedSpawn {
+  const root = overrides.root ?? isRoot();
+  const sudoAvailable = overrides.sudoAvailable ?? isSudoAvailable();
+  const noSudo = overrides.noSudo ?? isNoSudoEnv();
+  const stripSudo = command === "sudo" && (root || !sudoAvailable || noSudo);
   const needsPassword = !stripSudo && command === "sudo";
   let finalCommand = command;
   let finalArgs = args;
@@ -86,6 +114,24 @@ export function execFileWithPassword(
     }
   }
 
+  return { finalCommand, finalArgs, stripSudo, needsPassword };
+}
+
+export function execFileWithPassword(
+  command: string,
+  args: string[],
+  password: string,
+  stdinAfterPassword = ""
+): Promise<string> {
+  // When running as root, when `sudo` is not installed on the host (slim
+  // Docker images / containerized non-root runtime), OR when the operator sets
+  // `OMNIROUTE_NO_SUDO` (root-less / user-namespace deployments — #6122), skip
+  // `sudo -S` and run the underlying command directly — same user, no
+  // elevation. This lets MITM operations triggered from inside `node:*-slim`
+  // containers succeed for any command that does not actually require root
+  // (everything but writing to /etc/hosts or the system trust store).
+  const { finalCommand, finalArgs, needsPassword } = resolveSudoSpawn(command, args);
+
   return new Promise((resolve, reject) => {
     // `command` and `args` are never user-controlled. This helper is a
     // controlled wrapper called only from src/mitm/cert/install.ts with a
diff --git a/src/server/authz/classify.ts b/src/server/authz/classify.ts
index f8fc361565..a5270860d6 100644
--- a/src/server/authz/classify.ts
+++ b/src/server/authz/classify.ts
@@ -1,7 +1,7 @@
 import {
-  PUBLIC_API_ROUTE_PREFIXES,
   PUBLIC_READONLY_API_ROUTE_PREFIXES,
   PUBLIC_READONLY_METHODS,
+  isPublicApiRoute,
 } from "../../shared/constants/publicApiRoutes";
 import type { ClassificationReason, RouteClassification } from "./types";
 
@@ -131,11 +131,5 @@ function matchesReadonlyPublic(path: string, method: string): boolean {
 }
 
 function isClassifiedAsPublic(path: string, method: string): boolean {
-  const isV1ApiPrefix = (p: string) =>
-    p === "/api/v1" || p === "/api/v1/" || p.startsWith("/api/v1/");
-  const filtered = PUBLIC_API_ROUTE_PREFIXES.filter((p) => p !== "/api/v1/");
-  if (filtered.some((prefix) => path.startsWith(prefix)) && !isV1ApiPrefix(path)) {
-    return true;
-  }
-  return matchesReadonlyPublic(path, method);
+  return isPublicApiRoute(path, method);
 }
diff --git a/src/shared/components/AutoRoutingBanner.test.tsx b/src/shared/components/AutoRoutingBanner.test.tsx
deleted file mode 100644
index e01cdd0b1d..0000000000
--- a/src/shared/components/AutoRoutingBanner.test.tsx
+++ /dev/null
@@ -1,116 +0,0 @@
-// @vitest-environment jsdom
-import React from "react";
-import { act } from "react";
-import { createRoot } from "react-dom/client";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-
-const cleanupCallbacks: Array<() => void> = [];
-
-function createTestStorage(): Storage {
-  const entries = new Map<string, string>();
-  return {
-    get length() {
-      return entries.size;
-    },
-    clear: () => entries.clear(),
-    getItem: (key) => entries.get(key) ?? null,
-    key: (index) => Array.from(entries.keys())[index] ?? null,
-    removeItem: (key) => {
-      entries.delete(key);
-    },
-    setItem: (key, value) => {
-      entries.set(key, value);
-    },
-  };
-}
-
-function makeContainer(): HTMLElement {
-  const container = document.createElement("div");
-  document.body.appendChild(container);
-  cleanupCallbacks.push(() => {
-    container.remove();
-  });
-  return container;
-}
-
-describe("AutoRoutingBanner", () => {
-  beforeEach(() => {
-    (
-      globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT?: boolean }
-    ).IS_REACT_ACT_ENVIRONMENT = true;
-    vi.stubGlobal("localStorage", createTestStorage());
-    localStorage.clear();
-  });
-
-  afterEach(() => {
-    while (cleanupCallbacks.length > 0) {
-      cleanupCallbacks.pop()?.();
-    }
-    document.body.innerHTML = "";
-    localStorage.clear();
-    vi.unstubAllGlobals();
-  });
-
-  it("renders banner on first mount", async () => {
-    const { default: AutoRoutingBanner } = await import("./AutoRoutingBanner");
-    const container = makeContainer();
-    const root = createRoot(container);
-    await act(async () => {
-      root.render(<AutoRoutingBanner />);
-    });
-    expect(container.querySelector('[role="banner"]')).toBeTruthy();
-    expect(container.textContent).toContain("Auto-Routing Active");
-  });
-
-  it("includes link to Combos page", async () => {
-    const { default: AutoRoutingBanner } = await import("./AutoRoutingBanner");
-    const container = makeContainer();
-    const root = createRoot(container);
-    await act(async () => {
-      root.render(<AutoRoutingBanner />);
-    });
-    const link = container.querySelector('a[href="/dashboard/combos"]');
-    expect(link).toBeTruthy();
-  });
-
-  it("can be dismissed by clicking close button", async () => {
-    const { default: AutoRoutingBanner } = await import("./AutoRoutingBanner");
-    const container = makeContainer();
-    const root = createRoot(container);
-    await act(async () => {
-      root.render(<AutoRoutingBanner />);
-    });
-    expect(container.querySelector('[role="banner"]')).toBeTruthy();
-    const closeButton = container.querySelector('button[aria-label="Dismiss auto-routing banner"]');
-    expect(closeButton).toBeTruthy();
-    await act(async () => {
-      closeButton?.click();
-    });
-    expect(container.querySelector('[role="banner"]')).toBeFalsy();
-  });
-
-  it("persists dismissal to localStorage", async () => {
-    const { default: AutoRoutingBanner } = await import("./AutoRoutingBanner");
-    const container = makeContainer();
-    const root = createRoot(container);
-    await act(async () => {
-      root.render(<AutoRoutingBanner />);
-    });
-    const closeButton = container.querySelector('button[aria-label="Dismiss auto-routing banner"]');
-    await act(async () => {
-      closeButton?.click();
-    });
-    expect(localStorage.getItem("auto-routing-banner-dismissed")).toBe("true");
-  });
-
-  it("remains hidden after dismissal on remount", async () => {
-    localStorage.setItem("auto-routing-banner-dismissed", "true");
-    const { default: AutoRoutingBanner } = await import("./AutoRoutingBanner");
-    const container = makeContainer();
-    const root = createRoot(container);
-    await act(async () => {
-      root.render(<AutoRoutingBanner />);
-    });
-    expect(container.querySelector('[role="banner"]')).toBeFalsy();
-  });
-});
diff --git a/src/shared/components/AutoRoutingBanner.tsx b/src/shared/components/AutoRoutingBanner.tsx
deleted file mode 100644
index 3c232cdc8d..0000000000
--- a/src/shared/components/AutoRoutingBanner.tsx
+++ /dev/null
@@ -1,80 +0,0 @@
-"use client";
-
-import Link from "next/link";
-import { useEffect, useState } from "react";
-
-const AUTO_ROUTING_DISMISSED_KEY = "auto-routing-banner-dismissed";
-
-export default function AutoRoutingBanner() {
-  const [isDismissed, setIsDismissed] = useState(false);
-
-  useEffect(() => {
-    try {
-      const dismissed = localStorage.getItem(AUTO_ROUTING_DISMISSED_KEY);
-      if (dismissed === "true") {
-        // eslint-disable-next-line react-hooks/set-state-in-effect
-        setIsDismissed(true);
-      }
-    } catch {
-      // localStorage unavailable (SSR or private mode) — do nothing
-    }
-  }, []);
-
-  const handleDismiss = () => {
-    try {
-      localStorage.setItem(AUTO_ROUTING_DISMISSED_KEY, "true");
-    } catch {
-      // ignore localStorage errors (private mode, quotas)
-    }
-
-    setIsDismissed(true);
-  };
-
-  if (isDismissed) return null;
-
-  return (
-    <div
-      role="banner"
-      aria-label="Auto-routing mode active"
-      className="relative overflow-hidden rounded-lg border-l-4 border-blue-500 bg-blue-50/50 p-4 my-4 dark:bg-blue-950/30 transition-colors"
-    >
-      <div className="flex items-start gap-3">
-        <div className="flex items-center gap-2">
-          <span className="inline-flex h-2 w-2 animate-pulse rounded-full bg-blue-500" />
-          <span className="font-semibold text-sm text-blue-700 dark:text-blue-300">
-            Auto-Routing Active
-          </span>
-        </div>
-        <div className="text-sm leading-relaxed text-text-muted">
-          OmniRoute is automatically routing requests using combo-based strategies.
-          <span className="block sm:inline sm:ml-1">
-            View or change your routing configuration on the{" "}
-            <Link
-              href="/dashboard/combos"
-              className="text-blue-600 hover:text-blue-800 underline dark:text-blue-400 dark:hover:text-blue-300"
-            >
-              Combos page
-            </Link>
-            .
-          </span>
-        </div>
-        <button
-          type="button"
-          onClick={handleDismiss}
-          aria-label="Dismiss auto-routing banner"
-          className="ml-auto flex-shrink-0 rounded-md p-1 text-text-muted hover:bg-blue-100 hover:text-blue-700 dark:hover:bg-blue-900/50 dark:hover:text-blue-300 transition-colors"
-        >
-          <svg
-            xmlns="http://www.w3.org/2000/svg"
-            viewBox="0 0 20 20"
-            fill="currentColor"
-            className="h-5 w-5"
-            aria-hidden="true"
-          >
-            <path d="M6.28 5.22a.75.75 0 00-1.06 1.06L8.94 10l-3.72 3.72a.75.75 0 101.06 1.06L10 11.06l3.72 3.72a.75.75 0 101.06-1.06L11.06 10l3.72-3.72a.75.75 0 00-1.06-1.06L10 8.94 6.28 5.22z" />
-          </svg>
-        </button>
-      </div>
-    </div>
-  );
-}
diff --git a/src/shared/components/CloudSyncStatus.tsx b/src/shared/components/CloudSyncStatus.tsx
index f01c7d9dab..aae7fa1b09 100644
--- a/src/shared/components/CloudSyncStatus.tsx
+++ b/src/shared/components/CloudSyncStatus.tsx
@@ -13,11 +13,15 @@
 import { useState, useEffect, useRef, useCallback } from "react";
 import { useRouter } from "next/navigation";
 
+// #6147 — user-facing labels renamed from "Cloud …" to "Remote Settings Sync"
+// wording (this feature syncs the operator's own settings to their own remote
+// store — it is not a cloud/telemetry service). Internal state keys, the
+// `cloud_*` material icons and the cloudSync.* wiring are intentionally kept.
 const STATUS_CONFIG = {
-  connected: { icon: "cloud_done", color: "text-green-500", label: "Cloud" },
+  connected: { icon: "cloud_done", color: "text-green-500", label: "Synced" },
   syncing: { icon: "cloud_sync", color: "text-blue-400 animate-pulse", label: "Syncing..." },
-  disconnected: { icon: "cloud_off", color: "text-amber-500", label: "Cloud Off" },
-  error: { icon: "cloud_off", color: "text-red-400", label: "Cloud Error" },
+  disconnected: { icon: "cloud_off", color: "text-amber-500", label: "Sync Off" },
+  error: { icon: "cloud_off", color: "text-red-400", label: "Sync Error" },
   disabled: { icon: "cloud_off", color: "text-text-muted/50", label: "Disabled" },
 };
 
@@ -80,10 +84,10 @@ export default function CloudSyncStatus({ collapsed = false }) {
       className="flex items-center gap-2 px-3 py-1.5 text-xs rounded-lg hover:bg-white/5 transition-colors cursor-pointer w-full"
       title={
         lastSync
-          ? `Cloud ${status === "connected" ? "connected" : "disconnected"} — Last sync: ${lastSync.toLocaleTimeString()}`
+          ? `Remote settings sync ${status === "connected" ? "connected" : "disconnected"} — Last sync: ${lastSync.toLocaleTimeString()}`
           : config.label
       }
-      aria-label={`Cloud sync status: ${config.label}`}
+      aria-label={`Remote settings sync status: ${config.label}`}
     >
       <span className={`material-symbols-outlined text-[16px] ${config.color}`} aria-hidden="true">
         {config.icon}
diff --git a/src/shared/components/NotificationToast.tsx b/src/shared/components/NotificationToast.tsx
index b7b6af861a..d6fec929a5 100644
--- a/src/shared/components/NotificationToast.tsx
+++ b/src/shared/components/NotificationToast.tsx
@@ -19,6 +19,28 @@ const ICONS = {
   info: "ℹ",
 };
 
+/**
+ * Coerce a toast title/message to a string. `message`/`title` are typed as
+ * `string`, but callers occasionally pass a raw API error body (an object) —
+ * rendering that object directly throws React #31 ("Objects are not valid as a
+ * React child") and freezes the whole page. This keeps the toast resilient no
+ * matter what a caller hands it.
+ */
+export function toToastText(value: unknown): string {
+  if (typeof value === "string") return value;
+  if (value == null) return "";
+  if (typeof value === "object") {
+    const message = (value as { message?: unknown }).message;
+    if (typeof message === "string") return message;
+    try {
+      return JSON.stringify(value);
+    } catch {
+      return String(value);
+    }
+  }
+  return String(value);
+}
+
 const BG_DARK = "rgba(30, 30, 30, 0.95)";
 
 const COLORS = {
@@ -101,7 +123,7 @@ function Toast({ notification, onDismiss }) {
               marginBottom: "2px",
             }}
           >
-            {notification.title}
+            {toToastText(notification.title)}
           </div>
         )}
         <div
@@ -111,7 +133,7 @@ function Toast({ notification, onDismiss }) {
             lineHeight: 1.4,
           }}
         >
-          {notification.message}
+          {toToastText(notification.message)}
         </div>
       </div>
       {notification.dismissible && (
diff --git a/src/shared/components/RequestLoggerDetail.tsx b/src/shared/components/RequestLoggerDetail.tsx
index d4d42b0f31..8bdd43481e 100644
--- a/src/shared/components/RequestLoggerDetail.tsx
+++ b/src/shared/components/RequestLoggerDetail.tsx
@@ -547,6 +547,19 @@ export default function RequestLoggerDetail({
                   {cacheSourceLabel}
                 </span>
               </div>
+              {(detail?.modelPinned || log.modelPinned) && (
+                <div>
+                  <div className="text-[10px] text-text-muted uppercase tracking-wider mb-1">
+                    Model Pinning
+                  </div>
+                  <span className="inline-flex items-center gap-1 px-2.5 py-1 rounded text-[10px] font-bold bg-violet-500/15 text-violet-600 dark:text-violet-400 border border-violet-500/25">
+                    <svg className="w-3 h-3" viewBox="0 0 16 16" fill="currentColor">
+                      <path d="M4.5 2A1.5 1.5 0 003 3.5v1.9l-1.4 2.8A.5.5 0 002 9h4v4.5a.5.5 0 00.5.5h3a.5.5 0 00.5-.5V9h4a.5.5 0 00.44-.73L13 5.4V3.5A1.5 1.5 0 0011.5 2h-7z" />
+                    </svg>
+                    Active — model selected via session pinning
+                  </span>
+                </div>
+              )}
               <div>
                 <div className="text-[10px] text-text-muted uppercase tracking-wider mb-1">
                   Account
diff --git a/src/shared/components/RequestLoggerV2.tsx b/src/shared/components/RequestLoggerV2.tsx
index 25eb736b60..3c7b266e96 100644
--- a/src/shared/components/RequestLoggerV2.tsx
+++ b/src/shared/components/RequestLoggerV2.tsx
@@ -140,6 +140,8 @@ const RequestLoggerV2 = forwardRef<RequestLoggerV2Handle, { initialSelectedId?:
     const [sortBy, setSortBy] = useState("newest");
     const [selectedLog, setSelectedLog] = useState(null);
     const [correlationIdFilter, setCorrelationIdFilter] = useState("");
+    const [hoveredCid, setHoveredCid] = useState<string | null>(null);
+    const [groupedView, setGroupedView] = useState(false);
     const [detailLoading, setDetailLoading] = useState(false);
 
     // Column sort toggle: clicking a column header toggles asc/desc
@@ -372,7 +374,15 @@ const RequestLoggerV2 = forwardRef<RequestLoggerV2Handle, { initialSelectedId?:
       // #4269: a filter change is a fresh first-page view — re-arm the ghost-load-more
       // guard so auto-refresh resumes until the user scrolls again.
       hasScrolledRef.current = false;
-    }, [search, activeFilter, selectedModel, selectedAccount, selectedProvider, selectedApiKey]);
+    }, [
+      search,
+      activeFilter,
+      selectedModel,
+      selectedAccount,
+      selectedProvider,
+      selectedApiKey,
+      correlationIdFilter,
+    ]);
 
     const loadMore = useCallback(() => {
       setLimit((prev) => prev + PAGE_SIZE);
@@ -432,8 +442,31 @@ const RequestLoggerV2 = forwardRef<RequestLoggerV2Handle, { initialSelectedId?:
       return arr;
     }, [logs, activeFilter]);
 
+    // Grouped view: deduplicate by correlationId, keeping only the latest per group.
+    // Rows without a correlationId are always shown.
+    const dedupedLogs = useMemo(() => {
+      if (!groupedView) return filteredLogs;
+      const byCid = new Map<string, (typeof filteredLogs)[0]>();
+      const noCid: typeof filteredLogs = [];
+      for (const log of filteredLogs) {
+        const cid = log.correlationId;
+        if (!cid) {
+          noCid.push(log);
+          continue;
+        }
+        const existing = byCid.get(cid);
+        if (
+          !existing ||
+          new Date(log.timestamp).getTime() > new Date(existing.timestamp).getTime()
+        ) {
+          byCid.set(cid, log);
+        }
+      }
+      return [...noCid, ...byCid.values()];
+    }, [filteredLogs, groupedView]);
+
     const sortedLogs = useMemo(() => {
-      const arr = [...filteredLogs];
+      const arr = [...dedupedLogs];
 
       arr.sort((a, b) => {
         switch (sortBy) {
@@ -466,7 +499,7 @@ const RequestLoggerV2 = forwardRef<RequestLoggerV2Handle, { initialSelectedId?:
       });
 
       return arr;
-    }, [filteredLogs, sortBy]);
+    }, [dedupedLogs, sortBy]);
 
     // Group by correlationId: mark retries as children so they render indented
     // under the first request in each group. Compute group health:
@@ -867,6 +900,22 @@ const RequestLoggerV2 = forwardRef<RequestLoggerV2Handle, { initialSelectedId?:
             />
           </div>
 
+          {/* Group by CID toggle */}
+          <button
+            onClick={() => setGroupedView((v) => !v)}
+            className={`flex items-center gap-1.5 px-3 py-2 rounded-lg text-sm font-medium border transition-colors ${
+              groupedView
+                ? "bg-violet-500/15 border-violet-500/30 text-violet-700 dark:text-violet-300"
+                : "bg-bg-subtle border-border text-text-muted hover:text-text-primary"
+            }`}
+            title={groupedView ? "Show all rows" : "Show latest per correlation ID"}
+          >
+            <span className="material-symbols-outlined text-[16px]">
+              {groupedView ? "unfold_less" : "unfold_more"}
+            </span>
+            {groupedView ? "Grouped" : "All"}
+          </button>
+
           {/* Provider Dropdown */}
           <select
             value={selectedProvider}
@@ -1217,9 +1266,28 @@ const RequestLoggerV2 = forwardRef<RequestLoggerV2Handle, { initialSelectedId?:
                       <tr
                         key={log.id}
                         onClick={() => openDetail(log)}
-                        className={`cursor-pointer hover:bg-sky-500/10 dark:hover:bg-sky-400/10 transition-colors ${isError ? "bg-red-500/5" : ""} ${log.isRetry ? "border-l-2 border-l-amber-500/50" : ""}`}
+                        data-cid={log.correlationId || undefined}
+                        onMouseEnter={() => log.correlationId && setHoveredCid(log.correlationId)}
+                        onMouseLeave={() => setHoveredCid(null)}
+                        className={
+                          `cursor-pointer transition-colors ` +
+                          `${
+                            isError
+                              ? "bg-red-500/5 hover:bg-red-500/15 dark:hover:bg-red-400/15"
+                              : "hover:bg-sky-500/10 dark:hover:bg-sky-400/10"
+                          } ` +
+                          `${log.isRetry ? "border-l-2 border-l-amber-500/50" : ""} ` +
+                          `${hoveredCid && log.correlationId === hoveredCid ? "bg-violet-500/10 dark:bg-violet-400/10 ring-1 ring-violet-500/20" : ""}`
+                        }
                         style={
-                          log.isRetry ? { backgroundColor: "rgba(245,158,11,0.03)" } : undefined
+                          log.isRetry
+                            ? {
+                                backgroundColor:
+                                  hoveredCid && log.correlationId === hoveredCid
+                                    ? undefined
+                                    : "rgba(245,158,11,0.03)",
+                              }
+                            : undefined
                         }
                       >
                         {visibleColumns.status && (
@@ -1307,6 +1375,14 @@ const RequestLoggerV2 = forwardRef<RequestLoggerV2Handle, { initialSelectedId?:
                                   failed
                                 </span>
                               )}
+                              {log.modelPinned && (
+                                <span
+                                  className="inline-flex items-center gap-0.5 px-1 py-0 rounded text-[8px] font-bold bg-violet-500/15 text-violet-600 dark:text-violet-400 border border-violet-500/25"
+                                  title="Model selected via context-cache session pinning"
+                                >
+                                  pinned
+                                </span>
+                              )}
                             </div>
                             {log.correlationId && !log.isRetry && log.groupSize > 1 && (
                               <div
diff --git a/src/shared/constants/agentSkills.ts b/src/shared/constants/agentSkills.ts
index a9cee5c0c7..90fbce6fbe 100644
--- a/src/shared/constants/agentSkills.ts
+++ b/src/shared/constants/agentSkills.ts
@@ -441,4 +441,17 @@ export const CURATED_SKILLS: CuratedSkillEntry[] = [
     icon: "terminal",
     isNew: true,
   },
+
+  // ── GitHub Skills ─────────────────────────────────────────────────────────
+
+  {
+    id: "omni-github-skills",
+    name: "GitHub Skill Discovery",
+    description:
+      "Search, score, scan, and import agent skills from GitHub repositories that contain SKILL.md, CLAUDE.md, .cursorrules, and similar agent skill files. Discover community skills across 160+ provider categories, evaluate relevance with heuristic scoring, check for malware or hardcoded secrets, and install into Hermes, Claude Code, Gemini CLI, or OpenCode agent directories.",
+    category: "api",
+    area: "github-skills",
+    icon: "explore",
+    isNew: true,
+  },
 ];
diff --git a/src/shared/constants/modelSpecs.ts b/src/shared/constants/modelSpecs.ts
index 8be768089c..b724487326 100644
--- a/src/shared/constants/modelSpecs.ts
+++ b/src/shared/constants/modelSpecs.ts
@@ -292,7 +292,7 @@ export const MODEL_SPECS: Record<string, ModelSpec> = {
     supportsTools: true,
     supportsVision: true,
     adaptiveThinkingOnly: true,
-    aliases: BEDROCK_CLAUDE_ALIASES("claude-opus-4-8", "claude-opus-4.8"),
+    aliases: BEDROCK_CLAUDE_ALIASES("claude-opus-4-8", "claude-opus-4.8", "claude-opus-4.8-fast"),
   },
 
   // ── Claude Sonnet 4.5 ───────────────────────────────────────────
diff --git a/src/shared/constants/pricing/oauth-subscriptions.ts b/src/shared/constants/pricing/oauth-subscriptions.ts
index b5aa770351..04792b5ea1 100644
--- a/src/shared/constants/pricing/oauth-subscriptions.ts
+++ b/src/shared/constants/pricing/oauth-subscriptions.ts
@@ -584,7 +584,10 @@ export const DEFAULT_PRICING_OAUTH = {
       reasoning: 8.0,
       cache_creation: 2.0,
     },
-    // Kiro "Auto" model — routes to best available
+    // Kiro "Auto" pricing — retained as a fallback price for any legacy "auto"
+    // reference. The "auto-kiro" registry model was removed (Kiro's API has no
+    // "auto" model id — it 400'd "Invalid model"), so its dedicated price key
+    // was dropped with it. See kiro cluster #6112/#6113/#6099.
     auto: {
       input: 3.0,
       output: 15.0,
@@ -592,13 +595,5 @@ export const DEFAULT_PRICING_OAUTH = {
       reasoning: 15.0,
       cache_creation: 3.0,
     },
-    // Registry exposes the Auto model as id "auto-kiro" — keep both keys priced.
-    "auto-kiro": {
-      input: 3.0,
-      output: 15.0,
-      cached: 1.5,
-      reasoning: 15.0,
-      cache_creation: 3.0,
-    },
   },
 };
diff --git a/src/shared/constants/providers.ts b/src/shared/constants/providers.ts
index 36f3a535e4..513d66a725 100644
--- a/src/shared/constants/providers.ts
+++ b/src/shared/constants/providers.ts
@@ -196,7 +196,6 @@ const BULK_API_KEY_EXCLUDED = new Set([
   "google-pse-search",
   "command-code",
   "azure",
-  "cloudflare-ai",
 ]);
 
 export function supportsBulkApiKey(providerId: unknown): boolean {
diff --git a/src/shared/constants/providers/apikey/gateways.ts b/src/shared/constants/providers/apikey/gateways.ts
index 460a24a587..3d6de0cb9b 100644
--- a/src/shared/constants/providers/apikey/gateways.ts
+++ b/src/shared/constants/providers/apikey/gateways.ts
@@ -68,6 +68,21 @@ export const APIKEY_PROVIDERS_GATEWAYS = {
     hasFree: true,
     freeNote: "Free models at $0/token with :free suffix - 20 RPM / 200 RPD",
   },
+  requesty: {
+    id: "requesty",
+    alias: "requesty",
+    name: "Requesty",
+    icon: "router",
+    color: "#6366F1",
+    textIcon: "RQ",
+    passthroughModels: true,
+    website: "https://requesty.ai",
+    hasFree: true,
+    freeNote: "Free tier ~200 requests/day - multi-model routing gateway (300+ models)",
+    apiHint:
+      "Create an API key at https://app.requesty.ai, then paste it here as a Bearer token. " +
+      "OpenAI-compatible endpoint at https://router.requesty.ai/v1, with a live /v1/models catalog.",
+  },
   dgrid: {
     id: "dgrid",
     alias: "dgrid",
diff --git a/src/shared/constants/providers/web-cookie.ts b/src/shared/constants/providers/web-cookie.ts
index d6b56c43a1..6b00ba0dd1 100644
--- a/src/shared/constants/providers/web-cookie.ts
+++ b/src/shared/constants/providers/web-cookie.ts
@@ -185,6 +185,21 @@ export const WEB_COOKIE_PROVIDERS = {
       "Paste the full Cookie header from lmarena.ai (DevTools → Network → request → Cookie). The session is now split across arena-auth-prod-v1.0, .1, … — copy the whole header. Optional — works with free tier for basic comparisons.",
     riskNoticeVariant: "webCookie",
   },
+  "yuanbao-web": {
+    id: "yuanbao-web",
+    alias: "ybw",
+    name: "Tencent Yuanbao (Free)",
+    icon: "auto_awesome",
+    color: "#0052D9",
+    textIcon: "YB",
+    website: "https://yuanbao.tencent.com",
+    hasFree: true,
+    freeNote:
+      "Free consumer web session — DeepSeek V3/R1 and Hunyuan / Hunyuan-T1, optional web search. No subscription required. Rate limits apply.",
+    authHint:
+      "Log in to yuanbao.tencent.com, then paste the full Cookie header (DevTools → Network → any /api request → Request Headers → Cookie). It must contain hy_user and hy_token.",
+    riskNoticeVariant: "webCookie",
+  },
   huggingchat: {
     id: "huggingchat",
     // "hc" belongs to the hackclub provider; huggingchat uses its own id as alias.
@@ -243,19 +258,21 @@ export const WEB_COOKIE_PROVIDERS = {
     color: "#2563EB",
     textIcon: "KW",
     website: "https://www.kimi.com",
-    authHint: "Paste your Cookie header from www.kimi.com (must contain kimi-auth=...). Find it via DevTools → Network → request → Cookie.",
+    authHint:
+      "Paste your Cookie header from www.kimi.com (must contain kimi-auth=...). Find it via DevTools → Network → request → Cookie.",
     subscriptionRisk: true,
     riskNoticeVariant: "webCookie",
   },
   "doubao-web": {
     id: "doubao-web",
     alias: "db",
-    name: "Doubao Web (ByteDance)",
+    name: "Dola Web (ByteDance)",
     icon: "auto_awesome",
     color: "#3B82F6",
-    textIcon: "DW",
-    website: "https://www.doubao.com",
-    authHint: "Paste your session cookie from doubao.com (DevTools → Application → Cookies)",
+    textIcon: "DA",
+    website: "https://www.dola.com",
+    authHint:
+      "Paste the full Cookie header from www.dola.com. It should include sessionid, ttwid, and s_v_web_id. If s_v_web_id is unavailable, fp=verify_... from a chat/completion request URL can be used as a fallback.",
     subscriptionRisk: true,
     riskNoticeVariant: "webCookie",
   },
@@ -298,7 +315,7 @@ export const WEB_COOKIE_PROVIDERS = {
     website: "https://zenmux.ai",
     hasFree: true,
     freeNote:
-      "Free tier (5 Flows/5h, 38.64 Flows/week) — DeepSeek V3.2, GLM 4.7 Flash Free, MiMo V2 Flash Free and more. No subscription required.",
+      "Free tier (5 Flows/5h, 38.64 Flows/week) — DeepSeek V3.2, GLM 4.7 Flash Free and more. No subscription required.",
     authHint:
       "Login at zenmux.ai, then export all cookies using EditThisCookie or Cookie-Editor and paste the full Cookie header string here. Refresh every ~30 days.",
   },
diff --git a/src/shared/constants/publicApiRoutes.ts b/src/shared/constants/publicApiRoutes.ts
index 26df9df12b..70853e142a 100644
--- a/src/shared/constants/publicApiRoutes.ts
+++ b/src/shared/constants/publicApiRoutes.ts
@@ -4,7 +4,6 @@ const PUBLIC_API_ROUTE_PREFIXES = [
   "/api/auth/status",
   "/api/init",
   "/api/v1/",
-  "/api/cloud/",
   "/api/sync/bundle",
   "/api/oauth/",
   // Public, ticket-gated Codex device-flow completion (validate + persist).
@@ -27,7 +26,28 @@ const PUBLIC_READONLY_API_ROUTE_PREFIXES = [
 
 const PUBLIC_READONLY_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
 
+const PUBLIC_CLOUD_API_ROUTES = [
+  { path: "/api/cloud/auth", methods: new Set(["POST", "OPTIONS"]) },
+  { path: "/api/cloud/model/resolve", methods: new Set(["POST", "OPTIONS"]) },
+  { path: "/api/cloud/models/alias", methods: new Set(["GET", "HEAD", "OPTIONS"]) },
+];
+
+function pathMatchesExactRoute(pathname: string, routePath: string): boolean {
+  return pathname === routePath || pathname === `${routePath}/`;
+}
+
+function isPublicCloudApiRoute(pathname: string, method: string): boolean {
+  const normalizedMethod = String(method).toUpperCase();
+  return PUBLIC_CLOUD_API_ROUTES.some(
+    ({ path, methods }) => pathMatchesExactRoute(pathname, path) && methods.has(normalizedMethod)
+  );
+}
+
 export function isPublicApiRoute(pathname: string, method = "GET"): boolean {
+  if (isPublicCloudApiRoute(pathname, method)) {
+    return true;
+  }
+
   if (PUBLIC_API_ROUTE_PREFIXES.some((route) => pathname.startsWith(route))) {
     return true;
   }
diff --git a/src/shared/providers/webSessionCredentials.ts b/src/shared/providers/webSessionCredentials.ts
index 04a8ce6928..77d3d3ca5e 100644
--- a/src/shared/providers/webSessionCredentials.ts
+++ b/src/shared/providers/webSessionCredentials.ts
@@ -141,6 +141,13 @@ export const WEB_SESSION_CREDENTIAL_REQUIREMENTS = {
     acceptsFullCookieHeader: true,
     storageKeys: ["cookie", "hf-chat"],
   },
+  "yuanbao-web": {
+    kind: "cookie",
+    credentialName: "full Cookie header (hy_user + hy_token)",
+    placeholder: "hy_user=...; hy_token=... (full Cookie header from yuanbao.tencent.com)",
+    acceptsFullCookieHeader: true,
+    storageKeys: ["cookie", "hy_user", "hy_token"],
+  },
   "poe-web": {
     kind: "cookie",
     credentialName: "p-b",
@@ -171,10 +178,11 @@ export const WEB_SESSION_CREDENTIAL_REQUIREMENTS = {
   },
   "doubao-web": {
     kind: "cookie",
-    credentialName: "session",
-    placeholder: "session=... or full Cookie header from doubao.com",
+    credentialName: "full Cookie header (sessionid + ttwid + s_v_web_id)",
+    placeholder:
+      "sessionid=...; ttwid=...; s_v_web_id=... (or fp=verify_... fallback from www.dola.com)",
     acceptsFullCookieHeader: true,
-    storageKeys: ["cookie", "session"],
+    storageKeys: ["cookie", "sessionid", "ttwid", "s_v_web_id", "fp"],
   },
   "qwen-web": {
     kind: "cookie",
diff --git a/src/shared/utils/bulkApiKeyParser.ts b/src/shared/utils/bulkApiKeyParser.ts
index a0d3f93d15..a7ca1d0ce9 100644
--- a/src/shared/utils/bulkApiKeyParser.ts
+++ b/src/shared/utils/bulkApiKeyParser.ts
@@ -8,12 +8,21 @@
  *   - blank lines (skipped)
  *
  * `apiKey` may contain `|` — only the first `|` is treated as the separator.
+ *
+ * When `withAccountId` is enabled (Cloudflare Workers AI), each line carries a
+ * per-key account id in a 3-field shape:
+ *   - `name|accountId|apiKey`
+ * Only the first two `|` are treated as separators, so an `apiKey` containing
+ * `|` stays intact. Lines missing the `accountId` or `apiKey` field are flagged
+ * as warnings and skipped.
  */
 
 export interface BulkApiKeyEntry {
   name: string;
   apiKey: string;
   lineNumber: number;
+  /** Per-key account id — only populated for providers parsed with `withAccountId` (Cloudflare). */
+  accountId?: string;
 }
 
 export interface BulkApiKeyParseResult {
@@ -21,9 +30,17 @@ export interface BulkApiKeyParseResult {
   warnings: string[];
 }
 
+export interface ParseBulkApiKeysOptions {
+  /** Parse each line as the 3-field `name|accountId|apiKey` shape (Cloudflare Workers AI). */
+  withAccountId?: boolean;
+}
+
 const MAX_BULK_LINES = 200;
 
-export function parseBulkApiKeys(text: string): BulkApiKeyParseResult {
+export function parseBulkApiKeys(
+  text: string,
+  options: ParseBulkApiKeysOptions = {}
+): BulkApiKeyParseResult {
   const lines = text.split(/\r?\n/);
   const entries: BulkApiKeyEntry[] = [];
   const warnings: string[] = [];
@@ -41,6 +58,35 @@ export function parseBulkApiKeys(text: string): BulkApiKeyParseResult {
     if (!raw) continue;
     if (raw.startsWith("#")) continue;
 
+    if (options.withAccountId) {
+      const firstPipe = raw.indexOf("|");
+      if (firstPipe === -1) {
+        warnings.push(`Line ${i + 1}: expected name|accountId|apiKey, skipped`);
+        continue;
+      }
+      const secondPipe = raw.indexOf("|", firstPipe + 1);
+      if (secondPipe === -1) {
+        warnings.push(`Line ${i + 1}: missing accountId or apiKey, skipped`);
+        continue;
+      }
+      const namePart = raw.slice(0, firstPipe).trim();
+      const accountId = raw.slice(firstPipe + 1, secondPipe).trim();
+      const apiKey = raw.slice(secondPipe + 1).trim();
+      const name = namePart || `Key ${autoIdx++}`;
+
+      if (!accountId) {
+        warnings.push(`Line ${i + 1}: empty accountId, skipped`);
+        continue;
+      }
+      if (!apiKey) {
+        warnings.push(`Line ${i + 1}: empty apiKey, skipped`);
+        continue;
+      }
+
+      entries.push({ name, accountId, apiKey, lineNumber: i + 1 });
+      continue;
+    }
+
     const pipeIdx = raw.indexOf("|");
     let name: string;
     let apiKey: string;
diff --git a/src/shared/validation/schemas/combo.ts b/src/shared/validation/schemas/combo.ts
index 792d53f60e..568fd7bfcf 100644
--- a/src/shared/validation/schemas/combo.ts
+++ b/src/shared/validation/schemas/combo.ts
@@ -159,6 +159,12 @@ export const comboRuntimeConfigSchema = z
     // falls back to the global `settings.stickyRoundRobinLimit` so the existing
     // knob still controls the default. 0 clamps to 1 (no batching) upstream.
     stickyRoundRobinLimit: z.coerce.number().int().min(0).max(1000).optional(),
+    // #6168: opt-out for per-conversation session stickiness. When true, round-robin
+    // and random/weighted/priority combos rotate freely instead of pinning a whole
+    // conversation to one connection by the first-message hash. Per-combo `config`
+    // wins over the global `settings.disableSessionStickiness` fallback. Default false
+    // preserves the #3825 prompt-cache/504 fix.
+    disableSessionStickiness: z.boolean().optional(),
     stickyWeightedLimit: z.coerce.number().int().min(0).max(1000).optional(),
     healthCheckEnabled: z.boolean().optional(),
     healthCheckTimeoutMs: z.coerce.number().int().min(100).max(30000).optional(),
diff --git a/src/shared/validation/schemas/provider.ts b/src/shared/validation/schemas/provider.ts
index f57bb8124b..07b7d2ea1b 100644
--- a/src/shared/validation/schemas/provider.ts
+++ b/src/shared/validation/schemas/provider.ts
@@ -92,6 +92,8 @@ export const bulkCreateProviderSchema = z
         z.object({
           name: z.string().min(1).max(200),
           apiKey: z.string().min(1).max(10000),
+          // Per-key account id — required for cloudflare-ai (enforced in superRefine below).
+          accountId: z.string().min(1).max(200).optional(),
         })
       )
       .min(1, "entries must contain at least 1 item")
@@ -120,6 +122,19 @@ export const bulkCreateProviderSchema = z
         });
       }
     }
+    if (data.provider === "cloudflare-ai") {
+      // Cloudflare Workers AI builds its per-connection URL from accountId, so every
+      // bulk entry must carry its own non-empty account id (name|accountId|apiKey).
+      data.entries.forEach((entry, index) => {
+        if (typeof entry.accountId !== "string" || entry.accountId.trim().length === 0) {
+          ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "accountId is required for cloudflare-ai entries",
+            path: ["entries", index, "accountId"],
+          });
+        }
+      });
+    }
   });
 
 // ──── Bulk Web-Session Import Schema ────
diff --git a/src/shared/validation/settingsSchemas.ts b/src/shared/validation/settingsSchemas.ts
index de513b621e..cb0b63d084 100644
--- a/src/shared/validation/settingsSchemas.ts
+++ b/src/shared/validation/settingsSchemas.ts
@@ -183,6 +183,8 @@ export const updateSettingsSchema = z.object({
   fallbackStrategy: z.enum(ACCOUNT_FALLBACK_STRATEGY_VALUES).optional(),
   wildcardAliases: z.array(z.object({ pattern: z.string(), target: z.string() })).optional(),
   stickyRoundRobinLimit: z.number().int().min(0).max(1000).optional(),
+  // #6168: global session-stickiness opt-out (per-combo config overrides this).
+  disableSessionStickiness: z.boolean().optional(),
   requestRetry: z.number().int().min(0).max(10).optional(),
   maxRetryIntervalSec: z.number().int().min(0).max(300).optional(),
   maxBodySizeMb: z
diff --git a/src/sse/handlers/chat.ts b/src/sse/handlers/chat.ts
index 1305fd4271..af00b793eb 100644
--- a/src/sse/handlers/chat.ts
+++ b/src/sse/handlers/chat.ts
@@ -214,10 +214,11 @@ const comboPromoteDeps = { updateCombo, info: log.info, warn: log.warn };
 export async function handleChat(
   request: any,
   clientRawRequest: any = null,
-  preParsedBody: any = null
+  preParsedBody: any = null,
+  correlationId?: string
 ) {
   // Pipeline: Start request telemetry
-  const reqId = generateRequestId();
+  const reqId = correlationId || generateRequestId();
   const telemetry = new RequestTelemetry(reqId);
 
   let body;
@@ -718,6 +719,7 @@ export async function handleChat(
             cachedSettings: settings,
             providerId: target?.providerId ?? null,
             correlationId: reqId,
+            modelPinned: (target as any)?.modelPinned ?? false,
           },
           target?.effectiveComboStrategy ?? combo.strategy,
           true
@@ -1288,6 +1290,7 @@ async function handleSingleModelChat(
         cachedSettings: runtimeOptions.cachedSettings,
         skipUpstreamRetry: runtimeOptions.skipUpstreamRetry ?? false,
         correlationId: runtimeOptions?.correlationId ?? null,
+        modelPinned: runtimeOptions?.modelPinned ?? false,
       });
       if (telemetry) telemetry.endPhase();
 
diff --git a/src/sse/handlers/chatHelpers.ts b/src/sse/handlers/chatHelpers.ts
index 992e4d3a76..87eb47a389 100644
--- a/src/sse/handlers/chatHelpers.ts
+++ b/src/sse/handlers/chatHelpers.ts
@@ -28,6 +28,7 @@ import {
   type AppliedProxySink,
 } from "@omniroute/open-sse/utils/proxyFetch.ts";
 import { resolveProxyForConnection } from "@/lib/localDb";
+import { hasBlockingProxyAssignment } from "@/lib/db/proxies";
 import {
   CircuitBreakerOpenError,
   getCircuitBreaker,
@@ -383,6 +384,7 @@ export async function executeChatWithBreaker({
   skipUpstreamRetry = false,
   trafficType = "production",
   correlationId = null,
+  modelPinned = false,
 }: ExecuteChatWithBreakerOptions): Promise<{ result: any; tlsFingerprintUsed: boolean }> {
   let tlsFingerprintUsed = false;
   const normalizedTrafficType: TrafficType =
@@ -400,81 +402,82 @@ export async function executeChatWithBreaker({
   try {
     const chatFn = () =>
       capture(() =>
-      runWithProxyContext(proxyInfo?.proxy || null, () =>
-        (handleChatCore as any)({
-          body: { ...body, model: `${provider}/${model}` },
-          modelInfo: { provider, model, extendedContext, apiFormat: modelApiFormat },
-          credentials: refreshedCredentials,
-          log: handlerLog,
-          clientRawRequest,
-          connectionId: credentials.connectionId,
-          apiKeyInfo,
-          userAgent,
-          comboName,
-          comboStrategy,
-          isCombo,
-          comboStepId,
-          comboExecutionKey,
-          cachedSettings,
-          skipUpstreamRetry,
-          trafficType: normalizedTrafficType,
-          correlationId,
-          onCredentialsRefreshed: async (newCreds: any) => {
-            await updateProviderCredentials(credentials.connectionId, {
-              accessToken: newCreds.accessToken,
-              refreshToken: newCreds.refreshToken,
-              expiresIn: newCreds.expiresIn,
-              expiresAt: newCreds.expiresAt,
-              providerSpecificData: newCreds.providerSpecificData,
-              // Cookie/session providers (chatgpt-web) rotate the stored
-              // apiKey blob mid-request — forward it so the DB credential
-              // doesn't go stale after Set-Cookie rotation.
-              apiKey: newCreds.apiKey,
-              testStatus: newCreds.testStatus ?? "active",
-              isActive: newCreds.isActive,
-            });
-          },
-          onRequestSuccess: async () => {
-            if (isShadowTraffic) return;
-            await clearAccountError(credentials.connectionId, credentials);
-          },
-          onStreamFailure: async (failure: any) => {
-            if (isShadowTraffic) return;
-            if (!credentials.connectionId) return;
-            if (
-              Number(failure?.status) === 499 ||
-              failure?.code === "client_disconnected" ||
-              failure?.type === "client_disconnected"
-            ) {
-              return;
-            }
-            // A3 guard: if 401 and connection has extra keys, skip connection-level disable
-            // (key-level failure already recorded in chatCore.ts via T07)
-            // Check extra keys directly from credentials for reliability across restarts
-            const extraKeys =
-              (credentials.providerSpecificData?.extraApiKeys as string[] | undefined) ?? [];
-            const hasExtraKeys =
-              extraKeys.length > 0 || connectionHasExtraKeys(credentials.connectionId);
-            const is401 = Number(failure?.status) === 401;
-            if (is401 && hasExtraKeys) {
-              log.debug(
-                "AUTH",
-                `A3 guard: skipping markAccountUnavailable for 401 with extra keys on ${credentials.connectionId.slice(0, 8)}`
+        runWithProxyContext(proxyInfo?.proxy || null, () =>
+          (handleChatCore as any)({
+            body: { ...body, model: `${provider}/${model}` },
+            modelInfo: { provider, model, extendedContext, apiFormat: modelApiFormat },
+            credentials: refreshedCredentials,
+            log: handlerLog,
+            clientRawRequest,
+            connectionId: credentials.connectionId,
+            apiKeyInfo,
+            userAgent,
+            comboName,
+            comboStrategy,
+            isCombo,
+            comboStepId,
+            comboExecutionKey,
+            cachedSettings,
+            skipUpstreamRetry,
+            trafficType: normalizedTrafficType,
+            correlationId,
+            modelPinned,
+            onCredentialsRefreshed: async (newCreds: any) => {
+              await updateProviderCredentials(credentials.connectionId, {
+                accessToken: newCreds.accessToken,
+                refreshToken: newCreds.refreshToken,
+                expiresIn: newCreds.expiresIn,
+                expiresAt: newCreds.expiresAt,
+                providerSpecificData: newCreds.providerSpecificData,
+                // Cookie/session providers (chatgpt-web) rotate the stored
+                // apiKey blob mid-request — forward it so the DB credential
+                // doesn't go stale after Set-Cookie rotation.
+                apiKey: newCreds.apiKey,
+                testStatus: newCreds.testStatus ?? "active",
+                isActive: newCreds.isActive,
+              });
+            },
+            onRequestSuccess: async () => {
+              if (isShadowTraffic) return;
+              await clearAccountError(credentials.connectionId, credentials);
+            },
+            onStreamFailure: async (failure: any) => {
+              if (isShadowTraffic) return;
+              if (!credentials.connectionId) return;
+              if (
+                Number(failure?.status) === 499 ||
+                failure?.code === "client_disconnected" ||
+                failure?.type === "client_disconnected"
+              ) {
+                return;
+              }
+              // A3 guard: if 401 and connection has extra keys, skip connection-level disable
+              // (key-level failure already recorded in chatCore.ts via T07)
+              // Check extra keys directly from credentials for reliability across restarts
+              const extraKeys =
+                (credentials.providerSpecificData?.extraApiKeys as string[] | undefined) ?? [];
+              const hasExtraKeys =
+                extraKeys.length > 0 || connectionHasExtraKeys(credentials.connectionId);
+              const is401 = Number(failure?.status) === 401;
+              if (is401 && hasExtraKeys) {
+                log.debug(
+                  "AUTH",
+                  `A3 guard: skipping markAccountUnavailable for 401 with extra keys on ${credentials.connectionId.slice(0, 8)}`
+                );
+                return;
+              }
+              await markAccountUnavailable(
+                credentials.connectionId,
+                Number(failure?.status || HTTP_STATUS.BAD_GATEWAY),
+                String(failure?.message || failure?.code || "stream failure"),
+                provider,
+                model,
+                providerProfile,
+                { isCombo }
               );
-              return;
-            }
-            await markAccountUnavailable(
-              credentials.connectionId,
-              Number(failure?.status || HTTP_STATUS.BAD_GATEWAY),
-              String(failure?.message || failure?.code || "stream failure"),
-              provider,
-              model,
-              providerProfile,
-              { isCombo }
-            );
-          },
-        })
-      )
+            },
+          })
+        )
       );
 
     if (isShadowTraffic) {
@@ -684,7 +687,22 @@ export function decideProxyResolutionFailure(
 
 export async function safeResolveProxy(connectionId: string, apiKeyId?: string) {
   try {
-    return await resolveProxyForConnection(connectionId, apiKeyId);
+    const resolved = await resolveProxyForConnection(connectionId, apiKeyId);
+    // #6246: a connection that resolves to DIRECT only because its assigned proxy
+    // is dead/inactive must fail closed — egressing on the real IP leaks it. Reuse
+    // the existing proxy-resolution-failure policy (blocks by default; PROXY_FAIL_OPEN
+    // opts back into direct). Explicit "proxy off" is not a leak (see the guard).
+    if (!(resolved as { proxy?: unknown } | null)?.proxy && hasBlockingProxyAssignment(connectionId)) {
+      return decideProxyResolutionFailure(
+        Object.assign(
+          new Error(
+            "PROXY_ASSIGNED_UNAVAILABLE: assigned proxy is inactive/unreachable; refusing to egress on a direct connection"
+          ),
+          { code: "PROXY_ASSIGNED_UNAVAILABLE" }
+        )
+      );
+    }
+    return resolved;
   } catch (proxyErr) {
     return decideProxyResolutionFailure(proxyErr);
   }
diff --git a/src/sse/services/auth.ts b/src/sse/services/auth.ts
index 6c07cf7b66..c556d0a0d6 100644
--- a/src/sse/services/auth.ts
+++ b/src/sse/services/auth.ts
@@ -1990,6 +1990,27 @@ export async function markAccountUnavailable(
             : status === 429
               ? "rate_limited"
               : "server_error";
+
+      // #5976: Gemini (and other per-model-quota providers) have model-level rate
+      // limits, not global. A 500 server error is intermittent and NOT model-specific
+      // — recording a model lockout here blocks the sibling model from being tried
+      // by both the combo retry loop (isModelLocked check) and the credential
+      // resolver. Skip model lockout for server errors; only lock for 404 (model
+      // genuinely missing) and 429 (rate limit / quota exhaustion).
+      if (status >= 500) {
+        updateProviderConnection(connectionId, {
+          lastErrorType: reason,
+          lastError: `Model ${model} ${reason}`,
+          lastErrorAt: new Date().toISOString(),
+          errorCode: status,
+        }).catch(() => {});
+        log.info(
+          "AUTH",
+          `Server error for ${provider}:${model} — ${status} ${reason} (no model lockout, connection stays active for sibling models)`
+        );
+        return { shouldFallback: true, cooldownMs: 0 };
+      }
+
       const quotaScope = getQuotaScopeLabelForProvider(provider, model);
       const antigravityFamilyInferredBaseCooldownMs =
         provider === "antigravity" && quotaScope === "family" && status === 429
diff --git a/tests/integration/agent-skills-discovery.test.ts b/tests/integration/agent-skills-discovery.test.ts
index 49071f8849..9e80ff4d18 100644
--- a/tests/integration/agent-skills-discovery.test.ts
+++ b/tests/integration/agent-skills-discovery.test.ts
@@ -4,8 +4,8 @@
  * Verifies:
  *  1. Every ID in API_SKILL_IDS + CLI_SKILL_IDS has a skills/<id>/SKILL.md on disk.
  *  2. Each SKILL.md has valid frontmatter (name + description) and body ≥ 100 chars.
- *  3. MCP tool omniroute_agent_skills_list handler returns 43 entries.
- *  4. A2A skill list-capabilities returns 1 artifact with 43 lines.
+ *  3. MCP tool omniroute_agent_skills_list handler returns 44 entries.
+ *  4. A2A skill list-capabilities returns 1 artifact with 44 lines.
  *
  * Does NOT spin up a server — tests handlers directly via imports.
  */
@@ -69,8 +69,8 @@ test("every CLI skill ID has skills/<id>/SKILL.md on disk", () => {
   assert.deepEqual(missing, [], `Missing CLI SKILL.md files: ${missing.join(", ")}`);
 });
 
