feat(codex): prepare Codex Spark retirement and remove its quota UI

devlog/_plan/260912_codex_spark_retirement/000_plan.md

@@ -0,0 +1,28 @@
+# Spark retirement preparation
+
+Prepare an unmerged draft PR for removing GPT-5.3-Codex-Spark after its announced retirement. Tibo's September 11 announcement says next week, without an exact cutoff. Deployment timing stays with the maintainer; this branch contains the future removal and must not be merged now.
+
+## Loop contract
+- Archetype: satisfy-spec; trigger: user requested complete Spark removal PR including usage quota and UI.
+- Goal: one cohesive retirement patch covering membership, quota/route semantics and settings/UI.
+- Class: C3 with C4 care for quota isolation, persisted evidence and management settings.
+- Non-goals: no merge/auto-merge/deploy/live config changes; no historical usage deletion; no Meta Muse Spark or vendor snapshot retirement.
+- Verifier: exact-head Cross-platform CI and independent source review. Local product tests/typecheck/build/install NOT RUN by user instruction. CI workflow runs the relevant Bun tests and gates. UI evidence must be a genuine rendered screenshot, not a waiver invented by the agent.
+- Stop: correct reviewed Draft PR, complete head-specific CI with no failures or pending required jobs, remains unmerged.
+- Artifact: this unit, 001_source.md, 010_implementation.md, 020_review.md, 030_delivery.md.
+- Outcomes: DONE means draft delivery, not retirement deployed. Source-date uncertainty must stay explicit. No invented budget.
+- Delegation: inherited model/effort only; independent read-only scout/auditor and three disjoint implementation lanes. Main coordinates, reviews and delivers. Native architect role is not exposed; ordinary inherited read-only source review is recorded as such, not claimed to be that registered role.
+- Escalation: investigate actual correctness conflicts; reclaim remaining work only after inspecting failed agent state. No shared role configuration edits.
+
+## Single work-phase
+One P-A-B-C-D cycle for a single user-visible outcome. Backend, API and UI are subtasks in dependency order; no partial retirement can be considered complete alone. This avoids the previous task's retrospective phase attestations.
+
+## Decisions
+D1: remove Spark native membership AND add the exact slug to the existing retired set. Preserve unknown/new account-native observations.
+D2: remove Spark-only quota collection, routing scope and show/hide preference. A narrow tombstone for old persisted Spark quota rows is allowed; such evidence must neither display nor affect shared/Reserve capacity. Do not delete generic custom windows.
+D3: reject or ignore retired Spark response quota evidence so it cannot be reclassified as shared account quota.
+D4: preserve shared/Reserve affinity, account selection, probe leases and cooldown isolation. Replace old Spark positive-control tests with existing Reserve/shared coverage or real retirement negatives, not blind slug substitutions.
+D5: remove Spark compatibility branches where exclusive to Codex Spark; preserve general Responses Lite, namespace scrubbing and other-provider behavior.
+D6: remove GUI toggle/state/i18n/CSS and settings API/type/schema field together. Old config documents remain loadable; a legacy-only settings update must not revive the switch.
+D7: preserve historical costs/benchmark data/vendor slugs and maintained general fixtures; document each remaining active-source Spark match.
+

devlog/_plan/260912_codex_spark_retirement/001_source.md

@@ -0,0 +1,11 @@
+# Retirement announcement
+
+Source: https://x.com/thsottiaux/status/2098300998968357218
+
+Author: Tibo (@thsottiaux). Posted 2026-09-11 at 06:41:57 UTC (15:41 KST).
+
+Verified with Aside's signed-in twitter.search and by opening the exact post in Aside repl. The post states: “Next week we’ll be retiring GPT-5.3-Codex-Spark.”
+
+The post gives no exact retirement date or time. The calendar week following the post is September 14–20, 2026; that range is an interpretation, not an announced cutoff. No time-triggered production switch or automatic merge is authorized.
+
+User direction: prepare the complete removal PR, leave the current service alone, no merge. New subagents inherit the main session; no explicit model override. The prior no-local-suite and no-verify-push instructions continue.