-test("total skill count is exactly 42 (22 API + 20 CLI)", () => {
-  assert.equal(API_SKILL_IDS.length + CLI_SKILL_IDS.length, 42);
+test("total skill count is exactly 43 (23 API + 20 CLI)", () => {
+  assert.equal(API_SKILL_IDS.length + CLI_SKILL_IDS.length, 43);
 });
 
 // ── §2: Frontmatter validation ────────────────────────────────────────────────
@@ -120,11 +120,11 @@ test("each SKILL.md body is at least 100 chars", () => {
 
 // ── §3: MCP tool omniroute_agent_skills_list ─────────────────────────────────
 
-test("MCP omniroute_agent_skills_list handler returns count 43", async () => {
+test("MCP omniroute_agent_skills_list handler returns count 44 (43 + config)", async () => {
   const result = await agentSkillTools.omniroute_agent_skills_list.handler({});
-  assert.equal(result.count, 43, `Expected 43 but got ${result.count}`);
+  assert.equal(result.count, 44, `Expected 44 but got ${result.count}`);
   assert.ok(Array.isArray(result.skills));
-  assert.equal(result.skills.length, 43);
+  assert.equal(result.skills.length, 44);
 });
 
 test("MCP omniroute_agent_skills_list result has all 42 IDs", async () => {
@@ -148,17 +148,18 @@ test("A2A list-capabilities returns exactly 1 artifact", async () => {
 test("A2A list-capabilities artifact content contains 42 skill IDs as table rows", async () => {
   const result = await executeListCapabilities(stubTask);
   const content = result.artifacts[0].content;
-  const rows = content.split("\n").filter((line) => line.startsWith("| ") && !line.startsWith("| ID") && !line.startsWith("| ---"));
+  const rows = content
+    .split("\n")
+    .filter(
+      (line) => line.startsWith("| ") && !line.startsWith("| ID") && !line.startsWith("| ---")
+    );
   // Each skill row starts with "| <id> |"
-  assert.ok(
-    rows.length >= 42,
-    `Expected at least 42 data rows but got ${rows.length}`,
-  );
+  assert.ok(rows.length >= 42, `Expected at least 42 data rows but got ${rows.length}`);
 });
 
-test("A2A list-capabilities metadata.totalSkills === 43", async () => {
+test("A2A list-capabilities metadata.totalSkills === 44 (43 + config)", async () => {
   const result = await executeListCapabilities(stubTask);
-  assert.equal(result.metadata.totalSkills, 43);
+  assert.equal(result.metadata.totalSkills, 44);
 });
 
 test("A2A list-capabilities artifact contains all 42 skill IDs", async () => {
diff --git a/tests/integration/live-gemini-workload.test.ts b/tests/integration/live-gemini-workload.test.ts
index b4e2f2da96..ea7a1fec1b 100644
--- a/tests/integration/live-gemini-workload.test.ts
+++ b/tests/integration/live-gemini-workload.test.ts
@@ -159,7 +159,8 @@ test("[27] single-thread sequential — 1 thread × 5 iterations", { skip }, asy
       results.push(r);
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
-      console.log(`  ${label.padEnd(45)} FAILED: ${msg}`);
+      const ts = new Date().toISOString().slice(11, 23);
+      console.log(`${ts} ${label.padEnd(45)} FAILED: ${msg}`);
       assert.fail(`iteration ${i} failed: ${msg}`);
     }
   }
diff --git a/tests/integration/liveGeminiShared.ts b/tests/integration/liveGeminiShared.ts
index 516e5ddb43..133b3e9299 100644
--- a/tests/integration/liveGeminiShared.ts
+++ b/tests/integration/liveGeminiShared.ts
@@ -482,10 +482,14 @@ export async function readSSEStream(response: Response): Promise<StreamResult> {
   let fullContent = "";
   let finishReason = "unknown";
   let totalTokens = 0;
+  let rawChunkCount = 0;
+  let dataLineCount = 0;
+  const debugLines: string[] = [];
 
   while (true) {
     const { done, value } = await reader.read();
     if (done) break;
+    rawChunkCount++;
 
     buffer += decoder.decode(value, { stream: true });
     const lines = buffer.split("\n");
@@ -493,15 +497,21 @@ export async function readSSEStream(response: Response): Promise<StreamResult> {
 
     for (const line of lines) {
       if (!line.startsWith("data: ")) continue;
+      dataLineCount++;
       const data = line.slice(6).trim();
       if (data === "[DONE]") continue;
 
+      if (debugLines.length < 3) {
+        debugLines.push(data.slice(0, 200));
+      }
+
       try {
         const parsed = JSON.parse(data) as Record<string, unknown>;
         const choice = ((parsed?.choices ?? []) as Array<Record<string, unknown>>)[0];
         if (choice) {
           const delta = choice.delta as Record<string, unknown> | undefined;
           if (delta?.content) fullContent += delta.content as string;
+          else if (delta?.reasoning_content) fullContent += delta.reasoning_content as string;
           if (choice.finish_reason) finishReason = choice.finish_reason as string;
         }
         const usage = parsed.usage as Record<string, number> | undefined;
@@ -515,6 +525,17 @@ export async function readSSEStream(response: Response): Promise<StreamResult> {
     }
   }
 
+  if (fullContent.length === 0 && rawChunkCount > 0) {
+    console.log(
+      `    [DEBUG] empty content: ${rawChunkCount} raw chunks, ${dataLineCount} data lines`
+    );
+    for (const d of debugLines) console.log(`    [DEBUG] data: ${d}`);
+  } else if (fullContent.length > 0 && fullContent.length < 1000 && finishReason === "unknown") {
+    console.log(
+      `    [DEBUG] suspicious content (${fullContent.length} chars, finish=${finishReason}): ${fullContent.slice(0, 300)}`
+    );
+  }
+
   return { fullContent, finishReason, totalTokens };
 }
 
@@ -522,6 +543,10 @@ export async function readSSEStream(response: Response): Promise<StreamResult> {
 // Shared helper
 // --------------------------------------------------------------------------
 
+function ts(): string {
+  return new Date().toISOString().slice(11, 23); // HH:MM:SS.mmm
+}
+
 export async function sendAndValidate(
   tcName: string,
   buildMessages: () => Message[],
@@ -585,7 +610,7 @@ export async function sendAndValidate(
       const msPerToken = totalTokens > 0 ? (duration / totalTokens).toFixed(1) : "?";
 
       console.log(
-        `  ${tcName.padEnd(45)} ` +
+        `${ts()} ${tcName.padEnd(45)} ` +
           `HTTP ${response.status} | ` +
           `${Math.round(duration).toString().padStart(5)}ms | ` +
           `${String(messages.length).padStart(2)} msgs | ` +
@@ -597,17 +622,33 @@ export async function sendAndValidate(
       );
 
       if (response.status === 200) {
-        if (content.length > 0) {
-          assert.ok(
-            finishReason === "stop" || finishReason === "length",
-            `expected stop/length finish, got ${finishReason}`
+        const isGoodFinish = finishReason === "stop" || finishReason === "length";
+        const isRetryable =
+          content.length === 0 ||
+          finishReason === "malformed_response" ||
+          finishReason === "content_filter" ||
+          (finishReason === "unknown" && totalTokens === 0);
+
+        if (isGoodFinish) {
+          // success — continue to return
+        } else if (isRetryable && attempt < MAX_RETRIES) {
+          const backoff = Math.min(RETRY_DELAY_MS * 2 ** (attempt - 1), 30_000);
+          const reason = content.length === 0 ? "empty content" : `finish: ${finishReason}`;
+          console.log(
+            `${ts()} ${tcName.padEnd(45)} RETRY ${attempt}/${MAX_RETRIES} after ${reason} (waiting ${Math.round(backoff / 1000)}s) | cid: ${correlationId}`
+          );
+          await new Promise((r) => setTimeout(r, backoff));
+          continue;
+        } else if (isRetryable) {
+          assert.fail(
+            `${ts()} ${tcName.padEnd(45)} ${finishReason === "malformed_response" ? "malformed_response" : "empty content"} after ${MAX_RETRIES} attempts | cid: ${correlationId}`
           );
         } else {
-          assert.fail(`  ${tcName.padEnd(45)} WARNING: empty content returned`);
+          assert.fail(`expected stop/length finish, got ${finishReason} | cid: ${correlationId}`);
         }
       } else if ((response.status === 503 || response.status === 429) && attempt < MAX_RETRIES) {
         console.log(
-          `  ${tcName.padEnd(45)} RETRY ${attempt}/${MAX_RETRIES} after ${response.status} (waiting ${RETRY_DELAY_MS / 1000}s)`
+          `${ts()} ${tcName.padEnd(45)} RETRY ${attempt}/${MAX_RETRIES} after ${response.status} (waiting ${RETRY_DELAY_MS / 1000}s)`
         );
         await new Promise((r) => setTimeout(r, RETRY_DELAY_MS));
         continue;
@@ -628,12 +669,12 @@ export async function sendAndValidate(
       const errorMessage = err instanceof Error ? err.message : String(err);
       if ((errorMessage.includes("503") || errorMessage.includes("429")) && attempt < MAX_RETRIES) {
         console.log(
-          `  ${tcName.padEnd(45)} RETRY ${attempt}/${MAX_RETRIES} after error (waiting ${RETRY_DELAY_MS / 1000}s)`
+          `${ts()} ${tcName.padEnd(45)} RETRY ${attempt}/${MAX_RETRIES} after error (waiting ${RETRY_DELAY_MS / 1000}s)`
         );
         await new Promise((r) => setTimeout(r, RETRY_DELAY_MS));
         continue;
       }
-      console.log(`  ${tcName.padEnd(45)} FAILED: ${errorMessage}`);
+      console.log(`${ts()} ${tcName.padEnd(45)} FAILED: ${errorMessage}`);
       throw err;
     }
   }
diff --git a/tests/snapshots/provider/translate-path.json b/tests/snapshots/provider/translate-path.json
index e477551cec..95c12d3b22 100644
--- a/tests/snapshots/provider/translate-path.json
+++ b/tests/snapshots/provider/translate-path.json
@@ -27,64 +27,65 @@
     "headers": {
       "apiKey": {
         "Accept": "text/event-stream",
-        "Anthropic-Beta": "claude-code-20250219,oauth-2025-04-20,interleaved-thinking-2025-05-14,fine-grained-tool-streaming-2025-05-14,context-management-2025-06-27,prompt-caching-scope-2026-01-05,advanced-tool-use-2025-11-20,effort-2025-11-24,structured-outputs-2025-12-15,fast-mode-2026-02-01,redact-thinking-2026-02-12,token-efficient-tools-2026-03-28,advisor-tool-2026-03-01,extended-cache-ttl-2025-04-11,cache-diagnosis-2026-04-07",
-        "Anthropic-Dangerous-Direct-Browser-Access": "true",
-        "Anthropic-Version": "2023-06-01",
         "Content-Type": "application/json",
-        "User-Agent": "claude-cli/2.1.195 (external, cli)",
-        "X-App": "cli",
+        "User-Agent": "claude-cli/2.1.195 (external, sdk-cli)",
         "X-Stainless-Arch": "<ARCH>",
-        "X-Stainless-Helper-Method": "stream",
         "X-Stainless-Lang": "js",
-        "X-Stainless-Os": "<OS>",
+        "X-Stainless-OS": "MacOS",
         "X-Stainless-Package-Version": "0.94.0",
         "X-Stainless-Retry-Count": "0",
         "X-Stainless-Runtime": "node",
         "X-Stainless-Runtime-Version": "v24.3.0",
         "X-Stainless-Timeout": "600",
-        "x-api-key": "<CRED>"
+        "accept-encoding": "gzip, deflate, br, zstd",
+        "anthropic-beta": "claude-code-20250219,interleaved-thinking-2025-05-14,effort-2025-11-24",
+        "anthropic-dangerous-direct-browser-access": "true",
+        "anthropic-version": "2023-06-01",
+        "x-api-key": "<CRED>",
+        "x-app": "cli"
       },
       "nonStream": {
-        "Anthropic-Beta": "claude-code-20250219,oauth-2025-04-20,interleaved-thinking-2025-05-14,fine-grained-tool-streaming-2025-05-14,context-management-2025-06-27,prompt-caching-scope-2026-01-05,advanced-tool-use-2025-11-20,effort-2025-11-24,structured-outputs-2025-12-15,fast-mode-2026-02-01,redact-thinking-2026-02-12,token-efficient-tools-2026-03-28,advisor-tool-2026-03-01,extended-cache-ttl-2025-04-11,cache-diagnosis-2026-04-07",
-        "Anthropic-Dangerous-Direct-Browser-Access": "true",
-        "Anthropic-Version": "2023-06-01",
+        "Accept": "application/json",
         "Content-Type": "application/json",
-        "User-Agent": "claude-cli/2.1.195 (external, cli)",
-        "X-App": "cli",
+        "User-Agent": "claude-cli/2.1.195 (external, sdk-cli)",
         "X-Stainless-Arch": "<ARCH>",
-        "X-Stainless-Helper-Method": "stream",
         "X-Stainless-Lang": "js",
-        "X-Stainless-Os": "<OS>",
+        "X-Stainless-OS": "MacOS",
         "X-Stainless-Package-Version": "0.94.0",
         "X-Stainless-Retry-Count": "0",
         "X-Stainless-Runtime": "node",
         "X-Stainless-Runtime-Version": "v24.3.0",
         "X-Stainless-Timeout": "600",
-        "x-api-key": "<CRED>"
+        "accept-encoding": "gzip, deflate, br, zstd",
+        "anthropic-beta": "claude-code-20250219,interleaved-thinking-2025-05-14,effort-2025-11-24",
+        "anthropic-dangerous-direct-browser-access": "true",
+        "anthropic-version": "2023-06-01",
+        "x-api-key": "<CRED>",
+        "x-app": "cli"
       },
       "oauth": {
         "Accept": "text/event-stream",
-        "Anthropic-Beta": "claude-code-20250219,oauth-2025-04-20,interleaved-thinking-2025-05-14,fine-grained-tool-streaming-2025-05-14,context-management-2025-06-27,prompt-caching-scope-2026-01-05,advanced-tool-use-2025-11-20,effort-2025-11-24,structured-outputs-2025-12-15,fast-mode-2026-02-01,redact-thinking-2026-02-12,token-efficient-tools-2026-03-28,advisor-tool-2026-03-01,extended-cache-ttl-2025-04-11,cache-diagnosis-2026-04-07",
-        "Anthropic-Dangerous-Direct-Browser-Access": "true",
-        "Anthropic-Version": "2023-06-01",
         "Content-Type": "application/json",
-        "User-Agent": "claude-cli/2.1.195 (external, cli)",
-        "X-App": "cli",
+        "User-Agent": "claude-cli/2.1.195 (external, sdk-cli)",
         "X-Stainless-Arch": "<ARCH>",
-        "X-Stainless-Helper-Method": "stream",
         "X-Stainless-Lang": "js",
-        "X-Stainless-Os": "<OS>",
+        "X-Stainless-OS": "MacOS",
         "X-Stainless-Package-Version": "0.94.0",
         "X-Stainless-Retry-Count": "0",
         "X-Stainless-Runtime": "node",
         "X-Stainless-Runtime-Version": "v24.3.0",
         "X-Stainless-Timeout": "600",
-        "x-api-key": "<CRED>"
+        "accept-encoding": "gzip, deflate, br, zstd",
+        "anthropic-beta": "claude-code-20250219,interleaved-thinking-2025-05-14,effort-2025-11-24",
+        "anthropic-dangerous-direct-browser-access": "true",
+        "anthropic-version": "2023-06-01",
+        "x-api-key": "<CRED>",
+        "x-app": "cli"
       }
     },
     "url": {
-      "nonStream": "https://agentrouter.org/v1/messages",
-      "stream": "https://agentrouter.org/v1/messages"
+      "nonStream": "https://agentrouter.org/v1/messages?beta=true",
+      "stream": "https://agentrouter.org/v1/messages?beta=true"
     }
   },
   "agy": {
@@ -804,7 +805,7 @@
         "X-CLIENT-VERSION": "<APP>",
         "X-CORE-VERSION": "<APP>",
         "X-IS-MULTIROOT": "false",
-        "X-PLATFORM": "linux",
+        "X-PLATFORM": "<PLATFORM>",
         "X-PLATFORM-VERSION": "<NODE>",
         "X-Title": "Cline"
       },
@@ -817,7 +818,7 @@
         "X-CLIENT-VERSION": "<APP>",
         "X-CORE-VERSION": "<APP>",
         "X-IS-MULTIROOT": "false",
-        "X-PLATFORM": "linux",
+        "X-PLATFORM": "<PLATFORM>",
         "X-PLATFORM-VERSION": "<NODE>",
         "X-Title": "Cline"
       },
@@ -831,7 +832,7 @@
         "X-CLIENT-VERSION": "<APP>",
         "X-CORE-VERSION": "<APP>",
         "X-IS-MULTIROOT": "false",
-        "X-PLATFORM": "linux",
+        "X-PLATFORM": "<PLATFORM>",
         "X-PLATFORM-VERSION": "<NODE>",
         "X-Title": "Cline"
       }
@@ -1388,8 +1389,8 @@
       }
     },
     "url": {
-      "nonStream": "https://www.doubao.com/api/chat",
-      "stream": "https://www.doubao.com/api/chat"
+      "nonStream": "https://www.dola.com/chat/completion",
+      "stream": "https://www.dola.com/chat/completion"
     }
   },
   "duckduckgo-web": {
@@ -3640,6 +3641,29 @@
       "stream": "https://api.reka.ai/v1/chat/completions"
     }
   },
+  "requesty": {
+    "format": "openai",
+    "headers": {
+      "apiKey": {
+        "Accept": "text/event-stream",
+        "Authorization": "Bearer <TOK>",
+        "Content-Type": "application/json"
+      },
+      "nonStream": {
+        "Authorization": "Bearer <TOK>",
+        "Content-Type": "application/json"
+      },
+      "oauth": {
+        "Accept": "text/event-stream",
+        "Authorization": "Bearer <TOK>",
+        "Content-Type": "application/json"
+      }
+    },
+    "url": {
+      "nonStream": "https://router.requesty.ai/v1/chat/completions",
+      "stream": "https://router.requesty.ai/v1/chat/completions"
+    }
+  },
   "sambanova": {
     "format": "openai",
     "headers": {
@@ -4402,6 +4426,29 @@
       "stream": "https://api.lingyiwanwu.com/v1/chat/completions"
     }
   },
+  "yuanbao-web": {
+    "format": "openai",
+    "headers": {
+      "apiKey": {
+        "Accept": "text/event-stream",
+        "Authorization": "Bearer <TOK>",
+        "Content-Type": "application/json"
+      },
+      "nonStream": {
+        "Authorization": "Bearer <TOK>",
+        "Content-Type": "application/json"
+      },
+      "oauth": {
+        "Accept": "text/event-stream",
+        "Authorization": "Bearer <TOK>",
+        "Content-Type": "application/json"
+      }
+    },
+    "url": {
+      "nonStream": "https://yuanbao.tencent.com/api/chat",
+      "stream": "https://yuanbao.tencent.com/api/chat"
+    }
+  },
   "zai": {
     "format": "claude",
     "headers": {
diff --git a/tests/unit/agentSkillTools-mcp.test.ts b/tests/unit/agentSkillTools-mcp.test.ts
index c221f19ab8..a34acea595 100644
--- a/tests/unit/agentSkillTools-mcp.test.ts
+++ b/tests/unit/agentSkillTools-mcp.test.ts
@@ -43,8 +43,14 @@ test("agentSkillTools exports exactly 3 tools", () => {
 
 test("each agentSkillTool has name, description, inputSchema, and handler", () => {
   for (const toolDef of Object.values(agentSkillTools)) {
-    assert.ok(typeof toolDef.name === "string" && toolDef.name.length > 0, `${toolDef.name}: name missing`);
-    assert.ok(typeof toolDef.description === "string" && toolDef.description.length > 0, `${toolDef.name}: description missing`);
+    assert.ok(
+      typeof toolDef.name === "string" && toolDef.name.length > 0,
+      `${toolDef.name}: name missing`
+    );
+    assert.ok(
+      typeof toolDef.description === "string" && toolDef.description.length > 0,
+      `${toolDef.name}: description missing`
+    );
     assert.ok(toolDef.inputSchema != null, `${toolDef.name}: inputSchema missing`);
     assert.ok(typeof toolDef.handler === "function", `${toolDef.name}: handler missing`);
   }
@@ -52,16 +58,16 @@ test("each agentSkillTool has name, description, inputSchema, and handler", () =
 
 // ─── omniroute_agent_skills_list ────────────────────────────────────────────
 
-test("omniroute_agent_skills_list with no filters returns all 43 skills", async () => {
+test("omniroute_agent_skills_list with no filters returns all 44 skills", async () => {
   const result = await agentSkillTools.omniroute_agent_skills_list.handler({});
-  assert.equal(result.count, 43, `Expected 43 but got ${result.count}`);
+  assert.equal(result.count, 44, `Expected 44 but got ${result.count}`);
   assert.ok(Array.isArray(result.skills));
-  assert.equal(result.skills.length, 43);
+  assert.equal(result.skills.length, 44);
 });
 
-test("omniroute_agent_skills_list({category:'api'}) returns exactly 22 entries", async () => {
+test("omniroute_agent_skills_list({category:'api'}) returns exactly 23 entries", async () => {
   const result = await agentSkillTools.omniroute_agent_skills_list.handler({ category: "api" });
-  assert.equal(result.count, 22, `Expected 22 api skills but got ${result.count}`);
+  assert.equal(result.count, 23, `Expected 23 api skills but got ${result.count}`);
   assert.ok(result.skills.every((s: { category: string }) => s.category === "api"));
 });
 
@@ -76,7 +82,7 @@ test("omniroute_agent_skills_list result includes coverage shape", async () => {
   assert.ok(result.coverage != null, "coverage should be present");
   assert.ok(typeof result.coverage.api === "object");
   assert.ok(typeof result.coverage.cli === "object");
-  assert.equal(result.coverage.api.total, 22);
+  assert.equal(result.coverage.api.total, 23);
   assert.equal(result.coverage.cli.total, 20);
   assert.ok(typeof result.coverage.totalSkills === "number");
   assert.ok(typeof result.coverage.generatedAt === "string");
@@ -161,11 +167,11 @@ test("omniroute_agent_skills_coverage({}) returns coverage shape", async () => {
   assert.ok(result != null);
   assert.ok(typeof result.api === "object");
   assert.ok(typeof result.cli === "object");
-  assert.equal(result.api.total, 22);
+  assert.equal(result.api.total, 23);
   assert.equal(result.cli.total, 20);
   assert.ok(typeof result.api.have === "number");
   assert.ok(typeof result.cli.have === "number");
-  assert.ok(result.api.have >= 0 && result.api.have <= 22);
+  assert.ok(result.api.have >= 0 && result.api.have <= 23);
   assert.ok(result.cli.have >= 0 && result.cli.have <= 20);
   assert.ok(typeof result.totalSkills === "number");
   assert.equal(result.totalSkills, result.api.have + result.cli.have + (result.config?.have ?? 0));
diff --git a/tests/unit/agentSkills-catalog.test.ts b/tests/unit/agentSkills-catalog.test.ts
index 9d90f1c5d0..9820c627c7 100644
--- a/tests/unit/agentSkills-catalog.test.ts
+++ b/tests/unit/agentSkills-catalog.test.ts
@@ -15,14 +15,14 @@ const agentSkillsConstants = await import("../../src/shared/constants/agentSkill
 
 // ─── Counts ───────────────────────────────────────────────────────────────────
 
-test("getCatalog() returns exactly 43 entries", () => {
+test("getCatalog() returns exactly 44 entries", () => {
   refreshCatalog();
   const catalog = getCatalog();
-  assert.equal(catalog.length, 43, `Expected 43 but got ${catalog.length}`);
+  assert.equal(catalog.length, 44, `Expected 44 but got ${catalog.length}`);
 });
 
-test("API_SKILL_IDS has exactly 22 entries", () => {
-  assert.equal(API_SKILL_IDS.length, 22);
+test("API_SKILL_IDS has exactly 23 entries", () => {
+  assert.equal(API_SKILL_IDS.length, 23);
 });
 
 test("CLI_SKILL_IDS has exactly 20 entries", () => {
@@ -31,7 +31,7 @@ test("CLI_SKILL_IDS has exactly 20 entries", () => {
 
 test("getCatalog() contains exactly 22 api skills", () => {
   const apiSkills = getCatalog().filter((s) => s.category === "api");
-  assert.equal(apiSkills.length, 22);
+  assert.equal(apiSkills.length, 23);
 });
 
 test("getCatalog() contains exactly 20 cli skills", () => {
@@ -152,9 +152,9 @@ test("getSkillById('') returns null", () => {
 
 // ─── filterCatalog ────────────────────────────────────────────────────────────
 
-test("filterCatalog({ category: 'api' }) returns 22 api skills", () => {
+test("filterCatalog({ category: 'api' }) returns 23 api skills", () => {
   const skills = filterCatalog({ category: "api" });
-  assert.equal(skills.length, 22);
+  assert.equal(skills.length, 23);
   for (const s of skills) {
     assert.equal(s.category, "api");
   }
@@ -185,9 +185,9 @@ test("filterCatalog({ area: 'nonexistent' }) returns empty array", () => {
   assert.equal(skills.length, 0);
 });
 
-test("filterCatalog({}) returns full catalog (43 entries)", () => {
+test("filterCatalog({}) returns full catalog (44 entries)", () => {
   const skills = filterCatalog({});
-  assert.equal(skills.length, 43);
+  assert.equal(skills.length, 44);
 });
 
 // ─── refreshCatalog ───────────────────────────────────────────────────────────
@@ -209,9 +209,9 @@ test("computeCoverage() returns valid SkillCoverage shape", () => {
   const cov = computeCoverage();
 
   assert.ok(typeof cov.api === "object");
-  assert.equal(cov.api.total, 22);
+  assert.equal(cov.api.total, 23);
   assert.ok(typeof cov.api.have === "number");
-  assert.ok(cov.api.have >= 0 && cov.api.have <= 22);
+  assert.ok(cov.api.have >= 0 && cov.api.have <= 23);
 
   assert.ok(typeof cov.cli === "object");
   assert.equal(cov.cli.total, 20);
@@ -247,8 +247,8 @@ test("API_SKILL_IDS first entry is omni-auth", () => {
   assert.equal(API_SKILL_IDS[0], "omni-auth");
 });
 
-test("API_SKILL_IDS last entry is omni-inference", () => {
-  assert.equal(API_SKILL_IDS[API_SKILL_IDS.length - 1], "omni-inference");
+test("API_SKILL_IDS last entry is omni-github-skills", () => {
+  assert.equal(API_SKILL_IDS[API_SKILL_IDS.length - 1], "omni-github-skills");
 });
 
 test("CLI_SKILL_IDS first entry is cli-serve", () => {
diff --git a/tests/unit/agentSkills-generator.test.ts b/tests/unit/agentSkills-generator.test.ts
index 4056e676ac..db54f73ad2 100644
--- a/tests/unit/agentSkills-generator.test.ts
+++ b/tests/unit/agentSkills-generator.test.ts
@@ -61,11 +61,11 @@ test("dry-run (default) returns report without writing any files", async () => {
       outputDir: tmpDir,
     });
 
-    // All 43 skills should appear as generated (would-write) since dir is empty
+    // All 44 skills should appear as generated (would-write) since dir is empty
     assert.equal(
       report.generated.length + report.unchanged.length,
-      43,
-      `Expected 43 total (generated+unchanged), got generated=${report.generated.length} unchanged=${report.unchanged.length}`,
+      44,
+      `Expected 44 total (generated+unchanged), got generated=${report.generated.length} unchanged=${report.unchanged.length}`,
     );
     assert.equal(report.errors.length, 0, `Unexpected errors: ${JSON.stringify(report.errors)}`);
 
@@ -81,7 +81,7 @@ test("dry-run (default) returns report without writing any files", async () => {
   }
 });
 
-test("dry-run generates report with 43 total (generated+unchanged)", async () => {
+test("dry-run generates report with 44 total (generated+unchanged)", async () => {
   const tmpDir = mkTmpDir();
   try {
     refreshCatalog();
@@ -91,7 +91,7 @@ test("dry-run generates report with 43 total (generated+unchanged)", async () =>
       outputDir: tmpDir,
     });
     const total = report.generated.length + report.unchanged.length;
-    assert.equal(total, 43);
+    assert.equal(total, 44);
   } finally {
     rmTmpDir(tmpDir);
   }
@@ -134,7 +134,7 @@ test("apply mode writes SKILL.md with valid frontmatter for omni-providers", asy
   }
 });
 
-test("apply mode writes all 43 SKILL.md files when no onlyIds filter", async () => {
+test("apply mode writes all 44 SKILL.md files when no onlyIds filter", async () => {
   const tmpDir = mkTmpDir();
   try {
     refreshCatalog();
@@ -145,7 +145,7 @@ test("apply mode writes all 43 SKILL.md files when no onlyIds filter", async ()
     });
 
     assert.equal(report.errors.length, 0, `Errors: ${JSON.stringify(report.errors)}`);
-    assert.equal(report.generated.length, 43);
+    assert.equal(report.generated.length, 44);
 
     // Verify all dirs exist
     const catalog = getCatalog();
diff --git a/tests/unit/agentSkills-routes.test.ts b/tests/unit/agentSkills-routes.test.ts
index e29b031969..16265f4a4f 100644
--- a/tests/unit/agentSkills-routes.test.ts
+++ b/tests/unit/agentSkills-routes.test.ts
@@ -101,25 +101,25 @@ test.after(() => {
 // GET /api/agent-skills
 // ═════════════════════════════════════════════════════════════════════════════
 
-test("GET /api/agent-skills — returns 43 skills with count and coverage", async () => {
+test("GET /api/agent-skills — returns 44 skills with count and coverage", async () => {
   const req = makeRequest("GET", "http://localhost/api/agent-skills");
   const res = await listRoute.GET(req);
 
   assert.equal(res.status, 200);
   const body = (await res.json()) as { skills: unknown[]; count: number; coverage: unknown };
-  assert.equal(body.count, 43, `Expected 43 skills but got ${body.count}`);
+  assert.equal(body.count, 44, `Expected 44 skills but got ${body.count}`);
   assert.equal(Array.isArray(body.skills), true);
-  assert.equal(body.skills.length, 43);
+  assert.equal(body.skills.length, 44);
   assert.ok(body.coverage !== undefined, "coverage should be present");
 });
 
-test("GET /api/agent-skills?category=api — returns 22 api skills", async () => {
+test("GET /api/agent-skills?category=api — returns 23 api skills", async () => {
   const req = makeRequest("GET", "http://localhost/api/agent-skills?category=api");
   const res = await listRoute.GET(req);
 
   assert.equal(res.status, 200);
   const body = (await res.json()) as { skills: Array<{ category: string }>; count: number };
-  assert.equal(body.count, 22);
+  assert.equal(body.count, 23);
   assert.ok(body.skills.every((s) => s.category === "api"), "All skills should be api category");
 });
 
@@ -267,7 +267,7 @@ test("GET /api/agent-skills/coverage — returns valid SkillCoverage shape", asy
     generatedAt: string;
   };
 
-  assert.equal(body.api.total, 22, "api.total must be 22");
+  assert.equal(body.api.total, 23, "api.total must be 23");
   assert.equal(body.cli.total, 20, "cli.total must be 20");
   assert.ok(typeof body.totalSkills === "number", "totalSkills must be a number");
   assert.ok(typeof body.generatedAt === "string", "generatedAt must be a string");
diff --git a/tests/unit/agentrouter-cc-wire-image.test.ts b/tests/unit/agentrouter-cc-wire-image.test.ts
new file mode 100644
index 0000000000..1cc334990d
--- /dev/null
+++ b/tests/unit/agentrouter-cc-wire-image.test.ts
@@ -0,0 +1,91 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  isClaudeCodeCompatible,
+  buildProviderUrl,
+  buildProviderHeaders,
+} from "../../open-sse/services/provider.ts";
+import { isClaudeCodeCompatibleProvider } from "../../open-sse/services/claudeCodeCompatible.ts";
+import {
+  CC_WIRE_IMAGE_BUILTINS,
+  usesCcWireImage,
+} from "../../open-sse/services/ccWireImageBuiltins.ts";
+import { CLAUDE_CODE_COMPATIBLE_USER_AGENT } from "../../open-sse/services/claudeCodeCompatible.ts";
+import { CLAUDE_CLI_USER_AGENT } from "../../open-sse/config/anthropicHeaders.ts";
+import { applyFingerprint } from "../../open-sse/config/cliFingerprints.ts";
+
+// Regression guard for #6056 — the built-in `agentrouter` provider must route
+// through the DYNAMIC Claude-Code wire image (fingerprint headers + `?beta=true`
+// chat path) while KEEPING its own registry baseUrl + x-api-key auth.
+
+test("agentrouter is registered in the CC-wire-image built-in allow-set", () => {
+  assert.ok(CC_WIRE_IMAGE_BUILTINS.has("agentrouter"));
+  assert.equal(usesCcWireImage("agentrouter"), true);
+  assert.equal(usesCcWireImage("claude"), false);
+  assert.equal(usesCcWireImage(null), false);
+});
+
+test("(a) both CC predicates return true for agentrouter", () => {
+  assert.equal(isClaudeCodeCompatible("agentrouter"), true);
+  assert.equal(isClaudeCodeCompatibleProvider("agentrouter"), true);
+});
+
+test("(a) predicates are unaffected for non-allow-set providers", () => {
+  // Official Claude OAuth provider must NOT be treated as CC-compatible.
+  assert.equal(isClaudeCodeCompatible("claude"), false);
+  assert.equal(isClaudeCodeCompatibleProvider("claude"), false);
+  // Genuine CC-family providers still match via the prefix.
+  assert.equal(isClaudeCodeCompatible("anthropic-compatible-cc-foo"), true);
+  assert.equal(isClaudeCodeCompatibleProvider("anthropic-compatible-cc-foo"), true);
+});
+
+test("(b) agentrouter outbound headers carry the dynamic CC wire image", () => {
+  const headers = buildProviderHeaders("agentrouter", { apiKey: "sk-agentrouter" }, true);
+
+  // CC wire image markers (not the static getClaudeCliHeaders() shape).
+  assert.equal(headers["User-Agent"], CLAUDE_CODE_COMPATIBLE_USER_AGENT);
+  assert.notEqual(headers["User-Agent"], CLAUDE_CLI_USER_AGENT);
+  assert.equal(headers["x-app"], "cli");
+  assert.equal(headers["anthropic-dangerous-direct-browser-access"], "true");
+  assert.ok(headers["anthropic-beta"], "expected the CC anthropic-beta header");
+  assert.ok(headers["X-Stainless-Package-Version"], "expected CC X-Stainless anchors");
+});
+
+test("(b) applyFingerprint selects the claude-code-compatible fingerprint for agentrouter", () => {
+  const { headers } = applyFingerprint(
+    "agentrouter",
+    buildProviderHeaders("agentrouter", { apiKey: "sk-agentrouter" }, true),
+    { model: "claude-opus-4-6", messages: [] }
+  );
+  // Fingerprint reordering keeps the CC wire image + the preserved x-api-key auth.
+  assert.equal(headers["x-api-key"], "sk-agentrouter");
+  assert.equal(headers["User-Agent"], CLAUDE_CODE_COMPATIBLE_USER_AGENT);
+});
+
+test("(c) CRUX: agentrouter keeps its OWN x-api-key auth (NOT CC Bearer)", () => {
+  const headers = buildProviderHeaders("agentrouter", { apiKey: "sk-agentrouter" }, true);
+  assert.equal(headers["x-api-key"], "sk-agentrouter");
+  assert.equal(headers["Authorization"], undefined);
+});
+
+test("(c) CRUX: agentrouter keeps its OWN registry baseUrl + ?beta=true", () => {
+  const url = buildProviderUrl("agentrouter", "claude-opus-4-6", true);
+  assert.equal(url, "https://agentrouter.org/v1/messages?beta=true");
+  // NOT the CC-family anthropic default baseUrl.
+  assert.ok(!url.includes("api.anthropic.com"));
+});
+
+test("(c) real CC-family provider still uses the CC default baseUrl + Bearer auth", () => {
+  // The wire-image guard must NOT leak into genuine anthropic-compatible-cc-* providers.
+  const headers = buildProviderHeaders(
+    "anthropic-compatible-cc-foo",
+    { apiKey: "sk-foo" },
+    true
+  );
+  assert.equal(headers["Authorization"], "Bearer sk-foo");
+  assert.equal(headers["x-api-key"], undefined);
+
+  const url = buildProviderUrl("anthropic-compatible-cc-foo", "claude-sonnet-4-6", true);
+  assert.ok(url.includes("api.anthropic.com"));
+});
diff --git a/tests/unit/antigravity-claude-prefill-strip.test.ts b/tests/unit/antigravity-claude-prefill-strip.test.ts
new file mode 100644
index 0000000000..cac8d881ef
--- /dev/null
+++ b/tests/unit/antigravity-claude-prefill-strip.test.ts
@@ -0,0 +1,101 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  AntigravityExecutor,
+  __test_stripTrailingAntigravityAssistantTurn,
+} from "../../open-sse/executors/antigravity.ts";
+
+/**
+ * Ports decolua/9router#2321 (anki1kr): Vertex AI (used by Antigravity for
+ * Claude-branded models) rejects a conversation ending on an assistant turn —
+ * "This model does not support assistant message prefill" — so the request must
+ * always end on a user turn.
+ *
+ * Upstream's diff patched `openaiToClaudeRequestForAntigravity` in
+ * `open-sse/translator/request/openai-to-claude.ts`, which has ZERO callers in
+ * OmniRoute (dead code). The live Antigravity Claude dispatch path converts to
+ * Gemini `contents` (`role: "user"/"model"`) in `AntigravityExecutor.transformRequest`
+ * via `sanitizeAntigravityGeminiRequest` — this test drives THAT function end-to-end.
+ */
+
+async function transform(model: string, contents: Array<Record<string, unknown>>) {
+  const executor = new AntigravityExecutor();
+  const body = {
+    request: {
+      contents,
+      generationConfig: {},
+    },
+  };
+  const result = await executor.transformRequest(model, body, true, {
+    projectId: "project-1",
+  });
+  if (result instanceof Response) throw new Error("Unexpected Response from transformRequest");
+  return (result as Record<string, unknown>).request as Record<string, unknown>;
+}
+
+test("(a) strips a single trailing assistant (model) turn for Claude models", async () => {
+  const request = await transform("antigravity/claude-opus-4-8", [
+    { role: "user", parts: [{ text: "Hello" }] },
+    { role: "model", parts: [{ text: "Hi there" }] }, // prefill to strip
+  ]);
+  const contents = request.contents as Array<{ role: string }>;
+  assert.equal(contents.length, 1);
+  assert.equal(contents.at(-1)?.role, "user");
+});
+
+test("(b) does NOT strip a trailing model turn for non-Claude (native Gemini) models", async () => {
+  const request = await transform("antigravity/gemini-3.1-pro", [
+    { role: "user", parts: [{ text: "Hello" }] },
+    { role: "model", parts: [{ text: "Hi there" }] },
+  ]);
+  const contents = request.contents as Array<{ role: string }>;
+  assert.equal(contents.length, 2);
+  assert.equal(contents.at(-1)?.role, "model", "native Gemini requests via Antigravity are untouched");
+});
+
+test("(c) a Claude conversation already ending on user is unchanged", async () => {
+  const request = await transform("antigravity/claude-opus-4-8", [
+    { role: "user", parts: [{ text: "Hello" }] },
+    { role: "model", parts: [{ text: "Hi" }] },
+    { role: "user", parts: [{ text: "What is 2+2?" }] },
+  ]);
+  const contents = request.contents as Array<{ role: string }>;
+  assert.equal(contents.length, 3);
+  assert.equal(contents.at(-1)?.role, "user");
+});
+
+test("(d) multiple trailing model turns are all stripped", () => {
+  // Under normal executor flow, adjacent same-role turns are merged before this
+  // helper runs — this directly exercises the helper's robustness for an input
+  // that (defensively) still carries multiple consecutive trailing "model" turns.
+  const request = __test_stripTrailingAntigravityAssistantTurn({
+    contents: [
+      { role: "user", parts: [{ text: "Hello" }] },
+      { role: "model", parts: [{ text: "A" }] },
+      { role: "model", parts: [{ text: "B" }] },
+    ],
+  });
+  const contents = request.contents as Array<{ role: string }>;
+  assert.equal(contents.length, 1);
+  assert.equal(contents.at(-1)?.role, "user");
+});
+
+test("(e) never strips contents down to empty", () => {
+  const request = __test_stripTrailingAntigravityAssistantTurn({
+    contents: [{ role: "model", parts: [{ text: "solo prefill" }] }],
+  });
+  const contents = request.contents as Array<{ role: string }>;
+  // A lone trailing "model" turn is preserved rather than emptying `contents`
+  // (an empty contents array is itself an invalid upstream request).
+  assert.equal(contents.length, 1);
+  assert.equal(contents[0].role, "model");
+});
+
+test("empty/missing contents does not throw", () => {
+  const request = __test_stripTrailingAntigravityAssistantTurn({ contents: [] });
+  assert.deepEqual(request.contents, []);
+
+  const request2 = __test_stripTrailingAntigravityAssistantTurn({});
+  assert.equal(request2.contents, undefined);
+});
diff --git a/tests/unit/authz/classify.test.ts b/tests/unit/authz/classify.test.ts
index c9a76bb950..f091bb2bf9 100644
--- a/tests/unit/authz/classify.test.ts
+++ b/tests/unit/authz/classify.test.ts
@@ -136,11 +136,41 @@ const cases: Case[] = [
     expectedClass: "PUBLIC",
   },
   {
-    name: "/api/cloud/* is PUBLIC",
-    path: "/api/cloud/something",
+    name: "/api/cloud/auth POST is PUBLIC",
+    path: "/api/cloud/auth",
+    method: "POST",
+    expectedClass: "PUBLIC",
+  },
+  {
+    name: "/api/cloud/model/resolve POST is PUBLIC",
+    path: "/api/cloud/model/resolve",
+    method: "POST",
+    expectedClass: "PUBLIC",
+  },
+  {
+    name: "/api/cloud/models/alias GET is PUBLIC",
+    path: "/api/cloud/models/alias",
     method: "GET",
     expectedClass: "PUBLIC",
   },
+  {
+    name: "/api/cloud/credentials/update PUT is MANAGEMENT",
+    path: "/api/cloud/credentials/update",
+    method: "PUT",
+    expectedClass: "MANAGEMENT",
+  },
+  {
+    name: "/api/cloud/models/alias PUT is MANAGEMENT",
+    path: "/api/cloud/models/alias",
+    method: "PUT",
+    expectedClass: "MANAGEMENT",
+  },
+  {
+    name: "/api/cloud/unknown GET is MANAGEMENT",
+    path: "/api/cloud/unknown",
+    method: "GET",
+    expectedClass: "MANAGEMENT",
+  },
   {
     name: "/api/oauth/* is PUBLIC",
     path: "/api/oauth/callback",
diff --git a/tests/unit/build-bundler-default-turbopack.test.ts b/tests/unit/build-bundler-default-turbopack.test.ts
new file mode 100644
index 0000000000..65a31e44fa
--- /dev/null
+++ b/tests/unit/build-bundler-default-turbopack.test.ts
@@ -0,0 +1,34 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+// Turbopack is the default production bundler (Next 16 stable, benchmarked ~2-3x
+// faster than the webpack pass); webpack stays available as the explicit opt-out
+// escape hatch (OMNIROUTE_USE_TURBOPACK=0) for environments that hit native
+// binding or bundler-compat issues.
+const buildIsolated = await import("../../scripts/build/build-next-isolated.mjs");
+
+test("resolveNextBuildBundlerFlag defaults to --turbopack when the env var is unset", () => {
+  assert.equal(buildIsolated.resolveNextBuildBundlerFlag({}), "--turbopack");
+});
+
+test("resolveNextBuildBundlerFlag keeps --turbopack for explicit opt-in", () => {
+  assert.equal(
+    buildIsolated.resolveNextBuildBundlerFlag({ OMNIROUTE_USE_TURBOPACK: "1" }),
+    "--turbopack"
+  );
+});
+
+test("resolveNextBuildBundlerFlag honors the webpack escape hatch (=0)", () => {
+  assert.equal(
+    buildIsolated.resolveNextBuildBundlerFlag({ OMNIROUTE_USE_TURBOPACK: "0" }),
+    "--webpack"
+  );
+});
+
+test("resolveNextBuildBundlerFlag treats other values as the turbopack default", () => {
+  // Only the documented "0" opts out — junk values must not silently flip the bundler.
+  assert.equal(
+    buildIsolated.resolveNextBuildBundlerFlag({ OMNIROUTE_USE_TURBOPACK: "yes" }),
+    "--turbopack"
+  );
+});
diff --git a/tests/unit/bulk-api-key-parser-cloudflare.test.ts b/tests/unit/bulk-api-key-parser-cloudflare.test.ts
new file mode 100644
index 0000000000..3c5267f529
--- /dev/null
+++ b/tests/unit/bulk-api-key-parser-cloudflare.test.ts
@@ -0,0 +1,176 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { parseBulkApiKeys } from "../../src/shared/utils/bulkApiKeyParser.ts";
+import { bulkCreateProviderSchema } from "../../src/shared/validation/schemas.ts";
+
+// #6174 — Bulk Add API Keys for Cloudflare Workers AI.
+// Cloudflare needs a per-key accountId, so the bulk rail parses a 3-field
+// `name|accountId|apiKey` shape and threads a DISTINCT accountId per entry.
+
+// ─────────────────────────────────────────────────────────────────────────────
+// (a) 3-field parser — splits name|accountId|apiKey; 1-2 field shape unaffected
+// ─────────────────────────────────────────────────────────────────────────────
+
+test("withAccountId: splits name|accountId|apiKey", () => {
+  const { entries, warnings } = parseBulkApiKeys("prod|acc-123|cf-token-abc", {
+    withAccountId: true,
+  });
+  assert.equal(entries.length, 1);
+  assert.deepEqual(
+    { name: entries[0].name, accountId: entries[0].accountId, apiKey: entries[0].apiKey },
+    { name: "prod", accountId: "acc-123", apiKey: "cf-token-abc" }
+  );
+  assert.equal(warnings.length, 0);
+});
+
+test("withAccountId: trims whitespace around each field", () => {
+  const { entries } = parseBulkApiKeys("  prod  |  acc-1  |  cf-token  ", {
+    withAccountId: true,
+  });
+  assert.equal(entries.length, 1);
+  assert.equal(entries[0].name, "prod");
+  assert.equal(entries[0].accountId, "acc-1");
+  assert.equal(entries[0].apiKey, "cf-token");
+});
+
+test("withAccountId: only the first two pipes are separators — apiKey keeps its own '|'", () => {
+  const { entries } = parseBulkApiKeys("prod|acc-1|cf|token|with|pipes", {
+    withAccountId: true,
+  });
+  assert.equal(entries.length, 1);
+  assert.equal(entries[0].accountId, "acc-1");
+  assert.equal(entries[0].apiKey, "cf|token|with|pipes");
+});
+
+test("withAccountId: auto-names when the name field is empty", () => {
+  const { entries } = parseBulkApiKeys("|acc-1|cf-token", { withAccountId: true });
+  assert.equal(entries.length, 1);
+  assert.equal(entries[0].name, "Key 1");
+  assert.equal(entries[0].accountId, "acc-1");
+});
+
+test("withAccountId: flags & skips a line missing the accountId/apiKey field", () => {
+  const { entries, warnings } = parseBulkApiKeys("prod|only-two-fields", {
+    withAccountId: true,
+  });
+  assert.equal(entries.length, 0);
+  assert.equal(warnings.length, 1);
+  assert.match(warnings[0], /Line 1/);
+});
+
+test("withAccountId: flags & skips a line with no pipe at all", () => {
+  const { entries, warnings } = parseBulkApiKeys("justonefield", { withAccountId: true });
+  assert.equal(entries.length, 0);
+  assert.equal(warnings.length, 1);
+  assert.match(warnings[0], /name\|accountId\|apiKey/);
+});
+
+test("withAccountId: flags & skips empty accountId or empty apiKey", () => {
+  const emptyAccount = parseBulkApiKeys("prod||cf-token", { withAccountId: true });
+  assert.equal(emptyAccount.entries.length, 0);
+  assert.match(emptyAccount.warnings[0], /accountId/);
+
+  const emptyKey = parseBulkApiKeys("prod|acc-1|", { withAccountId: true });
+  assert.equal(emptyKey.entries.length, 0);
+  assert.match(emptyKey.warnings[0], /apiKey/);
+});
+
+test("withAccountId: skips blank lines and # comments, still caps at 200", () => {
+  const good = parseBulkApiKeys("\n# a comment\nprod|acc-1|cf-token\n\n", {
+    withAccountId: true,
+  });
+  assert.equal(good.entries.length, 1);
+  assert.equal(good.entries[0].name, "prod");
+
+  const overCap = Array.from({ length: 205 }, (_, i) => `n${i}|acc-${i}|key-${i}`).join("\n");
+  const capped = parseBulkApiKeys(overCap, { withAccountId: true });
+  assert.equal(capped.entries.length, 200);
+  assert.ok(capped.warnings.some((w) => /200/.test(w)));
+});
+
+test("default (no options): non-cloudflare providers keep 1-2 field parsing, no accountId", () => {
+  const { entries } = parseBulkApiKeys("prod|sk-key-1\nsk-key-only");
+  assert.equal(entries.length, 2);
+  assert.equal(entries[0].name, "prod");
+  assert.equal(entries[0].apiKey, "sk-key-1");
+  assert.equal(entries[0].accountId, undefined);
+  assert.equal(entries[1].name, "Key 1");
+  assert.equal(entries[1].apiKey, "sk-key-only");
+  assert.equal(entries[1].accountId, undefined);
+});
+
+test("default: a pipe in a 2-field line is kept in the apiKey (first-pipe split)", () => {
+  const { entries } = parseBulkApiKeys("prod|sk|has|pipes");
+  assert.equal(entries.length, 1);
+  assert.equal(entries[0].apiKey, "sk|has|pipes");
+});
+
+// ─────────────────────────────────────────────────────────────────────────────
+// (b) Per-entry providerSpecificData — DISTINCT accountId per entry, no shared-
+//     object bleed. This mirrors the exact merge performed in
+//     src/app/api/providers/bulk/route.ts (the core bug the feature fixes: the
+//     route previously reused ONE shared providerSpecificData object for every
+//     entry, so a per-key accountId would bleed across all connections).
+// ─────────────────────────────────────────────────────────────────────────────
+
+test("per-entry PSD: each Cloudflare entry yields its own distinct accountId (no bleed)", () => {
+  const { entries } = parseBulkApiKeys("k1|acc-AAA|token-1\nk2|acc-BBB|token-2", {
+    withAccountId: true,
+  });
+  assert.equal(entries.length, 2);
+
+  // Base PSD shared across the batch (e.g. baseUrl) — must NOT be mutated/reused.
+  const baseProviderSpecificData: Record<string, unknown> = { baseUrl: "https://api.cf" };
+
+  // Exact per-entry merge from route.ts:
+  const perEntryPsd = entries.map((entry) => ({
+    ...baseProviderSpecificData,
+    ...(entry.accountId ? { accountId: entry.accountId } : {}),
+  }));
+
+  // Distinct accountId per entry.
+  assert.equal(perEntryPsd[0].accountId, "acc-AAA");
+  assert.equal(perEntryPsd[1].accountId, "acc-BBB");
+
+  // No shared-object bleed: distinct references, and mutating one leaves the
+  // other + the base untouched.
+  assert.notEqual(perEntryPsd[0], perEntryPsd[1]);
+  assert.notEqual(perEntryPsd[0], baseProviderSpecificData);
+  (perEntryPsd[0] as Record<string, unknown>).accountId = "MUTATED";
+  assert.equal(perEntryPsd[1].accountId, "acc-BBB");
+  assert.equal(baseProviderSpecificData.accountId, undefined);
+});
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Schema: cloudflare-ai requires accountId per entry; other providers unaffected
+// ─────────────────────────────────────────────────────────────────────────────
+
+test("schema: cloudflare-ai bulk accepts entries carrying accountId", () => {
+  const result = bulkCreateProviderSchema.safeParse({
+    provider: "cloudflare-ai",
+    entries: [
+      { name: "k1", apiKey: "token-1", accountId: "acc-AAA" },
+      { name: "k2", apiKey: "token-2", accountId: "acc-BBB" },
+    ],
+  });
+  assert.equal(result.success, true);
+});
+
+test("schema: cloudflare-ai bulk rejects an entry missing accountId", () => {
+  const result = bulkCreateProviderSchema.safeParse({
+    provider: "cloudflare-ai",
+    entries: [
+      { name: "k1", apiKey: "token-1", accountId: "acc-AAA" },
+      { name: "k2", apiKey: "token-2" },
+    ],
+  });
+  assert.equal(result.success, false);
+});
+
+test("schema: accountId stays optional for non-cloudflare providers", () => {
+  const result = bulkCreateProviderSchema.safeParse({
+    provider: "anthropic",
+    entries: [{ name: "prod", apiKey: "sk-1" }],
+  });
+  assert.equal(result.success, true);
+});
diff --git a/tests/unit/call-logs-correlation-substring.test.ts b/tests/unit/call-logs-correlation-substring.test.ts
new file mode 100644
index 0000000000..c5fe01a53e
--- /dev/null
+++ b/tests/unit/call-logs-correlation-substring.test.ts
@@ -0,0 +1,152 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-cid-substr-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const callLogs = await import("../../src/lib/usage/callLogs.ts");
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+// Seed test data
+function seedLogs() {
+  const db = core.getDbInstance();
+  const now = new Date().toISOString();
+  db.prepare(
+    `INSERT OR REPLACE INTO call_logs (id, timestamp, method, path, status, model, provider, account, duration, tokens_in, tokens_out, correlation_id)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+  ).run(
+    "log-1",
+    now,
+    "POST",
+    "/v1/chat/completions",
+    200,
+    "gpt-4",
+    "openai",
+    "acc1",
+    100,
+    10,
+    20,
+    "abc123-def456-ghi789"
+  );
+  db.prepare(
+    `INSERT OR REPLACE INTO call_logs (id, timestamp, method, path, status, model, provider, account, duration, tokens_in, tokens_out, correlation_id)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+  ).run(
+    "log-2",
+    now,
+    "POST",
+    "/v1/chat/completions",
+    200,
+    "claude-3",
+    "anthropic",
+    "acc2",
+    200,
+    15,
+    30,
+    "xyz999-uvw888-tsr777"
+  );
+  db.prepare(
+    `INSERT OR REPLACE INTO call_logs (id, timestamp, method, path, status, model, provider, account, duration, tokens_in, tokens_out, correlation_id)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+  ).run(
+    "log-3",
+    now,
+    "POST",
+    "/v1/chat/completions",
+    500,
+    "gpt-4",
+    "openai",
+    "acc1",
+    50,
+    0,
+    0,
+    null
+  );
+}
+
+// ── Exact match ───────────────────────────────────────────────────────────
+
+test("correlationId exact match returns single entry", async () => {
+  seedLogs();
+  const results = await callLogs.getCallLogs({ correlationId: "abc123-def456-ghi789" });
+  assert.equal(results.length, 1);
+  assert.equal(results[0].correlationId, "abc123-def456-ghi789");
+});
+
+// ── Substring match ───────────────────────────────────────────────────────
+
+test("correlationId substring match (prefix)", async () => {
+  seedLogs();
+  const results = await callLogs.getCallLogs({ correlationId: "abc123" });
+  assert.equal(results.length, 1);
+  assert.equal(results[0].id, "log-1");
+});
+
+test("correlationId substring match (middle)", async () => {
+  seedLogs();
+  const results = await callLogs.getCallLogs({ correlationId: "def456" });
+  assert.equal(results.length, 1);
+  assert.equal(results[0].id, "log-1");
+});
+
+test("correlationId substring match (suffix)", async () => {
+  seedLogs();
+  const results = await callLogs.getCallLogs({ correlationId: "ghi789" });
+  assert.equal(results.length, 1);
+  assert.equal(results[0].id, "log-1");
+});
+
+test("correlationId substring match returns multiple when shared", async () => {
+  const db = core.getDbInstance();
+  const now = new Date().toISOString();
+  // Add another log sharing a substring
+  db.prepare(
+    `INSERT OR REPLACE INTO call_logs (id, timestamp, method, path, status, model, provider, account, duration, tokens_in, tokens_out, correlation_id)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+  ).run(
+    "log-4",
+    now,
+    "POST",
+    "/v1/chat/completions",
+    200,
+    "gpt-4",
+    "openai",
+    "acc1",
+    100,
+    10,
+    20,
+    "abc123-RETRY-suffix"
+  );
+
+  const results = await callLogs.getCallLogs({ correlationId: "abc123" });
+  assert.equal(results.length, 2);
+  const ids = results.map((r: { id: string }) => r.id).sort();
+  assert.deepEqual(ids, ["log-1", "log-4"]);
+});
+
+// ── No match ──────────────────────────────────────────────────────────────
+
+test("correlationId no match returns empty", async () => {
+  seedLogs();
+  const results = await callLogs.getCallLogs({ correlationId: "nonexistent" });
+  assert.equal(results.length, 0);
+});
+
+// ── Null/empty correlationId rows excluded ─────────────────────────────────
+
+test("rows with null correlationId are excluded from substring search", async () => {
+  seedLogs();
+  // Search for a unique substring that only matches log-1
+  const results = await callLogs.getCallLogs({ correlationId: "ghi789" });
+  const ids = results.map((r: { id: string }) => r.id);
+  assert.ok(!ids.includes("log-3"), "null correlation_id rows must be excluded");
+  assert.equal(results.length, 1);
+});
diff --git a/tests/unit/catalog-updates-v3x.test.ts b/tests/unit/catalog-updates-v3x.test.ts
index a246171cea..0f3bbc80ee 100644
--- a/tests/unit/catalog-updates-v3x.test.ts
+++ b/tests/unit/catalog-updates-v3x.test.ts
@@ -47,23 +47,19 @@ test("NVIDIA catalog includes the verified 2026 additions and GPT OSS 20B alias
   });
 });
 
-test("Fable 5 catalog exposes claude-fable-5 in cc and kiro providers with matching pricing", () => {
+test("Fable 5 catalog exposes claude-fable-5 in cc — but NOT via Kiro (fabricated)", () => {
+  // claude-fable-5 is a real Claude flagship served by the Claude Code (cc) channel,
+  // but Kiro's upstream never served it — it had been copied verbatim into the Kiro
+  // registry from OmniRoute's own Anthropic catalog and returned upstream 400
+  // "Invalid model". #6170 removed the fabricated Kiro copy.
   const ccIds = new Set(getModelsByProviderId("cc").map((m) => m.id));
   assert.ok(ccIds.has("claude-fable-5"), "cc must expose claude-fable-5");
 
-  const kiroModels = getModelsByProviderId("kiro");
-  const kiroIds = new Set(kiroModels.map((m) => m.id));
-  assert.ok(kiroIds.has("claude-fable-5"), "kiro must expose claude-fable-5");
-
-  const fable = kiroModels.find((m) => m.id === "claude-fable-5");
-  assert.equal(fable?.contextLength, 1000000);
-  assert.equal(fable?.maxOutputTokens, 128000);
-
   const ccPricing = (DEFAULT_PRICING as Record<string, Record<string, unknown>>).cc;
   assert.ok(ccPricing["claude-fable-5"], "cc pricing must include claude-fable-5");
 
-  const kiroPricing = (DEFAULT_PRICING as Record<string, Record<string, unknown>>).kiro;
-  assert.ok(kiroPricing["claude-fable-5"], "kiro pricing must include claude-fable-5");
+  const kiroIds = new Set(getModelsByProviderId("kiro").map((m) => m.id));
+  assert.equal(kiroIds.has("claude-fable-5"), false, "kiro must NOT expose claude-fable-5 (fabricated)");
 });
 
 test("Sonnet 5 catalog exposes claude-sonnet-5 across cc/kiro/anthropic/blackbox with Sonnet-tier pricing", () => {
@@ -89,20 +85,15 @@ test("Sonnet 5 catalog exposes claude-sonnet-5 across cc/kiro/anthropic/blackbox
   assert.equal(kiroSonnet5Price.output, 15.0);
 });
 
-test("Kiro catalog exposes Claude Opus 4.8 alongside 4.7 with matching pricing", () => {
-  const models = getModelsByProviderId("kiro");
-  const ids = new Set(models.map((model) => model.id));
+test("Kiro catalog does NOT expose Claude Opus (fabricated — Kiro upstream has no Opus)", () => {
+  // Kiro's real upstream never served any Opus model; the Opus 4.8/4.7/4.6 ids had been
+  // copied into the Kiro registry from OmniRoute's Anthropic catalog and returned upstream
+  // 400 "Invalid model. Please select a different model". #6170 removed them.
+  const ids = new Set(getModelsByProviderId("kiro").map((model) => model.id));
 
-  assert.ok(ids.has("claude-opus-4.8"), "kiro must expose claude-opus-4.8");
-  assert.ok(ids.has("claude-opus-4.7"), "kiro must still expose claude-opus-4.7");
-
-  const opus48 = models.find((model) => model.id === "claude-opus-4.8");
-  assert.equal(opus48?.contextLength, 1000000);
-  assert.equal(opus48?.maxOutputTokens, 128000);
-
-  // Pricing for the Kiro channel must cover the new model so usage cost is non-zero.
-  const kiroPricing = (DEFAULT_PRICING as Record<string, Record<string, unknown>>).kiro;
-  assert.ok(kiroPricing["claude-opus-4.8"], "kiro pricing must include claude-opus-4.8");
+  assert.equal(ids.has("claude-opus-4.8"), false, "kiro must NOT expose claude-opus-4.8 (fabricated)");
+  assert.equal(ids.has("claude-opus-4.7"), false, "kiro must NOT expose claude-opus-4.7 (fabricated)");
+  assert.equal(ids.has("claude-opus-4.6"), false, "kiro must NOT expose claude-opus-4.6 (fabricated)");
 });
 
 test("Every Kiro registry model resolves a non-zero pricing row (no $0.00 usage)", async () => {
@@ -124,14 +115,15 @@ test("Every Kiro registry model resolves a non-zero pricing row (no $0.00 usage)
     );
   }
 
-  // Regression guard for the reported issue: Sonnet 4.6 must be priced like Sonnet 4.5.
-  const sonnet46 = getPricingForModel("kiro", "claude-sonnet-4.6") as {
+  // Regression guard: Kiro's real Sonnet is 4.5 (the "4.6" id was fabricated — #6170) and
+  // must carry Sonnet-tier pricing ($3/$15).
+  const sonnet45 = getPricingForModel("kiro", "claude-sonnet-4.5") as {
     input: number;
     output: number;
   } | null;
-  assert.ok(sonnet46, "kiro pricing must include claude-sonnet-4.6");
-  assert.equal(sonnet46?.input, 3.0);
-  assert.equal(sonnet46?.output, 15.0);
+  assert.ok(sonnet45, "kiro pricing must include claude-sonnet-4.5");
+  assert.equal(sonnet45?.input, 3.0);
+  assert.equal(sonnet45?.output, 15.0);
 });
 
 test("Every OpenAI registry model resolves a non-zero pricing row (alias: openai)", async () => {
diff --git a/tests/unit/chatgpt-web-image-silentdrop.test.ts b/tests/unit/chatgpt-web-image-silentdrop.test.ts
new file mode 100644
index 0000000000..1b3c3c7309
--- /dev/null
+++ b/tests/unit/chatgpt-web-image-silentdrop.test.ts
@@ -0,0 +1,96 @@
+// Regression guard for the escalated mesh-bot report: a user generated an
+// image via the ChatGPT Web provider; the image WAS produced upstream but
+// OmniRoute returned `502 "ChatGPT Web completed without returning image
+// markdown"` — i.e. the silent-drop path where an image_asset_pointer existed
+// but resolution failed, and the handler reported it as "no image made".
+//
+// The fix distinguishes "image generated but not retrievable" (executor sets
+// x_image_resolution_failed) from "no image at all", so the 502 is accurate
+// and actionable instead of misleading.
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+process.env.DATA_DIR = mkdtempSync(join(tmpdir(), "omniroute-cgptweb-silentdrop-"));
+
+const { detectImageResolutionFailure } = await import("../../open-sse/executors/chatgpt-web.ts");
+const { handleChatGptWebImageGeneration } = await import(
+  "../../open-sse/handlers/imageGeneration/providers/chatgptWeb.ts"
+);
+
+function fakeExecutor(jsonBody: object, status = 200) {
+  return {
+    execute: async () => ({
+      response: new Response(JSON.stringify(jsonBody), {
+        status,
+        headers: { "Content-Type": "application/json" },
+      }),
+    }),
+  };
+}
+
+const baseArgs = {
+  model: "gpt-4o",
+  provider: "chatgpt-web",
+  body: { prompt: "a kitten" },
+  credentials: { apiKey: "sess-cookie" },
+  log: null,
+  signal: null,
+  clientHeaders: {},
+};
+
+test("detectImageResolutionFailure: true only when a pointer existed but none resolved", () => {
+  assert.equal(detectImageResolutionFailure(1, 0), true);
+  assert.equal(detectImageResolutionFailure(2, 0), true);
+  assert.equal(detectImageResolutionFailure(0, 0), false); // no image at all
+  assert.equal(detectImageResolutionFailure(1, 1), false); // resolved fine
+});
+
+test("handler surfaces a specific 502 when the image was generated but not retrievable", async () => {
+  const res = await handleChatGptWebImageGeneration({
+    ...baseArgs,
+    executorFactory: () =>
+      fakeExecutor({
+        choices: [{ message: { role: "assistant", content: "Here's your image:" } }],
+        x_image_resolution_failed: true,
+      }),
+  });
+  assert.equal(res.success, false);
+  assert.equal(res.status, 502);
+  // must NOT be the misleading "completed without returning image markdown"
+  assert.ok(
+    !/completed without returning image markdown/i.test(res.error),
+    `expected specific retrieval error, got: ${res.error}`
+  );
+  // must clearly say the image was generated but could not be retrieved
+  assert.match(res.error, /could not (be )?retriev|generated an image but/i);
+});
+
+test("handler keeps the generic 502 when no image was generated at all", async () => {
+  const res = await handleChatGptWebImageGeneration({
+    ...baseArgs,
+    executorFactory: () =>
+      fakeExecutor({
+        choices: [{ message: { role: "assistant", content: "I can't create that." } }],
+      }),
+  });
+  assert.equal(res.success, false);
+  assert.equal(res.status, 502);
+  assert.match(res.error, /completed without returning image markdown/i);
+});
+
+test("handler returns success when the executor produced image markdown", async () => {
+  const url = "/v1/chatgpt-web/image/abcdef0123456789";
+  const res = await handleChatGptWebImageGeneration({
+    ...baseArgs,
+    executorFactory: () =>
+      fakeExecutor({
+        choices: [{ message: { role: "assistant", content: `Here you go:\n\n![image](${url})` } }],
+      }),
+  });
+  assert.equal(res.success, true);
+  assert.equal(res.data.data.length, 1);
+  assert.equal(res.data.data[0].url, url);
+});
diff --git a/tests/unit/claude-web-sonnet5-registry-6209.test.ts b/tests/unit/claude-web-sonnet5-registry-6209.test.ts
new file mode 100644
index 0000000000..d3d3ba0058
--- /dev/null
+++ b/tests/unit/claude-web-sonnet5-registry-6209.test.ts
@@ -0,0 +1,15 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { getModelsByProviderId } from "../../open-sse/config/providerModels.ts";
+
+// #6209 (#6200): the Claude Web provider (claude.ai scrape) now offers Claude 5 Sonnet.
+// Regression guard: the claude-web registry must expose `claude-sonnet-5` alongside the
+// pre-existing 4.6 Sonnet / 4.5 Haiku web entries. Fails without the registry line.
+test("claude-web registry exposes claude-sonnet-5 (Claude 5 Sonnet web)", () => {
+  const models = getModelsByProviderId("claude-web");
+  const ids = new Set(models.map((m) => m.id));
+  assert.ok(ids.has("claude-sonnet-5"), "claude-web must expose claude-sonnet-5");
+  // the prior web lineup must survive
+  assert.ok(ids.has("claude-sonnet-4-6"), "claude-web must keep claude-sonnet-4-6");
+  assert.ok(ids.has("claude-haiku-4-5"), "claude-web must keep claude-haiku-4-5");
+});
diff --git a/tests/unit/cli-doctor-liveness-fallback-6162.test.ts b/tests/unit/cli-doctor-liveness-fallback-6162.test.ts
new file mode 100644
index 0000000000..a77ec143e8
--- /dev/null
+++ b/tests/unit/cli-doctor-liveness-fallback-6162.test.ts
@@ -0,0 +1,66 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync, existsSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// Regression test for #6162 (liveness portion): `omniroute doctor` reported
+// "Server liveness: Server responded with HTTP 401" on healthy installs
+// because /api/health and /api/health/degradation both require the management
+// token. The doctor called them without auth → 401 → WARN, even when the
+// Next.js server was clearly alive and listening.
+//
+// Fix: probe the configured health endpoint first; on 401/403, fall back to
+// a publicly served static asset (/favicon.ico) to confirm the server is
+// alive. WARN now only fires when both probes fail.
+//
+// This regression test asserts:
+//   1. The current doctor.mjs source contains the fallback logic.
+//   2. The fallback derives its URL from the primary URL via `new URL()`
+//      so custom host/port/protocol are preserved (Gemini code-assist review).
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
+const DOCTOR_SRC = join(ROOT, "bin/cli/commands/doctor.mjs");
+
+test("doctor.mjs must exist", () => {
+  assert.ok(existsSync(DOCTOR_SRC), "bin/cli/commands/doctor.mjs should exist");
+});
+
+test("doctor.mjs implements a /favicon.ico fallback for unauthenticated liveness (#6162)", () => {
+  const content = readFileSync(DOCTOR_SRC, "utf8");
+
+  assert.ok(
+    content.includes("/favicon.ico"),
+    "doctor.mjs must include /favicon.ico as a fallback probe (fix for #6162)"
+  );
+
+  // The probe order matters: try the configured health endpoint first, then
+  // fall back. Locking the order prevents future refactors from regressing
+  // back to "always report WARN on 401".
+  assert.ok(
+    /\bprimary\.ok\b/.test(content),
+    "doctor.mjs must branch on `primary.ok` to decide whether to fall back to /favicon.ico"
+  );
+});
+
+test("doctor.mjs derives fallback URL from primary URL via new URL() (Gemini review)", () => {
+  const content = readFileSync(DOCTOR_SRC, "utf8");
+
+  assert.ok(
+    content.includes("new URL("),
+    "doctor.mjs must derive the fallback URL from the primary URL via `new URL()` to preserve protocol/host/port (Gemini review feedback on PR #6163)"
+  );
+});
+
+test("doctor.mjs no longer reports WARN on HTTP 401/403 alone", () => {
+  const content = readFileSync(DOCTOR_SRC, "utf8");
+
+  // Old (buggy) line was:
+  //   return warn("Server liveness", `Server responded with HTTP ${response.status}`, { url });
+  // This asserted immediately on !response.ok without considering auth.
+  // The fix should NOT contain that exact phrase anymore.
+  assert.ok(
+    !content.includes("`Server responded with HTTP ${response.status}`"),
+    "doctor.mjs must not contain the buggy 'Server responded with HTTP ${response.status}' warn message (would be hit on auth-required 401)"
+  );
+});
\ No newline at end of file
diff --git a/tests/unit/cli-helper-tool-detector-paths-6162.test.ts b/tests/unit/cli-helper-tool-detector-paths-6162.test.ts
new file mode 100644
index 0000000000..e8810d8db7
--- /dev/null
+++ b/tests/unit/cli-helper-tool-detector-paths-6162.test.ts
@@ -0,0 +1,61 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync, existsSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// Regression test for #6162: published `omniroute doctor` failed with
+// "Could not run CLI tool checks: Cannot find package '@/shared'" because
+// src/lib/cli-helper/*.ts files imported `@/shared/...` aliases that the
+// CLI runtime (tsx + ESM `import()`) cannot resolve. Fix: replace
+// `@/shared/...` with relative imports in the cli-helper files so they work
+// in the published package without a compile step.
+//
+// Lock the fix by asserting that no cli-helper source file uses the
+// `@/shared` alias any more, and that the runtime module load succeeds.
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
+
+const CLI_HELPER_FILES = [
+  "src/lib/cli-helper/tool-detector.ts",
+  "src/lib/cli-helper/claudeProfileAutoSync.ts",
+  "src/lib/cli-helper/codexProfileAutoSync.ts",
+  "src/lib/cli-helper/config-generator/opencode.ts",
+];
+
+for (const file of CLI_HELPER_FILES) {
+  test(`${file} must not use @/shared path alias (fix for #6162)`, () => {
+    const abs = join(ROOT, file);
+    assert.ok(existsSync(abs), `${file} should exist`);
+    const content = readFileSync(abs, "utf8");
+    assert.ok(
+      !/@\/shared/.test(content),
+      `${file} must not import via "@/shared/..." alias — the published CLI runtime (tsx + ESM import) cannot resolve tsconfig path aliases. Use relative paths instead. See #6162.`
+    );
+  });
+}
+
+test("tool-detector.ts is importable at runtime (regression for #6162)", async () => {
+  // This would have failed before the fix with
+  // "Cannot find package '@/shared' imported from .../tool-detector.ts".
+  const mod = await import("../../src/lib/cli-helper/tool-detector.ts");
+  assert.equal(typeof mod.detectAllTools, "function");
+  assert.equal(typeof mod.detectTool, "function");
+});
+
+test("claudeProfileAutoSync.ts is importable at runtime (regression for #6162)", async () => {
+  const mod = await import("../../src/lib/cli-helper/claudeProfileAutoSync.ts");
+  // The module exports at least the sync function; we don't care about its
+  // specific name, only that the import resolves without throwing.
+  assert.equal(typeof mod, "object");
+});
+
+test("codexProfileAutoSync.ts is importable at runtime (regression for #6162)", async () => {
+  const mod = await import("../../src/lib/cli-helper/codexProfileAutoSync.ts");
+  assert.equal(typeof mod, "object");
+});
+
+test("config-generator/opencode.ts is importable at runtime (regression for #6162)", async () => {
+  const mod = await import("../../src/lib/cli-helper/config-generator/opencode.ts");
+  assert.equal(typeof mod, "object");
+});
\ No newline at end of file
diff --git a/tests/unit/cli-serve-hostname.test.ts b/tests/unit/cli-serve-hostname.test.ts
index 64573aa2c1..80eeb6ff9c 100644
--- a/tests/unit/cli-serve-hostname.test.ts
+++ b/tests/unit/cli-serve-hostname.test.ts
@@ -3,27 +3,70 @@ import assert from "node:assert/strict";
 
 /**
  * Replicate the HOSTNAME resolution from bin/cli/commands/serve.mjs to verify
- * that the spawned server honours a HOSTNAME provided via env/.env instead of
- * always hardcoding "0.0.0.0" (#5134). Mirrors the in-file replication pattern
- * used by cli-serve-port.test.ts (serve.mjs spawns processes, so the logic is
- * tested in isolation rather than imported).
+ * the #6194 fix: POSIX shells auto-set HOSTNAME to the machine name, which
+ * collides with the bind address. The fix uses os.hostname() to detect the
+ * auto-set signature and ignores it, while preserving backward compatibility
+ * for explicit HOSTNAME values (e.g. Windows CMD/PowerShell users).
+ *
+ * Resolution order:
+ *   1. OMNIROUTE_SERVER_HOST (new dedicated var — always wins)
+ *   2. HOSTNAME if it does NOT match os.hostname() (legacy backward compat)
+ *   3. "0.0.0.0" (default)
  */
-function resolveHostname(envHostname: string | undefined): string {
-  return envHostname || "0.0.0.0";
+function resolveHostname(
+  envServerHost: string | undefined,
+  envHostname: string | undefined,
+  machineHostname: string
+): string {
+  return envServerHost || (envHostname !== machineHostname ? envHostname : undefined) || "0.0.0.0";
 }
 
-test("serve hostname: honours HOSTNAME env var when set", () => {
-  assert.equal(resolveHostname("127.0.0.1"), "127.0.0.1");
+// --- OMNIROUTE_SERVER_HOST takes precedence ---
+
+test("serve hostname: OMNIROUTE_SERVER_HOST takes precedence over everything", () => {
+  assert.equal(resolveHostname("127.0.0.1", "myhostname", "myhostname"), "127.0.0.1");
 });
 
-test("serve hostname: honours a specific bind interface", () => {
-  assert.equal(resolveHostname("192.168.0.15"), "192.168.0.15");
+test("serve hostname: OMNIROUTE_SERVER_HOST overrides an explicit HOSTNAME", () => {
+  assert.equal(resolveHostname("192.168.1.100", "10.0.0.1", "myhostname"), "192.168.1.100");
 });
 
-test("serve hostname: falls back to 0.0.0.0 when HOSTNAME is unset", () => {
-  assert.equal(resolveHostname(undefined), "0.0.0.0");
+// --- POSIX shell auto-set detection (the #6194 bug) ---
+
+test("serve hostname: POSIX auto-set HOSTNAME (matches os.hostname()) is ignored (#6194)", () => {
+  // bash/zsh sets HOSTNAME=<machine-name>. When it matches os.hostname(),
+  // it's the auto-set signature — must be ignored.
+  assert.equal(resolveHostname(undefined, "myhostname", "myhostname"), "0.0.0.0");
 });
 
-test("serve hostname: falls back to 0.0.0.0 when HOSTNAME is an empty string", () => {
-  assert.equal(resolveHostname(""), "0.0.0.0");
+// --- Backward compatibility for explicit HOSTNAME values ---
+
+test("serve hostname: explicit HOSTNAME (not matching os.hostname()) is preserved", () => {
+  // Windows CMD/PowerShell user who set HOSTNAME=192.168.1.50 in .env
+  // HOSTNAME != os.hostname() → treat as intentional user config
+  assert.equal(resolveHostname(undefined, "192.168.1.50", "myhostname"), "192.168.1.50");
+});
+
+test("serve hostname: localhost as explicit HOSTNAME is preserved", () => {
+  assert.equal(resolveHostname(undefined, "localhost", "myhostname"), "localhost");
+});
+
+// --- Default fallback ---
+
+test("serve hostname: falls back to 0.0.0.0 when both are unset", () => {
+  assert.equal(resolveHostname(undefined, undefined, "myhostname"), "0.0.0.0");
+});
+
+test("serve hostname: falls back to 0.0.0.0 when both are empty strings", () => {
+  assert.equal(resolveHostname("", "", "myhostname"), "0.0.0.0");
+});
+
+test("serve hostname: OMNIROUTE_SERVER_HOST empty string falls through to HOSTNAME check", () => {
+  // Empty string is falsy → falls through; HOSTNAME is auto-set → ignored → 0.0.0.0
+  assert.equal(resolveHostname("", "myhostname", "myhostname"), "0.0.0.0");
+});
+
+test("serve hostname: OMNIROUTE_SERVER_HOST empty string with explicit HOSTNAME", () => {
+  // Empty string is falsy → falls through; HOSTNAME != os.hostname() → used
+  assert.equal(resolveHostname("", "10.0.0.5", "myhostname"), "10.0.0.5");
 });
diff --git a/tests/unit/cline-force-stream.test.ts b/tests/unit/cline-force-stream.test.ts
new file mode 100644
index 0000000000..2c8ea5caaf
--- /dev/null
+++ b/tests/unit/cline-force-stream.test.ts
@@ -0,0 +1,43 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { REGISTRY } from "@omniroute/open-sse/config/providers/index.ts";
+import { resolveStreamFlag } from "@omniroute/open-sse/utils/aiSdkCompat.ts";
+
+// Cline / ClinePass only implement upstream streaming — a non-streaming request
+// returns "generateText is not implemented" / an empty body. They carry
+// `forceStream: true` so chatCore forces the UPSTREAM request to stream
+// (`upstreamStream = stream || isClaudeCodeCompatible || providerRequiresStreaming`)
+// even when the client wants JSON. The client-facing `stream` flag stays as the
+// client sent it, so the `if (!stream)` branch drains the forced upstream SSE and
+// converts it back to JSON via readNonStreamingResponseBody. Regression guard for
+// the "cline model test → generateText is not implemented / STREAM_EARLY_EOF" bug
+// (live-verified on the VPS: stream:true works, stream:false failed). (#6126)
+
+test("cline provider is flagged forceStream (streaming-only upstream)", () => {
+  assert.equal(REGISTRY.cline?.forceStream, true);
+});
+
+test("clinepass provider is flagged forceStream (streaming-only upstream)", () => {
+  assert.equal(REGISTRY.clinepass?.forceStream, true);
+});
+
+test("upstreamStream is forced true for a forceStream provider even when the client sent stream:false", () => {
+  // Mirror the chatCore wiring: providerRequiresStreaming derives from the
+  // registry flag, and upstreamStream ORs it in so the upstream always streams.
+  const providerRequiresStreaming = REGISTRY.cline?.forceStream === true;
+  const isClaudeCodeCompatible = false;
+  const clientStream = false; // client asked for JSON
+  const upstreamStream = clientStream || isClaudeCodeCompatible || providerRequiresStreaming;
+  assert.equal(upstreamStream, true);
+});
+
+test("client-facing stream stays false for a stream:false JSON caller (so SSE→JSON conversion runs)", () => {
+  // chatCore MUST NOT pass providerRequiresStreaming into resolveStreamFlag:
+  // a stream:false client keeps stream=false so the `if (!stream)` branch drains
+  // the forced upstream SSE and returns JSON. Forcing stream=true here would skip
+  // that conversion and yield STREAM_EARLY_EOF for JSON callers.
+  assert.equal(resolveStreamFlag(false, "application/json", "openai"), false);
+  // A stream:true client still streams end-to-end.
+  assert.equal(resolveStreamFlag(true, "application/json", "openai"), true);
+});
diff --git a/tests/unit/cloud-write-auth.test.ts b/tests/unit/cloud-write-auth.test.ts
new file mode 100644
index 0000000000..7a04b1e40b
--- /dev/null
+++ b/tests/unit/cloud-write-auth.test.ts
@@ -0,0 +1,221 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-cloud-write-auth-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.DISABLE_SQLITE_AUTO_BACKUP = "true";
+process.env.JWT_SECRET = "cloud-write-auth-jwt";
+process.env.INITIAL_PASSWORD = "bootstrap-password";
+process.env.API_KEY_SECRET = "cloud-write-auth-api-key-secret";
+
+type ApiKeyRecord = { key: string };
+type ProviderConnectionRecord = {
+  id: string;
+  accessToken?: string | null;
+  refreshToken?: string | null;
+  expiresAt?: string | null;
+};
+
+const core = await import("../../src/lib/db/core.ts");
+const localDb = await import("../../src/lib/localDb.ts");
+const credentialsRoute = await import("../../src/app/api/cloud/credentials/update/route.ts");
+const aliasRoute = await import("../../src/app/api/cloud/models/alias/route.ts");
+
+async function resetStorage() {
+  delete process.env.OMNIROUTE_API_KEY;
+  delete process.env.ROUTER_API_KEY;
+  process.env.INITIAL_PASSWORD = "bootstrap-password";
+  process.env.JWT_SECRET = "cloud-write-auth-jwt";
+  process.env.API_KEY_SECRET = "cloud-write-auth-api-key-secret";
+  core.resetDbInstance();
+  localDb.resetApiKeyState();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+  await localDb.updateSettings({ requireLogin: true, password: "" });
+}
+
+async function createKey(scopes: string[] = []): Promise<ApiKeyRecord> {
+  return localDb.createApiKey(`cloud-write-${scopes.join("-") || "none"}`, "machine-test", scopes);
+}
+
+async function createActiveConnection(): Promise<ProviderConnectionRecord> {
+  const connection = await localDb.createProviderConnection({
+    provider: "openai",
+    authType: "oauth",
+    name: "OpenAI OAuth",
+    email: "owner@example.test",
+    isActive: true,
+    accessToken: "old-access-token",
+    refreshToken: "old-refresh-token",
+    expiresAt: "2026-01-01T00:00:00.000Z",
+  });
+  assert.ok(connection?.id);
+  return connection as ProviderConnectionRecord;
+}
+
+async function readActiveConnection(): Promise<ProviderConnectionRecord> {
+  const [connection] = (await localDb.getProviderConnections({
+    provider: "openai",
+    isActive: true,
+  })) as ProviderConnectionRecord[];
+  assert.ok(connection);
+  return connection;
+}
+
+function credentialUpdateBody() {
+  return {
+    provider: "openai",
+    credentials: {
+      accessToken: "new-access-secret",
+      refreshToken: "new-refresh-secret",
+      expiresIn: 3600,
+    },
+  };
+}
+
+function aliasUpdateBody() {
+  return {
+    model: "openai/gpt-4o-mini",
+    alias: "fast-default",
+  };
+}
+
+function cloudCredentialsRequest(token: string | null, body = credentialUpdateBody()) {
+  const headers = new Headers({ "content-type": "application/json" });
+  if (token) headers.set("authorization", `Bearer ${token}`);
+  return new Request("http://localhost/api/cloud/credentials/update", {
+    method: "PUT",
+    headers,
+    body: JSON.stringify(body),
+  });
+}
+
+function cloudAliasRequest(token: string | null, body = aliasUpdateBody()) {
+  const headers = new Headers({ "content-type": "application/json" });
+  if (token) headers.set("authorization", `Bearer ${token}`);
+  return new Request("http://localhost/api/cloud/models/alias", {
+    method: "PUT",
+    headers,
+    body: JSON.stringify(body),
+  });
+}
+
+async function captureConsoleLog<T>(fn: () => Promise<T>): Promise<{ value: T; logs: string }> {
+  const originalLog = console.log;
+  const entries: string[] = [];
+  console.log = (...args: unknown[]) => {
+    entries.push(args.map((arg) => String(arg)).join(" "));
+  };
+  try {
+    return { value: await fn(), logs: entries.join("\n") };
+  } finally {
+    console.log = originalLog;
+  }
+}
+
+function assertTextDoesNotLeakSecrets(text: string, label: string, secrets: string[]) {
+  for (const secret of secrets) {
+    assert.equal(text.includes(secret), false, `${label} leaked secret: ${secret}`);
+  }
+}
+
+async function assertResponseDoesNotLeakSecrets(response: Response, secrets: string[]) {
+  const text = await response.text();
+  assertTextDoesNotLeakSecrets(text, "response", secrets);
+  return text.length > 0 ? JSON.parse(text) : null;
+}
+
+test.beforeEach(async () => {
+  await resetStorage();
+});
+
+test.after(async () => {
+  core.resetDbInstance();
+  localDb.resetApiKeyState();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+test("PUT /api/cloud/credentials/update rejects valid API key without manage/admin scope and leaves credentials unchanged", async () => {
+  await createActiveConnection();
+  const key = await createKey();
+
+  const { value: response, logs } = await captureConsoleLog(() =>
+    credentialsRoute.PUT(cloudCredentialsRequest(key.key))
+  );
+  const body = await assertResponseDoesNotLeakSecrets(response, [
+    "new-access-secret",
+    "new-refresh-secret",
+  ]);
+  assertTextDoesNotLeakSecrets(logs, "logs", ["new-access-secret", "new-refresh-secret"]);
+  const connection = await readActiveConnection();
+
+  assert.equal(response.status, 403);
+  assert.match(body.error?.message || "", /manage/);
+  assert.equal(connection.accessToken, "old-access-token");
+  assert.equal(connection.refreshToken, "old-refresh-token");
+  assert.equal(connection.expiresAt, "2026-01-01T00:00:00.000Z");
+});
+
+test("PUT /api/cloud/models/alias rejects valid API key without manage/admin scope and leaves aliases unchanged", async () => {
+  await localDb.setModelAlias("fast-default", "openai/original-model");
+  const key = await createKey();
+
+  const { value: response, logs } = await captureConsoleLog(() =>
+    aliasRoute.PUT(cloudAliasRequest(key.key))
+  );
+  const body = await assertResponseDoesNotLeakSecrets(response, ["openai/gpt-4o-mini"]);
+  assertTextDoesNotLeakSecrets(logs, "logs", ["openai/gpt-4o-mini"]);
+  const aliases = await localDb.getModelAliases();
+
+  assert.equal(response.status, 403);
+  assert.match(body.error?.message || "", /manage/);
+  assert.equal(aliases["fast-default"], "openai/original-model");
+});
+
+test("PUT /api/cloud/credentials/update accepts API key with manage scope", async () => {
+  await createActiveConnection();
+  const key = await createKey(["manage"]);
+
+  const response = await credentialsRoute.PUT(cloudCredentialsRequest(key.key));
+  const body = await response.json();
+  const connection = await readActiveConnection();
+
+  assert.equal(response.status, 200);
+  assert.equal(body.success, true);
+  assert.equal(connection.accessToken, "new-access-secret");
+  assert.equal(connection.refreshToken, "new-refresh-secret");
+  assert.notEqual(connection.expiresAt, "2026-01-01T00:00:00.000Z");
+});
+
+test("PUT /api/cloud/models/alias accepts API key with manage scope", async () => {
+  const key = await createKey(["manage"]);
+
+  const response = await aliasRoute.PUT(cloudAliasRequest(key.key));
+  const body = await response.json();
+  const aliases = await localDb.getModelAliases();
+
+  assert.equal(response.status, 200);
+  assert.equal(body.success, true);
+  assert.equal(aliases["fast-default"], "openai/gpt-4o-mini");
+});
+
+test("cloud write routes keep 401 for missing or invalid Bearer credentials", async () => {
+  await createActiveConnection();
+
+  const { value: missing, logs: missingLogs } = await captureConsoleLog(() =>
+    credentialsRoute.PUT(cloudCredentialsRequest(null))
+  );
+  const { value: invalid, logs: invalidLogs } = await captureConsoleLog(() =>
+    aliasRoute.PUT(cloudAliasRequest("sk-invalid"))
+  );
+  await assertResponseDoesNotLeakSecrets(missing, ["new-access-secret", "new-refresh-secret"]);
+  await assertResponseDoesNotLeakSecrets(invalid, ["openai/gpt-4o-mini"]);
+  assertTextDoesNotLeakSecrets(missingLogs, "logs", ["new-access-secret", "new-refresh-secret"]);
+  assertTextDoesNotLeakSecrets(invalidLogs, "logs", ["openai/gpt-4o-mini"]);
+
+  assert.equal(missing.status, 401);
+  assert.equal(invalid.status, 401);
+});
diff --git a/tests/unit/combo-context-relay.test.ts b/tests/unit/combo-context-relay.test.ts
index 66ef46fef5..ea36bba079 100644
--- a/tests/unit/combo-context-relay.test.ts
+++ b/tests/unit/combo-context-relay.test.ts
@@ -542,7 +542,20 @@ test("context_cache_protection: pins body.model to last session model when histo
   const comboName = "cache-pin-combo";
 
   // Pre-record a prior model usage for this session/combo
-  handoffDb.recordSessionModelUsage(sessionId, comboName, "anthropic/claude-3-5-sonnet", "anthropic");
+  handoffDb.recordSessionModelUsage(
+    sessionId,
+    comboName,
+    "anthropic/claude-3-5-sonnet",
+    "anthropic"
+  );
+
+  // Ensure anthropic provider has an active connection so the pin isn't
+  // dropped by isPinnedModelDurablyUnhealthy (no connections = durably down).
+  const db = core.getDbInstance();
+  db.prepare(
+    `INSERT OR IGNORE INTO provider_connections (id, provider, auth_type, name, is_active, test_status, created_at, updated_at)
+     VALUES ('test-anthropic-conn', 'anthropic', 'api_key', 'test-anthropic', 1, 'active', datetime('now'), datetime('now'))`
+  ).run();
 
   const capturedModels: string[] = [];
 
@@ -609,5 +622,54 @@ test("context_cache_protection: does NOT pin when no session history exists (fir
 
   assert.equal(result.ok, true);
   // No pinning on first request — should use the combo's first model
-  assert.equal(capturedModels[0], "openai/gpt-4o", "first request must use combo model (no pinning)");
+  assert.equal(
+    capturedModels[0],
+    "openai/gpt-4o",
+    "first request must use combo model (no pinning)"
+  );
+});
+
+// ── clearSessionModelHistoryForCombo ────────────────────────────────────────
+// Proves that clearing pins for a combo name removes stale session history,
+// so that after a combo edit the next request does NOT use the old pinned model.
+
+test("clearSessionModelHistoryForCombo removes all pins for a combo", async () => {
+  const comboName = "test-clear-pins";
+
+  // Seed history for two different sessions on the same combo
+  handoffDb.recordSessionModelUsage("sess-A", comboName, "openai/gpt-4o", "openai");
+  handoffDb.recordSessionModelUsage(
+    "sess-B",
+    comboName,
+    "anthropic/claude-3-5-sonnet",
+    "anthropic"
+  );
+
+  // Sanity: pins exist
+  assert.equal(handoffDb.getLastSessionModel("sess-A", comboName), "openai/gpt-4o");
+  assert.equal(handoffDb.getLastSessionModel("sess-B", comboName), "anthropic/claude-3-5-sonnet");
+
+  // Clear pins for this combo
+  const cleared = handoffDb.clearSessionModelHistoryForCombo(comboName);
+  assert.ok(cleared >= 2, `should have cleared at least 2 entries, got ${cleared}`);
+
+  // Pins are gone
+  assert.equal(handoffDb.getLastSessionModel("sess-A", comboName), null);
+  assert.equal(handoffDb.getLastSessionModel("sess-B", comboName), null);
+});
+
+test("clearSessionModelHistoryForCombo does not affect other combos", async () => {
+  const comboA = "combo-keep";
+  const comboB = "combo-clear";
+
+  handoffDb.recordSessionModelUsage("sess-1", comboA, "openai/gpt-4o", "openai");
+  handoffDb.recordSessionModelUsage("sess-1", comboB, "anthropic/claude-3-5-sonnet", "anthropic");
+
+  // Clear only comboB
+  handoffDb.clearSessionModelHistoryForCombo(comboB);
+
+  // comboA is untouched
+  assert.equal(handoffDb.getLastSessionModel("sess-1", comboA), "openai/gpt-4o");
+  // comboB is cleared
+  assert.equal(handoffDb.getLastSessionModel("sess-1", comboB), null);
 });
diff --git a/tests/unit/combo-disable-session-stickiness.test.ts b/tests/unit/combo-disable-session-stickiness.test.ts
new file mode 100644
index 0000000000..88bfca2d4b
--- /dev/null
+++ b/tests/unit/combo-disable-session-stickiness.test.ts
@@ -0,0 +1,233 @@
+/**
+ * tests/unit/combo-disable-session-stickiness.test.ts
+ *
+ * #6168 — "disable session stickiness" opt-out toggle.
+ *
+ * Two things are covered:
+ *  1. resolveDisableSessionStickiness(config, settings) — the real production
+ *     resolver used at BOTH call sites in open-sse/services/combo.ts:
+ *       per-combo config.disableSessionStickiness (boolean)
+ *         → global settings.disableSessionStickiness (boolean)
+ *         → default false.
+ *  2. The GATE behavior — the exact ternary combo.ts uses at both the main
+ *     dispatch loop (combo.ts ~1078) and the round-robin handler (combo.ts ~2404):
+ *       const disable = resolveDisableSessionStickiness(config, settings);
+ *       const result = disable
+ *         ? { targets, messageHash: null, stuck: false }
+ *         : await applySessionStickiness(targets, messages);
+ *     With the flag ON, applySessionStickiness must NOT run (targets left as-is,
+ *     stuck:false, messageHash:null → recordStickyBinding write-back is skipped)
+ *     EVEN THOUGH a healthy sticky binding exists. With the flag OFF/absent the
+ *     conversation still pins to its sticky connection (#3825 preserved).
+ *
+ * Saturation is injected via __setStickinessHeadroomFetcherForTests — no network,
+ * no DB, fully deterministic.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import type { HeadroomSaturation } from "../../open-sse/services/combo/headroomRanking.ts";
+import type { ResolvedComboTarget } from "../../open-sse/services/combo/types.ts";
+
+const mod = await import("../../open-sse/services/combo/sessionStickiness.ts");
+const {
+  applySessionStickiness,
+  recordStickyBinding,
+  clearAllStickyBindings,
+  deriveMessageHash,
+  resolveDisableSessionStickiness,
+  __setStickinessHeadroomFetcherForTests,
+} = mod;
+
+function makeTarget(connectionId: string): ResolvedComboTarget {
+  return {
+    kind: "model",
+    stepId: `step-${connectionId}`,
+    executionKey: `key-${connectionId}`,
+    modelStr: `gpt-4/${connectionId}`,
+    provider: "openai",
+    providerId: null,
+    connectionId,
+    weight: 1,
+    label: null,
+  };
+}
+
+function injectSat(sat: HeadroomSaturation | undefined): void {
+  __setStickinessHeadroomFetcherForTests(async (_id: string) => sat);
+}
+
+/**
+ * Faithful reproduction of the gate the production call sites use (combo.ts
+ * ~1078 main dispatch and ~2404 round-robin — the expression is identical at
+ * both). `applySessionStickiness` is wrapped so we can OBSERVE whether it ran.
+ */
+async function gatedStickiness(
+  targets: ResolvedComboTarget[],
+  messages: Array<{ role?: string; content?: unknown }> | null | undefined,
+  config: Record<string, unknown> | null | undefined,
+  settings: Record<string, unknown> | null | undefined,
+  observe: { called: number }
+) {
+  const disable = resolveDisableSessionStickiness(config, settings);
+  if (disable) {
+    // No-op — applySessionStickiness NOT invoked (recordStickyBinding skipped).
+    return { targets, messageHash: null as string | null, stuck: false };
+  }
+  observe.called += 1;
+  return applySessionStickiness(targets, messages);
+}
+
+test.beforeEach(() => {
+  clearAllStickyBindings();
+  injectSat({ util5h: 0.1, util7d: 0.1 }); // healthy — headroom ~0.9
+});
+
+test.after(() => {
+  __setStickinessHeadroomFetcherForTests(null);
+});
+
+// ─── resolveDisableSessionStickiness (production resolver) ────────────────────
+
+test("resolver: default false when neither config nor settings set it", () => {
+  assert.equal(resolveDisableSessionStickiness({}, {}), false);
+  assert.equal(resolveDisableSessionStickiness(null, null), false);
+  assert.equal(resolveDisableSessionStickiness(undefined, undefined), false);
+});
+
+test("resolver: global settings fallback (AC #3 global on)", () => {
+  assert.equal(
+    resolveDisableSessionStickiness({}, { disableSessionStickiness: true }),
+    true
+  );
+  assert.equal(
+    resolveDisableSessionStickiness({}, { disableSessionStickiness: false }),
+    false
+  );
+});
+
+test("resolver: per-combo config wins over global (AC #3 precedence)", () => {
+  // combo true beats global false
+  assert.equal(
+    resolveDisableSessionStickiness(
+      { disableSessionStickiness: true },
+      { disableSessionStickiness: false }
+    ),
+    true
+  );
+  // combo false beats global true
+  assert.equal(
+    resolveDisableSessionStickiness(
+      { disableSessionStickiness: false },
+      { disableSessionStickiness: true }
+    ),
+    false
+  );
+});
+
+test("resolver: non-boolean per-combo value is ignored, falls back to global", () => {
+  assert.equal(
+    resolveDisableSessionStickiness(
+      { disableSessionStickiness: "true" as unknown as boolean },
+      { disableSessionStickiness: true }
+    ),
+    true
+  );
+});
+
+// ─── Gate behavior — flag ON bypasses stickiness on both paths ────────────────
+
+test("flag ON (per-combo): applySessionStickiness is bypassed even with a healthy binding", async () => {
+  const targets = [makeTarget("conn-A"), makeTarget("conn-B"), makeTarget("conn-C")];
+  const messages = [{ role: "user", content: "identical first message" }];
+  const hash = deriveMessageHash(messages)!;
+  recordStickyBinding(hash, "conn-C"); // would normally pin conn-C to index 0
+
+  const observe = { called: 0 };
+  const result = await gatedStickiness(
+    targets,
+    messages,
+    { disableSessionStickiness: true },
+    { disableSessionStickiness: false },
+    observe
+  );
+
+  assert.equal(observe.called, 0, "applySessionStickiness must NOT be called when disabled");
+  assert.equal(result.stuck, false, "no stickiness applied");
+  assert.equal(result.messageHash, null, "no hash → recordStickyBinding write-back skipped");
+  assert.deepEqual(
+    result.targets.map((t) => t.connectionId),
+    ["conn-A", "conn-B", "conn-C"],
+    "targets left untouched (no reordering to the sticky connection)"
+  );
+});
+
+test("flag ON (global settings): identical first message fans out to distinct targets across N requests", async () => {
+  const targets = [makeTarget("conn-A"), makeTarget("conn-B"), makeTarget("conn-C")];
+  const messages = [{ role: "user", content: "same first message every time" }];
+  const hash = deriveMessageHash(messages)!;
+  recordStickyBinding(hash, "conn-B");
+
+  // Simulate the round-robin start-index rotation the RR handler applies AFTER
+  // the (now-bypassed) stickiness step: rrStartIndex stays at the rotation
+  // counter instead of being overridden to the sticky target's index.
+  const firstOfEach: string[] = [];
+  for (let i = 0; i < 3; i++) {
+    const observe = { called: 0 };
+    const result = await gatedStickiness(
+      targets,
+      messages,
+      {},
+      { disableSessionStickiness: true },
+      observe
+    );
+    assert.equal(observe.called, 0);
+    assert.equal(result.stuck, false);
+    // Rotation is free to pick index i since stickiness did not force index 0.
+    firstOfEach.push(result.targets[i % targets.length].connectionId!);
+  }
+  assert.deepEqual(
+    firstOfEach,
+    ["conn-A", "conn-B", "conn-C"],
+    "rotation is free — not collapsed onto the sticky connection"
+  );
+});
+
+// ─── Regression: flag OFF/absent preserves #3825 stickiness ───────────────────
+
+test("flag OFF/absent: identical first message still pins to the same target (#3825 preserved)", async () => {
+  const targets = [makeTarget("conn-A"), makeTarget("conn-B"), makeTarget("conn-C")];
+  const messages = [{ role: "user", content: "identical first message" }];
+  const hash = deriveMessageHash(messages)!;
+  recordStickyBinding(hash, "conn-C");
+
+  const observe = { called: 0 };
+  const r1 = await gatedStickiness(targets, messages, {}, {}, observe);
+  const r2 = await gatedStickiness(targets, messages, {}, {}, observe);
+
+  assert.equal(observe.called, 2, "applySessionStickiness runs on the default path");
+  assert.ok(r1.stuck, "first request pins to sticky connection");
+  assert.ok(r2.stuck, "second request stays pinned");
+  assert.equal(r1.targets[0].connectionId, "conn-C");
+  assert.equal(r2.targets[0].connectionId, "conn-C");
+});
+
+test("flag explicit false (per-combo) also preserves stickiness", async () => {
+  const targets = [makeTarget("conn-A"), makeTarget("conn-B")];
+  const messages = [{ role: "user", content: "pin me" }];
+  const hash = deriveMessageHash(messages)!;
+  recordStickyBinding(hash, "conn-B");
+
+  const observe = { called: 0 };
+  const result = await gatedStickiness(
+    targets,
+    messages,
+    { disableSessionStickiness: false },
+    { disableSessionStickiness: true }, // per-combo false must win
+    observe
+  );
+
+  assert.equal(observe.called, 1, "per-combo false → stickiness still runs");
+  assert.ok(result.stuck);
+  assert.equal(result.targets[0].connectionId, "conn-B");
+});
diff --git a/tests/unit/combo-provider-cooldown-sibling.test.ts b/tests/unit/combo-provider-cooldown-sibling.test.ts
new file mode 100644
index 0000000000..562173fccc
--- /dev/null
+++ b/tests/unit/combo-provider-cooldown-sibling.test.ts
@@ -0,0 +1,140 @@
+// tests/unit/combo-provider-cooldown-sibling.test.ts
+// Regression test for the provider cooldown blocking sibling models after a 500.
+// When gemini/gemma-4-31b-it returns 500, the provider cooldown must NOT block
+// gemini/gemma-4-26b-a4b-it from being tried.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import {
+  recordProviderCooldown,
+  isProviderInCooldown,
+  clearCooldownState,
+  getRemainingCooldownMs,
+} from "../../open-sse/services/providerCooldownTracker.ts";
+import { hasPerModelQuota } from "../../open-sse/services/accountFallback.ts";
+
+const settings = {
+  providerCooldown: {
+    enabled: true,
+    minRetryCooldownMs: 1000,
+    maxRetryCooldownMs: 60000,
+  },
+};
+
+test("provider cooldown records and blocks same provider", () => {
+  clearCooldownState();
+  recordProviderCooldown("openai", "conn-1", settings);
+  assert.ok(isProviderInCooldown("openai", "conn-1", settings));
+  assert.ok(getRemainingCooldownMs("openai", "conn-1", settings) > 0);
+});
+
+test("per-model-quota provider (gemini) has per-model quota = true", () => {
+  assert.equal(hasPerModelQuota("gemini", "gemma-4-31b-it"), true);
+  assert.equal(hasPerModelQuota("gemini", "gemma-4-26b-a4b-it"), true);
+  assert.equal(hasPerModelQuota("github", "some-model"), true);
+});
+
+test("non-per-model-quota provider (openai) has per-model quota = false", () => {
+  assert.equal(hasPerModelQuota("openai", "gpt-4"), false);
+});
+
+test("provider cooldown for gemini blocks sibling models (current behavior — the bug)", () => {
+  clearCooldownState();
+  // Simulate what combo.ts does: record cooldown for gemini after a 500
+  recordProviderCooldown("gemini", "conn-1", settings);
+  // Both models on the same provider/connection are blocked
+  assert.ok(isProviderInCooldown("gemini", "conn-1", settings));
+});
+
+// ── Verify the fix: combo.ts skips cooldown for per-model-quota on 500 ──
+
+test("fix: combo skips provider cooldown for per-model-quota provider on 500", () => {
+  clearCooldownState();
+  const provider = "gemini";
+  const rawModel = "gemma-4-31b-it";
+  const status = 500;
+
+  // The fix condition: skip cooldown when status is 500 AND provider has per-model quota
+  const shouldSkipCooldown = status === 500 && hasPerModelQuota(provider, rawModel);
+  assert.equal(shouldSkipCooldown, true, "Gemini 500 should skip cooldown");
+
+  // If the fix is applied, cooldown is NOT recorded
+  if (!shouldSkipCooldown) {
+    recordProviderCooldown(provider, "conn-1", settings);
+  }
+  assert.equal(
+    isProviderInCooldown(provider, "conn-1", settings),
+    false,
+    "Gemini should NOT be in cooldown after 500 (sibling models must still be tried)"
+  );
+});
+
+test("fix: combo still records cooldown for per-model-quota provider on 503", () => {
+  clearCooldownState();
+  const provider = "gemini";
+  const rawModel = "gemma-4-31b-it";
+  const status = 503;
+
+  const shouldSkipCooldown = status === 500 && hasPerModelQuota(provider, rawModel);
+  assert.equal(shouldSkipCooldown, false, "Gemini 503 should NOT skip cooldown");
+
+  // Cooldown IS recorded for non-500 errors
+  if (!shouldSkipCooldown) {
+    recordProviderCooldown(provider, "conn-1", settings);
+  }
+  assert.equal(
+    isProviderInCooldown(provider, "conn-1", settings),
+    true,
+    "Gemini should be in cooldown after 503"
+  );
+});
+
+test("fix: combo still records cooldown for non-per-model-quota provider on 500", () => {
+  clearCooldownState();
+  const provider = "openai";
+  const rawModel = "gpt-4";
+  const status = 500;
+
+  const shouldSkipCooldown = status === 500 && hasPerModelQuota(provider, rawModel);
+  assert.equal(shouldSkipCooldown, false, "OpenAI 500 should NOT skip cooldown");
+
+  if (!shouldSkipCooldown) {
+    recordProviderCooldown(provider, "conn-1", settings);
+  }
+  assert.equal(
+    isProviderInCooldown(provider, "conn-1", settings),
+    true,
+    "OpenAI should be in cooldown after 500"
+  );
+});
+
+// ── Source guards: auth.ts must not model-lockout Gemini on 500 ──
+
+test("source guard: auth.ts skips model lockout for per-model-quota providers on 500+", () => {
+  const src = fs.readFileSync(
+    path.join(process.cwd(), "src", "sse", "services", "auth.ts"),
+    "utf-8"
+  );
+  // The fix adds an early return for status >= 500 that skips recordModelLockoutFailure
+  assert.ok(
+    src.includes("status >= 500") && src.includes("no model lockout"),
+    "auth.ts must have a guard that skips model lockout for 500+ server errors on per-model-quota providers"
+  );
+  // Verify the early return sends cooldownMs: 0 (no cooldown for sibling models)
+  assert.ok(
+    src.includes("cooldownMs: 0") && src.includes("sibling models"),
+    "auth.ts must return cooldownMs: 0 for per-model-quota 500 errors to allow sibling retries"
+  );
+});
+
+test("source guard: combo.ts skips provider cooldown for per-model-quota on 500", () => {
+  const src = fs.readFileSync(
+    path.join(process.cwd(), "open-sse", "services", "combo.ts"),
+    "utf-8"
+  );
+  assert.ok(
+    src.includes("hasPerModelQuota(provider, rawModel)") && src.includes("recordProviderCooldown"),
+    "combo.ts must skip provider cooldown recording for per-model-quota providers on 500"
+  );
+});
diff --git a/tests/unit/combo-streaming-empty-content-failover.test.ts b/tests/unit/combo-streaming-empty-content-failover.test.ts
index f623cd1bd1..1d38c10b76 100644
--- a/tests/unit/combo-streaming-empty-content-failover.test.ts
+++ b/tests/unit/combo-streaming-empty-content-failover.test.ts
@@ -273,3 +273,22 @@ test("#3685 streaming is preserved for non-empty response: clonedResponse body y
   assert.ok(decoded.includes("Hello"), "decoded body must contain the actual text content");
   assert.ok(decoded.includes(", world!"), "decoded body must contain the full text delta");
 });
+
+test("#5976 truly EMPTY streaming body (zero bytes) → invalid for combo failover", async () => {
+  // A 200 SSE response whose body closes without emitting a single byte
+  // (e.g. Gemini returning HTTP 200 with an empty body) cannot carry content —
+  // fail over to the sibling model. Streams with ANY SSE activity (an explicit
+  // [DONE], ping/metadata events) keep the pass-through contract (#3399/#3685).
+  const emptyBody = new ReadableStream<Uint8Array>({
+    start(controller) {
+      controller.close();
+    },
+  });
+  const res = new Response(emptyBody, {
+    status: 200,
+    headers: { "content-type": "text/event-stream" },
+  });
+  const out = await validateResponseQuality(res, true, silentLog);
+  assert.equal(out.valid, false, "zero-byte streaming body must trigger failover");
+  assert.equal(out.reason, "streaming no recognized content");
+});
diff --git a/tests/unit/copilot-gemini-claude-route-no-responses.test.ts b/tests/unit/copilot-gemini-claude-route-no-responses.test.ts
index e4d9685d13..751cf98713 100644
--- a/tests/unit/copilot-gemini-claude-route-no-responses.test.ts
+++ b/tests/unit/copilot-gemini-claude-route-no-responses.test.ts
@@ -23,10 +23,17 @@ import assert from "node:assert/strict";
 
 import { GithubExecutor } from "../../open-sse/executors/github.ts";
 import { PROVIDER_MODELS } from "../../open-sse/config/providerModels.ts";
+import type { RegistryModel } from "../../open-sse/config/providerRegistry.ts";
 
 const CHAT_URL = "https://api.githubcopilot.com/chat/completions";
 const RESPONSES_URL = "https://api.githubcopilot.com/responses";
 
+function getGithubModel(modelId: string): RegistryModel {
+  const model = PROVIDER_MODELS["gh"]?.find((entry) => entry.id === modelId);
+  assert.ok(model, `${modelId} must be registered`);
+  return model;
+}
+
 describe("GithubExecutor — Gemini/Claude must never hit /responses (port 9router#1536)", () => {
   it("routes registered Claude/Gemini Copilot models to chat/completions", () => {
     const exec = new GithubExecutor();
@@ -34,11 +41,15 @@ describe("GithubExecutor — Gemini/Claude must never hit /responses (port 9rout
       "claude-haiku-4.5",
       "claude-sonnet-4.5",
       "claude-sonnet-4.6",
+      "claude-sonnet-5",
+      "claude-fable-5",
       "claude-opus-4.6",
       "claude-opus-4.7",
-      "claude-opus-4-5-20251101",
+      "claude-opus-4.8",
+      "claude-opus-4.8-fast",
+      "claude-opus-4.5",
       "gemini-3.1-pro-preview",
-      "gemini-3-flash-preview",
+      "gemini-3.5-flash",
     ]) {
       assert.equal(exec.buildUrl(id, false), CHAT_URL, `${id} must route to chat/completions`);
     }
@@ -46,48 +57,51 @@ describe("GithubExecutor — Gemini/Claude must never hit /responses (port 9rout
 
   it("still uses chat/completions if a Claude/Gemini model is wrongly tagged openai-responses", () => {
     const exec = new GithubExecutor();
-    const ghModels = PROVIDER_MODELS["gh"];
-    assert.ok(Array.isArray(ghModels), "gh provider models registry must exist");
-
-    const claude = ghModels.find((m: any) => m.id === "claude-sonnet-4.6");
-    const gemini = ghModels.find((m: any) => m.id === "gemini-3.1-pro-preview");
-    assert.ok(claude && gemini, "claude-sonnet-4.6 and gemini-3.1-pro-preview must be registered");
+    const claude = getGithubModel("claude-sonnet-4.6");
+    const gemini = getGithubModel("gemini-3.1-pro-preview");
 
     const originalClaude = claude.targetFormat;
     const originalGemini = gemini.targetFormat;
     try {
       // Simulate a future misconfiguration. The guard must still hold.
-      (claude as any).targetFormat = "openai-responses";
-      (gemini as any).targetFormat = "openai-responses";
+      claude.targetFormat = "openai-responses";
+      gemini.targetFormat = "openai-responses";
 
       assert.equal(exec.buildUrl("claude-sonnet-4.6", false), CHAT_URL);
       assert.equal(exec.buildUrl("gemini-3.1-pro-preview", false), CHAT_URL);
     } finally {
-      (claude as any).targetFormat = originalClaude;
-      (gemini as any).targetFormat = originalGemini;
+      claude.targetFormat = originalClaude;
+      gemini.targetFormat = originalGemini;
     }
   });
 
   it("still routes registered OpenAI/codex Copilot models to /responses", () => {
     const exec = new GithubExecutor();
-    for (const id of ["gpt-5-mini", "gpt-5.3-codex", "gpt-5.4-mini", "gpt-5.4"]) {
+    for (const id of [
+      "gpt-5.3-codex",
+      "gpt-5.4-mini",
+      "gpt-5.4",
+      "gpt-5.5",
+      "mai-code-1-flash",
+      "gpt-5-mini",
+      "oswe-vscode-prime",
+    ]) {
       assert.equal(exec.buildUrl(id, false), RESPONSES_URL, `${id} must route to /responses`);
     }
   });
 
   it("is case-insensitive when guarding (defensive against upper/mixed-case ids)", () => {
     const exec = new GithubExecutor();
-    const ghModels = PROVIDER_MODELS["gh"];
-    const claude = ghModels.find((m: any) => m.id === "claude-sonnet-4.6");
+    const claude = getGithubModel("claude-sonnet-4.6");
     const original = claude.targetFormat;
     try {
-      (claude as any).targetFormat = "openai-responses";
+      claude.targetFormat = "openai-responses";
       // Look up by the same id (registry is case-sensitive on lookup) but with a
       // mixed-case path through the guard. We rebuild with the registered id;
       // the guard normalizes before substring check, so it must still detect.
       assert.equal(exec.buildUrl("claude-sonnet-4.6", false), CHAT_URL);
     } finally {
-      (claude as any).targetFormat = original;
+      claude.targetFormat = original;
     }
   });
 });
diff --git a/tests/unit/decrypt-stale-key-hint-6148.test.ts b/tests/unit/decrypt-stale-key-hint-6148.test.ts
new file mode 100644
index 0000000000..2622d0fc1a
--- /dev/null
+++ b/tests/unit/decrypt-stale-key-hint-6148.test.ts
@@ -0,0 +1,91 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+// #6148 — A decryption failure caused by a stale/changed STORAGE_ENCRYPTION_KEY
+// must surface as a clear, specific error (HTTP 424, type
+// "storage_encryption_stale") instead of the misleading "Auth failed: 401" that
+// resulted from coercing the null credential to "" and sending an empty Bearer
+// token upstream.
+
+const ORIGINAL_STORAGE_KEY = process.env.STORAGE_ENCRYPTION_KEY;
+
+// Cache-busted fresh import so the encryption module re-derives its key from the
+// current STORAGE_ENCRYPTION_KEY (module-level key cache would otherwise persist).
+async function importFresh(modulePath: string) {
+  const url = pathToFileURL(path.resolve(modulePath)).href;
+  return import(`${url}?test=${Date.now()}-${Math.random().toString(16).slice(2)}`);
+}
+
+test.after(() => {
+  if (ORIGINAL_STORAGE_KEY === undefined) {
+    delete process.env.STORAGE_ENCRYPTION_KEY;
+  } else {
+    process.env.STORAGE_ENCRYPTION_KEY = ORIGINAL_STORAGE_KEY;
+  }
+});
+
+test("decryptConnectionFields flags a credential that no longer decrypts (#6148)", async () => {
+  // 1. Encrypt an apiKey under key A.
+  process.env.STORAGE_ENCRYPTION_KEY = "stale-key-6148-A";
+  const encA = await importFresh("src/lib/db/encryption.ts");
+  const ciphertext = encA.encrypt("sk-real-secret-key");
+  assert.match(ciphertext, /^enc:v1:/, "expected a real enc:v1 ciphertext");
+
+  // 2. Read it back under a DIFFERENT key B (simulating a changed key).
+  process.env.STORAGE_ENCRYPTION_KEY = "stale-key-6148-B";
+  const encB = await importFresh("src/lib/db/encryption.ts");
+
+  const decrypted = encB.decryptConnectionFields({
+    provider: "openai",
+    apiKey: ciphertext,
+  });
+
+  // The credential fails to decrypt (null) but the guard flag distinguishes this
+  // from a genuinely empty credential.
+  assert.equal(decrypted.apiKey, null, "stale key must decrypt to null");
+  assert.equal(
+    decrypted.credentialDecryptFailed,
+    true,
+    "undecryptable ciphertext must set credentialDecryptFailed"
+  );
+  assert.equal(encB.looksEncrypted(ciphertext), true);
+});
+
+test("a genuinely empty credential is NOT flagged as decrypt failure (#6148)", async () => {
+  process.env.STORAGE_ENCRYPTION_KEY = "stale-key-6148-empty";
+  const enc = await importFresh("src/lib/db/encryption.ts");
+
+  const decrypted = enc.decryptConnectionFields({ provider: "openai", apiKey: null });
+  assert.notEqual(decrypted.credentialDecryptFailed, true, "empty credential must not flag");
+});
+
+test("models route guard returns HTTP 424 storage_encryption_stale (#6148)", async () => {
+  const guard = await importFresh(
+    "src/app/api/providers/[id]/models/staleEncryptionGuard.ts"
+  );
+
+  // Connection flagged by decryptConnectionFields (stale key).
+  const staleResponse = guard.buildStaleEncryptionKeyResponse({
+    provider: "openai",
+    apiKey: null,
+    credentialDecryptFailed: true,
+  });
+
+  assert.ok(staleResponse, "guard must return a response for a stale connection");
+  assert.equal(staleResponse.status, 424, "must be HTTP 424, not an upstream 401");
+
+  const body = await staleResponse.json();
+  assert.equal(body.error.type, "storage_encryption_stale");
+  assert.match(body.error.message, /decrypt/i);
+  // Rule #12 — no stack trace leakage in the error body.
+  assert.equal(body.error.message.includes("at /"), false);
+
+  // A healthy connection must NOT be short-circuited.
+  const okResponse = guard.buildStaleEncryptionKeyResponse({
+    provider: "openai",
+    apiKey: "sk-real-secret-key",
+  });
+  assert.equal(okResponse, null, "healthy connection must proceed (null)");
+});
diff --git a/tests/unit/earlyStreamKeepalive.test.ts b/tests/unit/earlyStreamKeepalive.test.ts
new file mode 100644
index 0000000000..c7a1594ca9
--- /dev/null
+++ b/tests/unit/earlyStreamKeepalive.test.ts
@@ -0,0 +1,164 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { withEarlyStreamKeepalive } from "../../open-sse/utils/earlyStreamKeepalive.ts";
+
+const ENCODER = new TextEncoder();
+const DECODER = new TextDecoder();
+
+async function drainStream(body: ReadableStream<Uint8Array>): Promise<string> {
+  const reader = body.getReader();
+  let text = "";
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    text += DECODER.decode(value, { stream: true });
+  }
+  return text;
+}
+
+function makeSseStream(chunks: string[]): ReadableStream<Uint8Array> {
+  const encoded = chunks.map((c) => ENCODER.encode(c));
+  let idx = 0;
+  return new ReadableStream<Uint8Array>({
+    pull(controller) {
+      if (idx < encoded.length) controller.enqueue(encoded[idx++]);
+      else controller.close();
+    },
+  });
+}
+
+// ── Fast path: handler resolves within threshold ──────────────────────────
+
+test("fast path returns handler response verbatim", async () => {
+  const response = new Response("hello", { status: 200 });
+  const result = await withEarlyStreamKeepalive(Promise.resolve(response), {
+    thresholdMs: 5000,
+  });
+  assert.equal(result.status, 200);
+  const text = await result.text();
+  assert.equal(text, "hello");
+});
+
+// ── Slow path: SSE stream forwarded correctly ─────────────────────────────
+
+test("slow path forwards SSE stream content", async () => {
+  const sseBody = makeSseStream([
+    'data: {"choices":[{"delta":{"content":"hello"}}]}\n\n',
+    'data: {"choices":[{"delta":{"content":" world"}}]}\n\n',
+    "data: [DONE]\n\n",
+  ]);
+  const response = new Response(sseBody, {
+    status: 200,
+    headers: { "content-type": "text/event-stream" },
+  });
+
+  // Delay resolution past threshold to trigger slow path
+  const delayed = new Promise<Response>((resolve) => setTimeout(() => resolve(response), 100));
+
+  const result = await withEarlyStreamKeepalive(delayed, {
+    thresholdMs: 10, // very low to ensure slow path
+    intervalMs: 50,
+  });
+
+  assert.equal(result.status, 200);
+  const text = await drainStream(result.body!);
+  assert.ok(text.includes("hello"), "should contain first chunk");
+  assert.ok(text.includes("world"), "should contain second chunk");
+  assert.ok(text.includes("[DONE]"), "should contain DONE marker");
+});
+
+// ── Upstream error with 0 bytes → error frame emitted ─────────────────────
+
+test("upstream error with 0 bytes forwarded emits error frame", { skip: true, todo: "ReadableStream error simulation hangs in Node.js test runner" }, async () => {
+  // Use a TransformStream where we error the writable side
+  const { readable, writable } = new TransformStream<Uint8Array, Uint8Array>();
+  const writer = writable.getWriter();
+  writer.releaseLock();
+  writable.abort(new Error("upstream died")).catch(() => {});
+
+  const response = new Response(readable, {
+    status: 200,
+    headers: { "content-type": "text/event-stream" },
+  });
+
+  const delayed = new Promise<Response>((resolve) => setTimeout(() => resolve(response), 10));
+
+  const result = await withEarlyStreamKeepalive(delayed, {
+    thresholdMs: 10,
+    intervalMs: 50,
+  });
+
+  assert.equal(result.status, 200);
+  const text = await drainStream(result.body!);
+  assert.ok(text.includes("Upstream stream failed before completion"), "should contain error frame");
+});
+
+// ── Upstream error after partial content → NO error frame ──────────────────
+
+test("upstream error after partial content does NOT emit error frame", { skip: true, todo: "ReadableStream error simulation hangs in Node.js test runner" }, async () => {
+  // Use a TransformStream where we send one chunk then error
+  const { readable, writable } = new TransformStream<Uint8Array, Uint8Array>();
+  const writer = writable.getWriter();
+  await writer.write(ENCODER.encode('data: {"choices":[{"delta":{"content":"partial"}}]}\n\n'));
+  writer.releaseLock();
+  writable.abort(new Error("upstream died mid-stream")).catch(() => {});
+
+  const response = new Response(readable, {
+    status: 200,
+    headers: { "content-type": "text/event-stream" },
+  });
+
+  const delayed = new Promise<Response>((resolve) => setTimeout(() => resolve(response), 10));
+
+  const result = await withEarlyStreamKeepalive(delayed, {
+    thresholdMs: 10,
+    intervalMs: 50,
+  });
+
+  assert.equal(result.status, 200);
+  const text = await drainStream(result.body!);
+  assert.ok(text.includes("partial"), "should contain forwarded content");
+  assert.ok(
+    !text.includes("Upstream stream failed"),
+    "should NOT contain error frame after partial content"
+  );
+});
+
+// ── Handler rejection → error frame ───────────────────────────────────────
+
+test("handler rejection emits error frame", async () => {
+  const delayed = new Promise<Response>((_resolve, reject) =>
+    setTimeout(() => reject(new Error("handler failed")), 10)
+  );
+
+  const result = await withEarlyStreamKeepalive(delayed, {
+    thresholdMs: 5,
+    intervalMs: 50,
+  });
+
+  assert.equal(result.status, 200);
+  const text = await drainStream(result.body!);
+  assert.ok(text.includes("Upstream stream failed before completion"));
+});
+
+// ── Client abort stops keepalive ──────────────────────────────────────────
+
+test("client abort stops keepalive and closes stream", async () => {
+  const controller = new AbortController();
+  const neverResolves = new Promise<Response>(() => {}); // never resolves
+
+  const result = await withEarlyStreamKeepalive(neverResolves, {
+    thresholdMs: 10,
+    intervalMs: 50,
+    signal: controller.signal,
+  });
+
+  assert.equal(result.status, 200);
+
+  // Abort after a short delay
+  setTimeout(() => controller.abort(), 50);
+
+  const text = await drainStream(result.body!);
+  // Should have received some keepalive frames then closed
+  assert.ok(text.length >= 0, "stream should close on abort");
+});
diff --git a/tests/unit/executor-doubao-web.test.ts b/tests/unit/executor-doubao-web.test.ts
index 3ac5cd9015..111d3aff4d 100644
--- a/tests/unit/executor-doubao-web.test.ts
+++ b/tests/unit/executor-doubao-web.test.ts
@@ -9,24 +9,248 @@ describe("DoubaoWebExecutor", () => {
     assert.ok(executor);
   });
 
-  it("execute returns error on fetch failure", async () => {
+  it("builds Dola cookie headers from JSON token extraction data", () => {
+    const cookie = mod.buildDolaCookieHeader(
+      JSON.stringify({
+        sessionid: "sid",
+        ttwid: "tt",
+        s_v_web_id: "verify_abc",
+      })
+    );
+
+    assert.equal(cookie, "sessionid=sid; ttwid=tt; s_v_web_id=verify_abc");
+  });
+
+  it("strips Cookie prefix from full Dola cookie headers", () => {
+    const cookie = mod.buildDolaCookieHeader(
+      "Cookie: sessionid=sid; ttwid=tt; s_v_web_id=verify_abc"
+    );
+    assert.equal(cookie, "sessionid=sid; ttwid=tt; s_v_web_id=verify_abc");
+  });
+
+  it("builds Dola query params without browser-only anti-bot signature params", () => {
+    const params = mod.buildDolaQueryParams("sessionid=sid; ttwid=tt; s_v_web_id=verify_abc", {
+      device_id: "1234567890123456789",
+    });
+
+    assert.equal(params.get("aid"), "495671");
+    assert.equal(params.get("device_id"), "1234567890123456789");
+    assert.equal(params.get("fp"), "verify_abc");
+    assert.equal(params.has("msToken"), false);
+    assert.equal(params.has("a_bogus"), false);
+  });
+
+  it("prefers s_v_web_id over fp when both fingerprint values exist", () => {
+    const cookie = "sessionid=sid; ttwid=tt; s_v_web_id=verify_cookie; fp=verify_fp";
+    const params = mod.buildDolaQueryParams(cookie, { fp: "verify_data" });
+
+    assert.equal(mod.resolveDolaFingerprint(cookie, { fp: "verify_data" }), "verify_cookie");
+    assert.equal(params.get("fp"), "verify_cookie");
+  });
+
+  it("accepts fp from the pasted credential when s_v_web_id is absent", () => {
+    const credential = "sessionid=sid; ttwid=tt; fp=verify_from_url";
+    const cookie = mod.buildDolaCookieHeader(credential);
+    const params = mod.buildDolaQueryParams(cookie, undefined, credential);
+
+    assert.equal(mod.resolveDolaFingerprint(cookie, undefined, credential), "verify_from_url");
+    assert.equal(params.get("fp"), "verify_from_url");
+  });
+
+  it("builds the Dola new-conversation payload shape", () => {
+    const payload = mod.buildDolaPayload(
+      "user: hello",
+      "dola-speed",
+      "sessionid=sid; ttwid=tt; s_v_web_id=verify_abc"
+    );
+    const clientMeta = payload.client_meta as Record<string, unknown>;
+    const option = payload.option as Record<string, unknown>;
+    const ext = payload.ext as Record<string, unknown>;
+    const messages = payload.messages as Array<Record<string, unknown>>;
+
+    assert.equal(clientMeta.conversation_id, "");
+    assert.equal(clientMeta.bot_id, "7339470689562525703");
+    assert.equal(option.need_create_conversation, true);
+    assert.deepEqual(option.conversation_init_option, { need_ack_conversation: true });
+    assert.equal(option.need_deep_think, 0);
+    assert.equal(ext.fp, "verify_abc");
+    assert.equal(ext.use_deep_think, "0");
+    assert.equal(ext.conversation_init_option, '{"need_ack_conversation":true}');
+    assert.equal(messages.length, 1);
+  });
+
+  it("maps Dola Pro to deep-think value 3", () => {
+    const payload = mod.buildDolaPayload(
+      "user: hello",
+      "dola-pro",
+      "sessionid=sid; ttwid=tt; s_v_web_id=verify_abc"
+    );
+    const option = payload.option as Record<string, unknown>;
+    const ext = payload.ext as Record<string, unknown>;
+
+    assert.equal(option.need_deep_think, 3);
+    assert.equal(ext.use_deep_think, "3");
+  });
+
+  it("extracts text deltas from Dola STREAM_MSG_NOTIFY and STREAM_CHUNK events", () => {
+    const initial = mod.extractDolaTextDeltas({
+      content: {
+        content_block: [
+          {
+            content: {
+              text_block: {
+                text: "hello",
+              },
+            },
+          },
+        ],
+      },
+    });
+    const deltas = mod.extractDolaTextDeltas({
+      message_id: "1154824514127377",
+      patch_op: [
+        {
+          patch_object: 1,
+          patch_type: 1,
+          patch_value: {
+            content_block: [
+              {
+                block_type: 10000,
+                content: {
+                  text_block: {
+                    text: " world",
+                  },
+                },
+                is_finish: false,
+                patch_type: 1,
+              },
+            ],
+          },
+        },
+      ],
+    });
+
+    assert.deepEqual(initial, ["hello"]);
+    assert.deepEqual(deltas, [" world"]);
+  });
+
+  it("defers Dola Pro reasoning text until the answer boundary", () => {
+    const state = { deferUntilAnswer: true, answerStarted: false, bufferedDeltas: [] as string[] };
+    const reasoning = mod.extractDolaTextDeltas(
+      {
+        patch_op: [
+          {
+            patch_value: {
+              content_block: [
+                {
+                  block_type: 10000,
+                  content: { text_block: { text: "reasoning" } },
+                  is_finish: false,
+                },
+              ],
+            },
+          },
+        ],
+      },
+      state
+    );
+    const answer = mod.extractDolaTextDeltas(
+      {
+        patch_op: [
+          {
+            patch_value: {
+              content_block: [
+                { block_type: 10040, content: { text_block: {} }, is_finish: true },
+                { block_type: 10000, content: { text_block: { text: "2" } }, is_finish: false },
+              ],
+            },
+          },
+        ],
+      },
+      state
+    );
+
+    assert.deepEqual(reasoning, []);
+    assert.deepEqual(answer, ["2"]);
+  });
+
+  it("detects Dola busy messages", () => {
+    assert.equal(
+      mod.isDolaBusyMessage("A lot of people are using the app right now. Please try again later."),
+      true
+    );
+    assert.equal(mod.isDolaBusyMessage("2"), false);
+  });
+
+  it("returns a credential error when sessionid is missing", async () => {
     const executor = new mod.DoubaoWebExecutor();
+    const result = await executor.execute({
+      model: "dola-speed",
+      body: { messages: [{ role: "user", content: "hi" }] },
+      stream: false,
+      credentials: { apiKey: "" },
+      signal: null,
+    });
+
+    assert.equal(result.response.status, 401);
+    assert.equal(new URL(result.url).hostname, "www.dola.com");
+  });
+
+  it("returns a credential error when browser fingerprint is missing", async () => {
+    const executor = new mod.DoubaoWebExecutor();
+    const result = await executor.execute({
+      model: "dola-speed",
+      body: { messages: [{ role: "user", content: "hi" }] },
+      stream: false,
+      credentials: { apiKey: "sessionid=sid; ttwid=tt" },
+      signal: null,
+    });
+    const text = await result.response.text();
+
+    assert.equal(result.response.status, 401);
+    assert.match(text, /s_v_web_id|fp=verify/);
+  });
+
+  it("classifies Dola busy SSE text as a rate limit error", async () => {
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = (async () =>
+      new Response(
+        [
+          "event: STREAM_MSG_NOTIFY",
+          `data: ${JSON.stringify({
+            content: {
+              content_block: [
+                {
+                  content: {
+                    text_block: {
+                      text: "A lot of people are using the app right now. Please try again later.",
+                    },
+                  },
+                },
+              ],
+            },
+          })}`,
+          "",
+          "",
+        ].join("\n"),
+        { headers: { "Content-Type": "text/event-stream" } }
+      )) as typeof fetch;
+
     try {
+      const executor = new mod.DoubaoWebExecutor();
       const result = await executor.execute({
-        model: "doubao-default",
+        model: "dola-speed",
         body: { messages: [{ role: "user", content: "hi" }] },
         stream: false,
-        credentials: { apiKey: "" },
+        credentials: { apiKey: "sessionid=sid; ttwid=tt; s_v_web_id=verify_abc" },
         signal: null,
       });
-      assert.ok(result.response instanceof Response);
-      // Parse the host instead of substring-matching the URL: a bare
-      // `.includes("doubao.com")` would also accept hostile URLs like
-      // `https://evil.com/?x=doubao.com` (CodeQL js/incomplete-url-substring-sanitization).
-      const host = new URL(result.url).hostname;
-      assert.ok(host === "doubao.com" || host.endsWith(".doubao.com"), `unexpected host: ${host}`);
-    } catch {
-      // Network error expected
+      const text = await result.response.text();
+
+      assert.equal(result.response.status, 429);
+      assert.match(text, /temporarily busy/i);
+    } finally {
+      globalThis.fetch = originalFetch;
     }
   });
 });
diff --git a/tests/unit/executor-kiro.test.ts b/tests/unit/executor-kiro.test.ts
index c746c6a5f3..61f5a4493c 100644
--- a/tests/unit/executor-kiro.test.ts
+++ b/tests/unit/executor-kiro.test.ts
@@ -162,10 +162,38 @@ test("KiroExecutor.transformRequest removes the top-level model field", () => {
 
   const result = executor.transformRequest("kiro-model", body, true, {});
   assert.equal("model" in result, false);
-  assert.equal(
-    (result as any).conversationState.currentMessage.userInputMessage.modelId,
-    "kiro-model"
-  );
+  const kiroResult = result as unknown as {
+    conversationState: { currentMessage: { userInputMessage: { modelId: string } } };
+  };
+  assert.equal(kiroResult.conversationState.currentMessage.userInputMessage.modelId, "kiro-model");
+});
+
+test("KiroExecutor.transformRequest forwards additionalModelRequestFields (thinking) to AWS", () => {
+  const executor = new KiroExecutor();
+  const body = {
+    model: "kiro-model",
+    conversationState: {
+      currentMessage: { userInputMessage: { modelId: "kiro-model" } },
+    },
+    additionalModelRequestFields: {
+      output_config: { effort: "high" },
+      thinking: { type: "adaptive", display: "summarized" },
+      max_tokens: 32000,
+    },
+  };
+
+  const result = executor.transformRequest("kiro-model", body, true, {}) as unknown as Record<
+    string,
+    unknown
+  >;
+  // The thinking control must survive the strict allowlist — otherwise graded
+  // reasoning never reaches CodeWhisperer (the field the openai-to-kiro
+  // translator builds would be silently dropped).
+  assert.deepEqual(result.additionalModelRequestFields, {
+    output_config: { effort: "high" },
+    thinking: { type: "adaptive", display: "summarized" },
+    max_tokens: 32000,
+  });
 });
 
 test("KiroExecutor.transformEventStreamToSSE converts text, tool calls, usage and DONE", async () => {
@@ -202,6 +230,39 @@ test("KiroExecutor.transformEventStreamToSSE converts text, tool calls, usage an
   assert.match(text, /\[DONE\]/);
 });
 
+test("KiroExecutor.transformEventStreamToSSE surfaces native reasoning frames as reasoning_content", async () => {
+  const executor = new KiroExecutor();
+  // Verified live wire format: Kiro streams adaptive-thinking reasoning as a
+  // dedicated `reasoningContentEvent` frame carrying `{ text, signature }`. Also
+  // cover the `reasoningText` object variant and a signature-only frame.
+  const response = buildEventStreamResponse([
+    buildEventFrame("reasoningContentEvent", { text: "Let me think... " }),
+    buildEventFrame("reasoningContentEvent", { text: "step two. " }),
+    buildEventFrame("reasoningContentEvent", { signature: "sig-only-frame" }),
+    buildEventFrame("assistantResponseEvent", { reasoningText: { text: "variant." } }),
+    buildEventFrame("assistantResponseEvent", { content: "The answer is 42." }),
+    buildEventFrame("metricsEvent", { inputTokens: 3, outputTokens: 5 }),
+  ]);
+
+  const transformed = executor.transformEventStreamToSSE(response, "kiro-model");
+  const chunks = parseSSEJsonChunks(await transformed.text());
+  const reasoning = chunks
+    .map((c) => c.choices?.[0]?.delta?.reasoning_content)
+    .filter(Boolean)
+    .join("");
+  const content = chunks
+    .map((c) => c.choices?.[0]?.delta?.content)
+    .filter(Boolean)
+    .join("");
+
+  assert.equal(
+    reasoning,
+    "Let me think... step two. variant.",
+    "reasoningContentEvent frames + reasoningText variant must all surface"
+  );
+  assert.match(content, /The answer is 42\./, "normal content must still flow");
+});
+
 test("KiroExecutor.transformEventStreamToSSE parses fragmented frames and waits for post-stop usage", async () => {
   const executor = new KiroExecutor();
   const bytes = concatArrays(
diff --git a/tests/unit/executor-web-cookie-sweep.test.ts b/tests/unit/executor-web-cookie-sweep.test.ts
index 94bcd67f63..8aa3ca0245 100644
--- a/tests/unit/executor-web-cookie-sweep.test.ts
+++ b/tests/unit/executor-web-cookie-sweep.test.ts
@@ -28,10 +28,7 @@
 import { describe, it } from "node:test";
 import assert from "node:assert/strict";
 import { getExecutor } from "../../open-sse/executors/index.ts";
-import {
-  WEB_COOKIE_PROVIDERS,
-  NOAUTH_PROVIDERS,
-} from "../../src/shared/constants/providers.ts";
+import { WEB_COOKIE_PROVIDERS, NOAUTH_PROVIDERS } from "../../src/shared/constants/providers.ts";
 
 type WebCookieId = keyof typeof WEB_COOKIE_PROVIDERS;
 type NoauthId = keyof typeof NOAUTH_PROVIDERS;
@@ -64,7 +61,7 @@ const FAKE_CREDS: Record<string, string> = {
   "venice-web": "fake-audit-sweep",
   "v0-vercel-web": "fake-audit-sweep",
   "kimi-web": "fake-audit-sweep",
-  "doubao-web": "fake-audit-sweep",
+  "doubao-web": "sessionid=fake-audit-sweep; ttwid=fake-audit-sweep; s_v_web_id=verify_fake",
   "qwen-web": "fake-audit-sweep",
   "duckduckgo-web": "",
   "veoaifree-web": "",
@@ -100,11 +97,7 @@ function assertExecutorWrapperShape(
     r.response instanceof Response,
     `[${provider}] result.response must be a Response (got ${typeof r.response})`
   );
-  assert.equal(
-    typeof r.url,
-    "string",
-    `[${provider}] result.url must be a string`
-  );
+  assert.equal(typeof r.url, "string", `[${provider}] result.url must be a string`);
   assert.ok(
     r.headers && typeof r.headers === "object",
     `[${provider}] result.headers must be an object`
@@ -148,10 +141,7 @@ describe("web-cookie + noauth executor wrapper contract sweep", () => {
         // We don't require JSON, but we DO require the body to be a
         // non-empty string (not the literal "[object Response]" or
         // a TypeError stack trace).
-        assert.ok(
-          body.length > 0,
-          `[${providerId}] response body must be non-empty`
-        );
+        assert.ok(body.length > 0, `[${providerId}] response body must be non-empty`);
         // And it must NOT be the duckduckgo-web regression signature.
         assert.doesNotMatch(
           body,
@@ -166,9 +156,7 @@ describe("web-cookie + noauth executor wrapper contract sweep", () => {
     // Only noauth providers that should be probed without creds:
     // duckduckgo-web and veoaifree-web. opencode/notice have dedicated
     // executor tests already (executor-opencode.test.ts / executor-notice.test.ts).
-    const TARGETS = NOAUTH_IDS.filter(
-      (id) => id === "duckduckgo-web" || id === "veoaifree-web"
-    );
+    const TARGETS = NOAUTH_IDS.filter((id) => id === "duckduckgo-web" || id === "veoaifree-web");
 
     for (const providerId of TARGETS) {
       it(`${providerId} noauth executor returns wrapper shape`, async () => {
@@ -201,13 +189,8 @@ describe("web-cookie + noauth executor wrapper contract sweep", () => {
         } else {
           assertExecutorWrapperShape(result, providerId);
         }
-        const body = await (
-          result instanceof Response ? result : result.response
-        ).text();
-        assert.ok(
-          body.length > 0,
-          `[${providerId}] response body must be non-empty`
-        );
+        const body = await (result instanceof Response ? result : result.response).text();
+        assert.ok(body.length > 0, `[${providerId}] response body must be non-empty`);
         assert.doesNotMatch(
           body,
           /Cannot read properties of undefined \(reading 'status'\)/,
diff --git a/tests/unit/executors-strip-unsupported-params.test.ts b/tests/unit/executors-strip-unsupported-params.test.ts
index d1896408c4..e9169d731f 100644
--- a/tests/unit/executors-strip-unsupported-params.test.ts
+++ b/tests/unit/executors-strip-unsupported-params.test.ts
@@ -5,6 +5,7 @@
 //   1. claude-opus-4 series: temperature deprecated → Anthropic 400.
 //   2. github + gpt-5.4: temperature unsupported.
 //   3. github + Claude (except opus/sonnet 4.6): thinking + reasoning_effort rejected.
+//   4. nvidia + z-ai/glm-5.2: reasoning rejected → NVIDIA 400.
 
 import { test } from "node:test";
 import assert from "node:assert/strict";
@@ -112,6 +113,47 @@ test("stripUnsupportedParams: missing model is a no-op", () => {
   assert.equal(body.temperature, 0.7);
 });
 
+test("stripUnsupportedParams: drops reasoning for nvidia z-ai/glm-5.2", () => {
+  const body: Record<string, unknown> = {
+    model: "z-ai/glm-5.2",
+    reasoning: { effort: "high" },
+    temperature: 0.7,
+  };
+  stripUnsupportedParams("nvidia", "z-ai/glm-5.2", body);
+  assert.equal(body.reasoning, undefined, "reasoning must be stripped");
+  assert.equal(body.temperature, 0.7, "other params must survive");
+  assert.equal(body.model, "z-ai/glm-5.2", "model must not be touched");
+});
+
+test("stripUnsupportedParams: nvidia z-ai/glm-5.1 keeps reasoning (rule is 5.2-only)", () => {
+  const body: Record<string, unknown> = {
+    model: "z-ai/glm-5.1",
+    reasoning: { effort: "medium" },
+    max_tokens: 100,
+  };
+  stripUnsupportedParams("nvidia", "z-ai/glm-5.1", body);
+  assert.ok(body.reasoning !== undefined, "reasoning must survive for glm-5.1");
+  assert.equal(body.max_tokens, 100, "other params must survive");
+});
+
+test("stripUnsupportedParams: nvidia glm-5 rule is provider-scoped (no-op for other providers)", () => {
+  const body: Record<string, unknown> = {
+    model: "z-ai/glm-5.2",
+    reasoning: { effort: "high" },
+  };
+  stripUnsupportedParams("openai", "z-ai/glm-5.2", body);
+  assert.ok(body.reasoning !== undefined, "reasoning must survive for non-nvidia provider");
+});
+
+test("stripUnsupportedParams: nvidia non-glm-5 model keeps reasoning", () => {
+  const body: Record<string, unknown> = {
+    model: "deepseek-ai/deepseek-v4-pro",
+    reasoning: { effort: "high" },
+  };
+  stripUnsupportedParams("nvidia", "deepseek-ai/deepseek-v4-pro", body);
+  assert.ok(body.reasoning !== undefined, "reasoning must survive for non-glm-5 nvidia model");
+});
+
 test("STRIP_RULES is non-empty and every rule has a drop list", () => {
   assert.ok(__STRIP_RULES_FOR_TEST.length > 0);
   for (const rule of __STRIP_RULES_FOR_TEST) {
diff --git a/tests/unit/finishReason.test.ts b/tests/unit/finishReason.test.ts
new file mode 100644
index 0000000000..00442edffb
--- /dev/null
+++ b/tests/unit/finishReason.test.ts
@@ -0,0 +1,78 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import {
+  normalizeOpenAICompatibleFinishReason,
+  normalizeOpenAICompatibleFinishReasonString,
+} from "../../open-sse/utils/finishReason.ts";
+
+// ── normalizeOpenAICompatibleFinishReason ──────────────────────────────────
+
+test("standard OpenAI finish reasons pass through unchanged", () => {
+  assert.equal(normalizeOpenAICompatibleFinishReason("stop"), "stop");
+  assert.equal(normalizeOpenAICompatibleFinishReason("length"), "length");
+  assert.equal(normalizeOpenAICompatibleFinishReason("tool_calls"), "tool_calls");
+  assert.equal(normalizeOpenAICompatibleFinishReason("content_filter"), "content_filter");
+  assert.equal(normalizeOpenAICompatibleFinishReason("function_call"), "function_call");
+});
+
+test("max_tokens normalizes to length", () => {
+  assert.equal(normalizeOpenAICompatibleFinishReason("max_tokens"), "length");
+  assert.equal(normalizeOpenAICompatibleFinishReason("MAX_TOKENS"), "length");
+});
+
+test("Gemini MALFORMED_RESPONSE maps to content_filter", () => {
+  assert.equal(normalizeOpenAICompatibleFinishReason("MALFORMED_RESPONSE"), "content_filter");
+  assert.equal(normalizeOpenAICompatibleFinishReason("malformed_response"), "content_filter");
+});
+
+test("all safety finish reasons map to content_filter", () => {
+  const reasons = [
+    "safety",
+    "recitation",
+    "blocklist",
+    "prohibited_content",
+    "content_filtered",
+    "policy_violation",
+    "malformed_response",
+  ];
+  for (const reason of reasons) {
+    assert.equal(
+      normalizeOpenAICompatibleFinishReason(reason),
+      "content_filter",
+      `${reason} should map to content_filter`
+    );
+  }
+});
+
+test("case-insensitive matching", () => {
+  assert.equal(normalizeOpenAICompatibleFinishReason("STOP"), "stop");
+  assert.equal(normalizeOpenAICompatibleFinishReason("Safety"), "content_filter");
+  assert.equal(normalizeOpenAICompatibleFinishReason("MALFORMED_RESPONSE"), "content_filter");
+});
+
+test("unknown reason passes through as-is", () => {
+  assert.equal(normalizeOpenAICompatibleFinishReason("some_new_reason"), "some_new_reason");
+});
+
+test("non-string input returns as-is", () => {
+  assert.equal(normalizeOpenAICompatibleFinishReason(null), null);
+  assert.equal(normalizeOpenAICompatibleFinishReason(undefined), undefined);
+  assert.equal(normalizeOpenAICompatibleFinishReason(42), 42);
+});
+
+// ── normalizeOpenAICompatibleFinishReasonString ────────────────────────────
+
+test("string variant returns normalized string", () => {
+  assert.equal(normalizeOpenAICompatibleFinishReasonString("stop"), "stop");
+  assert.equal(normalizeOpenAICompatibleFinishReasonString("malformed_response"), "content_filter");
+});
+
+test("non-string input returns fallback (default stop)", () => {
+  assert.equal(normalizeOpenAICompatibleFinishReasonString(null), "stop");
+  assert.equal(normalizeOpenAICompatibleFinishReasonString(undefined), "stop");
+  assert.equal(normalizeOpenAICompatibleFinishReasonString(""), "stop");
+});
+
+test("custom fallback", () => {
+  assert.equal(normalizeOpenAICompatibleFinishReasonString(null, "length"), "length");
+});
diff --git a/tests/unit/freeProviderRankings-filters.test.ts b/tests/unit/freeProviderRankings-filters.test.ts
new file mode 100644
index 0000000000..2232c6480c
--- /dev/null
+++ b/tests/unit/freeProviderRankings-filters.test.ts
@@ -0,0 +1,165 @@
+/**
+ * Unit tests for the #6150 "configured / non-exhausted" filters on the Free
+ * Provider Rankings page.
+ *
+ * Targets the PURE helpers `isProviderUsable` + `filterFreeProviderRankings`
+ * (no DB, no I/O) so the filter logic is exercised in isolation. The async
+ * `computeFreeProviderRankings` merely wraps these over `getProviderConnections`.
+ */
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import {
+  isProviderUsable,
+  filterFreeProviderRankings,
+  type ConnectionState,
+  type FreeProviderRanking,
+} from "../../src/lib/freeProviderRankings.ts";
+
+const FIXED_NOW = 1_700_000_000_000; // deterministic "now" for rate-limit math
+const future = () => new Date(FIXED_NOW + 60_000).toISOString();
+const past = () => new Date(FIXED_NOW - 60_000).toISOString();
+
+function ranking(id: string): FreeProviderRanking {
+  return {
+    id,
+    name: id,
+    icon: "",
+    color: "#000",
+    category: "apikey",
+    topModel: null,
+    averageScore: 0.5,
+    modelCount: 1,
+  };
+}
+
+function conn(provider: string, extra: Partial<ConnectionState> = {}): ConnectionState {
+  return { provider, testStatus: "active", rateLimitedUntil: null, ...extra };
+}
+
+// ──────────────── isProviderUsable ────────────────
+
+test("isProviderUsable: healthy connection is usable", () => {
+  assert.equal(isProviderUsable([conn("glm")], FIXED_NOW), true);
+});
+
+test("isProviderUsable: empty connection list is not usable", () => {
+  assert.equal(isProviderUsable([], FIXED_NOW), false);
+});
+
+test("isProviderUsable: terminal statuses (credits_exhausted/banned/expired) are not usable", () => {
+  for (const status of ["credits_exhausted", "banned", "expired"]) {
+    assert.equal(
+      isProviderUsable([conn("glm", { testStatus: status })], FIXED_NOW),
+      false,
+      `expected ${status} to be unusable`
+    );
+  }
+  // case/whitespace-insensitive normalization
+  assert.equal(isProviderUsable([conn("glm", { testStatus: "  BANNED " })], FIXED_NOW), false);
+});
+
+test("isProviderUsable: future rateLimitedUntil is not usable; past/null is usable", () => {
+  assert.equal(isProviderUsable([conn("glm", { rateLimitedUntil: future() })], FIXED_NOW), false);
+  assert.equal(isProviderUsable([conn("glm", { rateLimitedUntil: past() })], FIXED_NOW), true);
+  assert.equal(isProviderUsable([conn("glm", { rateLimitedUntil: null })], FIXED_NOW), true);
+});
+
+test("isProviderUsable: mixed — one usable connection makes the provider usable", () => {
+  const conns = [
+    conn("glm", { testStatus: "credits_exhausted" }),
+    conn("glm", { rateLimitedUntil: future() }),
+    conn("glm"), // healthy
+  ];
+  assert.equal(isProviderUsable(conns, FIXED_NOW), true);
+});
+
+// ──────────────── filterFreeProviderRankings ────────────────
+
+const RANKINGS = [ranking("glm"), ranking("groq"), ranking("cerebras")];
+
+test("filter: both flags off returns the input unchanged (regression)", () => {
+  const out = filterFreeProviderRankings(RANKINGS, [], {}, FIXED_NOW);
+  assert.deepEqual(
+    out.map((r) => r.id),
+    ["glm", "groq", "cerebras"]
+  );
+  // identical even when connections exist but no flag is set
+  const out2 = filterFreeProviderRankings(RANKINGS, [conn("glm")], {}, FIXED_NOW);
+  assert.equal(out2.length, 3);
+});
+
+test("filter: configuredOnly keeps only providers with ≥1 connection", () => {
+  const connections = [conn("glm"), conn("groq", { testStatus: "credits_exhausted" })];
+  const out = filterFreeProviderRankings(
+    RANKINGS,
+    connections,
+    { configuredOnly: true },
+    FIXED_NOW
+  );
+  // cerebras has no connection → dropped; groq stays (configured, exhaustion ignored)
+  assert.deepEqual(
+    out.map((r) => r.id),
+    ["glm", "groq"]
+  );
+});
+
+test("filter: availableOnly drops exhausted-only provider, keeps healthy", () => {
+  const connections = [conn("glm"), conn("groq", { testStatus: "credits_exhausted" })];
+  const out = filterFreeProviderRankings(
+    RANKINGS,
+    connections,
+    { availableOnly: true },
+    FIXED_NOW
+  );
+  assert.deepEqual(
+    out.map((r) => r.id),
+    ["glm"]
+  );
+});
+
+test("filter: availableOnly drops rate-limited-only provider; recovers when in the past", () => {
+  const dropped = filterFreeProviderRankings(
+    RANKINGS,
+    [conn("glm", { rateLimitedUntil: future() })],
+    { availableOnly: true },
+    FIXED_NOW
+  );
+  assert.deepEqual(
+    dropped.map((r) => r.id),
+    []
+  );
+
+  const recovered = filterFreeProviderRankings(
+    RANKINGS,
+    [conn("glm", { rateLimitedUntil: past() })],
+    { availableOnly: true },
+    FIXED_NOW
+  );
+  assert.deepEqual(
+    recovered.map((r) => r.id),
+    ["glm"]
+  );
+});
+
+test("filter: availableOnly keeps a provider that has at least one usable connection", () => {
+  const connections = [
+    conn("glm", { testStatus: "banned" }),
+    conn("glm"), // second connection is healthy
+  ];
+  const out = filterFreeProviderRankings(
+    RANKINGS,
+    connections,
+    { availableOnly: true },
+    FIXED_NOW
+  );
+  assert.deepEqual(
+    out.map((r) => r.id),
+    ["glm"]
+  );
+});
+
+test("filter: availableOnly implies configured (unconfigured provider excluded)", () => {
+  // no connections at all → nothing survives availableOnly
+  const out = filterFreeProviderRankings(RANKINGS, [], { availableOnly: true }, FIXED_NOW);
+  assert.equal(out.length, 0);
+});
diff --git a/tests/unit/github-collector.test.ts b/tests/unit/github-collector.test.ts
new file mode 100644
index 0000000000..e61a4e0d0f
--- /dev/null
+++ b/tests/unit/github-collector.test.ts
@@ -0,0 +1,300 @@
+/**
+ * Tests for githubCollector.ts — GitHub agent skill discovery, scoring, scanning, and installation.
+ * Uses node:test (Node.js built-in test runner), matching the project convention.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const {
+  scoreRepo,
+  scanText,
+  inferCategory,
+  resolveInstallPath,
+  QUERY_STRATEGIES,
+  INSTALL_TARGETS,
+} = await import("../../src/lib/skills/githubCollector.ts");
+
+// ─── scoreRepo ─────────────────────────────────────────────────────────────
+
+void test("scoreRepo: returns 0.98 for gold repos", () => {
+  const score = scoreRepo({
+    fullName: "addyosmani/agent-skills",
+    description: "Collection of agent skills",
+    stars: 100,
+    forks: 10,
+    hasLicense: true,
+    topics: [],
+  });
+  assert.equal(score, 0.98);
+});
+
+void test("scoreRepo: returns reasonable score for good agent repos", () => {
+  const score = scoreRepo({
+    fullName: "user/awesome-agent-skills",
+    description: "Curated list of AI agent skills for LLMs",
+    stars: 5000,
+    forks: 200,
+    hasLicense: true,
+    topics: ["agent", "ai-agent", "mcp"],
+  });
+  assert.ok(score > 0.5);
+  assert.ok(score <= 1.0);
+});
+
+void test("scoreRepo: returns low score for unrelated repos", () => {
+  const score = scoreRepo({
+    fullName: "user/todo-app",
+    description: "A simple todo list app built with react",
+    stars: 5,
+    forks: 1,
+    hasLicense: false,
+    topics: ["javascript", "react"],
+  });
+  assert.ok(score < 0.5);
+});
+
+void test("scoreRepo: boosts score for skill-file name signals", () => {
+  const score = scoreRepo({
+    fullName: "user/agent-skill-pack",
+    description: "Agent skill pack for codex",
+    stars: 100,
+    forks: 30,
+    hasLicense: true,
+    topics: ["agent"],
+  });
+  assert.ok(score > 0.3);
+  assert.ok(score < 0.98);
+});
+
+void test("scoreRepo: applies stars bonus logarithmically", () => {
+  const low = scoreRepo({
+    fullName: "user/skill-repo",
+    description: "Agent skill",
+    stars: 50,
+    forks: 5,
+    hasLicense: false,
+    topics: [],
+  });
+  const high = scoreRepo({
+    fullName: "user/skill-repo",
+    description: "Agent skill",
+    stars: 10000,
+    forks: 500,
+    hasLicense: false,
+    topics: [],
+  });
+  assert.ok(high > low);
+  assert.ok(high < 0.98);
+});
+
+void test("scoreRepo: caps stars for awesome lists", () => {
+  const score = scoreRepo({
+    fullName: "user/awesome-list",
+    description: "A curated list of awesome things",
+    stars: 50000,
+    forks: 2000,
+    hasLicense: true,
+    topics: [],
+  });
+  // awesome list without skill file signals should be capped below gold-repo threshold
+  assert.ok(score < 0.9);
+});
+
+void test("scoreRepo: handles zero stars gracefully", () => {
+  const score = scoreRepo({
+    fullName: "user/new-repo",
+    description: "Brand new agent skill",
+    stars: 0,
+    forks: 0,
+    hasLicense: false,
+    topics: [],
+  });
+  assert.ok(score >= 0);
+  assert.ok(score < 0.5);
+});
+
+// ─── scanText ──────────────────────────────────────────────────────────────
+
+void test("scanText: empty findings for clean content", () => {
+  const findings = scanText("print('hello world')\nconst x = 1;\n", "test.md");
+  assert.equal(findings.length, 0);
+});
+
+void test("scanText: detects eval(base64) pattern", () => {
+  const findings = scanText('eval(base64_decode("dGVzdA=="))', "evil.md");
+  assert.ok(findings.length > 0);
+  assert.ok(findings[0].pattern.includes("eval(base64)"));
+  assert.equal(findings[0].file, "evil.md");
+});
+
+void test("scanText: detects hardcoded private keys", () => {
+  const content =
+    "-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEA...\n-----END RSA PRIVATE KEY-----";
+  const findings = scanText(content, "leaked.md");
+  assert.ok(findings.some((f) => f.pattern.includes("Private key")));
+});
+
+void test("scanText: detects API key patterns", () => {
+  const findings = scanText('const api_key = "abc123def456";', "config.js");
+  assert.ok(findings.some((f) => f.pattern.includes("API key")));
+});
+
+void test("scanText: detects multiple patterns in one file", () => {
+  const content = `
+    const api_key = "12345";
+    password = "secret123";
+    eval(base64_decode("test"));
+  `;
+  const findings = scanText(content, "danger.js");
+  assert.ok(findings.length >= 3);
+});
+
+void test("scanText: provides context around the match", () => {
+  const findings = scanText("some text before api_key = 'abc123' some text after", "test.js");
+  assert.ok(findings.length > 0);
+  assert.ok(findings[0].context.length > 15);
+});
+
+void test("scanText: ignores safe content with keyword-like patterns", () => {
+  const findings = scanText("using password hashing for security\napi version 2.0", "safe.txt");
+  assert.equal(findings.length, 0);
+});
+
+void test("scanText: detects OpenAI key pattern (sk- alphanumeric)", () => {
+  // OpenAI keys: sk- followed by 20+ alphanumeric chars (no hyphens inside the token part)
+  const findings = scanText('OPENAI_API_KEY="sk-abcdefghijklmnopqrstuvwxyz1234567890"', ".env");
+  assert.ok(findings.some((f) => f.pattern.includes("OpenAI API key")));
+});
+
+void test("scanText: detects GitHub PAT pattern (ghp_)", () => {
+  const findings = scanText("GITHUB_TOKEN=ghp_abcdefghijklmnopqrstuvwxyz1234567890123456", ".env");
+  assert.ok(findings.some((f) => f.pattern.includes("GitHub PAT")));
+});
+
+// ─── inferCategory ─────────────────────────────────────────────────────────
+
+void test("inferCategory: returns 'imported-github' for generic skills", () => {
+  const cat = inferCategory("user/some-skill", "A useful skill for agents");
+  assert.equal(cat, "imported-github");
+});
+
+void test("inferCategory: detects security-related skills", () => {
+  const cat = inferCategory("user/sec-scan", "Security vulnerability scanner for code");
+  assert.equal(cat, "security");
+});
+
+void test("inferCategory: detects data-science skills", () => {
+  const cat = inferCategory("user/ml-pipeline", "ML model training and data analytics");
+  assert.equal(cat, "data-science");
+});
+
+void test("inferCategory: detects devops skills", () => {
+  const cat = inferCategory("user/deploy-tool", "Docker deployment pipeline for CI/CD");
+  assert.equal(cat, "devops");
+});
+
+void test("inferCategory: detects creative skills", () => {
+  const cat = inferCategory("user/art-gen", "AI image design generator");
+  assert.equal(cat, "creative");
+});
+
+void test("inferCategory: detects productivity skills", () => {
+  const cat = inferCategory("user/email-assistant", "Email scheduling and document tool");
+  assert.equal(cat, "productivity");
+});
+
+void test("inferCategory: detects research skills", () => {
+  const cat = inferCategory("user/paper-finder", "arXiv academic paper search");
+  assert.equal(cat, "research");
+});
+
+void test("inferCategory: detects software-development skills", () => {
+  const cat = inferCategory("user/code-reviewer", "Automated code review and debugging");
+  assert.equal(cat, "software-development");
+});
+
+void test("inferCategory: detects media skills (youtube + transcript keywords)", () => {
+  const cat = inferCategory("user/yt-dl", "YouTube transcript downloader");
+  assert.equal(cat, "media");
+});
+
+// ─── resolveInstallPath ────────────────────────────────────────────────────
+
+void test("resolveInstallPath: resolves to a valid path string", () => {
+  const origHome = process.env.HOME;
+  process.env.HOME = "/home/testuser";
+  try {
+    const path = resolveInstallPath("hermes", "sec-scan", "A security scanner");
+    // The path should start with the HOME directory and contain the category
+    assert.ok(path.startsWith("/home/testuser"));
+    assert.ok(path.includes("security"));
+    assert.ok(path.includes("hermes/skills"));
+  } finally {
+    process.env.HOME = origHome;
+  }
+});
+
+void test("resolveInstallPath: infers category from description", () => {
+  const origHome = process.env.HOME;
+  process.env.HOME = "/home/testuser";
+  try {
+    const path = resolveInstallPath("claude", "data-pipeline", "Data science tool");
+    assert.ok(path.includes("data-science"));
+  } finally {
+    process.env.HOME = origHome;
+  }
+});
+
+void test("resolveInstallPath: uses category for unknown target and throws", () => {
+  assert.throws(() => resolveInstallPath("unknown", "x", ""), Error);
+});
+
+void test("resolveInstallPath: different targets produce different base paths", () => {
+  const origHome = process.env.HOME;
+  process.env.HOME = "/home/testuser";
+  try {
+    const hermesPath = resolveInstallPath("hermes", "my-skill", "generic");
+    const claudePath = resolveInstallPath("claude", "my-skill", "generic");
+    assert.notEqual(hermesPath, claudePath);
+    assert.ok(hermesPath.includes("AppData/Local/hermes"));
+    assert.ok(claudePath.includes(".claude"));
+  } finally {
+    process.env.HOME = origHome;
+  }
+});
+
+// ─── QUERY_STRATEGIES structural sanity ────────────────────────────────────
+
+void test("QUERY_STRATEGIES: has file, name, and description categories", () => {
+  assert.ok(Array.isArray(QUERY_STRATEGIES.file));
+  assert.ok(Array.isArray(QUERY_STRATEGIES.name));
+  assert.ok(Array.isArray(QUERY_STRATEGIES.description));
+});
+
+void test("QUERY_STRATEGIES: has at least 10 file-name queries", () => {
+  assert.ok(QUERY_STRATEGIES.file.length >= 10);
+});
+
+void test("QUERY_STRATEGIES: all queries are non-empty strings", () => {
+  const all = [...QUERY_STRATEGIES.file, ...QUERY_STRATEGIES.name, ...QUERY_STRATEGIES.description];
+  assert.ok(all.length > 15);
+  for (const q of all) {
+    assert.equal(typeof q, "string");
+    assert.ok(q.length > 5);
+  }
+});
+
+void test("QUERY_STRATEGIES: each file query ends with a star threshold", () => {
+  for (const q of QUERY_STRATEGIES.file) {
+    assert.ok(/stars:>=\d+/.test(q));
+  }
+});
+
+// ─── INSTALL_TARGETS ────────────────────────────────────────────────────────
+
+void test("INSTALL_TARGETS: includes all expected agent targets", () => {
+  assert.ok(INSTALL_TARGETS.includes("hermes"));
+  assert.ok(INSTALL_TARGETS.includes("claude"));
+  assert.ok(INSTALL_TARGETS.includes("gemini"));
+  assert.ok(INSTALL_TARGETS.includes("opencode"));
+});
diff --git a/tests/unit/github-copilot-gpt-4o-mini.test.ts b/tests/unit/github-copilot-gpt-4o-mini.test.ts
index 0f6d0a766d..1a1c9e8af9 100644
--- a/tests/unit/github-copilot-gpt-4o-mini.test.ts
+++ b/tests/unit/github-copilot-gpt-4o-mini.test.ts
@@ -3,20 +3,20 @@ import assert from "node:assert/strict";
 import { getRegistryEntry } from "../../open-sse/config/providerRegistry.ts";
 
 // Regression guard: the GitHub Copilot (`gh`) provider must expose `gpt-4o-mini`
-// alongside `gpt-4o`. Copilot serves the cheaper mini variant via
+// alongside the curated date-pinned GPT-4o model. Copilot serves the cheaper mini variant via
 // chat/completions, so apps that hard-code `gpt-4o-mini` should resolve to the
 // Copilot provider — not only to the separate github-models (`ghm`) marketplace
 // entry, which lists it under the `openai/` prefix (`openai/gpt-4o-mini`).
 //
 // Ported from upstream decolua/9router (add GPT-4o mini to GitHub Copilot).
 
-test("github (Copilot) provider exposes gpt-4o-mini next to gpt-4o", () => {
+test("github (Copilot) provider exposes gpt-4o-mini next to curated GPT-4o", () => {
   const entry = getRegistryEntry("github");
   assert.ok(entry, "github registry entry should exist");
   assert.ok(entry.models, "github registry entry should have a models array");
 
   const ids = entry.models!.map((m) => m.id);
-  assert.ok(ids.includes("gpt-4o"), "gpt-4o should remain registered");
+  assert.ok(ids.includes("gpt-4o-2024-11-20"), "date-pinned gpt-4o should remain registered");
   assert.ok(
     ids.includes("gpt-4o-mini"),
     "gpt-4o-mini should be registered on the Copilot (gh) provider"
@@ -25,6 +25,7 @@ test("github (Copilot) provider exposes gpt-4o-mini next to gpt-4o", () => {
   const mini = entry.models!.find((m) => m.id === "gpt-4o-mini");
   assert.equal(mini?.name, "GPT-4o mini");
   assert.equal(mini?.contextLength, 128000);
+  assert.equal(ids.includes("gpt-4o"), false, "bare gpt-4o is not in the curated list");
 });
 
 test("Copilot gpt-4o-mini is distinct from the github-models openai/gpt-4o-mini", () => {
diff --git a/tests/unit/github-copilot-model-discovery.test.ts b/tests/unit/github-copilot-model-discovery.test.ts
index d925631dda..bf3ed4c43c 100644
--- a/tests/unit/github-copilot-model-discovery.test.ts
+++ b/tests/unit/github-copilot-model-discovery.test.ts
@@ -19,13 +19,14 @@ import assert from "node:assert/strict";
 
 const {
   GITHUB_COPILOT_MODELS_URL,
+  GITHUB_COPILOT_MODEL_ALLOWLIST,
   parseGitHubCopilotModels,
   fetchGitHubCopilotModels,
 } = await import("../../open-sse/services/githubCopilotModels.ts");
 
-// A representative slice of a real Copilot /models response. Crucially it
-// includes models the account IS entitled to, and OMITS gemini previews to
-// prove non-entitled models are not advertised (#3121).
+// A representative slice of a real Copilot /models response. The upstream list
+// includes selectable chat models plus utility/legacy models; OmniRoute imports
+// only the curated allowlist.
 const MOCK_COPILOT_MODELS_RESPONSE = {
   data: [
     {
@@ -42,7 +43,7 @@ const MOCK_COPILOT_MODELS_RESPONSE = {
       capabilities: { type: "chat" },
     },
     {
-      // embeddings model — not a chat model; discovery should still surface the id
+      // Embeddings model — present upstream but intentionally not in the curated chat list.
       id: "text-embedding-3-small",
       name: "Embedding V3 small",
       capabilities: { type: "embeddings" },
@@ -53,12 +54,12 @@ const MOCK_COPILOT_MODELS_RESPONSE = {
 test("#3120 parseGitHubCopilotModels maps data[].id into managed models", () => {
   const models = parseGitHubCopilotModels(MOCK_COPILOT_MODELS_RESPONSE);
   const ids = models.map((m) => m.id);
-  assert.ok(ids.includes("gpt-5.4"), "gpt-5.4 must be discovered");
-  assert.ok(ids.includes("claude-sonnet-4.5"), "claude-sonnet-4.5 must be discovered");
+  assert.deepEqual(ids, ["gpt-5.4", "claude-sonnet-4.5"]);
   const gpt = models.find((m) => m.id === "gpt-5.4");
   assert.ok(gpt, "gpt-5.4 entry present");
   assert.equal(gpt.name, "GPT-5.4");
   assert.equal(gpt.owned_by, "github");
+  assert.ok(!ids.includes("text-embedding-3-small"), "non-allowlisted utility models are skipped");
 });
 
 test("#3121 a model NOT in the live response is not advertised (entitlement filtering)", () => {
@@ -98,16 +99,16 @@ test("#3120 fetchGitHubCopilotModels does a live fetch and returns parsed models
   assert.ok(capturedHeaders["copilot-integration-id"], "must send Copilot integration header");
   assert.equal(result.source, "api");
   const ids = result.models.map((m) => m.id);
-  assert.ok(ids.includes("gpt-5.4"));
+  assert.deepEqual(ids, ["gpt-5.4", "claude-sonnet-4.5"]);
   assert.ok(!ids.includes("gemini-3.1-pro-preview"));
 });
 
 test("#3120/#3121 fetch falls back to static catalog when the live fetch fails", async () => {
-  const fakeFetch = (async () =>
-    new Response("nope", { status: 503 })) as unknown as typeof fetch;
+  const fakeFetch = (async () => new Response("nope", { status: 503 })) as unknown as typeof fetch;
   const fallback = [
     { id: "gpt-5.4", name: "GPT-5.4" },
     { id: "gemini-3.1-pro-preview", name: "Gemini 3.1 Pro" },
+    { id: "gpt-3.5-turbo", name: "GPT 3.5 Turbo" },
   ];
 
   const result = await fetchGitHubCopilotModels({
@@ -120,7 +121,37 @@ test("#3120/#3121 fetch falls back to static catalog when the live fetch fails",
   assert.deepEqual(
     result.models.map((m) => m.id),
     ["gpt-5.4", "gemini-3.1-pro-preview"],
-    "offline/failed discovery must preserve the static catalog"
+    "offline/failed discovery must preserve only the curated static catalog"
+  );
+});
+
+test("curated Copilot allowlist contains the final approved model ids only", () => {
+  assert.deepEqual(
+    [...GITHUB_COPILOT_MODEL_ALLOWLIST],
+    [
+      "claude-fable-5",
+      "claude-opus-4.8-fast",
+      "claude-opus-4.8",
+      "claude-opus-4.7",
+      "claude-sonnet-4.6",
+      "claude-opus-4.5",
+      "claude-sonnet-5",
+      "claude-sonnet-4.5",
+      "claude-haiku-4.5",
+      "gemini-3.1-pro-preview",
+      "gemini-3.5-flash",
+      "gpt-5.5",
+      "gpt-5.4",
+      "gpt-5.4-mini",
+      "gpt-5.3-codex",
+      "gpt-5-mini",
+      "gpt-4o-2024-11-20",
+      "gpt-4o-mini",
+      "gpt-4-0125-preview",
+      "kimi-k2.7-code",
+      "mai-code-1-flash",
+      "oswe-vscode-prime",
+    ]
   );
 });
 
@@ -139,5 +170,8 @@ test("fetch falls back when no token is provided (unauthed refresh stays safe)",
 
   assert.equal(called, false, "must not fetch without a token");
   assert.equal(result.source, "fallback");
-  assert.deepEqual(result.models.map((m) => m.id), ["gpt-5.4"]);
+  assert.deepEqual(
+    result.models.map((m) => m.id),
+    ["gpt-5.4"]
+  );
 });
diff --git a/tests/unit/gpt-max-input-tokens-6191.test.ts b/tests/unit/gpt-max-input-tokens-6191.test.ts
new file mode 100644
index 0000000000..f89c42edb1
--- /dev/null
+++ b/tests/unit/gpt-max-input-tokens-6191.test.ts
@@ -0,0 +1,67 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+// #6191: GPT-family codex models advertised their full 400K context window as
+// BOTH context_length and max_input_tokens, so coding agents never triggered
+// auto-compaction. The real usable input budget is smaller (~272K). These tests
+// pin the distinct-input-cap behavior and guard the contextLength fallback for
+// models that do NOT declare an explicit maxInputTokens.
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-gpt-input-cap-6191-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const modelCapabilities = await import("../../src/lib/modelCapabilities.ts");
+
+function resetStorage() {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+test.beforeEach(() => {
+  resetStorage();
+});
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+test("codex gpt-5.5 reports max_input_tokens smaller than its context window (#6191)", () => {
+  const caps = modelCapabilities.getResolvedModelCapabilities("codex/gpt-5.5");
+  assert.equal(caps.contextWindow, 400000);
+  assert.equal(caps.maxInputTokens, 272000);
+  assert.ok(
+    (caps.maxInputTokens ?? 0) < (caps.contextWindow ?? 0),
+    "max_input_tokens must be strictly smaller than context_length so agents compact"
+  );
+});
+
+test("all codex gpt-5.5 effort variants carry the distinct input cap (#6191)", () => {
+  for (const modelId of [
+    "codex/gpt-5.5-xhigh",
+    "codex/gpt-5.5-high",
+    "codex/gpt-5.5-medium",
+    "codex/gpt-5.5-low",
+  ]) {
+    const caps = modelCapabilities.getResolvedModelCapabilities(modelId);
+    assert.equal(caps.contextWindow, 400000, modelId);
+    assert.equal(caps.maxInputTokens, 272000, modelId);
+  }
+});
+
+test("regression: a model without maxInputTokens still falls back to its context window", () => {
+  // codex gpt-5.4 declares no maxInputTokens, so max_input_tokens must equal
+  // the context window (the historical fallback) — no under-reporting.
+  const caps = modelCapabilities.getResolvedModelCapabilities("codex/gpt-5.4");
+  assert.ok((caps.contextWindow ?? 0) > 0, "gpt-5.4 should have a context window");
+  assert.equal(
+    caps.maxInputTokens,
+    caps.contextWindow,
+    "without an explicit input cap, max_input_tokens falls back to context_length"
+  );
+});
diff --git a/tests/unit/home-no-autorouting-banner.test.ts b/tests/unit/home-no-autorouting-banner.test.ts
new file mode 100644
index 0000000000..91a72fd974
--- /dev/null
+++ b/tests/unit/home-no-autorouting-banner.test.ts
@@ -0,0 +1,26 @@
+// #6164: the always-on Auto-Routing (combo) banner was removed from the home page —
+// it did not reflect live routing state and reappeared on every fresh browser.
+// This guard replaces the deleted AutoRoutingBanner.test.tsx: the component was
+// deleted along with its usage, so the contract to protect is its ABSENCE.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+
+const ROOT = path.resolve(import.meta.dirname, "..", "..");
+
+test("home page does not render the removed AutoRoutingBanner (#6164)", () => {
+  const homePage = fs.readFileSync(path.join(ROOT, "src/app/(dashboard)/home/page.tsx"), "utf8");
+  assert.ok(
+    !homePage.includes("AutoRoutingBanner"),
+    "AutoRoutingBanner was removed in #6164 and must not be re-imported into home/page.tsx"
+  );
+});
+
+test("AutoRoutingBanner component stays deleted (#6164)", () => {
+  assert.equal(
+    fs.existsSync(path.join(ROOT, "src/shared/components/AutoRoutingBanner.tsx")),
+    false,
+    "the component was deleted in #6164; a revival needs its own test file"
+  );
+});
diff --git a/tests/unit/kiro-catalog-real-models.test.ts b/tests/unit/kiro-catalog-real-models.test.ts
new file mode 100644
index 0000000000..e896ca5e44
--- /dev/null
+++ b/tests/unit/kiro-catalog-real-models.test.ts
@@ -0,0 +1,58 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { REGISTRY } from "@omniroute/open-sse/config/providers/index.ts";
+import { FREE_MODEL_BUDGETS } from "@omniroute/open-sse/config/freeModelCatalog.data.ts";
+
+// Kiro's upstream (`generateAssistantResponse`) returns 400 "Invalid model.
+// Please select a different model" for any model id it does not recognize. The
+// registry must therefore expose ONLY ids Kiro actually serves. These ids were
+// fabricated (copied from OmniRoute's own Anthropic catalog) and live-verified
+// to 400 on the VPS — they must never reappear. Regression guard for the kiro
+// cluster (#6112/#6113/#6099).
+const FABRICATED_KIRO_IDS = [
+  "auto-kiro", // no "auto" model id on Kiro — was sent verbatim and 400'd
+  "claude-fable-5", // Kiro offers no Fable
+  "claude-opus-4.8", // Kiro offers no Opus
+  "claude-opus-4.7",
+  "claude-opus-4.6",
+  "claude-sonnet-4.6", // Kiro's Sonnet is 4.5, not 4.6
+];
+
+// Ids proven to return 200 on the VPS (or a real, plan-gated Kiro model).
+const REAL_KIRO_IDS = [
+  "claude-sonnet-5", // real model, plan-gated per account (kept)
+  "claude-sonnet-4.5", // proven 200 (replaces the fabricated 4.6)
+  "claude-haiku-4.5", // proven 200
+  "deepseek-3.2", // proven 200
+  "glm-5", // proven 200
+  "minimax-m2.5", // proven 200
+  "minimax-m2.1", // proven 200
+  "qwen3-coder-next", // proven 200
+];
+
+test("kiro registry exposes no fabricated model ids", () => {
+  const ids = new Set((REGISTRY.kiro?.models || []).map((m) => m.id));
+  for (const bad of FABRICATED_KIRO_IDS) {
+    assert.ok(!ids.has(bad), `kiro registry must not expose fabricated id "${bad}"`);
+  }
+});
+
+test("kiro registry exposes exactly the real Kiro model ids", () => {
+  const ids = (REGISTRY.kiro?.models || []).map((m) => m.id).sort();
+  assert.deepEqual(ids, [...REAL_KIRO_IDS].sort());
+});
+
+test("kiro free-model catalog carries no fabricated ids", () => {
+  const kiroCatalogIds = new Set(
+    FREE_MODEL_BUDGETS.filter((e) => e.provider === "kiro").map((e) => e.modelId)
+  );
+  for (const bad of FABRICATED_KIRO_IDS) {
+    assert.ok(!kiroCatalogIds.has(bad), `free catalog must not list fabricated kiro id "${bad}"`);
+  }
+  // Every kiro free-catalog entry must exist in the registry (no orphans).
+  const registryIds = new Set((REGISTRY.kiro?.models || []).map((m) => m.id));
+  for (const id of kiroCatalogIds) {
+    assert.ok(registryIds.has(id), `free catalog kiro id "${id}" is not in the registry`);
+  }
+});
diff --git a/tests/unit/live-ws-standalone-wiring.test.ts b/tests/unit/live-ws-standalone-wiring.test.ts
new file mode 100644
index 0000000000..6c628d44eb
--- /dev/null
+++ b/tests/unit/live-ws-standalone-wiring.test.ts
@@ -0,0 +1,33 @@
+import { test, describe } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, resolve } from "node:path";
+
+// Regression guard for: "live-dashboard WebSocket daemon (port 20129) never
+// starts in the packaged standalone bin." liveServer.ts auto-starts the daemon
+// on import, but nothing imported it in the standalone/PM2 runtime — so the port
+// never bound and every live dashboard showed "Live disabled — WebSocket
+// disconnected." The fix wires the import into the Next instrumentation hook
+// (instrumentation-node.ts), which is the module that actually runs in the
+// packaged bin. This test asserts that wiring stays in place.
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const instrumentationPath = resolve(__dirname, "../../src/instrumentation-node.ts");
+const source = readFileSync(instrumentationPath, "utf8");
+
+describe("standalone runtime wires the live-dashboard WebSocket daemon", () => {
+  test("instrumentation-node.ts imports the live-WS server so its auto-start fires", () => {
+    assert.match(
+      source,
+      /import\(\s*["']@\/server\/ws\/liveServer["']\s*\)/,
+      "instrumentation-node.ts must import @/server/ws/liveServer so the port-20129 daemon starts in the standalone bin"
+    );
+  });
+
+  test("the live-WS bootstrap is gated with the background-services block and is non-fatal", () => {
+    // It must live inside the isBackgroundServicesDisabled() gate and be wrapped
+    // so a bind failure never crashes startup.
+    assert.match(source, /liveServer/);
+    assert.match(source, /Live dashboard WebSocket daemon failed to start \(non-fatal\)/);
+  });
+});
diff --git a/tests/unit/mcp-extra-forward-6178.test.ts b/tests/unit/mcp-extra-forward-6178.test.ts
new file mode 100644
index 0000000000..177541616f
--- /dev/null
+++ b/tests/unit/mcp-extra-forward-6178.test.ts
@@ -0,0 +1,82 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+// Regression guard for #6178: the static MCP tool-registration loops in
+// open-sse/mcp-server/server.ts wrapped handlers as `async (args) => { … }`,
+// dropping the MCP request `extra` argument that `withScopeEnforcement`
+// forwards. On the stdio transport `omniroute_ccr_retrieve` therefore fell back
+// to an anonymous caller (`resolveMcpCallerApiKeyId()` AsyncLocalStorage is
+// undefined off the HTTP path, and `extra` was gone), so its principal-scoped
+// CCR store lookup used the `__anon__` bucket and never matched the block the
+// real caller stored. The fix threads `extra` through every static loop:
+// `async (args, extra) => await toolDef.handler(parsedArgs, extra)`.
+//
+// This drives the REAL registration loop: it builds the live MCP server via
+// createMcpServer(), stores a CCR block under a concrete principal, then invokes
+// the registered omniroute_ccr_retrieve handler with an `extra` carrying that
+// principal as the caller id (clientId) — exactly what the SDK passes on a tool
+// call. If `extra` is dropped, the caller resolves to "anonymous", the store key
+// misses, and retrieval errors out.
+
+const { createMcpServer } = await import("../../open-sse/mcp-server/server.ts");
+const { storeBlock, resetCcrStore } = await import(
+  "../../open-sse/services/compression/engines/ccr/index.ts"
+);
+const { resetDbInstance } = await import("../../src/lib/db/core.ts");
+
+type RegisteredTool = {
+  handler: (args: unknown, extra?: unknown) => Promise<{
+    content?: Array<{ type: string; text: string }>;
+    isError?: boolean;
+  }>;
+};
+
+function getRegisteredHandler(server: unknown, toolName: string) {
+  const registry = (server as { _registeredTools?: Record<string, RegisteredTool> })
+    ._registeredTools;
+  assert.ok(registry, "McpServer should expose _registeredTools");
+  const tool = registry[toolName];
+  assert.ok(tool, `${toolName} must be registered on the live MCP server`);
+  return tool.handler;
+}
+
+test("static tool loops forward `extra` so stdio callers keep their scope/identity (#6178)", async () => {
+  resetCcrStore();
+
+  const principal = "apikey-6178";
+  const verbatim = "VERBATIM-CCR-BLOCK-6178: the original content the caller stored.";
+  const hash = storeBlock(verbatim, principal);
+
+  const server = createMcpServer();
+  const retrieve = getRegisteredHandler(server, "omniroute_ccr_retrieve");
+
+  // Simulate a stdio tool call: no HTTP AsyncLocalStorage principal, but the MCP
+  // `extra` carries the caller identity (clientId) + granted scopes.
+  const extra = {
+    authInfo: { clientId: principal, scopes: ["read:compression"] },
+  };
+
+  const result = await retrieve({ hash }, extra);
+  const text = result.content?.[0]?.text ?? "";
+  const payload = JSON.parse(text) as { content?: string; error?: string };
+
+  // With `extra` forwarded, the handler resolves the real principal, the CCR
+  // store key matches, and the verbatim block comes back. If the loop dropped
+  // `extra` (the #6178 bug), the caller resolves to "anonymous" and this fails
+  // with a "CCR block not found" error.
+  assert.equal(
+    result.isError,
+    undefined,
+    `retrieve must not error; got: ${payload.error ?? "(no error)"}`
+  );
+  assert.equal(
+    payload.content,
+    verbatim,
+    "the forwarded `extra` principal must match the stored block and return it verbatim"
+  );
+});
+
+test.after(() => {
+  resetCcrStore();
+  resetDbInstance();
+});
diff --git a/tests/unit/memory-system-first-6135.test.ts b/tests/unit/memory-system-first-6135.test.ts
new file mode 100644
index 0000000000..371ccc8d8a
--- /dev/null
+++ b/tests/unit/memory-system-first-6135.test.ts
@@ -0,0 +1,115 @@
+/**
+ * Tests for #6135: cache-safe memory injection inserts a system message at a
+ * non-zero index, which strict providers (e.g. xiaomi-mimo / alias `mimo`,
+ * serving mimo-v2.5) reject with HTTP 400.
+ *
+ * For providers flagged system-message-must-be-first, the injected system
+ * message MUST remain at index 0 (merged into an existing leading system
+ * message, or prepended) instead of being spliced before the last user turn.
+ * Non-flagged providers keep the existing cache-safe placement unchanged.
+ */
+
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import {
+  injectMemory,
+  systemMessageMustBeFirst,
+} from "../../src/lib/memory/injection.ts";
+import type { ChatMessage, ChatRequest } from "../../src/lib/memory/injection.ts";
+import { MemoryType } from "../../src/lib/memory/types.ts";
+import type { Memory } from "../../src/lib/memory/types.ts";
+
+function mem(content: string): Memory {
+  return {
+    id: `mem-${content}`,
+    content,
+    type: MemoryType.FACTUAL,
+    apiKeyId: "k",
+    createdAt: "2026-01-01T00:00:00.000Z",
+    updatedAt: "2026-01-01T00:00:00.000Z",
+    importance: 0.5,
+  } as unknown as Memory;
+}
+
+// Multi-turn conversation with >= 2 user turns → findLastIndex(user) > 0.
+function multiTurn(): ChatRequest {
+  return {
+    model: "mimo-v2.5",
+    messages: [
+      { role: "system", content: "SYSTEM PROMPT" } as ChatMessage,
+      { role: "user", content: "turn 1 question" },
+      { role: "assistant", content: "turn 1 answer" },
+      { role: "user", content: "turn 2 question" },
+    ],
+  };
+}
+
+describe("injectMemory system-must-be-first (#6135)", () => {
+  it("flags xiaomi-mimo (and alias mimo) as system-must-be-first", () => {
+    assert.equal(systemMessageMustBeFirst("xiaomi-mimo"), true);
+    assert.equal(systemMessageMustBeFirst("mimo"), true);
+    // default: unlisted providers keep current (non-first-constrained) behavior
+    assert.equal(systemMessageMustBeFirst("anthropic"), false);
+    assert.equal(systemMessageMustBeFirst(null), false);
+  });
+
+  it("keeps the injected system message at index 0 for a flagged provider even under cacheSafe", () => {
+    const out = injectMemory(multiTurn(), [mem("dark mode")], "xiaomi-mimo", {
+      cacheSafe: true,
+    });
+
+    // The system message must be first...
+    assert.equal(
+      out.messages.findIndex((m) => m.role === "system"),
+      0
+    );
+    // ...and there must be NO system message at any index > 0.
+    const strayIdx = out.messages.findIndex((m, i) => i > 0 && m.role === "system");
+    assert.equal(strayIdx, -1);
+    // Memory context is present in the leading system message.
+    assert.ok(out.messages[0].content.includes("Memory context"));
+    assert.ok(out.messages[0].content.includes("dark mode"));
+  });
+
+  it("merges memory into an existing leading system message (single system, still first)", () => {
+    const out = injectMemory(multiTurn(), [mem("dark mode")], "mimo", {
+      cacheSafe: true,
+    });
+    // Exactly one system message, at index 0, carrying both memory + original.
+    const systemCount = out.messages.filter((m) => m.role === "system").length;
+    assert.equal(systemCount, 1);
+    assert.equal(out.messages[0].role, "system");
+    assert.ok(out.messages[0].content.includes("Memory context"));
+    assert.ok(out.messages[0].content.includes("SYSTEM PROMPT"));
+    // Last user turn preserved at the tail.
+    assert.equal(out.messages[out.messages.length - 1].content, "turn 2 question");
+  });
+
+  it("prepends a leading system message when there is no existing one (flagged provider)", () => {
+    const req: ChatRequest = {
+      model: "mimo-v2.5",
+      messages: [
+        { role: "user", content: "turn 1 question" },
+        { role: "assistant", content: "turn 1 answer" },
+        { role: "user", content: "turn 2 question" },
+      ],
+    };
+    const out = injectMemory(req, [mem("dark mode")], "xiaomi-mimo", { cacheSafe: true });
+    assert.equal(out.messages[0].role, "system");
+    assert.ok(out.messages[0].content.includes("Memory context"));
+    assert.equal(
+      out.messages.findIndex((m, i) => i > 0 && m.role === "system"),
+      -1
+    );
+  });
+
+  it("regression: a NON-flagged provider keeps the existing cache-safe placement", () => {
+    const req = multiTurn();
+    const out = injectMemory(req, [mem("dark mode")], "anthropic", { cacheSafe: true });
+    // Existing behavior: memory inserted just before the last user message (index 3).
+    assert.equal(out.messages[3].role, "system");
+    assert.ok(out.messages[3].content.includes("Memory context"));
+    assert.equal(out.messages[4].content, "turn 2 question");
+    assert.equal(out.messages.length, 5);
+  });
+});
diff --git a/tests/unit/messages-count-tokens-route.test.ts b/tests/unit/messages-count-tokens-route.test.ts
index ffcdcdd461..a066e9cb63 100644
--- a/tests/unit/messages-count-tokens-route.test.ts
+++ b/tests/unit/messages-count-tokens-route.test.ts
@@ -11,6 +11,13 @@ const core = await import("../../src/lib/db/core.ts");
 const providersDb = await import("../../src/lib/db/providers.ts");
 const { POST } = await import("../../src/app/api/v1/messages/count_tokens/route.ts");
 
+type CountTokensResponse = {
+  input_tokens: number;
+  source: string;
+  provider?: string;
+  model?: string;
+};
+
 async function resetStorage() {
   core.resetDbInstance();
   fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
@@ -68,7 +75,7 @@ test("messages/count_tokens uses real provider count when Claude-compatible upst
     );
 
     assert.equal(response.status, 200);
-    const body = (await response.json()) as any;
+    const body = (await response.json()) as CountTokensResponse;
     assert.equal(body.input_tokens, 321);
     assert.equal(body.source, "provider");
     assert.equal(body.provider, "anthropic");
@@ -96,7 +103,7 @@ test("messages/count_tokens falls back to estimate when model is missing", async
   );
 
   assert.equal(response.status, 200);
-  const body = (await response.json()) as any;
+  const body = (await response.json()) as CountTokensResponse;
   assert.equal(body.input_tokens, 4); // tiktoken: "abcd"=1 + "12345678"=3
   assert.equal(body.source, "local");
 });
@@ -108,11 +115,81 @@ test("count_tokens fallback uses exact tiktoken count with source=local", async
     body: JSON.stringify({ messages: [{ role: "user", content: "hello world" }] }),
   });
   const res = await POST(req);
-  const json = (await res.json()) as any;
+  const json = (await res.json()) as CountTokensResponse;
   assert.equal(json.source, "local");
   assert.equal(json.input_tokens, 2); // exact cl100k_base count, not Math.ceil(11/4)=3
 });
 
+test("count_tokens estimate counts tool_use / tool_result / thinking blocks (not just text) — #2337", async () => {
+  // Real agentic conversations carry ~95% of their tokens inside tool_use inputs
+  // and tool_result content. The estimation path used to only sum `text` blocks,
+  // returning input_tokens: 0 for the shape below, which silently broke Claude
+  // Code's auto-compaction. Every non-text block below must contribute tokens.
+  const response = await POST(
+    new Request("http://localhost/v1/messages/count_tokens", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        messages: [
+          {
+            role: "assistant",
+            content: [
+              {
+                type: "thinking",
+                thinking: "The user wants me to read a file, let me call the Read tool.",
+              },
+              {
+                type: "tool_use",
+                id: "toolu_01",
+                name: "Read",
+                input: { file_path: "/tmp/a.txt", limit: 200 },
+              },
+            ],
+          },
+          {
+            role: "user",
+            content: [
+              {
+                type: "tool_result",
+                tool_use_id: "toolu_01",
+                content: "line1 line2 line3 some file content here",
+              },
+            ],
+          },
+        ],
+      }),
+    })
+  );
+
+  assert.equal(response.status, 200);
+  const body = (await response.json()) as CountTokensResponse;
+  assert.equal(body.source, "local");
+  // Before the fix this was 0 (only `text` blocks were counted).
+  assert.ok(
+    body.input_tokens > 0,
+    `expected tool/thinking blocks to contribute tokens, got ${body.input_tokens}`
+  );
+});
+
+test("count_tokens estimate counts array-form system prompt blocks — #2337", async () => {
+  const response = await POST(
+    new Request("http://localhost/v1/messages/count_tokens", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        system: [{ type: "text", text: "You are a helpful coding assistant." }],
+        messages: [{ role: "user", content: "hi" }],
+      }),
+    })
+  );
+
+  assert.equal(response.status, 200);
+  const body = (await response.json()) as CountTokensResponse;
+  assert.equal(body.source, "local");
+  // Array-form `system` used to count as 0 (only string system was summed).
+  assert.ok(body.input_tokens > 1, `expected system blocks counted, got ${body.input_tokens}`);
+});
+
 test("messages/count_tokens falls back to estimate when real upstream count fails", async () => {
   await seedConnection("anthropic", { apiKey: "sk-ant-fallback" });
 
@@ -132,7 +209,7 @@ test("messages/count_tokens falls back to estimate when real upstream count fail
     );
 
     assert.equal(response.status, 200);
-    const body = (await response.json()) as any;
+    const body = (await response.json()) as CountTokensResponse;
     assert.equal(body.input_tokens, 1); // tiktoken: "abcd"=1
     assert.equal(body.source, "local");
   } finally {
diff --git a/tests/unit/mitm-cert-mac-fingerprint.test.ts b/tests/unit/mitm-cert-mac-fingerprint.test.ts
new file mode 100644
index 0000000000..5b25a37112
--- /dev/null
+++ b/tests/unit/mitm-cert-mac-fingerprint.test.ts
@@ -0,0 +1,37 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { macCertOutputHasFingerprint } from "../../src/mitm/cert/install.ts";
+
+// Regression for #6204 (#6134): macOS `security find-certificate -a -Z` prints
+// the SHA-1 as a colon-less hex string, while getCertFingerprint() returns a
+// colon-separated one. The old `output.toUpperCase().includes(fingerprint)`
+// check therefore never matched, so the cert was always reported as
+// not-installed and the sudo install re-prompted on every run.
+
+const FINGERPRINT_WITH_COLONS = "AB:CD:EF:01:23:45:67:89:AB:CD:EF:01:23:45:67:89:AB:CD:EF:01";
+// What `security find-certificate -a -Z` actually emits (no colons).
+const MAC_SECURITY_OUTPUT = [
+  "keychain: /Library/Keychains/System.keychain",
+  "SHA-1 hash: ABCDEF0123456789ABCDEF0123456789ABCDEF01",
+  '"labl"<blob>="OmniRoute MITM Root CA"',
+].join("\n");
+
+test("macCertOutputHasFingerprint matches colon-less security output against a colon-separated fingerprint", () => {
+  assert.equal(macCertOutputHasFingerprint(MAC_SECURITY_OUTPUT, FINGERPRINT_WITH_COLONS), true);
+});
+
+test("macCertOutputHasFingerprint returns false when the fingerprint is absent", () => {
+  const other = "SHA-1 hash: 00000000000000000000000000000000000000FF";
+  assert.equal(macCertOutputHasFingerprint(other, FINGERPRINT_WITH_COLONS), false);
+});
+
+test("macCertOutputHasFingerprint is case-insensitive", () => {
+  const lower = MAC_SECURITY_OUTPUT.toLowerCase();
+  assert.equal(macCertOutputHasFingerprint(lower, FINGERPRINT_WITH_COLONS), true);
+});
+
+test("pre-fix behavior (raw substring incl. colons) would have missed — documents the bug", () => {
+  // The pre-#6204 check was `output.toUpperCase().includes(fingerprint)`.
+  assert.equal(MAC_SECURITY_OUTPUT.toUpperCase().includes(FINGERPRINT_WITH_COLONS), false);
+});
diff --git a/tests/unit/mitm-systemCommands-no-sudo.test.ts b/tests/unit/mitm-systemCommands-no-sudo.test.ts
new file mode 100644
index 0000000000..8754b490aa
--- /dev/null
+++ b/tests/unit/mitm-systemCommands-no-sudo.test.ts
@@ -0,0 +1,146 @@
+/**
+ * Feature #6122 — root-less / no-sudo mode for the MITM cert-trust path.
+ *
+ * OmniRoute funnels every privileged MITM command through the single choke
+ * point `execFileWithPassword("sudo", ["-S", ...], password)`, which strips the
+ * leading `sudo -S` when running as root or when `sudo` is not on PATH. This
+ * feature adds a third opt-out trigger — the `OMNIROUTE_NO_SUDO` env flag — so
+ * OmniRoute starts cleanly in a root-less / user-namespace deployment where
+ * `/usr/bin/sudo` exists but must not be used.
+ *
+ * These tests assert the RESOLVED argv (via the pure `resolveSudoSpawn` seam)
+ * WITHOUT spawning a real `sudo`: with the flag ON the leading `sudo`/`-S`
+ * tokens are dropped and no password is written to stdin; with the flag OFF
+ * (and non-root + sudo available) the `sudo -S …` argv is preserved.
+ */
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { isNoSudoEnv, resolveSudoSpawn } from "../../src/mitm/systemCommands.ts";
+
+// Non-root host with sudo on PATH: the only variable is the env flag. This is
+// the exact environment the feature targets (sudo present, must be skipped).
+const NON_ROOT_WITH_SUDO = { root: false, sudoAvailable: true } as const;
+
+test(
+  "resolveSudoSpawn: with OMNIROUTE_NO_SUDO=1, strips `sudo -S` and needs no password",
+  () => {
+    const prev = process.env.OMNIROUTE_NO_SUDO;
+    process.env.OMNIROUTE_NO_SUDO = "1";
+    try {
+      const { finalCommand, finalArgs, stripSudo, needsPassword } = resolveSudoSpawn(
+        "sudo",
+        ["-S", "cp", "/tmp/ca.pem", "/usr/local/share/ca-certificates/ca.crt"],
+        NON_ROOT_WITH_SUDO
+      );
+      assert.equal(stripSudo, true);
+      assert.equal(finalCommand, "cp");
+      assert.deepEqual(finalArgs, [
+        "/tmp/ca.pem",
+        "/usr/local/share/ca-certificates/ca.crt",
+      ]);
+      // No `sudo` and no `-S` survive into the spawned argv.
+      assert.ok(!finalArgs.includes("sudo"));
+      assert.ok(!finalArgs.includes("-S"));
+      // Password is only piped when `sudo -S` is actually spawned.
+      assert.equal(needsPassword, false);
+    } finally {
+      if (prev === undefined) delete process.env.OMNIROUTE_NO_SUDO;
+      else process.env.OMNIROUTE_NO_SUDO = prev;
+    }
+  }
+);
+
+test(
+  "resolveSudoSpawn: with the flag OFF + non-root + sudo available, preserves `sudo -S`",
+  () => {
+    const prev = process.env.OMNIROUTE_NO_SUDO;
+    delete process.env.OMNIROUTE_NO_SUDO;
+    try {
+      const { finalCommand, finalArgs, stripSudo, needsPassword } = resolveSudoSpawn(
+        "sudo",
+        ["-S", "cp", "/tmp/ca.pem", "/usr/local/share/ca-certificates/ca.crt"],
+        NON_ROOT_WITH_SUDO
+      );
+      // Regression guard: do NOT strip when not asked to.
+      assert.equal(stripSudo, false);
+      assert.equal(finalCommand, "sudo");
+      assert.deepEqual(finalArgs, [
+        "-S",
+        "cp",
+        "/tmp/ca.pem",
+        "/usr/local/share/ca-certificates/ca.crt",
+      ]);
+      assert.equal(needsPassword, true);
+    } finally {
+      if (prev === undefined) delete process.env.OMNIROUTE_NO_SUDO;
+      else process.env.OMNIROUTE_NO_SUDO = prev;
+    }
+  }
+);
+
+test("resolveSudoSpawn: a non-sudo command is never touched, regardless of the flag", () => {
+  const prev = process.env.OMNIROUTE_NO_SUDO;
+  process.env.OMNIROUTE_NO_SUDO = "1";
+  try {
+    const { finalCommand, finalArgs, stripSudo, needsPassword } = resolveSudoSpawn(
+      "certutil",
+      ["-A", "-n", "OmniRoute"],
+      NON_ROOT_WITH_SUDO
+    );
+    assert.equal(stripSudo, false);
+    assert.equal(needsPassword, false);
+    assert.equal(finalCommand, "certutil");
+    assert.deepEqual(finalArgs, ["-A", "-n", "OmniRoute"]);
+  } finally {
+    if (prev === undefined) delete process.env.OMNIROUTE_NO_SUDO;
+    else process.env.OMNIROUTE_NO_SUDO = prev;
+  }
+});
+
+test("isNoSudoEnv: truthiness matrix matches isTruthyEnvFlag semantics", () => {
+  const prev = process.env.OMNIROUTE_NO_SUDO;
+  const cases: Array<[string | undefined, boolean]> = [
+    ["1", true],
+    ["true", true],
+    ["TRUE", true],
+    ["yes", true],
+    ["on", true],
+    [" 1 ", true],
+    ["0", false],
+    ["false", false],
+    ["no", false],
+    ["off", false],
+    ["", false],
+    [undefined, false],
+  ];
+  try {
+    for (const [value, expected] of cases) {
+      if (value === undefined) delete process.env.OMNIROUTE_NO_SUDO;
+      else process.env.OMNIROUTE_NO_SUDO = value;
+      assert.equal(isNoSudoEnv(), expected, `OMNIROUTE_NO_SUDO=${JSON.stringify(value)}`);
+    }
+  } finally {
+    if (prev === undefined) delete process.env.OMNIROUTE_NO_SUDO;
+    else process.env.OMNIROUTE_NO_SUDO = prev;
+  }
+});
+
+test("resolveSudoSpawn: env flag alone (no overrides) drives stripping on non-root sudo host", () => {
+  // Exercises the real env-reading default path (noSudo defaults to isNoSudoEnv()).
+  const prev = process.env.OMNIROUTE_NO_SUDO;
+  process.env.OMNIROUTE_NO_SUDO = "yes";
+  try {
+    const { finalCommand, stripSudo } = resolveSudoSpawn(
+      "sudo",
+      ["-S", "true"],
+      // Pin root/sudo probes so the assertion is deterministic across hosts;
+      // leave `noSudo` unset so it reads the live env flag.
+      NON_ROOT_WITH_SUDO
+    );
+    assert.equal(stripSudo, true);
+    assert.equal(finalCommand, "true");
+  } finally {
+    if (prev === undefined) delete process.env.OMNIROUTE_NO_SUDO;
+    else process.env.OMNIROUTE_NO_SUDO = prev;
+  }
+});
diff --git a/tests/unit/model-capabilities-registry.test.ts b/tests/unit/model-capabilities-registry.test.ts
index b6582a1ca6..c4be2f0e49 100644
--- a/tests/unit/model-capabilities-registry.test.ts
+++ b/tests/unit/model-capabilities-registry.test.ts
@@ -108,7 +108,8 @@ test("canonical model capability resolver lets exact synced metadata override gl
 
   const codexGpt55 = modelCapabilities.getResolvedModelCapabilities("codex/gpt-5.5");
   assert.equal(codexGpt55.contextWindow, 400000);
-  assert.equal(codexGpt55.maxInputTokens, 400000);
+  // #6191: max_input_tokens is a distinct, smaller cap than the context window.
+  assert.equal(codexGpt55.maxInputTokens, 272000);
   assert.equal(codexGpt55.maxOutputTokens, 128000);
   assert.equal(codexGpt55.supportsThinking, true);
   assert.equal(codexGpt55.supportsVision, true);
diff --git a/tests/unit/model-family-fallback-notation.test.ts b/tests/unit/model-family-fallback-notation.test.ts
index bda527d98d..b52e58e8d1 100644
--- a/tests/unit/model-family-fallback-notation.test.ts
+++ b/tests/unit/model-family-fallback-notation.test.ts
@@ -4,8 +4,10 @@ import assert from "node:assert/strict";
 // Covers getNextFamilyFallback's dot-vs-hyphen notation resolution (the hunk
 // added alongside Claude Fable 5 in #3524 that affects ALL families): the
 // lookup normalizes dots→hyphens, and each candidate is resolved to the
-// notation the provider's registry actually exposes (kiro uses dot notation
-// `claude-opus-4.8`, cc uses hyphen `claude-opus-4-8`).
+// notation the provider's registry actually exposes (anthropic uses dot notation
+// `claude-opus-4.8`, cc uses hyphen `claude-opus-4-8`). Kiro is NOT used as the
+// dot-notation example any more — its upstream never served Opus/Fable and #6170
+// removed the fabricated ids; `anthropic` genuinely serves them in dot notation.
 const { getNextFamilyFallback } = await import("../../open-sse/services/modelFamilyFallback.ts");
 
 test("Fable 5 falls back to the next-best Opus tier first (not Sonnet) — cc→claude", () => {
@@ -14,16 +16,16 @@ test("Fable 5 falls back to the next-best Opus tier first (not Sonnet) — cc→
   assert.equal(next, "claude/claude-opus-4-8");
 });
 
-test("Fable 5 fallback resolves to kiro's dot-notation model id", () => {
-  // kiro registry exposes `claude-opus-4.8` (dot), not `claude-opus-4-8`.
-  const next = getNextFamilyFallback("kiro/claude-fable-5", new Set(["kiro/claude-fable-5"]));
-  assert.equal(next, "kiro/claude-opus-4.8");
+test("Fable 5 fallback resolves to anthropic's dot-notation model id", () => {
+  // anthropic registry exposes `claude-opus-4.8` (dot), not `claude-opus-4-8`.
+  const next = getNextFamilyFallback("anthropic/claude-fable-5", new Set(["anthropic/claude-fable-5"]));
+  assert.equal(next, "anthropic/claude-opus-4.8");
 });
 
 test("dot-notation current model is normalized for the family lookup", () => {
-  // kiro/claude-opus-4.8 must find the claude-opus-4-8 family entry.
-  const next = getNextFamilyFallback("kiro/claude-opus-4.8", new Set(["kiro/claude-opus-4.8"]));
-  assert.equal(next, "kiro/claude-opus-4.7");
+  // anthropic/claude-opus-4.8 must find the claude-opus-4-8 family entry.
+  const next = getNextFamilyFallback("anthropic/claude-opus-4.8", new Set(["anthropic/claude-opus-4.8"]));
+  assert.equal(next, "anthropic/claude-opus-4.7");
 });
 
 test("skips already-tried candidates and advances down the Fable chain", () => {
diff --git a/tests/unit/model-test-runner.test.ts b/tests/unit/model-test-runner.test.ts
index c32e0d0926..f7a8a55c8b 100644
--- a/tests/unit/model-test-runner.test.ts
+++ b/tests/unit/model-test-runner.test.ts
@@ -4,6 +4,7 @@ import {
   parseRetryAfterHeader,
   detectTestKind,
   extractProviderErrorMessage,
+  resolveModelTestTimeoutMs,
 } from "@/lib/api/modelTestRunner.ts";
 
 // ---------------------------------------------------------------------------
@@ -105,3 +106,14 @@ test("extractProviderErrorMessage includes upstream details when generic error i
     "HuggingChat returned HTTP 500: Model is temporarily overloaded"
   );
 });
+
+test("resolveModelTestTimeoutMs extends Dola Pro model checks", () => {
+  assert.equal(resolveModelTestTimeoutMs("doubao-web", "dola-pro", 10_000), 90_000);
+  assert.equal(resolveModelTestTimeoutMs("doubao-web", "doubao-web/dola-pro", 10_000), 90_000);
+  assert.equal(resolveModelTestTimeoutMs("DOUBAO-WEB", "dola-pro", 120_000), 120_000);
+});
+
+test("resolveModelTestTimeoutMs leaves ordinary models unchanged", () => {
+  assert.equal(resolveModelTestTimeoutMs("doubao-web", "dola-speed", 10_000), 10_000);
+  assert.equal(resolveModelTestTimeoutMs("openai", "dola-pro", 10_000), 10_000);
+});
diff --git a/tests/unit/models-test-error-shape.test.ts b/tests/unit/models-test-error-shape.test.ts
new file mode 100644
index 0000000000..54f98ed493
--- /dev/null
+++ b/tests/unit/models-test-error-shape.test.ts
@@ -0,0 +1,65 @@
+// Regression guard: POST /api/models/test must always return a STRING `error`,
+// never an object. The Zod-validation and invalid-JSON paths used to return
+// `{ error: <object> }` (Zod .format() / a details object). The dashboard renders
+// that value directly in a toast, so an object froze the whole page (React #31).
+// The "test a model → screen froze" bug.
+//
+// DB handles released in test.after (CLAUDE.md learning: unreleased SQLite
+// handles hang node:test).
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-models-test-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const settingsDb = await import("../../src/lib/db/settings.ts");
+const route = await import("../../src/app/api/models/test/route.ts");
+
+test.before(async () => {
+  await settingsDb.updateSettings({ requireLogin: false });
+});
+
+test.after(async () => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+function post(body: unknown, rawText?: string) {
+  return route.POST(
+    new Request("http://localhost:20128/api/models/test", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: rawText !== undefined ? rawText : JSON.stringify(body),
+    })
+  );
+}
+
+test("Zod validation failure returns a STRING error (not an object)", async () => {
+  // connectionId "" fails z.string().min(1).optional() -> validation error path
+  const res = await post({ providerId: "openai", modelId: "gpt-4o", connectionId: "" });
+  assert.equal(res.status, 400);
+  const body = await res.json();
+  assert.equal(typeof body.error, "string", "error must be a string, never an object");
+  assert.equal(body.status, "error");
+  assert.match(body.error, /Invalid request/i);
+});
+
+test("missing required field returns a STRING error", async () => {
+  const res = await post({ providerId: "openai" }); // no modelId
+  assert.equal(res.status, 400);
+  const body = await res.json();
+  assert.equal(typeof body.error, "string");
+});
+
+test("invalid JSON body returns a STRING error (not an object)", async () => {
+  const res = await post(undefined, "{ not json ");
+  assert.equal(res.status, 400);
+  const body = await res.json();
+  assert.equal(typeof body.error, "string");
+  assert.match(body.error, /Invalid JSON/i);
+});
diff --git a/tests/unit/ninerouter-embed-port-6205.test.ts b/tests/unit/ninerouter-embed-port-6205.test.ts
new file mode 100644
index 0000000000..be967d2f53
--- /dev/null
+++ b/tests/unit/ninerouter-embed-port-6205.test.ts
@@ -0,0 +1,100 @@
+/**
+ * #6205 — 9Router embedded service: embed-panel 404 + pre-spawn EADDRINUSE.
+ *
+ * SUB-BUG A — the embed panel root (`/embed/`, zero segments after `embed/`)
+ * 404s because the proxy route was a REQUIRED catch-all `[...path]`, which does
+ * not match a segment-less path. Fix: OPTIONAL catch-all `[[...path]]` so the
+ * root matches, and `reverseProxy.toUpstreamPath([])` maps the empty segment
+ * array to `"/"`.
+ *
+ * SUB-BUG B — `ServiceSupervisor.start()` spawned the child with no pre-flight
+ * port/health probe, so an orphaned prior instance holding the port made the
+ * child die with a raw EADDRINUSE stack. Fix: `decidePreSpawn()` — adopt a
+ * healthy instance, surface a clear error for a held-but-unhealthy port.
+ */
+
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import path from "node:path";
+
+import { toUpstreamPath } from "../../src/lib/services/embedPath.ts";
+import { decidePreSpawn } from "../../src/lib/services/portProbe.ts";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(__dirname, "../..");
+
+// ─── SUB-BUG A: optional catch-all route + empty-segment mapping ──────────────
+
+describe("#6205 A — embed panel root no longer 404s", () => {
+  it("the proxy route folder is an OPTIONAL catch-all ([[...path]])", () => {
+    const optional = path.join(
+      repoRoot,
+      "src/app/(dashboard)/dashboard/providers/services/[name]/embed/[[...path]]/route.ts"
+    );
+    const required = path.join(
+      repoRoot,
+      "src/app/(dashboard)/dashboard/providers/services/[name]/embed/[...path]/route.ts"
+    );
+    assert.ok(existsSync(optional), "optional catch-all [[...path]]/route.ts must exist");
+    assert.ok(
+      !existsSync(required),
+      "required catch-all [...path]/route.ts must be gone (it cannot match /embed/)"
+    );
+  });
+
+  it("maps the segment-less embed root ([]) to upstream '/'", () => {
+    // The embed frame links to `/dashboard/providers/services/9router/embed/`,
+    // i.e. zero segments after `embed/`. With the optional catch-all matching,
+    // Next hands the route an empty segment array — which must map to "/".
+    assert.equal(toUpstreamPath([]), "/");
+  });
+
+  it("still maps nested segments to their upstream path", () => {
+    assert.equal(toUpstreamPath(["ui", "index.html"]), "/ui/index.html");
+    assert.equal(toUpstreamPath(["api", "models"]), "/api/models");
+  });
+
+  it("derives an empty segment array from the embed frame's constructed path", () => {
+    // Mirrors what Next's catch-all does: strip the prefix, split remaining.
+    const framePath = "/dashboard/providers/services/9router/embed/";
+    const prefix = "/dashboard/providers/services/9router/embed/";
+    const rest = framePath.slice(prefix.length); // ""
+    const segments = rest.split("/").filter(Boolean); // []
+    assert.deepEqual(segments, []);
+    assert.equal(toUpstreamPath(segments), "/");
+  });
+});
+
+// ─── SUB-BUG B: pre-spawn port/health decision ───────────────────────────────
+
+describe("#6205 B — pre-spawn port probe avoids raw EADDRINUSE", () => {
+  it("adopts a healthy existing instance (no spawn)", () => {
+    const decision = decidePreSpawn({ healthy: true, portInUse: true }, 20130);
+    assert.equal(decision.action, "adopt");
+  });
+
+  it("returns a clear error object (not a throw) when the port is held but unhealthy", () => {
+    let decision;
+    assert.doesNotThrow(() => {
+      decision = decidePreSpawn({ healthy: false, portInUse: true }, 20130);
+    }, "decision must be returned, never thrown");
+    assert.equal(decision.action, "error");
+    assert.match(decision.message, /already in use/i);
+    assert.match(decision.message, /20130/, "error should name the port");
+    // The clear message must not be a raw EADDRINUSE stack trace.
+    assert.ok(!decision.message.includes("at /"), "must not leak a stack trace");
+  });
+
+  it("spawns when the port is free", () => {
+    const decision = decidePreSpawn({ healthy: false, portInUse: false }, 20130);
+    assert.equal(decision.action, "spawn");
+  });
+
+  it("adopts a healthy instance even if the TCP probe missed it", () => {
+    // Health is authoritative: a 2xx means a real instance is serving.
+    const decision = decidePreSpawn({ healthy: true, portInUse: false }, 20130);
+    assert.equal(decision.action, "adopt");
+  });
+});
diff --git a/tests/unit/notification-toast-coercion.test.ts b/tests/unit/notification-toast-coercion.test.ts
new file mode 100644
index 0000000000..89285ca66b
--- /dev/null
+++ b/tests/unit/notification-toast-coercion.test.ts
@@ -0,0 +1,35 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { toToastText } from "@/shared/components/NotificationToast";
+
+// Regression guard: a toast message/title that is NOT a string (e.g. a raw API
+// error body — a Zod `.format()` object) must be coerced to a string. Rendering
+// an object as a React child throws React #31 and freezes the whole page. This
+// was the "test model → screen froze" bug on the provider page.
+
+test("returns strings unchanged", () => {
+  assert.equal(toToastText("hello"), "hello");
+  assert.equal(toToastText(""), "");
+});
+
+test("returns empty string for null/undefined (never crashes render)", () => {
+  assert.equal(toToastText(null), "");
+  assert.equal(toToastText(undefined), "");
+});
+
+test("prefers a nested string .message on an object error body", () => {
+  assert.equal(toToastText({ message: "Rate limited" }), "Rate limited");
+});
+
+test("JSON-stringifies an arbitrary object instead of throwing (Zod .format() shape)", () => {
+  const zodish = { modelId: { _errors: ["Required"] }, _errors: [] };
+  const out = toToastText(zodish);
+  assert.equal(typeof out, "string");
+  assert.ok(out.includes("_errors"));
+});
+
+test("coerces numbers/booleans to string", () => {
+  assert.equal(toToastText(42), "42");
+  assert.equal(toToastText(true), "true");
+});
diff --git a/tests/unit/nvidia-nim-registry-6108.test.ts b/tests/unit/nvidia-nim-registry-6108.test.ts
new file mode 100644
index 0000000000..b9c12d9992
--- /dev/null
+++ b/tests/unit/nvidia-nim-registry-6108.test.ts
@@ -0,0 +1,23 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { nvidiaProvider } from "../../open-sse/config/providers/registry/nvidia/index.ts";
+
+// Regression guard for #6108: the static NVIDIA NIM model registry had gone
+// stale — z-ai/glm-5.1 was EOL'd (410) 2026-07-02, while glm-5.2 and
+// nvidia/nemotron-3-ultra-550b-a55b were absent. minimaxai/minimax-m3 stays
+// excluded per the #3329 guard (nvidia-minimax-m3-removed-3329.test.ts) — the
+// single 200 probe in #6108 wasn't reproducible enough to override it.
+const modelIds = new Set(nvidiaProvider.models.map((m) => m.id));
+
+test("#6108: NVIDIA NIM registry contains the refreshed live models", () => {
+  assert.ok(modelIds.has("z-ai/glm-5.2"), "z-ai/glm-5.2 must be present");
+  assert.ok(
+    modelIds.has("nvidia/nemotron-3-ultra-550b-a55b"),
+    "nvidia/nemotron-3-ultra-550b-a55b must be present"
+  );
+});
+
+test("#6108: NVIDIA NIM registry no longer lists EOL z-ai/glm-5.1", () => {
+  assert.ok(!modelIds.has("z-ai/glm-5.1"), "EOL z-ai/glm-5.1 must be removed");
+});
diff --git a/tests/unit/oauth-keychain-import-only-guard.test.ts b/tests/unit/oauth-keychain-import-only-guard.test.ts
new file mode 100644
index 0000000000..4160987917
--- /dev/null
+++ b/tests/unit/oauth-keychain-import-only-guard.test.ts
@@ -0,0 +1,38 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  keychainImportOnlyGuard,
+  KEYCHAIN_IMPORT_ONLY_PROVIDERS,
+  OAUTH_FLOW_ACTIONS,
+} from "../../src/app/api/oauth/[provider]/[action]/keychainImportOnly.ts";
+
+// Unit coverage for the leaf extracted from the OAuth route (#6155 file-size
+// base-red follow-up). The route-level behavior is guarded by
+// oauth-keychain-import-only-6041.test.ts; this pins the guard in isolation.
+
+test("keychainImportOnlyGuard returns a 400 for a keychain-import-only provider on an OAuth-flow action", async () => {
+  const res = keychainImportOnlyGuard("zed", "authorize");
+  assert.ok(res, "expected a response, not null");
+  assert.equal(res!.status, 400);
+  const body = await res!.json();
+  assert.match(body.error, /no browser OAuth flow/i);
+  assert.match(body.error, /Import/);
+});
+
+test("keychainImportOnlyGuard returns null for a normal OAuth provider", () => {
+  assert.equal(keychainImportOnlyGuard("openai", "authorize"), null);
+  assert.equal(keychainImportOnlyGuard("anthropic", "exchange"), null);
+});
+
+test("keychainImportOnlyGuard returns null for a keychain provider on a non-flow action", () => {
+  // e.g. a callback/status action that is not in OAUTH_FLOW_ACTIONS
+  assert.equal(keychainImportOnlyGuard("zed", "status"), null);
+});
+
+test("the sets stay in sync with the guard's expectations", () => {
+  assert.ok(KEYCHAIN_IMPORT_ONLY_PROVIDERS.has("zed"));
+  assert.ok(OAUTH_FLOW_ACTIONS.has("authorize"));
+  assert.ok(OAUTH_FLOW_ACTIONS.has("exchange"));
+  assert.ok(!OAUTH_FLOW_ACTIONS.has("status"));
+});
diff --git a/tests/unit/oauth-providers-config.test.ts b/tests/unit/oauth-providers-config.test.ts
index 5d4358f40a..2be59eb631 100644
--- a/tests/unit/oauth-providers-config.test.ts
+++ b/tests/unit/oauth-providers-config.test.ts
@@ -28,6 +28,7 @@ const {
   CLINE_CONFIG,
   CODEX_CONFIG,
   CODEBUDDY_CN_CONFIG,
+  ZED_CONFIG,
   CURSOR_CONFIG,
   GITHUB_CONFIG,
   GITLAB_DUO_CONFIG,
@@ -66,6 +67,7 @@ const EXPECTED_PROVIDER_KEYS = [
   "devin-cli",
   "grok-cli",
   "codebuddy-cn",
+  "zed",
 ];
 
 const EXPECTED_CONFIG_BY_PROVIDER = {
@@ -88,6 +90,7 @@ const EXPECTED_CONFIG_BY_PROVIDER = {
   trae: TRAE_CONFIG,
   "grok-cli": GROK_CLI_CONFIG,
   "codebuddy-cn": CODEBUDDY_CN_CONFIG,
+  zed: ZED_CONFIG,
 };
 
 const REQUIRED_FIELDS_BY_PROVIDER = {
diff --git a/tests/unit/onboarding-wizard-details-link-6145.test.ts b/tests/unit/onboarding-wizard-details-link-6145.test.ts
index 78ff6c67a7..52efbd241b 100644
--- a/tests/unit/onboarding-wizard-details-link-6145.test.ts
+++ b/tests/unit/onboarding-wizard-details-link-6145.test.ts
@@ -9,6 +9,13 @@ import { dirname, join } from "node:path";
 // `/dashboard/providers/[id]` route expects), NOT `connection.provider` (the
 // provider slug/type). The old code produced `/dashboard/providers/<provider-slug>`
 // which 404s for openai-compatible / anthropic-compatible providers.
+//
+// #6166 refactored the inline `href={`/dashboard/providers/${connection.id}`}`
+// literal into the tested `buildProviderDetailsHref(connection)` helper (its
+// id-based routing + null-safety is guarded behaviorally in
+// `provider-onboarding-href.test.ts`). This guard now tracks that refactor: the
+// wizard must delegate to the helper and must NOT reintroduce a raw
+// `connection.provider` URL.
 
 const here = dirname(fileURLToPath(import.meta.url));
 const repoRoot = join(here, "..", "..");
@@ -20,11 +27,11 @@ const wizard = readFileSync(
   "utf8"
 );
 
-test("#6145: provider-details link routes by connection.id (matches the [id] route)", () => {
+test("#6145: provider-details link routes through buildProviderDetailsHref (id-based helper)", () => {
   assert.match(
     wizard,
-    /href=\{`\/dashboard\/providers\/\$\{connection\.id\}`\}/,
-    "the details link must build the URL from connection.id"
+    /buildProviderDetailsHref\(connection\)/,
+    "the details link must be built by the tested buildProviderDetailsHref helper (routes by connection.id)"
   );
 });
 
diff --git a/tests/unit/opencode-executor.test.ts b/tests/unit/opencode-executor.test.ts
index 1cee807258..716c0f3d91 100644
--- a/tests/unit/opencode-executor.test.ts
+++ b/tests/unit/opencode-executor.test.ts
@@ -228,8 +228,8 @@ describe("OpencodeExecutor", () => {
       // Register new models
       registerModel("opencode-go", { id: "glm-5.1", name: "GLM-5.1", contextLength: 204800 });
       registerModel("opencode-go", { id: "kimi-k2.6", name: "Kimi K2.6" });
-      registerModel("opencode-go", { id: "mimo-v2-pro", name: "MiMo V2 Pro" });
-      registerModel("opencode-go", { id: "mimo-v2-omni", name: "MiMo V2 Omni" });
+      registerModel("opencode-go", { id: "mimo-v2.5-pro", name: "MiMo V2.5 Pro" });
+      registerModel("opencode-go", { id: "mimo-v2.5", name: "MiMo V2.5" });
 
       // glm-5.1
       const glm51 = await goExecutor.execute(createInput("glm-5.1"));
@@ -239,13 +239,13 @@ describe("OpencodeExecutor", () => {
       const kimi26 = await goExecutor.execute(createInput("kimi-k2.6"));
       assert.equal(kimi26.url, "https://opencode.ai/zen/go/v1/chat/completions");
 
-      // mimo-v2-pro
-      const mimoPro = await goExecutor.execute(createInput("mimo-v2-pro"));
+      // mimo-v2.5-pro
+      const mimoPro = await goExecutor.execute(createInput("mimo-v2.5-pro"));
       assert.equal(mimoPro.url, "https://opencode.ai/zen/go/v1/chat/completions");
 
-      // mimo-v2-omni
-      const mimoOmni = await goExecutor.execute(createInput("mimo-v2-omni"));
-      assert.equal(mimoOmni.url, "https://opencode.ai/zen/go/v1/chat/completions");
+      // mimo-v2.5
+      const mimo = await goExecutor.execute(createInput("mimo-v2.5"));
+      assert.equal(mimo.url, "https://opencode.ai/zen/go/v1/chat/completions");
     });
 
     it("routes opencode-go qwen models to claude messages endpoint", async () => {
@@ -278,21 +278,21 @@ describe("OpencodeExecutor", () => {
     it("routes opencode-go catalog-only models to chat completions", async () => {
       // Register new models
       registerModel("opencode-go", { id: "glm-6-max", name: "GLM-6 Max" });
-      registerModel("opencode-go", { id: "mimo-v2-pro", name: "MiMo-V2-Pro" });
-      registerModel("opencode-go", { id: "mimo-v2-omni", name: "MiMo-V2-Omni" });
+      registerModel("opencode-go", { id: "mimo-v2.5-pro", name: "MiMo-V2.5-Pro" });
+      registerModel("opencode-go", { id: "mimo-v2.5", name: "MiMo-V2.5" });
       registerModel("opencode-go", { id: "hy3-preview", name: "Hunyuan3 Preview" });
 
       // glm-6-max
       const glm6 = await goExecutor.execute(createInput("glm-6-max"));
       assert.equal(glm6.url, "https://opencode.ai/zen/go/v1/chat/completions");
 
-      // mimo-v2-pro
-      const mimoPro = await goExecutor.execute(createInput("mimo-v2-pro"));
+      // mimo-v2.5-pro
+      const mimoPro = await goExecutor.execute(createInput("mimo-v2.5-pro"));
       assert.equal(mimoPro.url, "https://opencode.ai/zen/go/v1/chat/completions");
 
-      // mimo-v2-omni
-      const mimoOmni = await goExecutor.execute(createInput("mimo-v2-omni"));
-      assert.equal(mimoOmni.url, "https://opencode.ai/zen/go/v1/chat/completions");
+      // mimo-v2.5
+      const mimo = await goExecutor.execute(createInput("mimo-v2.5"));
+      assert.equal(mimo.url, "https://opencode.ai/zen/go/v1/chat/completions");
 
       // hy3-preview
       const hy3 = await goExecutor.execute(createInput("hy3-preview"));
diff --git a/tests/unit/opencode-go-catalog-alignment.test.ts b/tests/unit/opencode-go-catalog-alignment.test.ts
index dd9741a1dd..6b9bd3b68b 100644
--- a/tests/unit/opencode-go-catalog-alignment.test.ts
+++ b/tests/unit/opencode-go-catalog-alignment.test.ts
@@ -11,14 +11,15 @@
 import test from "node:test";
 import assert from "node:assert/strict";
 
-const { opencode_goProvider } = await import(
-  "../../open-sse/config/providers/registry/opencode/go/index.ts"
-);
+const { opencode_goProvider } =
+  await import("../../open-sse/config/providers/registry/opencode/go/index.ts");
 
 function modelIds(): string[] {
   return (opencode_goProvider.models ?? []).map((m) => m.id);
 }
 
+const DEPRECATED_MIMO_V2_MODELS = ["mimo-v2-pro", "mimo-v2-omni"];
+
 test("opencode-go advertises glm-5.2 (official Go endpoint addition)", () => {
   assert.ok(
     modelIds().includes("glm-5.2"),
@@ -33,6 +34,13 @@ test("opencode-go advertises kimi-k2.7-code (live API rejects plain kimi-k2.7 fo
   );
 });
 
+test("opencode-go does not advertise deprecated MiMo V2 models", () => {
+  const ids = modelIds();
+  for (const modelId of DEPRECATED_MIMO_V2_MODELS) {
+    assert.ok(!ids.includes(modelId), `${modelId} is deprecated`);
+  }
+});
+
 test("opencode-go preserves the pre-existing minimax-m3 and qwen routing via targetFormat=claude", () => {
   // Routing through the /messages endpoint is OmniRoute's declarative
   // equivalent of upstream's MESSAGES_FORMAT_MODELS set; the alignment
diff --git a/tests/unit/provider-models-config.test.ts b/tests/unit/provider-models-config.test.ts
index be6acd59ab..a565e1a3e6 100644
--- a/tests/unit/provider-models-config.test.ts
+++ b/tests/unit/provider-models-config.test.ts
@@ -14,6 +14,7 @@ import {
   supportsXHighEffort,
   supportsXHighEffortForMaxNormalization,
 } from "../../open-sse/config/providerModels.ts";
+import { GITHUB_COPILOT_MODEL_ALLOWLIST } from "../../open-sse/services/githubCopilotModels.ts";
 
 test("provider models helpers expose model lists and defaults", () => {
   const openaiModels = getProviderModels("openai");
@@ -56,8 +57,7 @@ test("provider models helpers resolve provider IDs through aliases", () => {
 test("getProviderModels returns models for both the alias and the raw provider id", () => {
   // Pick a provider whose alias differs from its id (e.g. "github" → "gh").
   const aliased = Object.entries(PROVIDER_ID_TO_ALIAS).find(([id, a]) => id !== a) as
-    | [string, string]
-    | undefined;
+    [string, string] | undefined;
   if (!aliased) return; // no aliased providers → trivially satisfied
 
   const [rawId, alias] = aliased;
@@ -85,31 +85,37 @@ test("Reka registry exposes preset models", () => {
 
 test("GitHub Copilot registry reflects the current supported model lineup", () => {
   const githubModels = getProviderModels("gh");
-  const ids = new Set(githubModels.map((model) => model.id));
+  const ids = githubModels.map((model) => model.id);
 
-  assert.ok(ids.has("gpt-5.3-codex"));
-  assert.ok(ids.has("gpt-5.4"));
-  assert.ok(ids.has("gpt-5.4-mini"));
-  assert.ok(ids.has("claude-opus-4.7"));
-  assert.ok(ids.has("claude-opus-4.6"));
-  assert.ok(ids.has("claude-sonnet-4.6"));
-  assert.ok(ids.has("gemini-3-flash-preview"));
+  assert.deepEqual(ids, [...GITHUB_COPILOT_MODEL_ALLOWLIST]);
   assert.equal(getModelTargetFormat("gh", "gpt-5.3-codex"), "openai-responses");
   assert.equal(getModelTargetFormat("gh", "claude-opus-4.6"), null);
-  assert.equal(ids.has("gpt-5.1"), false);
-  assert.equal(ids.has("gpt-5.1-codex"), false);
-  assert.equal(ids.has("claude-opus-4.1"), false);
+  assert.equal(getModelTargetFormat("gh", "claude-opus-4.8-fast"), null);
+  assert.equal(getModelTargetFormat("gh", "gemini-3.5-flash"), null);
+  assert.equal(getModelTargetFormat("gh", "kimi-k2.7-code"), null);
+  assert.equal(ids.includes("gpt-4"), false);
+  assert.equal(ids.includes("gpt-4o"), false);
+  assert.equal(ids.includes("gpt-5.4-nano"), false);
+  assert.equal(ids.includes("gpt-5.1"), false);
+  assert.equal(ids.includes("gpt-5.1-codex"), false);
+  assert.equal(ids.includes("claude-opus-4.1"), false);
+  assert.equal(ids.includes("claude-opus-4-5-20251101"), false);
+  assert.equal(ids.includes("gemini-3-flash-preview"), false);
 });
 
 test("Kiro registry exposes the current CLI model lineup with context windows", () => {
   const kiroModels = getProviderModels("kr");
   const byId = new Map(kiroModels.map((model) => [model.id, model]));
 
-  assert.ok(byId.has("claude-opus-4.7"));
-  assert.equal(byId.get("claude-opus-4.7")?.contextLength, 1000000);
-  assert.ok(byId.has("claude-sonnet-4.6"));
+  // Kiro's real upstream Claude lineup (#6170): Sonnet 5 / Sonnet 4.5 / Haiku 4.5.
+  // The Opus 4.x and Sonnet 4.6 ids were fabricated (copied from the Anthropic
+  // catalog) and returned upstream 400 "Invalid model" — removed.
+  assert.ok(byId.has("claude-sonnet-5"));
+  assert.equal(byId.get("claude-sonnet-5")?.contextLength, 1000000);
+  assert.ok(byId.has("claude-sonnet-4.5"));
   assert.ok(byId.has("claude-haiku-4.5"));
-  assert.equal(byId.has("claude-opus-4-7"), false);
+  assert.equal(byId.has("claude-opus-4.7"), false);
+  assert.equal(byId.has("claude-sonnet-4.6"), false);
   assert.equal(byId.has("claude-sonnet-4-6"), false);
   assert.equal(byId.has("claude-haiku-4-5"), false);
 });
diff --git a/tests/unit/provider-models-route.test.ts b/tests/unit/provider-models-route.test.ts
index f83c81e5a3..ed8e5d5e8d 100644
--- a/tests/unit/provider-models-route.test.ts
+++ b/tests/unit/provider-models-route.test.ts
@@ -734,9 +734,9 @@ test("provider models route returns the expanded local catalog for Kiro", async
   assert.equal(response.status, 200);
   assert.equal(body.provider, "kiro");
   assert.equal(body.source, "local_catalog");
-  assert.ok(body.models.some((model) => model.id === "claude-haiku-4.5"));
-  assert.ok(body.models.some((model) => model.id === "claude-opus-4.7"));
-  assert.ok(body.models.some((model) => model.id === "claude-sonnet-4.6"));
+  const kiroIds = new Set(body.models.map((model) => model.id)); // #6170: real upstream lineup
+  assert.ok(kiroIds.has("claude-sonnet-5") && kiroIds.has("claude-sonnet-4.5") && kiroIds.has("claude-haiku-4.5"));
+  assert.equal(kiroIds.has("claude-opus-4.7") || kiroIds.has("claude-sonnet-4.6"), false); // fabricated ids removed
 });
 
 test("provider models route returns the local catalog for new built-in chat-openai-compat providers", async () => {
diff --git a/tests/unit/provider-onboarding-href.test.ts b/tests/unit/provider-onboarding-href.test.ts
new file mode 100644
index 0000000000..95548d0cab
--- /dev/null
+++ b/tests/unit/provider-onboarding-href.test.ts
@@ -0,0 +1,37 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { buildProviderDetailsHref } from "../../src/app/(dashboard)/dashboard/providers/components/onboarding/providerOnboardingHref";
+
+test("buildProviderDetailsHref uses the server-assigned connection UUID", () => {
+  const href = buildProviderDetailsHref({
+    id: "9f3c1a4d-1c2b-4a3c-8def-0123456789ab",
+  });
+  assert.equal(
+    href,
+    "/dashboard/providers/9f3c1a4d-1c2b-4a3c-8def-0123456789ab"
+  );
+});
+
+test("buildProviderDetailsHref does not leak the provider category into the URL", () => {
+  // Regression for issue #6144: previously the wizard used
+  // `connection.provider` ("openai-compatible") as the URL slug, which 404'd
+  // on /dashboard/providers/[id] because that route is keyed by UUID.
+  const href = buildProviderDetailsHref({
+    id: "9f3c1a4d-1c2b-4a3c-8def-0123456789ab",
+    provider: "openai-compatible",
+  });
+  assert.notEqual(href, "/dashboard/providers/openai-compatible");
+  assert.match(href ?? "", /\/dashboard\/providers\/[0-9a-f-]+$/);
+});
+
+test("buildProviderDetailsHref returns null when no id is available", () => {
+  assert.equal(buildProviderDetailsHref(null), null);
+  assert.equal(buildProviderDetailsHref(undefined), null);
+  assert.equal(buildProviderDetailsHref({ id: "" }), null);
+  assert.equal(buildProviderDetailsHref({ id: "   " }), null);
+});
+
+test("buildProviderDetailsHref percent-encodes unusual ids", () => {
+  const href = buildProviderDetailsHref({ id: "abc/123 def" });
+  assert.equal(href, "/dashboard/providers/abc%2F123%20def");
+});
\ No newline at end of file
diff --git a/tests/unit/provider-registry-github-copilot-gpt-4.test.ts b/tests/unit/provider-registry-github-copilot-gpt-4.test.ts
index a619314261..f4b917ed4f 100644
--- a/tests/unit/provider-registry-github-copilot-gpt-4.test.ts
+++ b/tests/unit/provider-registry-github-copilot-gpt-4.test.ts
@@ -1,22 +1,16 @@
 /**
- * Port: add GPT-4 to the GitHub Copilot (`github`/alias `gh`) provider.
+ * Curated GitHub Copilot GPT-4-family registry coverage.
  *
- * Copilot still serves the original `gpt-4` chat model via its chat/completions
- * endpoint, alongside `gpt-4o` and the GPT-5.x family. The OmniRoute registry
- * shipped GPT-4o + GPT-5.x but not plain `gpt-4`, so apps that explicitly request
- * `gpt-4` against the `gh` alias got an "unknown model" error. Adding the entry
- * restores parity with the upstream Copilot catalog without disturbing the
- * GPT-4o / GPT-5.x / Claude / Gemini lineups already curated.
- *
- * GPT-4 is a chat/completions model — it must NOT use `openai-responses`.
+ * The final Copilot allowlist keeps `gpt-4-0125-preview` but intentionally drops
+ * the older bare `gpt-4` alias. GPT-4 Turbo is a chat/completions model — it
+ * must NOT use `openai-responses`.
  */
 import test from "node:test";
 import assert from "node:assert/strict";
 
 const { REGISTRY } = await import("../../open-sse/config/providerRegistry.ts");
-const { getModelsByProviderId, getProviderModel, isValidModel } = await import(
-  "../../open-sse/config/providerModels.ts"
-);
+const { getModelsByProviderId, getProviderModel, isValidModel } =
+  await import("../../open-sse/config/providerModels.ts");
 
 type ModelEntry = { id: string; name?: string; targetFormat?: string; [k: string]: unknown };
 
@@ -25,33 +19,41 @@ function githubModel(id: string): ModelEntry | undefined {
   return provider?.models?.find((m) => m.id === id);
 }
 
-test("github/gpt-4 is registered under the gh provider", () => {
-  const model = githubModel("gpt-4");
-  assert.ok(model, "gpt-4 must be registered under the github (gh) provider");
+test("github/gpt-4-0125-preview is registered under the gh provider", () => {
+  const model = githubModel("gpt-4-0125-preview");
+  assert.ok(model, "gpt-4-0125-preview must be registered under the github (gh) provider");
   assert.equal(typeof model?.name, "string");
 });
 
-test("github/gpt-4 routes via chat/completions (no openai-responses)", () => {
-  const model = githubModel("gpt-4");
+test("github/gpt-4-0125-preview routes via chat/completions (no openai-responses)", () => {
+  const model = githubModel("gpt-4-0125-preview");
   assert.ok(model);
   assert.notEqual(
     model.targetFormat,
     "openai-responses",
-    "GPT-4 on GitHub Copilot is a chat/completions model — Responses API would reject it"
+    "GPT-4 Turbo on GitHub Copilot is a chat/completions model — Responses API would reject it"
   );
 });
 
-test("getModelsByProviderId(github) exposes gpt-4", () => {
+test("getModelsByProviderId(github) exposes gpt-4-0125-preview", () => {
   const models = getModelsByProviderId("github") as ModelEntry[];
-  const gpt4 = models.find((m) => m.id === "gpt-4");
-  assert.ok(gpt4, "gpt-4 resolvable via getModelsByProviderId(github)");
+  const gpt4 = models.find((m) => m.id === "gpt-4-0125-preview");
+  assert.ok(gpt4, "gpt-4-0125-preview resolvable via getModelsByProviderId(github)");
 });
 
-test("gpt-4 resolves through both the gh alias and the github id", () => {
+test("gpt-4-0125-preview resolves through both the gh alias and the github id", () => {
   // getProviderModel keys on the public alias; isValidModel mirrors it.
-  assert.ok(getProviderModel("gh", "gpt-4"), "getProviderModel('gh','gpt-4') must resolve");
-  assert.equal(isValidModel("gh", "gpt-4"), true, "isValidModel('gh','gpt-4') must be true");
+  assert.ok(
+    getProviderModel("gh", "gpt-4-0125-preview"),
+    "getProviderModel('gh','gpt-4-0125-preview') must resolve"
+  );
+  assert.equal(
+    isValidModel("gh", "gpt-4-0125-preview"),
+    true,
+    "isValidModel('gh','gpt-4-0125-preview') must be true"
+  );
   // Raw provider id resolves to the same entry via the alias map.
-  const viaId = getModelsByProviderId("github").find((m) => m.id === "gpt-4");
-  assert.ok(viaId, "gpt-4 resolvable via the raw 'github' provider id");
+  const viaId = getModelsByProviderId("github").find((m) => m.id === "gpt-4-0125-preview");
+  assert.ok(viaId, "gpt-4-0125-preview resolvable via the raw 'github' provider id");
+  assert.equal(isValidModel("gh", "gpt-4"), false, "bare gpt-4 is not in the curated list");
 });
diff --git a/tests/unit/provider-registry-github-copilot-gpt-4o.test.ts b/tests/unit/provider-registry-github-copilot-gpt-4o.test.ts
index d7dd8f0ce9..e1f328ab0d 100644
--- a/tests/unit/provider-registry-github-copilot-gpt-4o.test.ts
+++ b/tests/unit/provider-registry-github-copilot-gpt-4o.test.ts
@@ -1,13 +1,9 @@
 /**
- * Port of 9router PR #98 — add GPT-4o to GitHub Copilot (`github`/alias `gh`).
+ * Curated GitHub Copilot GPT-4o registry coverage.
  *
- * Copilot still serves the original `gpt-4o` chat model via its chat/completions
- * endpoint. The OmniRoute registry only ships the GPT-5.x family, so apps that
- * explicitly request `gpt-4o` against the `gh` alias get an "unknown model"
- * error. Adding the entry restores parity with the upstream Copilot catalog
- * without disturbing the GPT-5.x / Claude / Gemini lineups already curated.
- *
- * GPT-4o is a chat/completions model — it must NOT use `openai-responses`.
+ * The final Copilot allowlist keeps `gpt-4o-2024-11-20` but intentionally drops
+ * the older bare `gpt-4o` alias. GPT-4o is a chat/completions model — it must
+ * NOT use `openai-responses`.
  */
 import test from "node:test";
 import assert from "node:assert/strict";
@@ -22,14 +18,14 @@ function githubModel(id: string): ModelEntry | undefined {
   return provider?.models?.find((m) => m.id === id);
 }
 
-test("9router#98 github/gpt-4o is registered under the gh provider", () => {
-  const model = githubModel("gpt-4o");
-  assert.ok(model, "gpt-4o must be registered under the github (gh) provider");
+test("github/gpt-4o-2024-11-20 is registered under the gh provider", () => {
+  const model = githubModel("gpt-4o-2024-11-20");
+  assert.ok(model, "gpt-4o-2024-11-20 must be registered under the github (gh) provider");
   assert.equal(typeof model?.name, "string");
 });
 
-test("9router#98 github/gpt-4o routes via chat/completions (no openai-responses)", () => {
-  const model = githubModel("gpt-4o");
+test("github/gpt-4o-2024-11-20 routes via chat/completions (no openai-responses)", () => {
+  const model = githubModel("gpt-4o-2024-11-20");
   assert.ok(model);
   assert.notEqual(
     model.targetFormat,
@@ -38,8 +34,13 @@ test("9router#98 github/gpt-4o routes via chat/completions (no openai-responses)
   );
 });
 
-test("9router#98 getModelsByProviderId(github) exposes gpt-4o", () => {
+test("getModelsByProviderId(github) exposes gpt-4o-2024-11-20", () => {
   const models = getModelsByProviderId("github") as ModelEntry[];
-  const gpt4o = models.find((m) => m.id === "gpt-4o");
-  assert.ok(gpt4o, "gpt-4o resolvable via getModelsByProviderId(github)");
+  const gpt4o = models.find((m) => m.id === "gpt-4o-2024-11-20");
+  assert.ok(gpt4o, "gpt-4o-2024-11-20 resolvable via getModelsByProviderId(github)");
+  assert.equal(
+    models.some((m) => m.id === "gpt-4o"),
+    false,
+    "bare gpt-4o is not in the curated list"
+  );
 });
diff --git a/tests/unit/provider-registry-github-copilot-targetformat.test.ts b/tests/unit/provider-registry-github-copilot-targetformat.test.ts
index a2bbec4764..22fd9c30f0 100644
--- a/tests/unit/provider-registry-github-copilot-targetformat.test.ts
+++ b/tests/unit/provider-registry-github-copilot-targetformat.test.ts
@@ -6,8 +6,8 @@
  * Responses API when it sets `targetFormat: "openai-responses"`.
  *
  * GitHub Copilot's Responses API does NOT serve the Claude/Gemini models, so
- * `claude-opus-4.7`, `claude-opus-4-5-20251101`, `gemini-3.1-pro-preview` and
- * `gemini-3-flash-preview` failed with a 400. The working `claude-opus-4.6`
+ * `claude-opus-4.7`, `gemini-3.1-pro-preview` and other non-OpenAI models
+ * failed with a 400. The working `claude-sonnet-4.6`
  * carries no `targetFormat` and goes through chat/completions.
  *
  * Fix: drop `targetFormat: "openai-responses"` from the Claude/Gemini entries so
@@ -29,10 +29,17 @@ function githubModel(id: string): ModelEntry | undefined {
 
 // Claude/Gemini models that must NOT route through the Responses API.
 const MUST_NOT_BE_RESPONSES = [
+  "claude-fable-5",
   "claude-opus-4.7",
-  "claude-opus-4-5-20251101",
+  "claude-opus-4.8",
+  "claude-opus-4.8-fast",
+  "claude-opus-4.5",
+  "claude-sonnet-4.6",
+  "claude-sonnet-5",
+  "claude-sonnet-4.5",
+  "claude-haiku-4.5",
   "gemini-3.1-pro-preview",
-  "gemini-3-flash-preview",
+  "gemini-3.5-flash",
 ];
 
 for (const id of MUST_NOT_BE_RESPONSES) {
@@ -47,14 +54,22 @@ for (const id of MUST_NOT_BE_RESPONSES) {
   });
 }
 
-test("#2911 github/claude-opus-4.6 baseline stays on chat/completions (no targetFormat)", () => {
-  const model = githubModel("claude-opus-4.6");
-  assert.ok(model, "claude-opus-4.6 must be registered");
+test("#2911 github/claude-sonnet-4.6 baseline stays on chat/completions (no targetFormat)", () => {
+  const model = githubModel("claude-sonnet-4.6");
+  assert.ok(model, "claude-sonnet-4.6 must be registered");
   assert.notEqual(model.targetFormat, "openai-responses");
 });
 
-// Regression guard: native OpenAI models keep the Responses API.
-for (const id of ["gpt-5.4", "gpt-5.4-mini"]) {
+// Regression guard: models with `/responses` in the curated Copilot catalog keep the Responses API.
+for (const id of [
+  "gpt-5.3-codex",
+  "gpt-5.4-mini",
+  "gpt-5.4",
+  "gpt-5.5",
+  "mai-code-1-flash",
+  "gpt-5-mini",
+  "oswe-vscode-prime",
+]) {
   test(`#2911 github/${id} (OpenAI-native) still uses openai-responses`, () => {
     const model = githubModel(id);
     assert.ok(model, `${id} must be registered`);
diff --git a/tests/unit/provider-translate-path-golden.test.ts b/tests/unit/provider-translate-path-golden.test.ts
index 0aecd8e90f..b1c6ded279 100644
--- a/tests/unit/provider-translate-path-golden.test.ts
+++ b/tests/unit/provider-translate-path-golden.test.ts
@@ -56,6 +56,10 @@ function sanitize(headers: Record<string, unknown>): Record<string, unknown> {
       out[k] = "<OS>";
       continue;
     }
+    if (k === "X-PLATFORM") {
+      out[k] = "<PLATFORM>";
+      continue;
+    }
     let s = v
       .replace(/Bearer .+/, "Bearer <TOK>")
       .replace(/sk-test-APIKEY|tok-test-ACCESS/g, "<CRED>")
diff --git a/tests/unit/providers-bulk-route.test.ts b/tests/unit/providers-bulk-route.test.ts
index 02c921af6e..3371faf8d9 100644
--- a/tests/unit/providers-bulk-route.test.ts
+++ b/tests/unit/providers-bulk-route.test.ts
@@ -93,12 +93,15 @@ test("supportsBulkApiKey: false for OAuth/multi-field/web-session providers", ()
   assert.equal(supportsBulkApiKey("deepseek-web"), false);
   assert.equal(supportsBulkApiKey("qoder"), false);
   assert.equal(supportsBulkApiKey("azure"), false);
-  assert.equal(supportsBulkApiKey("cloudflare-ai"), false);
   assert.equal(supportsBulkApiKey("google-pse-search"), false);
   assert.equal(supportsBulkApiKey("command-code"), false);
   assert.equal(supportsBulkApiKey("ollama-local"), false);
 });
 
+test("supportsBulkApiKey: true for cloudflare-ai (bulk 3-field accountId support, #6174)", () => {
+  assert.equal(supportsBulkApiKey("cloudflare-ai"), true);
+});
+
 test("supportsBulkApiKey: false for non-string/empty input", () => {
   assert.equal(supportsBulkApiKey(""), false);
   assert.equal(supportsBulkApiKey(null), false);
diff --git a/tests/unit/providers-constants-split.test.ts b/tests/unit/providers-constants-split.test.ts
index 260657fa62..1c95453eda 100644
--- a/tests/unit/providers-constants-split.test.ts
+++ b/tests/unit/providers-constants-split.test.ts
@@ -1,7 +1,7 @@
 // Characterization of the providers.ts catalog split (god-file decomposition): the host became a
 // barrel that re-exports 10 data catalogs now living under constants/providers/*, and APIKEY is
 // merged from 6 semantic family files (apikey/<family>.ts). Locks: the public surface (every catalog
-// + helpers still exported), the spread-merge integrity (167 APIKEY entries, no loss/dup), and that
+// + helpers still exported), the spread-merge integrity (168 APIKEY entries, no loss/dup), and that
 // load-time Zod validation still runs. Pure-data move → behavior must be identical.
 import { test } from "node:test";
 import assert from "node:assert/strict";
@@ -31,12 +31,12 @@ test("barrel still exports every catalog + key helpers", () => {
   }
 });
 
-test("APIKEY_PROVIDERS merges the 6 family files into 167 entries (no loss / no dup)", async () => {
+test("APIKEY_PROVIDERS merges the 6 family files into 168 entries (no loss / no dup)", async () => {
   const keys = Object.keys((P as Record<string, object>).APIKEY_PROVIDERS);
-  assert.equal(keys.length, 167);
-  assert.equal(new Set(keys).size, 167, "duplicate keys after spread-merge");
+  assert.equal(keys.length, 168);
+  assert.equal(new Set(keys).size, 168, "duplicate keys after spread-merge");
   // the merged object's entry-count equals the sum of the 6 semantic family files; families are a
-  // strict partition (every provider in exactly one), so the sum must be exactly 167.
+  // strict partition (every provider in exactly one), so the sum must be exactly 168.
   const families: [string, string][] = [
     ["gateways", "APIKEY_PROVIDERS_GATEWAYS"],
     ["frontier-labs", "APIKEY_PROVIDERS_FRONTIER"],
@@ -56,7 +56,7 @@ test("APIKEY_PROVIDERS merges the 6 family files into 167 entries (no loss / no
       seen.add(k);
     }
   }
-  assert.equal(famTotal, 167, "families must partition all 167 providers");
+  assert.equal(famTotal, 168, "families must partition all 168 providers");
 });
 
 test("AI_PROVIDERS Proxy aggregates all sections; lookups resolve", () => {
diff --git a/tests/unit/providers-page-data-timeout.test.ts b/tests/unit/providers-page-data-timeout.test.ts
new file mode 100644
index 0000000000..200fd95f75
--- /dev/null
+++ b/tests/unit/providers-page-data-timeout.test.ts
@@ -0,0 +1,86 @@
+import { test, describe } from "node:test";
+import assert from "node:assert/strict";
+
+// Regression guard for the "providers/quota dashboard stuck on its skeleton
+// forever" bug. The page gates `loading` on awaiting every first-paint request;
+// a bare `fetch()` that never *settles* (browser connection-pool starvation
+// under the RSC prefetch storm, or a stalled connection) left `loading` true
+// forever. loadProviderPageData bounds each request with an AbortSignal timeout
+// so the loader ALWAYS resolves (degrading to defaults) and the page paints.
+const { loadProviderPageData } = await import(
+  "@/app/(dashboard)/dashboard/providers/providerPageUtils"
+);
+
+// A fetch mock that honors AbortSignal the way the real fetch does: it never
+// resolves on its own, but rejects with an AbortError once the signal fires.
+function hangingFetch(): typeof fetch {
+  return ((_url: string | URL, init?: RequestInit) =>
+    new Promise<Response>((_resolve, reject) => {
+      const signal = init?.signal;
+      if (signal) {
+        if (signal.aborted) {
+          reject(new DOMException("Aborted", "AbortError"));
+          return;
+        }
+        signal.addEventListener(
+          "abort",
+          () => reject(new DOMException("Aborted", "AbortError")),
+          { once: true }
+        );
+      }
+    })) as unknown as typeof fetch;
+}
+
+function jsonFetch(map: Record<string, unknown>): typeof fetch {
+  return ((url: string | URL) => {
+    const body = map[String(url)] ?? {};
+    return Promise.resolve(
+      new Response(JSON.stringify(body), {
+        status: 200,
+        headers: { "content-type": "application/json" },
+      })
+    );
+  }) as unknown as typeof fetch;
+}
+
+describe("loadProviderPageData — never freezes the dashboard skeleton", () => {
+  test("a never-settling fetch is aborted by the timeout and the loader still resolves", async () => {
+    const start = Date.now();
+    const data = await loadProviderPageData(hangingFetch(), 50);
+    const elapsed = Date.now() - start;
+
+    // The core guarantee: bounded, not infinite.
+    assert.ok(elapsed < 3000, `loader should resolve promptly, took ${elapsed}ms`);
+    assert.deepEqual(data.connections, []);
+    assert.deepEqual(data.providerNodes, []);
+    assert.equal(data.ccCompatibleProviderEnabled, false);
+    assert.equal(data.expirations, null);
+    assert.equal(data.blockedProviders, null);
+    assert.equal(data.settings, null);
+  });
+
+  test("returns parsed data when every endpoint resolves", async () => {
+    const data = await loadProviderPageData(
+      jsonFetch({
+        "/api/providers": { connections: [{ id: "c1" }] },
+        "/api/provider-nodes": { nodes: [{ id: "n1" }], ccCompatibleProviderEnabled: true },
+        "/api/providers/expiration": { openai: "2030-01-01" },
+        "/api/settings": { blockedProviders: ["openai"] },
+      }),
+      1000
+    );
+
+    assert.deepEqual(data.connections, [{ id: "c1" }]);
+    assert.deepEqual(data.providerNodes, [{ id: "n1" }]);
+    assert.equal(data.ccCompatibleProviderEnabled, true);
+    assert.deepEqual(data.expirations, { openai: "2030-01-01" });
+    assert.deepEqual(data.blockedProviders, ["openai"]);
+  });
+
+  test("a rejecting fetch degrades to defaults instead of throwing", async () => {
+    const rejectFetch = (() => Promise.reject(new Error("network down"))) as unknown as typeof fetch;
+    const data = await loadProviderPageData(rejectFetch, 1000);
+    assert.deepEqual(data.connections, []);
+    assert.equal(data.settings, null);
+  });
+});
diff --git a/tests/unit/providers-yuanbao-web.test.ts b/tests/unit/providers-yuanbao-web.test.ts
new file mode 100644
index 0000000000..2feab63371
--- /dev/null
+++ b/tests/unit/providers-yuanbao-web.test.ts
@@ -0,0 +1,201 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import type { ExecuteInput } from "../../open-sse/executors/base.ts";
+
+const { REGISTRY } = await import("../../open-sse/config/providerRegistry.ts");
+const providers = await import("../../src/shared/constants/providers.ts");
+const { getExecutor, hasSpecializedExecutor } = await import("../../open-sse/executors/index.ts");
+const { YuanbaoWebExecutor } = await import("../../open-sse/executors/yuanbao-web.ts");
+
+type Dict = Record<string, unknown>;
+const registry = REGISTRY as unknown as Record<string, Dict>;
+const catalog = providers.WEB_COOKIE_PROVIDERS as unknown as Record<string, Dict>;
+const creds = (apiKey: string) => ({ apiKey }) as unknown as ExecuteInput["credentials"];
+
+// ── Registry wiring ───────────────────────────────────────────────────────────
+
+test("yuanbao-web is registered as a cookie-auth provider in the registry", () => {
+  const entry = registry["yuanbao-web"];
+  assert.ok(entry, "yuanbao-web missing from REGISTRY");
+  assert.equal(entry.id, "yuanbao-web");
+  assert.equal(entry.alias, "ybw");
+  assert.equal(entry.executor, "yuanbao-web");
+  assert.equal(entry.format, "openai");
+  assert.equal(entry.authHeader, "cookie");
+  assert.equal(entry.baseUrl, "https://yuanbao.tencent.com/api/chat");
+  const models = entry.models as Array<{ id: string }>;
+  assert.ok(Array.isArray(models) && models.length > 0);
+  const ids = models.map((m) => m.id);
+  assert.ok(ids.includes("deepseek-v3"));
+  assert.ok(ids.includes("hunyuan-t1"));
+});
+
+test("yuanbao-web appears in the web-cookie catalog with a cookie authHint", () => {
+  const entry = catalog["yuanbao-web"];
+  assert.ok(entry, "yuanbao-web missing from WEB_COOKIE_PROVIDERS");
+  assert.equal(entry.id, "yuanbao-web");
+  assert.equal(entry.riskNoticeVariant, "webCookie");
+  assert.match(String(entry.authHint), /hy_token/);
+  assert.match(String(entry.website), /yuanbao\.tencent\.com/);
+});
+
+test("YuanbaoWebExecutor is wired under id and alias", () => {
+  assert.ok(hasSpecializedExecutor("yuanbao-web"));
+  assert.ok(hasSpecializedExecutor("ybw"));
+  assert.ok(getExecutor("yuanbao-web") instanceof YuanbaoWebExecutor);
+  assert.ok(getExecutor("ybw") instanceof YuanbaoWebExecutor);
+});
+
+// ── Behavioral: SSE → OpenAI translation (mocked upstream) ─────────────────────
+
+function makeSSEBody(lines: string[]): ReadableStream<Uint8Array> {
+  const encoder = new TextEncoder();
+  return new ReadableStream({
+    start(controller) {
+      for (const line of lines) controller.enqueue(encoder.encode(line));
+      controller.close();
+    },
+  });
+}
+
+async function readStreamText(res: Response): Promise<string> {
+  const reader = res.body!.getReader();
+  const decoder = new TextDecoder();
+  let out = "";
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    out += decoder.decode(value, { stream: true });
+  }
+  return out;
+}
+
+test("missing hy_token cookie returns a 401 auth error", async () => {
+  const exec = new YuanbaoWebExecutor();
+  const { response } = await exec.execute({
+    model: "deepseek-v3",
+    body: { messages: [{ role: "user", content: "hi" }] },
+    stream: false,
+    credentials: creds("some_unrelated_cookie=abc"),
+    signal: null,
+  });
+  assert.equal(response.status, 401);
+  const body = (await response.json()) as { error: { message: string } };
+  assert.match(body.error.message, /hy_user|hy_token|session cookie/);
+  // Never leak stack traces.
+  assert.ok(!body.error.message.includes("at /"));
+});
+
+test("streaming request translates think/text events into OpenAI chunks", async () => {
+  const original = globalThis.fetch;
+  const calls: string[] = [];
+  globalThis.fetch = (async (url: string | URL | Request) => {
+    calls.push(String(url));
+    if (String(url).includes("/conversation/create")) {
+      return new Response(JSON.stringify({ id: "conv-123" }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      });
+    }
+    return new Response(
+      makeSSEBody([
+        'data: {"type":"think","content":"reasoning..."}\n',
+        'data: {"type":"text","msg":"Hello"}\n',
+        'data: {"type":"text","msg":" world"}\n',
+        'data: {"stopReason":"stop"}\n',
+      ]),
+      { status: 200, headers: { "Content-Type": "text/event-stream" } }
+    );
+  }) as typeof fetch;
+
+  try {
+    const exec = new YuanbaoWebExecutor();
+    const { response, url } = await exec.execute({
+      model: "deepseek-r1",
+      body: { messages: [{ role: "user", content: "hi" }] },
+      stream: true,
+      credentials: creds("hy_source=web; hy_user=u1; hy_token=t1"),
+      signal: null,
+    });
+    assert.equal(response.status, 200);
+    assert.match(url, /\/api\/chat\/conv-123$/);
+    assert.ok(calls[0].includes("/conversation/create"));
+
+    const text = await readStreamText(response);
+    assert.match(text, /"reasoning_content":"reasoning\.\.\."/);
+    assert.match(text, /"content":"Hello"/);
+    assert.match(text, /"content":" world"/);
+    assert.match(text, /"finish_reason":"stop"/);
+    assert.match(text, /data: \[DONE\]/);
+  } finally {
+    globalThis.fetch = original;
+  }
+});
+
+test("non-streaming request collects content and reasoning", async () => {
+  const original = globalThis.fetch;
+  globalThis.fetch = (async (url: string | URL | Request) => {
+    if (String(url).includes("/conversation/create")) {
+      return new Response(JSON.stringify({ id: "conv-9" }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      });
+    }
+    return new Response(
+      makeSSEBody([
+        'data: {"type":"think","content":"think-part"}\n',
+        'data: {"type":"text","msg":"Answer"}\n',
+        'data: {"stopReason":"stop"}\n',
+      ]),
+      { status: 200, headers: { "Content-Type": "text/event-stream" } }
+    );
+  }) as typeof fetch;
+
+  try {
+    const exec = new YuanbaoWebExecutor();
+    const { response } = await exec.execute({
+      model: "hunyuan-t1",
+      body: { messages: [{ role: "user", content: "q" }] },
+      stream: false,
+      credentials: creds("hy_source=web; hy_user=u1; hy_token=t1"),
+      signal: null,
+    });
+    assert.equal(response.status, 200);
+    const body = (await response.json()) as {
+      object: string;
+      model: string;
+      choices: Array<{ message: { content: string; reasoning_content?: string } }>;
+    };
+    assert.equal(body.object, "chat.completion");
+    assert.equal(body.choices[0].message.content, "Answer");
+    assert.equal(body.choices[0].message.reasoning_content, "think-part");
+    assert.equal(body.model, "hunyuan-t1");
+  } finally {
+    globalThis.fetch = original;
+  }
+});
+
+test("upstream 401 on conversation create surfaces an auth error (no stack leak)", async () => {
+  const original = globalThis.fetch;
+  globalThis.fetch = (async () =>
+    new Response(JSON.stringify({ message: "unauthorized" }), {
+      status: 401,
+      headers: { "Content-Type": "application/json" },
+    })) as typeof fetch;
+
+  try {
+    const exec = new YuanbaoWebExecutor();
+    const { response } = await exec.execute({
+      model: "deepseek-v3",
+      body: { messages: [{ role: "user", content: "hi" }] },
+      stream: false,
+      credentials: creds("hy_source=web; hy_user=u1; hy_token=t1"),
+      signal: null,
+    });
+    assert.equal(response.status, 401);
+    const body = (await response.json()) as { error: { message: string } };
+    assert.ok(!body.error.message.includes("at /"));
+  } finally {
+    globalThis.fetch = original;
+  }
+});
diff --git a/tests/unit/proxy-assigned-unavailable-6246.test.ts b/tests/unit/proxy-assigned-unavailable-6246.test.ts
new file mode 100644
index 0000000000..8aa52f3192
--- /dev/null
+++ b/tests/unit/proxy-assigned-unavailable-6246.test.ts
@@ -0,0 +1,141 @@
+/**
+ * TDD — #6246 IP leak (part 1, fail-closed).
+ *
+ * When a proxy is ASSIGNED to a connection (account/provider/global scope) but is
+ * dead/inactive, `resolveProxyForConnection` returns a direct result (no alive
+ * proxy resolved). The chat path used to egress DIRECTLY in that case, leaking
+ * the operator's real IP. The fix is a fail-closed guard: if the only reason a
+ * connection resolves to direct is that its ASSIGNED proxy is dead, block instead
+ * of leaking. Explicit "proxy off" toggles are a deliberate direct choice and must
+ * NOT be treated as a leak.
+ *
+ * This test exercises the pure DB predicate `hasBlockingProxyAssignment`, which
+ * encodes exactly that decision (honoring the global + connection proxy toggles).
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-proxy-6246-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.API_KEY_SECRET = "test-secret";
+
+const core = await import("../../src/lib/db/core.ts");
+const proxiesDb = await import("../../src/lib/db/proxies.ts");
+const providersDb = await import("../../src/lib/db/providers.ts");
+
+async function resetStorage() {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+function setGlobalProxyEnabled(enabled: boolean) {
+  const db = core.getDbInstance();
+  db.prepare(
+    "INSERT OR REPLACE INTO key_value (namespace, key, value) VALUES ('settings', 'proxyEnabled', ?)"
+  ).run(JSON.stringify(enabled));
+}
+
+async function makeConnection(): Promise<string> {
+  const conn = await providersDb.createProviderConnection({
+    provider: "openai",
+    authType: "apiKey",
+    name: `Conn ${Date.now()} ${Math.random()}`,
+    apiKey: "sk-test",
+  });
+  return (conn as { id: string }).id;
+}
+
+test.after(async () => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+test("BLOCKS: an account proxy assigned but marked inactive (the IP-leak case)", async () => {
+  await resetStorage();
+  const connId = await makeConnection();
+  const proxy = await proxiesDb.createProxy({
+    name: "Dead paid proxy",
+    type: "http",
+    host: "127.0.0.1",
+    port: 9001,
+  });
+  await proxiesDb.updateProxy(proxy!.id, { status: "inactive" });
+  await proxiesDb.assignProxyToScope("account", connId, proxy!.id);
+
+  assert.equal(
+    proxiesDb.hasBlockingProxyAssignment(connId),
+    true,
+    "a dead assigned proxy must block, not fall back to a direct egress"
+  );
+});
+
+test("ALLOWS DIRECT: a connection with no proxy assignment at all", async () => {
+  await resetStorage();
+  const connId = await makeConnection();
+  assert.equal(
+    proxiesDb.hasBlockingProxyAssignment(connId),
+    false,
+    "no assignment = user never configured a proxy = direct is legitimate"
+  );
+});
+
+test("NOT BLOCKING: an assigned proxy that is still ALIVE", async () => {
+  await resetStorage();
+  const connId = await makeConnection();
+  const proxy = await proxiesDb.createProxy({
+    name: "Live proxy",
+    type: "http",
+    host: "127.0.0.1",
+    port: 9002,
+  });
+  await proxiesDb.assignProxyToScope("account", connId, proxy!.id);
+
+  assert.equal(
+    proxiesDb.hasBlockingProxyAssignment(connId),
+    false,
+    "an alive assigned proxy resolves normally; nothing to block"
+  );
+});
+
+test("EXPLICIT DIRECT: global proxyEnabled=false is a deliberate choice, not a leak", async () => {
+  await resetStorage();
+  const connId = await makeConnection();
+  const proxy = await proxiesDb.createProxy({
+    name: "Dead proxy",
+    type: "http",
+    host: "127.0.0.1",
+    port: 9003,
+  });
+  await proxiesDb.updateProxy(proxy!.id, { status: "inactive" });
+  await proxiesDb.assignProxyToScope("account", connId, proxy!.id);
+  setGlobalProxyEnabled(false);
+
+  assert.equal(
+    proxiesDb.hasBlockingProxyAssignment(connId),
+    false,
+    "operator turned proxying off globally — direct is intended, do not block"
+  );
+});
+
+test("BLOCKS: a dead GLOBAL proxy assignment blocks any connection", async () => {
+  await resetStorage();
+  const connId = await makeConnection();
+  const proxy = await proxiesDb.createProxy({
+    name: "Dead global proxy",
+    type: "http",
+    host: "127.0.0.1",
+    port: 9004,
+  });
+  await proxiesDb.updateProxy(proxy!.id, { status: "error" });
+  await proxiesDb.assignProxyToScope("global", null, proxy!.id);
+
+  assert.equal(
+    proxiesDb.hasBlockingProxyAssignment(connId),
+    true,
+    "a dead global proxy assignment must block, not leak direct"
+  );
+});
diff --git a/tests/unit/proxy-health-6246.test.ts b/tests/unit/proxy-health-6246.test.ts
new file mode 100644
index 0000000000..72668761bf
--- /dev/null
+++ b/tests/unit/proxy-health-6246.test.ts
@@ -0,0 +1,161 @@
+/**
+ * #6246 — "Massive issue with proxies since 3.8.44 - IP leak" (delta scope).
+ *
+ * The core fail-closed + scheduler regression is fixed in PR #6296. This suite
+ * covers the two remaining reporter asks that #6296 does NOT touch:
+ *   (#3) the "Test All" button (`/api/settings/proxies/auto-test`) must be a test,
+ *        not test-and-set — it flipped a proxy to `inactive` on a failed probe,
+ *        and the egress selector excludes `inactive` proxies, so "Test All"
+ *        silently disabled every proxy that failed a flaky probe;
+ *   (#4) a bulk enable/disable endpoint so an operator can re-activate proxies
+ *        in one action.
+ *
+ * DB-backed and network-free: the probe targets a dead localhost proxy
+ * (immediate ECONNREFUSED — no outbound traffic).
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-proxy-6246-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.API_KEY_SECRET = "test-secret";
+delete process.env.INITIAL_PASSWORD; // auth not required in this test env
+delete process.env.PROXY_HEALTH_AUTO_DEACTIVATE;
+
+const core = await import("../../src/lib/db/core.ts");
+const proxiesDb = await import("../../src/lib/db/proxies.ts");
+const { resolveHealthCheckStatusWrite, isProxyHealthAutoDeactivateEnabled } = await import(
+  "../../src/lib/proxyHealth/statusPolicy.ts"
+);
+const { POST: autoTestPost } = await import(
+  "../../src/app/api/settings/proxies/auto-test/route.ts"
+);
+const { POST: batchActivatePost } = await import(
+  "../../src/app/api/settings/proxies/batch-activate/route.ts"
+);
+
+function resetStorage() {
+  delete process.env.INITIAL_PASSWORD;
+  delete process.env.PROXY_HEALTH_AUTO_DEACTIVATE;
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+// ── status-write policy ───────────────────────────────────────────────────────
+test("policy: automated probes never write status by default", () => {
+  assert.equal(resolveHealthCheckStatusWrite(false, {}), null);
+  assert.equal(resolveHealthCheckStatusWrite(true, {}), null);
+  assert.equal(isProxyHealthAutoDeactivateEnabled({}), false);
+});
+
+test("policy: PROXY_HEALTH_AUTO_DEACTIVATE=true restores legacy test-and-set", () => {
+  const env = { PROXY_HEALTH_AUTO_DEACTIVATE: "true" };
+  assert.equal(resolveHealthCheckStatusWrite(false, env), "inactive");
+  assert.equal(resolveHealthCheckStatusWrite(true, env), "active");
+  assert.equal(isProxyHealthAutoDeactivateEnabled(env), true);
+});
+
+// ── (#3) "Test All" must not deactivate proxies by default ─────────────────────
+test("auto-test does NOT deactivate a failing proxy by default", async () => {
+  resetStorage();
+  // Dead proxy: nothing listens on this port → the probe fails immediately.
+  const p = await proxiesDb.createProxy({
+    name: "dead",
+    type: "http",
+    host: "127.0.0.1",
+    port: 1,
+  });
+  assert.ok(p?.id);
+  assert.equal(p.status, "active");
+
+  const req = new Request("http://localhost/api/settings/proxies/auto-test", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ ids: [p.id] }),
+  });
+  const res = await autoTestPost(req);
+  assert.equal(res.status, 200);
+  const body = await res.json();
+  // The probe reports it dead...
+  assert.equal(body.results?.[0]?.alive, false);
+  // ...but the stored status is untouched (the regression flipped it to inactive).
+  const after = await proxiesDb.getProxyById(p.id, { includeSecrets: false });
+  assert.equal(after?.status, "active", "auto-test must not mutate proxy status by default");
+});
+
+test("auto-test still deactivates when PROXY_HEALTH_AUTO_DEACTIVATE=true (opt-in)", async () => {
+  resetStorage();
+  process.env.PROXY_HEALTH_AUTO_DEACTIVATE = "true";
+  const p = await proxiesDb.createProxy({
+    name: "dead",
+    type: "http",
+    host: "127.0.0.1",
+    port: 1,
+  });
+  assert.ok(p?.id);
+  const req = new Request("http://localhost/api/settings/proxies/auto-test", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ ids: [p.id] }),
+  });
+  const res = await autoTestPost(req);
+  assert.equal(res.status, 200);
+  const after = await proxiesDb.getProxyById(p.id, { includeSecrets: false });
+  assert.equal(after?.status, "inactive");
+  delete process.env.PROXY_HEALTH_AUTO_DEACTIVATE;
+});
+
+// ── (#4) bulk enable/disable proxies ──────────────────────────────────────────
+test("batch-activate bulk-enables multiple proxies (default status=active)", async () => {
+  resetStorage();
+  const a = await proxiesDb.createProxy({ name: "a", type: "http", host: "127.0.0.1", port: 8080 });
+  const b = await proxiesDb.createProxy({ name: "b", type: "http", host: "127.0.0.1", port: 8081 });
+  await proxiesDb.updateProxy(a!.id, { status: "inactive" });
+  await proxiesDb.updateProxy(b!.id, { status: "inactive" });
+
+  const req = new Request("http://localhost/api/settings/proxies/batch-activate", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ ids: [a!.id, b!.id] }),
+  });
+  const res = await batchActivatePost(req);
+  assert.equal(res.status, 200);
+  const body = await res.json();
+  assert.equal(body.updated, 2);
+  assert.equal(body.status, "active");
+  assert.equal((await proxiesDb.getProxyById(a!.id, { includeSecrets: false }))?.status, "active");
+  assert.equal((await proxiesDb.getProxyById(b!.id, { includeSecrets: false }))?.status, "active");
+});
+
+test("batch-activate can bulk-disable with status=inactive", async () => {
+  resetStorage();
+  const a = await proxiesDb.createProxy({ name: "a", type: "http", host: "127.0.0.1", port: 8080 });
+  const req = new Request("http://localhost/api/settings/proxies/batch-activate", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ ids: [a!.id], status: "inactive" }),
+  });
+  const res = await batchActivatePost(req);
+  assert.equal(res.status, 200);
+  assert.equal((await proxiesDb.getProxyById(a!.id, { includeSecrets: false }))?.status, "inactive");
+});
+
+test("batch-activate rejects an empty ids array with 400", async () => {
+  resetStorage();
+  const req = new Request("http://localhost/api/settings/proxies/batch-activate", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ ids: [] }),
+  });
+  const res = await batchActivatePost(req);
+  assert.equal(res.status, 400);
+});
diff --git a/tests/unit/proxy-health-decide-action-6246.test.ts b/tests/unit/proxy-health-decide-action-6246.test.ts
new file mode 100644
index 0000000000..0967ceed75
--- /dev/null
+++ b/tests/unit/proxy-health-decide-action-6246.test.ts
@@ -0,0 +1,103 @@
+/**
+ * TDD — #6246 proxy health regression (part 2, A+B+C).
+ *
+ * Before this fix the sweep marked a proxy `inactive` on the FIRST failed probe,
+ * unconditionally, and treated any error (including our own timeout or the probe
+ * TARGET being down) as a proxy failure. That flipped healthy paid proxies to
+ * inactive, which then dropped them from egress selection ("my proxies are not
+ * being used anymore").
+ *
+ * The decision is extracted into a pure, network-free function so it can be
+ * unit-tested exhaustively:
+ *   A — only downgrade after `removeAfter` CONSECUTIVE conclusive failures.
+ *   B — an inconclusive probe (our timeout / probe-target error) never penalizes.
+ *   C — by default (PROXY_AUTO_REMOVE off) the health check NEVER mutates status;
+ *       it only counts/logs. Status downgrade happens only when auto-remove is on.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { decideProxyHealthAction } = await import("../../src/lib/proxyHealth/decision.ts");
+
+test("C: default (autoRemove off) never mutates status on failure — only counts", () => {
+  const d = decideProxyHealthAction({
+    outcome: "fail",
+    priorFailures: 0,
+    autoRemove: false,
+    removeAfter: 3,
+  });
+  assert.equal(d.setStatus, null, "must not downgrade status by default");
+  assert.equal(d.remove, false);
+  assert.equal(d.failures, 1, "still counts the failure for logging");
+});
+
+test("C: default (autoRemove off) never downgrades even after many failures", () => {
+  const d = decideProxyHealthAction({
+    outcome: "fail",
+    priorFailures: 9,
+    autoRemove: false,
+    removeAfter: 3,
+  });
+  assert.equal(d.setStatus, null);
+  assert.equal(d.remove, false);
+  assert.equal(d.failures, 10);
+});
+
+test("A: with autoRemove on, does NOT downgrade before the consecutive threshold", () => {
+  const d = decideProxyHealthAction({
+    outcome: "fail",
+    priorFailures: 1, // this probe makes it 2, threshold is 3
+    autoRemove: true,
+    removeAfter: 3,
+  });
+  assert.equal(d.setStatus, null, "2 < 3 failures must not flip inactive");
+  assert.equal(d.remove, false);
+  assert.equal(d.failures, 2);
+});
+
+test("A: with autoRemove on, downgrades + removes at the consecutive threshold", () => {
+  const d = decideProxyHealthAction({
+    outcome: "fail",
+    priorFailures: 2, // this probe makes it 3 == threshold
+    autoRemove: true,
+    removeAfter: 3,
+  });
+  assert.equal(d.setStatus, "inactive");
+  assert.equal(d.remove, true);
+  assert.equal(d.failures, 3);
+});
+
+test("B: an inconclusive probe never penalizes (no count bump, no status change)", () => {
+  const d = decideProxyHealthAction({
+    outcome: "inconclusive",
+    priorFailures: 2,
+    autoRemove: true,
+    removeAfter: 3,
+  });
+  assert.equal(d.setStatus, null, "inconclusive must not touch status");
+  assert.equal(d.remove, false);
+  assert.equal(d.failures, 2, "failure streak is preserved, not incremented");
+  assert.equal(d.clearFailures, false);
+});
+
+test("ok: resets the failure streak; re-activates only when autoRemove manages status", () => {
+  const onAuto = decideProxyHealthAction({
+    outcome: "ok",
+    priorFailures: 2,
+    autoRemove: true,
+    removeAfter: 3,
+  });
+  assert.equal(onAuto.clearFailures, true);
+  assert.equal(onAuto.setStatus, "active");
+  assert.equal(onAuto.failures, 0);
+
+  const offAuto = decideProxyHealthAction({
+    outcome: "ok",
+    priorFailures: 2,
+    autoRemove: false,
+    removeAfter: 3,
+  });
+  assert.equal(offAuto.clearFailures, true);
+  assert.equal(offAuto.setStatus, null, "default mode never touches user-controlled status");
+  assert.equal(offAuto.failures, 0);
+});
diff --git a/tests/unit/public-api-routes.test.ts b/tests/unit/public-api-routes.test.ts
index 00b2b02ecf..e480c528aa 100644
--- a/tests/unit/public-api-routes.test.ts
+++ b/tests/unit/public-api-routes.test.ts
@@ -9,6 +9,16 @@ test("isPublicApiRoute allows public management prefixes", () => {
   assert.equal(isPublicApiRoute("/api/oauth/cursor/callback"), true);
 });
 
+test("isPublicApiRoute keeps cloud read/auth routes public but not cloud write routes", () => {
+  assert.equal(isPublicApiRoute("/api/cloud/auth", "POST"), true);
+  assert.equal(isPublicApiRoute("/api/cloud/model/resolve", "POST"), true);
+  assert.equal(isPublicApiRoute("/api/cloud/models/alias", "GET"), true);
+
+  assert.equal(isPublicApiRoute("/api/cloud/credentials/update", "PUT"), false);
+  assert.equal(isPublicApiRoute("/api/cloud/models/alias", "PUT"), false);
+  assert.equal(isPublicApiRoute("/api/cloud/unknown", "GET"), false);
+});
+
 test("isPublicApiRoute allows readonly health and require-login bootstrap routes", () => {
   assert.equal(isPublicApiRoute("/api/monitoring/health", "GET"), true);
   assert.equal(isPublicApiRoute("/api/monitoring/health", "HEAD"), true);
diff --git a/tests/unit/reasoning-token-source-6187.test.ts b/tests/unit/reasoning-token-source-6187.test.ts
new file mode 100644
index 0000000000..f95095a199
--- /dev/null
+++ b/tests/unit/reasoning-token-source-6187.test.ts
@@ -0,0 +1,149 @@
+/**
+ * Regression test for #6187 — reasoning-token accounting is blind to
+ * `reasoning_content` / `<think>` models.
+ *
+ * Some providers (e.g. stepfun step-3.7-flash) emit reasoning content in the
+ * assistant message but report `reasoning_tokens=0` in usage. The usage-derived
+ * `tokens_reasoning` column then under-represents reasoning. The conservative
+ * fix records the reasoning SOURCE and raw CHARACTER count in two new,
+ * non-cost-touching columns (`reasoning_source`, `reasoning_chars`) while
+ * leaving `tokens_reasoning` (what cost math uses) untouched.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { getDbInstance, resetDbInstance } from "../../src/lib/db/core.ts";
+import { saveCallLog } from "../../src/lib/usage/callLogs.ts";
+import { getObservedReasoning } from "../../src/lib/usage/tokenAccounting.ts";
+import { computeCostFromPricing } from "../../src/lib/usage/costCalculator.ts";
+
+test.after(() => {
+  try {
+    const db = getDbInstance();
+    db.prepare("DELETE FROM call_logs WHERE id LIKE 'test-6187-%'").run();
+  } catch {
+    // best-effort cleanup
+  }
+  try {
+    resetDbInstance();
+  } catch {
+    // best-effort handle release (per DB-handle hang rule)
+  }
+});
+
+// ── getObservedReasoning helper ────────────────────────────────────────────
+
+test("getObservedReasoning: reasoning_content field → source=content", () => {
+  const observed = getObservedReasoning({ reasoning_content: "Let me think about this." });
+  assert.equal(observed.source, "content");
+  assert.equal(observed.chars, "Let me think about this.".length);
+});
+
+test("getObservedReasoning: reasoning field (sse-mapped) → source=content", () => {
+  const observed = getObservedReasoning({ reasoning: "step one, step two" });
+  assert.equal(observed.source, "content");
+  assert.ok(observed.chars > 0);
+});
+
+test("getObservedReasoning: inline <think> block → source=think", () => {
+  const observed = getObservedReasoning({
+    content: "<think>hidden chain of thought</think>final answer",
+  });
+  assert.equal(observed.source, "think");
+  assert.equal(observed.chars, "hidden chain of thought".length);
+});
+
+test("getObservedReasoning: no reasoning → source=null, chars=0", () => {
+  const observed = getObservedReasoning({ content: "just a plain answer" });
+  assert.equal(observed.source, null);
+  assert.equal(observed.chars, 0);
+});
+
+// ── Persistence: reasoning_content present but usage reports 0 ──────────────
+
+test("saveCallLog records reasoning_source=content when usage under-reports reasoning", async () => {
+  const db = getDbInstance();
+  const testId = `test-6187-content-${Date.now()}`;
+  const reasoning = "The model reasoned internally but reported zero reasoning tokens.";
+
+  await saveCallLog({
+    id: testId,
+    method: "POST",
+    path: "/v1/chat/completions",
+    status: 200,
+    model: "step-3.7-flash",
+    provider: "stepfun",
+    duration: 100,
+    // usage EXPLICITLY reports reasoning_tokens=0 (the bug trigger)
+    tokens: { prompt_tokens: 10, completion_tokens: 20, reasoning_tokens: 0 },
+    responseBody: {
+      choices: [{ message: { role: "assistant", content: "answer", reasoning_content: reasoning } }],
+    },
+  });
+
+  const row = db
+    .prepare(
+      "SELECT tokens_reasoning, reasoning_source, reasoning_chars FROM call_logs WHERE id = ?"
+    )
+    .get(testId) as {
+    tokens_reasoning: number | null;
+    reasoning_source: string | null;
+    reasoning_chars: number | null;
+  };
+
+  assert.ok(row, "row should exist");
+  // Reasoning presence is now recorded from the message content...
+  assert.equal(row.reasoning_source, "content", "source should be content");
+  assert.equal(row.reasoning_chars, reasoning.length, "char count should match reasoning content");
+  // ...while the usage-derived, cost-relevant column stays exactly 0.
+  assert.equal(row.tokens_reasoning, 0, "tokens_reasoning stays usage-derived (0)");
+
+  // Cost math is untouched: reasoning_chars never enters cost; tokens.reasoning is 0.
+  const cost = computeCostFromPricing(
+    { input: 5, output: 10, reasoning: 100 },
+    { prompt_tokens: 10, completion_tokens: 20, reasoning: 0 }
+  );
+  const costNoReasoning = computeCostFromPricing(
+    { input: 5, output: 10, reasoning: 100 },
+    { prompt_tokens: 10, completion_tokens: 20 }
+  );
+  assert.equal(cost, costNoReasoning, "reasoning contributes 0 to cost when metered 0");
+});
+
+// ── Regression: normal usage-reported reasoning keeps source=usage ──────────
+
+test("saveCallLog keeps reasoning_source=usage when usage reports reasoning tokens", async () => {
+  const db = getDbInstance();
+  const testId = `test-6187-usage-${Date.now()}`;
+
+  await saveCallLog({
+    id: testId,
+    method: "POST",
+    path: "/v1/chat/completions",
+    status: 200,
+    model: "o3-mini",
+    provider: "openai",
+    duration: 100,
+    tokens: {
+      prompt_tokens: 5,
+      completion_tokens: 100,
+      completion_tokens_details: { reasoning_tokens: 57 },
+    },
+    responseBody: {
+      choices: [{ message: { role: "assistant", content: "answer" } }],
+    },
+  });
+
+  const row = db
+    .prepare("SELECT tokens_reasoning, reasoning_source, reasoning_chars FROM call_logs WHERE id = ?")
+    .get(testId) as {
+    tokens_reasoning: number | null;
+    reasoning_source: string | null;
+    reasoning_chars: number | null;
+  };
+
+  assert.ok(row, "row should exist");
+  assert.equal(row.reasoning_source, "usage", "usage-reported reasoning keeps source=usage");
+  assert.equal(row.tokens_reasoning, 57, "tokens_reasoning stays usage-derived (57)");
+  assert.equal(row.reasoning_chars, null, "no char count needed when usage is authoritative");
+});
diff --git a/tests/unit/relay-minified-fn-6149.test.ts b/tests/unit/relay-minified-fn-6149.test.ts
new file mode 100644
index 0000000000..71c8751a6f
--- /dev/null
+++ b/tests/unit/relay-minified-fn-6149.test.ts
@@ -0,0 +1,144 @@
+// Regression guard for #6149 — relay worker throws
+// `ReferenceError: resolveRelayTarget is not defined` on minified standalone
+// (SWC) Docker builds.
+//
+// Root cause: both the Vercel and Deno relay generators embed the shared SSRF
+// guard as a BARE function declaration via `${resolveRelayTarget.toString()}`,
+// but the worker body CALLS the hardcoded string literal `resolveRelayTarget(...)`.
+// In the SWC-minified standalone build the SOURCE identifier gets mangled, so
+// `.toString()` emits `function <mangled>(...)` — the worker defines `<mangled>`
+// while the template still calls `resolveRelayTarget` → ReferenceError at runtime.
+// Unminified source tests never catch this because the source name is intact.
+//
+// The fix embeds the guard under a NAME-STABLE binding —
+// `const resolveRelayTarget = ${resolveRelayTarget.toString()};` — so the const
+// name is a literal in the template (immune to minification) and resolves the
+// hardcoded call regardless of the mangled inner function name.
+//
+// This test reproduces the defect WITHOUT a real build: it simulates the
+// minifier by renaming ONLY the embedded guard function's own declared name
+// (located precisely via `resolveRelayTarget.toString()`), then eval-runs the
+// emitted worker in a `node:vm` sandbox and asserts the handler still resolves
+// the guard instead of throwing ReferenceError. A structural assertion (stable
+// `const resolveRelayTarget =` binding) backs it up.
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import vm from "node:vm";
+import { resolveRelayTarget } from "../../src/app/api/settings/proxy/deno-deploy/route";
+import { __buildRelayFunctionForTest } from "../../src/app/api/settings/proxy/vercel-deploy/route";
+import { __buildRelayWorkerForTest } from "../../src/app/api/settings/proxy/deno-deploy/route";
+
+const RELAY_AUTH = "testrelayauth";
+const TARGET = "https://api.anthropic.com";
+const PATH = "/v1/messages";
+
+// Minimal WHATWG-ish stubs so the generated worker can run under node:vm.
+class FakeHeaders {
+  m: Map<string, string>;
+  constructor(init?: FakeHeaders) {
+    this.m = new Map();
+    if (init && init.m) for (const [k, v] of init.m) this.m.set(k, v);
+  }
+  get(k: string): string | null {
+    const key = k.toLowerCase();
+    return this.m.has(key) ? (this.m.get(key) as string) : null;
+  }
+  set(k: string, v: string): void {
+    this.m.set(k.toLowerCase(), v);
+  }
+  delete(k: string): void {
+    this.m.delete(k.toLowerCase());
+  }
+  forEach(fn: (v: string, k: string) => void): void {
+    this.m.forEach((v, k) => fn(v, k));
+  }
+}
+
+class FakeResponse {
+  body: unknown;
+  status: number;
+  headers: unknown;
+  constructor(body: unknown, init?: { status?: number; headers?: unknown }) {
+    this.body = body;
+    this.status = init?.status ?? 200;
+    this.headers = init?.headers;
+  }
+}
+
+function buildRequest(): { method: string; body: string; headers: FakeHeaders } {
+  const headers = new FakeHeaders();
+  headers.set("x-relay-auth", RELAY_AUTH);
+  headers.set("x-relay-target", TARGET);
+  headers.set("x-relay-path", PATH);
+  return { method: "POST", body: "payload", headers };
+}
+
+/**
+ * Simulate the SWC minifier: rename ONLY the embedded guard's declared function
+ * name (the source `resolveRelayTarget` identifier that gets mangled), leaving
+ * the hardcoded string-literal call sites in the template untouched — exactly
+ * what happens in the standalone build.
+ */
+function minify(worker: string): string {
+  const guardSrc = resolveRelayTarget.toString();
+  // First occurrence inside the guard source is its own declaration name.
+  const mangledGuard = guardSrc.replace("resolveRelayTarget", "m0mangled0m");
+  return worker.replace(guardSrc, mangledGuard);
+}
+
+async function runWorker(
+  worker: string,
+  kind: "vercel" | "deno"
+): Promise<FakeResponse> {
+  const ctx: Record<string, unknown> = {
+    URL,
+    Headers: FakeHeaders,
+    Response: FakeResponse,
+    console,
+    fetch: async () => ({ body: "ok", status: 200, headers: new FakeHeaders() }),
+  };
+  let captured: ((req: unknown) => Promise<FakeResponse>) | undefined;
+  ctx.Deno = { serve: (h: (req: unknown) => Promise<FakeResponse>) => (captured = h) };
+  vm.createContext(ctx);
+
+  let code = worker;
+  if (kind === "vercel") {
+    code = code
+      .replace(/export const config[^\n]*\n/, "")
+      .replace("export default async function handler", "__vercelHandler = async function handler");
+  }
+  vm.runInContext(code, ctx);
+  if (kind === "vercel") {
+    captured = ctx.__vercelHandler as (req: unknown) => Promise<FakeResponse>;
+  }
+  assert.ok(captured, `${kind} worker did not register a handler`);
+  return captured(buildRequest());
+}
+
+describe("#6149 relay worker binds SSRF guard to a stable name", () => {
+  it("Vercel worker: emitted source embeds a stable `const resolveRelayTarget =` binding", () => {
+    const worker = __buildRelayFunctionForTest(RELAY_AUTH);
+    assert.match(
+      worker,
+      /const\s+resolveRelayTarget\s*=/,
+      "worker must bind the guard to a literal const name so minification cannot dangle the call"
+    );
+  });
+
+  it("Deno worker: emitted source embeds a stable `const resolveRelayTarget =` binding", () => {
+    const worker = __buildRelayWorkerForTest(RELAY_AUTH);
+    assert.match(worker, /const\s+resolveRelayTarget\s*=/);
+  });
+
+  it("Vercel worker: resolves the guard after minification mangles the source fn name", async () => {
+    const worker = minify(__buildRelayFunctionForTest(RELAY_AUTH));
+    const res = await runWorker(worker, "vercel");
+    assert.equal(res.status, 200, "handler must reach the upstream fetch, not throw ReferenceError");
+  });
+
+  it("Deno worker: resolves the guard after minification mangles the source fn name", async () => {
+    const worker = minify(__buildRelayWorkerForTest(RELAY_AUTH));
+    const res = await runWorker(worker, "deno");
+    assert.equal(res.status, 200);
+  });
+});
diff --git a/tests/unit/requesty-provider.test.ts b/tests/unit/requesty-provider.test.ts
new file mode 100644
index 0000000000..b1d7cc339d
--- /dev/null
+++ b/tests/unit/requesty-provider.test.ts
@@ -0,0 +1,45 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { APIKEY_PROVIDERS } = await import("../../src/shared/constants/providers.ts");
+const { REGISTRY: providerRegistry } = await import("../../open-sse/config/providerRegistry.ts");
+const { isValidModel } = await import("../../src/shared/constants/models.ts");
+
+const REQUESTY_CHAT_URL = "https://router.requesty.ai/v1/chat/completions";
+const REQUESTY_MODELS_URL = "https://router.requesty.ai/v1/models";
+
+test("requesty is registered as an API-key gateway provider", () => {
+  const entry = APIKEY_PROVIDERS.requesty;
+  assert.ok(entry, "APIKEY_PROVIDERS.requesty must be defined");
+  assert.equal(entry.id, "requesty");
+  assert.equal(entry.alias, "requesty");
+  assert.equal(entry.name, "Requesty");
+  assert.equal(entry.website, "https://requesty.ai");
+  assert.equal(entry.passthroughModels, true);
+  assert.equal(entry.hasFree, true);
+});
+
+test("requesty registry entry uses OpenAI format with bearer API-key auth", () => {
+  const entry = providerRegistry.requesty;
+  assert.ok(entry, "providerRegistry.requesty must be defined");
+  assert.equal(entry.id, "requesty");
+  assert.equal(entry.alias, "requesty");
+  assert.equal(entry.format, "openai");
+  assert.equal(entry.executor, "default");
+  assert.equal(entry.authType, "apikey");
+  assert.equal(entry.authHeader, "bearer");
+  assert.equal(entry.baseUrl, REQUESTY_CHAT_URL);
+  assert.equal(entry.modelsUrl, REQUESTY_MODELS_URL);
+  assert.equal(entry.passthroughModels, true);
+});
+
+test("requesty ships no static model seed — relies fully on passthrough + live catalog", () => {
+  assert.deepEqual(providerRegistry.requesty.models, []);
+});
+
+test("requesty accepts any model id via passthrough (GPT/Claude/Gemini/Kimi behind one key)", () => {
+  assert.equal(isValidModel("requesty", "openai/gpt-5.2"), true);
+  assert.equal(isValidModel("requesty", "anthropic/claude-opus-4-5"), true);
+  assert.equal(isValidModel("requesty", "google/gemini-3-pro"), true);
+  assert.equal(isValidModel("requesty", "coding/gpt-4o-mini"), true);
+});
diff --git a/tests/unit/routing-settings-ux-6147.test.ts b/tests/unit/routing-settings-ux-6147.test.ts
new file mode 100644
index 0000000000..8fff64d4dd
--- /dev/null
+++ b/tests/unit/routing-settings-ux-6147.test.ts
@@ -0,0 +1,53 @@
+// #6147 — routing/settings UX clarity. Pure-function guards for two of the three
+// sub-fixes:
+//   1. Weighted effective-share % (weight ÷ Σweights), incl. total===0 and sum≠100.
+//   3. Opt-in base-URL override eligibility predicate for built-in providers.
+// (Item 2 is a display-only label rename with no pure seam — manual verification.)
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { effectiveSharePercent } from "../../src/app/(dashboard)/dashboard/combos/WeightTotalBar.tsx";
+import {
+  isBaseUrlOverrideEligibleProvider,
+  isBaseUrlConfigurableProvider,
+} from "../../src/app/(dashboard)/dashboard/providers/[id]/providerPageHelpers.ts";
+
+test("effectiveSharePercent — sum === 100 keeps raw weight", () => {
+  assert.equal(effectiveSharePercent(30, 100), 30);
+  assert.equal(effectiveSharePercent(70, 100), 70);
+});
+
+test("effectiveSharePercent — sum !== 100 rescales to the effective share", () => {
+  // Two equal weights of 30 (total 60) are each an effective 50%.
+  assert.equal(effectiveSharePercent(30, 60), 50);
+  // Over-100 total: 150 total, weight 75 → 50%.
+  assert.equal(effectiveSharePercent(75, 150), 50);
+});
+
+test("effectiveSharePercent — guards total === 0 and non-positive weight (no NaN)", () => {
+  assert.equal(effectiveSharePercent(0, 0), 0);
+  assert.equal(effectiveSharePercent(50, 0), 0);
+  assert.equal(effectiveSharePercent(0, 100), 0);
+  assert.equal(effectiveSharePercent(-10, 100), 0);
+  assert.ok(!Number.isNaN(effectiveSharePercent(10, 0)));
+});
+
+test("isBaseUrlOverrideEligibleProvider — built-in providers are opt-in eligible", () => {
+  // A plain built-in that has no dedicated base-URL field today.
+  assert.equal(isBaseUrlOverrideEligibleProvider("openai"), true);
+  assert.equal(isBaseUrlOverrideEligibleProvider("groq"), true);
+});
+
+test("isBaseUrlOverrideEligibleProvider — providers with an always-on field are NOT re-offered", () => {
+  // Everything already covered by the configurable set stays false here so the
+  // override does not double up on the existing dedicated field.
+  for (const id of ["azure-openai", "databricks", "siliconflow"]) {
+    assert.equal(isBaseUrlConfigurableProvider(id), true);
+    assert.equal(isBaseUrlOverrideEligibleProvider(id), false);
+  }
+});
+
+test("isBaseUrlOverrideEligibleProvider — empty/nullish ids are not eligible", () => {
+  assert.equal(isBaseUrlOverrideEligibleProvider(""), false);
+  assert.equal(isBaseUrlOverrideEligibleProvider(null), false);
+  assert.equal(isBaseUrlOverrideEligibleProvider(undefined), false);
+});
diff --git a/tests/unit/run-next-playwright.test.ts b/tests/unit/run-next-playwright.test.ts
index 9b66bca43d..61d166d380 100644
--- a/tests/unit/run-next-playwright.test.ts
+++ b/tests/unit/run-next-playwright.test.ts
@@ -56,6 +56,15 @@ test("shouldUseWebpackForPlaywrightDev only opts into webpack when turbopack is
     }),
     false
   );
+
+  // Turbopack is the default: an unset env var must NOT fall back to webpack.
+  assert.equal(
+    playwrightRunner.shouldUseWebpackForPlaywrightDev({
+      mode: "dev",
+      env: {},
+    }),
+    false
+  );
 });
 
 test("standalone asset helpers detect and rehydrate missing standalone static assets", () => {
diff --git a/tests/unit/save-call-log-persistence.test.ts b/tests/unit/save-call-log-persistence.test.ts
index 219766d514..8d59ad18d6 100644
--- a/tests/unit/save-call-log-persistence.test.ts
+++ b/tests/unit/save-call-log-persistence.test.ts
@@ -23,7 +23,7 @@ test("saveCallLog persists to DB with correlationId", async () => {
 
   const row = db
     .prepare("SELECT id, correlation_id, status, model FROM call_logs WHERE id = ?")
-    .get(testId) as any;
+    .get(testId) as Record<string, unknown>;
   assert.ok(row, "row should exist in call_logs");
   assert.equal(row.id, testId);
   assert.equal(row.correlation_id, "test-correlation-id-123");
@@ -50,7 +50,7 @@ test("saveCallLog persists null correlationId when not provided", async () => {
 
   const row = db
     .prepare("SELECT id, correlation_id FROM call_logs WHERE id = ?")
-    .get(testId) as any;
+    .get(testId) as Record<string, unknown>;
   assert.ok(row, "row should exist");
   assert.equal(row.correlation_id, null, "correlation_id should be null when not provided");
 
@@ -74,7 +74,7 @@ test("getCallLogs returns correlationId", async () => {
   });
 
   const logs = await getCallLogs({ limit: 100 });
-  const found = logs.find((l: any) => l.id === testId);
+  const found = logs.find((l: { id: string }) => l.id === testId);
   assert.ok(found, "log entry should be found via getCallLogs");
   assert.equal(found.correlationId, "cid-roundtrip-test");
 
@@ -83,14 +83,95 @@ test("getCallLogs returns correlationId", async () => {
 
 test("call_logs table has correlation_id column", () => {
   const db = getDbInstance();
-  const columns = db.prepare("PRAGMA table_info(call_logs)").all() as any[];
-  const colNames = columns.map((c: any) => c.name);
+  const columns = db.prepare("PRAGMA table_info(call_logs)").all() as { name: string }[];
+  const colNames = columns.map((c) => c.name);
   assert.ok(colNames.includes("correlation_id"), "call_logs should have correlation_id column");
 
-  const indexes = db.prepare("PRAGMA index_list(call_logs)").all() as any[];
-  const idxNames = indexes.map((i: any) => i.name);
+  const indexes = db.prepare("PRAGMA index_list(call_logs)").all() as { name: string }[];
+  const idxNames = indexes.map((i) => i.name);
   assert.ok(
     idxNames.includes("idx_cl_correlation_id"),
     "call_logs should have idx_cl_correlation_id index"
   );
 });
+
+test("call_logs table has model_pinned column", () => {
+  const db = getDbInstance();
+  const columns = db.prepare("PRAGMA table_info(call_logs)").all() as { name: string }[];
+  const colNames = columns.map((c) => c.name);
+  assert.ok(colNames.includes("model_pinned"), "call_logs should have model_pinned column");
+});
+
+test("saveCallLog persists modelPinned=true as 1", async () => {
+  const db = getDbInstance();
+  const testId = `test-pinned-${Date.now()}`;
+
+  await saveCallLog({
+    id: testId,
+    method: "POST",
+    path: "/v1/chat/completions",
+    status: 200,
+    model: "pinned-model",
+    provider: "test-provider",
+    duration: 500,
+    tokens: { in: 10, out: 5 },
+    modelPinned: true,
+  });
+
+  const row = db
+    .prepare("SELECT id, model_pinned FROM call_logs WHERE id = ?")
+    .get(testId) as Record<string, unknown>;
+  assert.ok(row, "row should exist");
+  assert.equal(row.model_pinned, 1, "model_pinned should be 1 when modelPinned=true");
+
+  db.prepare("DELETE FROM call_logs WHERE id = ?").run(testId);
+});
+
+test("saveCallLog persists modelPinned=false as 0", async () => {
+  const db = getDbInstance();
+  const testId = `test-notpinned-${Date.now()}`;
+
+  await saveCallLog({
+    id: testId,
+    method: "POST",
+    path: "/v1/chat/completions",
+    status: 200,
+    model: "normal-model",
+    provider: "test-provider",
+    duration: 500,
+    tokens: { in: 10, out: 5 },
+    modelPinned: false,
+  });
+
+  const row = db
+    .prepare("SELECT id, model_pinned FROM call_logs WHERE id = ?")
+    .get(testId) as Record<string, unknown>;
+  assert.ok(row, "row should exist");
+  assert.equal(row.model_pinned, 0, "model_pinned should be 0 when modelPinned=false");
+
+  db.prepare("DELETE FROM call_logs WHERE id = ?").run(testId);
+});
+
+test("getCallLogs returns modelPinned boolean", async () => {
+  const db = getDbInstance();
+  const testId = `test-pinned-roundtrip-${Date.now()}`;
+
+  await saveCallLog({
+    id: testId,
+    method: "POST",
+    path: "/v1/chat/completions",
+    status: 200,
+    model: "pinned-model-rt",
+    provider: "test-provider",
+    duration: 100,
+    tokens: { in: 20, out: 10 },
+    modelPinned: true,
+  });
+
+  const logs = await getCallLogs({ limit: 100 });
+  const found = logs.find((l: { id: string }) => l.id === testId);
+  assert.ok(found, "log entry should be found via getCallLogs");
+  assert.equal(found.modelPinned, true, "getCallLogs should return modelPinned as boolean true");
+
+  db.prepare("DELETE FROM call_logs WHERE id = ?").run(testId);
+});
diff --git a/tests/unit/services/ServiceSupervisor.test.ts b/tests/unit/services/ServiceSupervisor.test.ts
index ec36debd15..db7e218b48 100644
--- a/tests/unit/services/ServiceSupervisor.test.ts
+++ b/tests/unit/services/ServiceSupervisor.test.ts
@@ -36,6 +36,10 @@ db.prepare(
   `INSERT OR IGNORE INTO version_manager (tool, status, port, auto_start, auto_update, provider_expose)
    VALUES ('test-lock', 'stopped', 29997, 0, 0, 0)`
 ).run();
+db.prepare(
+  `INSERT OR IGNORE INTO version_manager (tool, status, port, auto_start, auto_update, provider_expose)
+   VALUES ('test-adopt', 'stopped', 29996, 0, 0, 0)`
+).run();
 
 const { ServiceSupervisor } = await import("../../../src/lib/services/ServiceSupervisor.ts");
 
@@ -204,3 +208,24 @@ test("does NOT auto-restart on crash", async () => {
     healthServer.close();
   }
 });
+
+// #6205: when probeBeforeSpawn is enabled and a healthy instance already serves
+// the port, the supervisor ADOPTS it (marks running, no child spawned) instead
+// of spawning a duplicate that would die with EADDRINUSE.
+test("#6205: probeBeforeSpawn adopts a healthy existing instance (no spawn)", async () => {
+  const healthServer = startHealthServer(29996);
+  const cfg = { ...tickConfig("test-adopt", 29996), probeBeforeSpawn: true };
+  const sup = new ServiceSupervisor(cfg);
+
+  try {
+    const status = await sup.start();
+    assert.equal(status.state, "running", "adopted instance is marked running");
+    assert.equal(status.pid, null, "no child process is spawned when adopting");
+    // No child means no captured stdout ticks.
+    await new Promise((r) => setTimeout(r, 300));
+    assert.equal(sup.getRingBuffer().snapshot().length, 0, "no logs — nothing was spawned");
+  } finally {
+    await sup.stop();
+    healthServer.close();
+  }
+});
diff --git a/tests/unit/services/embed-proxy.test.ts b/tests/unit/services/embed-proxy.test.ts
index b3675991a1..fdeedcb792 100644
--- a/tests/unit/services/embed-proxy.test.ts
+++ b/tests/unit/services/embed-proxy.test.ts
@@ -2,7 +2,7 @@
  * T-07 — embed proxy route handler tests.
  *
  * Tests GET/POST/PUT/PATCH/DELETE handlers in
- * /dashboard/providers/services/[name]/embed/[...path]/route.ts.
+ * /dashboard/providers/services/[name]/embed/[[...path]]/route.ts.
  *
  * Uses registerSupervisor to inject fake supervisors (ESM live bindings
  * can't be reassigned, so direct module patching is not possible).
@@ -21,7 +21,7 @@ import {
   DELETE,
   HEAD,
   OPTIONS,
-} from "../../../src/app/(dashboard)/dashboard/providers/services/[name]/embed/[...path]/route.ts";
+} from "../../../src/app/(dashboard)/dashboard/providers/services/[name]/embed/[[...path]]/route.ts";
 
 const originalFetch = globalThis.fetch;
 
diff --git a/tests/unit/tool-limit-detector.test.ts b/tests/unit/tool-limit-detector.test.ts
index d1ce4a88fd..ba4bba552d 100644
--- a/tests/unit/tool-limit-detector.test.ts
+++ b/tests/unit/tool-limit-detector.test.ts
@@ -7,6 +7,7 @@ import assert from "node:assert/strict";
 
 import {
   getEffectiveToolLimit,
+  getKnownToolLimit,
   setDetectedToolLimit,
   parseToolLimitFromError,
   shouldDetectLimit,
@@ -18,8 +19,37 @@ describe("toolLimitDetector", () => {
     clearDetectedLimits();
   });
 
+  it("should return null from getKnownToolLimit when no proactive or detected limit exists", () => {
+    assert.strictEqual(getKnownToolLimit("openai"), null);
+  });
+
+  it("should return null from getKnownToolLimit for null/undefined provider", () => {
+    assert.strictEqual(getKnownToolLimit("openai"), null);
+    assert.strictEqual(getKnownToolLimit(null), null);
+    assert.strictEqual(getKnownToolLimit(undefined), null);
+  });
+
   it("should return default limit when no cached value", () => {
     assert.strictEqual(getEffectiveToolLimit("openai"), 128);
+    assert.strictEqual(getEffectiveToolLimit(null), 128);
+    assert.strictEqual(getEffectiveToolLimit(undefined), 128);
+  });
+
+  it("should return proactive known limit for grok-cli", () => {
+    assert.strictEqual(getKnownToolLimit("grok-cli"), 200);
+  });
+
+  it("should return detected known limit when available", () => {
+    setDetectedToolLimit("openai", 100);
+    assert.strictEqual(getKnownToolLimit("openai"), 100);
+    assert.strictEqual(getEffectiveToolLimit("openai"), 100);
+  });
+
+  it("should keep getEffectiveToolLimit contract for default, proactive, and detected limits", () => {
+    assert.strictEqual(getEffectiveToolLimit("openai"), 128);
+    assert.strictEqual(getEffectiveToolLimit("grok-cli"), 200);
+    setDetectedToolLimit("openai", 100);
+    assert.strictEqual(getEffectiveToolLimit("openai"), 100);
   });
 
   it("should return cached limit when available", () => {
@@ -61,14 +91,28 @@ describe("toolLimitDetector", () => {
   });
 
   it("should return proactive limit for grok-cli (200) without any detection", () => {
+    assert.strictEqual(getKnownToolLimit("grok-cli"), 200);
     assert.strictEqual(getEffectiveToolLimit("grok-cli"), 200);
   });
 
+  it("should document grok-cli known limit precedence for opencode bypass truncation", () => {
+    assert.strictEqual(getKnownToolLimit("grok-cli"), 200);
+  });
+
   it("should not override proactive limit with setDetectedToolLimit", () => {
     setDetectedToolLimit("grok-cli", 150);
     assert.strictEqual(getEffectiveToolLimit("grok-cli"), 200);
   });
 
+  it("should return proactive limit for nvidia (1536) without any detection", () => {
+    assert.strictEqual(getEffectiveToolLimit("nvidia"), 1536);
+  });
+
+  it("should not override nvidia proactive limit with reactive detection", () => {
+    setDetectedToolLimit("nvidia", 100);
+    assert.strictEqual(getEffectiveToolLimit("nvidia"), 1536);
+  });
+
   it("should still return default (128) for unknown providers", () => {
     assert.strictEqual(getEffectiveToolLimit("some-new-provider"), 128);
   });
diff --git a/tests/unit/translator-openai-to-kiro.test.ts b/tests/unit/translator-openai-to-kiro.test.ts
index 9d74a3e20e..3421b2563b 100644
--- a/tests/unit/translator-openai-to-kiro.test.ts
+++ b/tests/unit/translator-openai-to-kiro.test.ts
@@ -1090,3 +1090,144 @@ test("buildKiroPayload leaves already-two-dash Claude ids unchanged (#2270)", ()
     "two-dash form (patch + date) must remain unchanged"
   );
 });
+
+test("buildKiroPayload enables thinking mode for Claude models via reasoning_effort", () => {
+  const body = {
+    messages: [{ role: "user", content: "Solve a hard problem" }],
+    reasoning_effort: "high",
+    max_tokens: 64000,
+  };
+
+  const result = buildKiroPayload("claude-opus-4.8", body, false, null);
+
+  assert.ok(result.additionalModelRequestFields, "additionalModelRequestFields must be set");
+  assert.deepEqual(result.additionalModelRequestFields.thinking, {
+    type: "adaptive",
+    display: "summarized",
+  });
+  assert.equal(result.additionalModelRequestFields.output_config.effort, "high");
+  assert.equal(result.additionalModelRequestFields.max_tokens, 64000);
+  assert.match(
+    result.conversationState.currentMessage.userInputMessage.content,
+    /<thinking_mode>enabled<\/thinking_mode>/,
+    "thinking_mode directive must be injected into user content"
+  );
+  assert.match(
+    result.conversationState.currentMessage.userInputMessage.content,
+    /<max_thinking_length>\d+<\/max_thinking_length>/,
+    "max_thinking_length directive must be injected into user content"
+  );
+});
+
+test("buildKiroPayload drops temperature when thinking is enabled", () => {
+  const body = {
+    messages: [{ role: "user", content: "Solve a hard problem" }],
+    reasoning_effort: "high",
+    temperature: 0.5,
+  };
+
+  const result = buildKiroPayload("claude-opus-4.8", body, false, null);
+
+  assert.ok(result.additionalModelRequestFields, "thinking must be enabled");
+  assert.equal(
+    result.inferenceConfig?.temperature,
+    undefined,
+    "temperature must be dropped when adaptive thinking is active"
+  );
+});
+
+test("buildKiroPayload ignores thinking request for unsupported effort levels", () => {
+  const body = {
+    messages: [{ role: "user", content: "Hello" }],
+    reasoning_effort: "invalid",
+  };
+
+  const result = buildKiroPayload("claude-opus-4.8", body, false, null);
+
+  assert.equal(
+    result.additionalModelRequestFields,
+    undefined,
+    "invalid effort must not enable thinking"
+  );
+});
+
+test("buildKiroPayload maps body.thinking budget_tokens to effort level", () => {
+  const body = {
+    messages: [{ role: "user", content: "Deep reasoning" }],
+    thinking: { type: "enabled", budget_tokens: 50000 },
+  };
+
+  const result = buildKiroPayload("claude-opus-4.7", body, false, null);
+
+  assert.ok(result.additionalModelRequestFields, "thinking must be enabled from budget_tokens");
+  assert.equal(result.additionalModelRequestFields.output_config.effort, "high");
+});
+
+test("buildKiroPayload leaves thinking off when no reasoning is requested", () => {
+  const body = { messages: [{ role: "user", content: "Hi" }] };
+
+  const result = buildKiroPayload("claude-opus-4.8", body, false, null);
+
+  assert.equal(result.additionalModelRequestFields, undefined, "no thinking fields by default");
+  assert.doesNotMatch(
+    result.conversationState.currentMessage.userInputMessage.content,
+    /<thinking_mode>/,
+    "no directive injected by default"
+  );
+});
+
+test("buildKiroPayload maps reasoning_effort to the same Kiro effort level (no +1 shift)", () => {
+  const result = buildKiroPayload(
+    "claude-sonnet-5",
+    { messages: [{ role: "user", content: "hard" }], reasoning_effort: "medium" },
+    false,
+    null
+  );
+
+  assert.equal(result.additionalModelRequestFields.output_config.effort, "medium");
+});
+
+test("buildKiroPayload reads effort from Anthropic output_config.effort", () => {
+  const result = buildKiroPayload(
+    "claude-opus-4.8",
+    { messages: [{ role: "user", content: "hard" }], output_config: { effort: "xhigh" } },
+    false,
+    null
+  );
+
+  assert.ok(result.additionalModelRequestFields, "output_config.effort must enable thinking");
+  assert.equal(result.additionalModelRequestFields.output_config.effort, "xhigh");
+});
+
+test("buildKiroPayload defaults adaptive thinking (no effort) to high", () => {
+  const result = buildKiroPayload(
+    "claude-opus-4.8",
+    { messages: [{ role: "user", content: "hard" }], thinking: { type: "adaptive" } },
+    false,
+    null
+  );
+
+  assert.equal(
+    result.additionalModelRequestFields.output_config.effort,
+    "high",
+    "adaptive with no explicit effort defaults to Anthropic's documented default (high)"
+  );
+});
+
+test("buildKiroPayload drops both temperature and top_p when thinking is enabled", () => {
+  const result = buildKiroPayload(
+    "claude-opus-4.8",
+    {
+      messages: [{ role: "user", content: "hard" }],
+      reasoning_effort: "high",
+      temperature: 0.5,
+      top_p: 0.9,
+    },
+    false,
+    null
+  );
+
+  assert.ok(result.additionalModelRequestFields, "thinking must be enabled");
+  assert.equal(result.inferenceConfig?.temperature, undefined, "temperature must be dropped");
+  assert.equal(result.inferenceConfig?.topP, undefined, "top_p must be dropped");
+});
diff --git a/tests/unit/validate-response-quality.test.ts b/tests/unit/validate-response-quality.test.ts
index 6971f0ecb1..c95df223f7 100644
--- a/tests/unit/validate-response-quality.test.ts
+++ b/tests/unit/validate-response-quality.test.ts
@@ -1,6 +1,9 @@
 import test from "node:test";
 import assert from "assert";
-import { validateResponseQuality } from "../../open-sse/services/combo/validateQuality.ts";
+import {
+  validateResponseQuality,
+  releaseQualityClone,
+} from "../../open-sse/services/combo/validateQuality.ts";
 
 function makeResponse(body: string, contentType = "text/plain") {
   return {
@@ -50,3 +53,33 @@ test("returns valid=true for Responses API bodies with structural output", async
   );
   assert.strictEqual(res.valid, true);
 });
+
+// ── releaseQualityClone (memory: release the abandoned quality-check tee branch) ──
+
+test("releaseQualityClone is a no-op when the clone fell back to the original", () => {
+  const original = new Response("body");
+  // clone === original → must NOT touch the body (it's the response being streamed).
+  releaseQualityClone(original, original, { clonedResponse: original });
+  assert.strictEqual(original.bodyUsed, false, "original body must remain untouched");
+});
+
+test("releaseQualityClone cancels the discarded clonedResponse body", async () => {
+  const original = new Response("streamed to client");
+  const cloneBody = new ReadableStream({
+    start(controller) {
+      controller.enqueue(new TextEncoder().encode("abandoned tee branch"));
+    },
+  });
+  const clonedResponse = new Response(cloneBody);
+  releaseQualityClone({} as Response, original, { clonedResponse });
+  // Give the microtask queue a tick for the cancel() promise to settle.
+  await Promise.resolve();
+  assert.ok(clonedResponse.body?.locked || cloneBody.locked === false);
+  // The original (client-facing) response is never disturbed.
+  assert.strictEqual(original.bodyUsed, false);
+});
+
+test("releaseQualityClone does not throw when there is no clonedResponse", () => {
+  const original = new Response("body");
+  assert.doesNotThrow(() => releaseQualityClone({} as Response, original, {}));
+});
diff --git a/tests/unit/web-cookie-providers-new.test.ts b/tests/unit/web-cookie-providers-new.test.ts
index 4390fc33ca..82dc22890a 100644
--- a/tests/unit/web-cookie-providers-new.test.ts
+++ b/tests/unit/web-cookie-providers-new.test.ts
@@ -12,6 +12,9 @@ const { getExecutor, hasSpecializedExecutor } = await import("../../open-sse/exe
 
 // ── Helpers ──────────────────────────────────────────────────────────────────
 
+type MockFetchInput = Parameters<typeof fetch>[0];
+type MockFetchInit = Parameters<typeof fetch>[1];
+
 function mockSSEStream(chunks: string[]) {
   const encoder = new TextEncoder();
   return new ReadableStream({
@@ -70,7 +73,7 @@ function mockFetchCapture(status = 200, responseBody?: ReadableStream | string)
         })
       : responseBody;
 
-  globalThis.fetch = async (url: any, opts: any) => {
+  globalThis.fetch = async (url: MockFetchInput, opts?: MockFetchInit) => {
     capturedUrl = String(url);
     capturedHeaders = opts?.headers || {};
     capturedBody = opts?.body || null;
@@ -210,7 +213,7 @@ test("HuggingChat: streaming returns SSE chunks", async () => {
 
   const original = globalThis.fetch;
   let callCount = 0;
-  globalThis.fetch = async (url: any, opts: any) => {
+  globalThis.fetch = async (url: MockFetchInput, opts?: MockFetchInit) => {
     callCount++;
     if (callCount === 1) {
       // First call: create conversation
@@ -250,7 +253,7 @@ test("HuggingChat: sends current web data payload with the root parent id", asyn
   const original = globalThis.fetch;
   let sentData: Record<string, unknown> | null = null;
   let callCount = 0;
-  globalThis.fetch = async (_url: any, opts: any) => {
+  globalThis.fetch = async (_url: MockFetchInput, opts?: MockFetchInit) => {
     callCount++;
     if (callCount === 1) {
       return new Response(JSON.stringify({ conversationId: "test-conv-123" }), {
@@ -298,7 +301,7 @@ test("HuggingChat: carries create response Set-Cookie into message send", async
   const original = globalThis.fetch;
   let sendCookie = "";
   let callCount = 0;
-  globalThis.fetch = async (_url: any, opts: any) => {
+  globalThis.fetch = async (_url: MockFetchInput, opts?: MockFetchInit) => {
     callCount++;
     if (callCount === 1) {
       return new Response(JSON.stringify({ conversationId: "test-conv-123" }), {
@@ -347,7 +350,7 @@ test("HuggingChat: default model is a current concrete catalog model", async ()
   const original = globalThis.fetch;
   let createModel: unknown = null;
   let callCount = 0;
-  globalThis.fetch = async (_url: any, opts: any) => {
+  globalThis.fetch = async (_url: MockFetchInput, opts?: MockFetchInit) => {
     callCount++;
     if (callCount === 1) {
       createModel = JSON.parse(String(opts.body)).model;
@@ -470,7 +473,7 @@ test("HuggingChat: non-streaming returns JSON completion", async () => {
 
   const original = globalThis.fetch;
   let callCount = 0;
-  globalThis.fetch = async (url: any, opts: any) => {
+  globalThis.fetch = async (url: MockFetchInput, opts?: MockFetchInit) => {
     callCount++;
     if (callCount === 1) {
       return new Response(JSON.stringify({ conversationId: "test-conv-123" }), {
@@ -719,17 +722,51 @@ test("Kimi Web: error response returns error result", async () => {
 
 // ── Doubao Web Execution Tests ───────────────────────────────────────────────
 
-test("Doubao Web: streaming passes through SSE", async () => {
-  const sseData = ['data: {"choices":[{"delta":{"content":"你好世界"}}]}'];
+test("Doubao Web: streaming converts Dola SSE chunks", async () => {
+  const sseData = [
+    'event: STREAM_MSG_NOTIFY\ndata: {"content":{"content_block":[{"content":{"text_block":{"text":"hello"}}}]}}\n\n',
+    'event: STREAM_CHUNK\ndata: {"message_id":"mid","patch_op":[{"patch_value":{"content_block":[{"content":{"text_block":{"text":" world"}}}]}}]}\n\n',
+  ];
   const restore = mockFetchCapture(200, mockSSEStream(sseData));
   try {
     const executor = new DoubaoWebExecutor();
     const result = await executor.execute({
       ...noopExecuteInput,
-      model: "doubao-default",
+      model: "dola-speed",
+      credentials: { apiKey: "sessionid=sid; ttwid=tt; s_v_web_id=verify_abc" },
     });
     assert.ok(result.response instanceof Response);
-    assert.ok(result.url.includes("doubao.com"));
+    assert.equal(new URL(result.url).hostname, "www.dola.com");
+    assert.equal(result.transformedBody.option.need_create_conversation, true);
+    const streamed = await result.response.text();
+    assert.match(streamed, /hello/);
+  } finally {
+    restore.restore();
+  }
+});
+
+test("Doubao Web: Dola Pro returns final answer after reasoning boundary", async () => {
+  const sseData = [
+    'event: STREAM_CHUNK\ndata: {"message_id":"mid","patch_op":[{"patch_object":1,"patch_type":1,"patch_value":{"content_block":[{"block_type":10000,"content":{"text_block":{"text":"The user asked for 1+1. "}},"is_finish":false}]}}]}\n\n',
+    'event: STREAM_CHUNK\ndata: {"message_id":"mid","patch_op":[{"patch_object":1,"patch_type":1,"patch_value":{"content_block":[{"block_type":10000,"content":{"text_block":{"text":"That is straightforward: 2."}},"is_finish":false}]}}]}\n\n',
+    'event: STREAM_CHUNK\ndata: {"message_id":"mid","patch_op":[{"patch_object":1,"patch_type":1,"patch_value":{"content_block":[{"block_type":10040,"content":{"text_block":{}},"is_finish":true}]}}]}\n\n',
+    'event: STREAM_CHUNK\ndata: {"message_id":"mid","patch_op":[{"patch_object":1,"patch_type":1,"patch_value":{"content_block":[{"block_type":10000,"content":{"text_block":{"text":"2"}},"is_finish":false}]}}]}\n\n',
+    'event: SSE_REPLY_END\ndata: {"end_type":1}\n\n',
+  ];
+  const restore = mockFetchCapture(200, mockSSEStream(sseData));
+  try {
+    const executor = new DoubaoWebExecutor();
+    const result = await executor.execute({
+      ...noopExecuteInput,
+      model: "dola-pro",
+      stream: false,
+      credentials: { apiKey: "sessionid=sid; ttwid=tt; s_v_web_id=verify_abc" },
+    });
+    const body = await result.response.json();
+
+    assert.equal(result.transformedBody.option.need_deep_think, 3);
+    assert.equal(result.transformedBody.ext.use_deep_think, "3");
+    assert.equal(body.choices[0].message.content, "2");
   } finally {
     restore.restore();
   }
@@ -739,7 +776,10 @@ test("Doubao Web: error response returns error result", async () => {
   const restore = mockFetchCapture(502, "Bad Gateway");
   try {
     const executor = new DoubaoWebExecutor();
-    const result = await executor.execute(noopExecuteInput);
+    const result = await executor.execute({
+      ...noopExecuteInput,
+      credentials: { apiKey: "sessionid=sid; ttwid=tt; s_v_web_id=verify_abc" },
+    });
     assert.ok(result.response instanceof Response);
     assert.equal(result.response.status, 502);
   } finally {
@@ -761,7 +801,7 @@ test("All executors handle Cookie: prefix", async () => {
 
   const original = globalThis.fetch;
   let lastHeaders: Record<string, string> = {};
-  globalThis.fetch = async (_url: any, opts: any) => {
+  globalThis.fetch = async (_url: MockFetchInput, opts?: MockFetchInit) => {
     lastHeaders = opts?.headers || {};
     // Poe expects JSON response with chatWithBot
     const body = JSON.stringify({ data: { chatWithBot: { text: "ok" } } });
@@ -775,7 +815,7 @@ test("All executors handle Cookie: prefix", async () => {
     for (const executor of executors) {
       await executor.execute({
         ...noopExecuteInput,
-        credentials: { apiKey: "Cookie: test=value" },
+        credentials: { apiKey: "Cookie: sessionid=test; ttwid=tt; s_v_web_id=verify_test" },
         stream: false,
       });
       // Cookie should be normalized (may or may not have prefix depending on executor)
@@ -798,7 +838,7 @@ test("All executors handle bare cookie value", async () => {
 
   const original = globalThis.fetch;
   let lastHeaders: Record<string, string> = {};
-  globalThis.fetch = async (_url: any, opts: any) => {
+  globalThis.fetch = async (_url: MockFetchInput, opts?: MockFetchInit) => {
     lastHeaders = opts?.headers || {};
     // Poe expects JSON response with chatWithBot
     const body = JSON.stringify({ data: { chatWithBot: { text: "ok" } } });
@@ -830,7 +870,7 @@ test("HuggingChat: respects abort signal", async () => {
 
   const original = globalThis.fetch;
   let fetchCalled = false;
-  globalThis.fetch = async (_url: any, _opts: any) => {
+  globalThis.fetch = async (_url: MockFetchInput, _opts?: MockFetchInit) => {
     fetchCalled = true;
     return new Response("ok", { status: 200 });
   };
diff --git a/tests/unit/xiaomi-mimo-provider.test.ts b/tests/unit/xiaomi-mimo-provider.test.ts
index c114dbe635..91a2ab0369 100644
--- a/tests/unit/xiaomi-mimo-provider.test.ts
+++ b/tests/unit/xiaomi-mimo-provider.test.ts
@@ -11,14 +11,19 @@ import {
 } from "../../src/shared/validation/schemas.ts";
 import { validateBody } from "../../src/shared/validation/helpers.ts";
 
-test("xiaomi-mimo registry uses the current default base URL and MiMo V2.5 + V2 models", () => {
+const DEPRECATED_MIMO_V2_MODELS = ["mimo-v2-pro", "mimo-v2-omni", "mimo-v2-flash", "mimo-v2-tts"];
+
+test("xiaomi-mimo registry uses the current default base URL and MiMo V2.5 models", () => {
   const entry = REGISTRY["xiaomi-mimo"];
 
   assert.ok(entry, "xiaomi-mimo should exist in registry");
   assert.equal(entry.baseUrl, "https://api.xiaomimimo.com/v1");
+  for (const modelId of DEPRECATED_MIMO_V2_MODELS) {
+    assert.ok(!entry.models.some((model) => model.id === modelId), `${modelId} is deprecated`);
+  }
   assert.deepEqual(
     entry.models.map((model) => model.id),
-    ["mimo-v2.5-pro", "mimo-v2.5", "mimo-v2-pro", "mimo-v2-omni", "mimo-v2-flash"]
+    ["mimo-v2.5-pro", "mimo-v2.5"]
   );
 });
 
@@ -32,7 +37,7 @@ test("xiaomi-mimo TTS models are registered in the audio speech registry", () =>
   assert.equal(provider.format, "xiaomi-mimo-tts");
   assert.deepEqual(
     provider.models.map((model) => model.id),
-    ["mimo-v2.5-tts", "mimo-v2.5-tts-voicedesign", "mimo-v2.5-tts-voiceclone", "mimo-v2-tts"]
+    ["mimo-v2.5-tts", "mimo-v2.5-tts-voicedesign", "mimo-v2.5-tts-voiceclone"]
   );
   assert.ok(
     getAllAudioModels().some(
@@ -98,14 +103,9 @@ test("xiaomi-mimo update schema accepts custom regional baseUrl", () => {
   }
 });
 
-test("only MiMo V2.5 and V2-Omni report vision; the *-pro/flash chat models are text-only", () => {
-  // Corrected: Xiaomi documents ONLY mimo-v2.5 and mimo-v2-omni as image-capable
-  // (mimo.mi.com .../image-understanding). models.dev mislabels the *-pro models
-  // (hermes-agent#18884); see the hard override in src/lib/modelCapabilities.ts.
+test("registered Xiaomi MiMo V2.5 chat models keep capability overrides", () => {
+  // models.dev mislabels the *-pro models (hermes-agent#18884); see the hard override in
+  // src/lib/modelCapabilities.ts.
   assert.equal(getModelSpec("mimo-v2.5")?.supportsVision, true);
-  assert.equal(getModelSpec("mimo-v2-omni")?.supportsVision, true);
-  // text-only chat models
   assert.equal(getModelSpec("mimo-v2.5-pro")?.supportsVision, false);
-  assert.equal(getModelSpec("mimo-v2-pro")?.supportsVision, false);
-  assert.equal(getModelSpec("mimo-v2-flash")?.supportsVision, undefined);
 });
diff --git a/tests/unit/zed-oauth-provider.test.ts b/tests/unit/zed-oauth-provider.test.ts
new file mode 100644
index 0000000000..35c4c53697
--- /dev/null
+++ b/tests/unit/zed-oauth-provider.test.ts
@@ -0,0 +1,70 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { PROVIDERS } from "../../src/lib/oauth/providers/index";
+import { getProvider, generateAuthData } from "../../src/lib/oauth/providers";
+
+// The import_token providers expose validateImportToken/mapTokens beyond the base
+// OAuth provider shape; narrow to just what these assertions touch.
+type ImportTokenProvider = {
+  flowType: string;
+  validateImportToken: (token: string) => { valid: boolean };
+  mapTokens: (t: { accessToken: string }) => {
+    accessToken: string;
+    refreshToken: string | null;
+    expiresIn: number | null;
+  };
+};
+const asImportProvider = (id: string) => getProvider(id) as unknown as ImportTokenProvider;
+
+/**
+ * Guards fix for issue #6041:
+ * GET /api/oauth/zed/[action] was throwing "Unknown provider: zed" because
+ * "zed" was not registered in the PROVIDERS map. The fix registers a minimal
+ * import_token entry so that getProvider("zed") returns cleanly and
+ * generateAuthData returns { supported: false } instead of a 500.
+ */
+describe("Zed OAuth provider registration", () => {
+  it("PROVIDERS map includes zed", () => {
+    assert.ok("zed" in PROVIDERS, "PROVIDERS must include zed");
+  });
+
+  it("getProvider('zed') does not throw", () => {
+    assert.doesNotThrow(() => getProvider("zed"));
+  });
+
+  it("zed provider has flowType import_token", () => {
+    const provider = getProvider("zed");
+    assert.equal(provider.flowType, "import_token");
+  });
+
+  it("generateAuthData returns supported:false for zed", () => {
+    const authData = generateAuthData("zed", "http://localhost:8080/callback");
+    assert.equal(authData.supported, false);
+    assert.equal(authData.authUrl, undefined);
+    assert.match(authData.error, /zed/i);
+  });
+
+  it("generateAuthData error message mentions the keychain import path", () => {
+    const authData = generateAuthData("zed", "http://localhost:8080/callback");
+    assert.ok(authData.error.includes("/api/providers/zed/import"));
+  });
+
+  it("zed validateImportToken rejects empty tokens", () => {
+    const provider = asImportProvider("zed");
+    assert.equal(provider.validateImportToken("").valid, false);
+    assert.equal(provider.validateImportToken("   ").valid, false);
+  });
+
+  it("zed validateImportToken accepts valid tokens", () => {
+    const provider = asImportProvider("zed");
+    assert.equal(provider.validateImportToken("sk-ant-api03-abc123def456").valid, true);
+  });
+
+  it("zed mapTokens returns accessToken and null refresh/expiry", () => {
+    const provider = asImportProvider("zed");
+    const result = provider.mapTokens({ accessToken: "sk-ant-test" });
+    assert.equal(result.accessToken, "sk-ant-test");
+    assert.equal(result.refreshToken, null);
+    assert.equal(result.expiresIn, null);
+  });
+});
diff --git a/tests/unit/zenmux-free-provider.test.ts b/tests/unit/zenmux-free-provider.test.ts
index 1ddc004ce3..ff677b4e9d 100644
--- a/tests/unit/zenmux-free-provider.test.ts
+++ b/tests/unit/zenmux-free-provider.test.ts
@@ -36,6 +36,10 @@ test("zenmux-free WEB_COOKIE_PROVIDERS entry is marked as free-tier", () => {
   >;
   assert.equal(p.hasFree, true);
   assert.ok(typeof p.freeNote === "string" && (p.freeNote as string).length > 0);
+  assert.ok(
+    !(p.freeNote as string).includes("MiMo V2 Flash Free"),
+    "free note must not advertise deprecated MiMo V2 Flash Free"
+  );
   assert.ok(typeof p.authHint === "string" && (p.authHint as string).length > 0);
 });
 
@@ -52,12 +56,11 @@ test("zenmux-free is present in the provider REGISTRY with correct shape", () =>
   assert.equal(r.authHeader, "cookie");
 });
 
-test("zenmux-free registry has 12 models including the 3 key free-tier ones", () => {
+test("zenmux-free registry excludes deprecated MiMo V2 Flash Free", () => {
   const r = REGISTRY["zenmux-free"];
   assert.ok(r.models && r.models.length > 0, "must have at least one model");
   const ids = r.models.map((m) => m.id);
 
-  // The 3 main models mentioned in the upstream PR
   assert.ok(
     ids.includes("deepseek/deepseek-chat"),
     "deepseek/deepseek-chat (DeepSeek V3.2) must be registered"
@@ -66,11 +69,8 @@ test("zenmux-free registry has 12 models including the 3 key free-tier ones", ()
     ids.includes("z-ai/glm-4.7-flash-free"),
     "z-ai/glm-4.7-flash-free (GLM 4.7 Flash Free) must be registered"
   );
-  assert.ok(
-    ids.includes("xiaomi/mimo-v2-flash-free"),
-    "xiaomi/mimo-v2-flash-free (MiMo V2 Flash Free) must be registered"
-  );
-  assert.equal(r.models.length, 12, "must have exactly 12 models");
+  assert.ok(!ids.includes("xiaomi/mimo-v2-flash-free"), "xiaomi/mimo-v2-flash-free is deprecated");
+  assert.equal(r.models.length, 11, "must have exactly 11 models");
 });
 
 test("zenmux-free model names are human-readable strings", () => {
@@ -115,7 +115,7 @@ test("ZenmuxFreeExecutor returns 401 when ctoken is missing from cookies", async
   } as Parameters<typeof executor.execute>[0]);
   assert.ok(result.response instanceof Response);
   assert.equal(result.response.status, 401);
-  const body = await result.response.json() as Record<string, unknown>;
+  const body = (await result.response.json()) as Record<string, unknown>;
   const errMsg = (body?.error as Record<string, unknown>)?.message as string;
   assert.ok(errMsg && typeof errMsg === "string", "error.message must be present");
   assert.ok(errMsg.includes("ctoken"), "error must mention ctoken");
@@ -162,10 +162,7 @@ test("ZenmuxFreeExecutor injects Cookie header from credentials when ctoken is p
     const req = intercepted[0];
 
     // URL must include ctoken as query param
-    assert.ok(
-      req.url.includes("ctoken=my-ctoken-value"),
-      "ctoken must appear in the request URL"
-    );
+    assert.ok(req.url.includes("ctoken=my-ctoken-value"), "ctoken must appear in the request URL");
     // Cookie header must carry the full cookie string
     assert.ok(req.headers["cookie"], "Cookie header must be set");
     assert.ok(
@@ -200,7 +197,7 @@ test("ZenmuxFreeExecutor handles upstream 401 and returns clean error (not raw m
     } as Parameters<typeof executor.execute>[0]);
     assert.ok(result.response instanceof Response);
     assert.equal(result.response.status, 401);
-    const body = await result.response.json() as Record<string, unknown>;
+    const body = (await result.response.json()) as Record<string, unknown>;
     const errMsg = ((body?.error as Record<string, unknown>)?.message as string) || "";
     // Hard Rule #12 — no stack traces
     assert.ok(!errMsg.includes("at /"), "error must not contain stack trace path");