devlog/_plan/260912_codex_spark_retirement/010_implementation.md

@@ -0,0 +1,43 @@
+# Implementation map
+
+## Lane A — native catalog and compatibility
+MODIFY src/codex/catalog/{native-models,metadata,parsing,sync,effort}.ts:
+- NATIVE_OPENAI_MODELS and DOCUMENTED_NATIVE_OPENAI_ADDITIONS lose gpt-5.3-codex-spark.
+- RETIRED_NATIVE_OPENAI_MODELS gains the exact slug; remove 100k Spark context override and exclusive tier/lite exceptions.
+- Verify full-shaped bare, cache, persisted account-selector-v1 Spark rows cannot reappear in assembly/restore; unrelated future native still admitted.
+MODIFY src/adapters/openai-responses.ts and src/responses/hosted-tool-policy.ts to remove exclusive Spark request/tool/lite flags. Retain shared response normalization. Adjust misleading src/server/responses-self-named-namespace-scrub.ts comment only, not generic scrub logic.
+Tests owned by A: catalog/metadata/effort/visibility/convergence/restore/selector tests; tests/claude-integration, tests/clients, tests/responses, tests/routing. Do not change quota/routing core tests owned by B. Keep adequate positive native controls after deleting Spark-specific behavior.
+
+## Lane B — quota, routing, settings
+MODIFY src/codex/{quota,routing,auth-context,auth-api}.ts, src/providers/quota.ts, src/server/management/config-routes.ts, src/config.ts, src/types/config.ts.
+Before: CodexQuotaScope = shared|spark|reserve, Spark WHAM additional rate limits and response header windows parsed, preference showCodexSparkQuota gates UI projection.
+After: shared|reserve scope only; no Spark collection/active affinity/probe family. Ignore Spark-specific response evidence; filter legacy Spark windows before presence/capacity/DTO use. Remove setting read/write/rollback/type/schema contract while accepting old config without dropping unrelated fields. Generic customWindows and Reserve detection remain.
+Trace scope generation -> maps/cache persistence -> auth error labels -> main claim recovery -> provider quota DTO. Tests owned by B: codex-{quota*,routing,pool*,auth-api,auth-context,cooldown*}, main-quota-evidence-validation, reserve-quota-scope, codex-spark-visibility; tests/server; tests/providers/provider-quota. Replace obsolete Spark tests with retired-evidence negatives and Reserve isolation.
+If deleting a test file adjust scripts/test-layout/layout.json and tests/fixtures/test-layout-expected.json; prefer repurposing existing files.
+
+## Lane C — UI and documentation
+MODIFY gui/src/components/CodexAccountPool.tsx, codex-account-pool-main-card.tsx: delete sparkVisible/sparkBusy/onToggleSpark and showCodexSparkQuota wiring; preserve other actions, feedback and busy state.
+MODIFY gui/src/styles.css to remove only Spark styles and revise actual action layout comments; remove codexAuth.sparkQuota* keys across all locales. Update gui/tests, notably main-account-hard-lock-setting.
+MODIFY current docs/, docs-site (all locales) and structure/ current ownership docs. Describe no Spark quota setting or native offering in this branch; retain historical decisions and benchmark records. Structure docs must describe shared/Reserve and retired-window suppression accurately. Main owns devlog unit only.
+Capture real UI evidence using an already available environment or remote-built artifact, with synthetic fixture data. No local product build/tests/install and no mutation of the live service.
+
+## Verification scenarios
+1. Seed full-shaped retired native rows bare and account-qualified, run assembly/sync twice: absent both times; keep a future unknown native positive control.
+2. Feed WHAM codex_bengalfox and Spark labels with shared/Reserve limits: Spark custom windows absent, ordinary limits unmodified.
+3. Feed old persisted custom windows and retired response headers: no resurrection and no shared cooldown contamination.
+4. Old showCodexSparkQuota config loads safely; API never advertises or accepts re-enabling it.
+5. Shared and Reserve independent quota/cooldown/affinity tests still prove independence.
+6. Native catalog tests retain reasoning/context/ordering positive coverage using live native models, not deleted assertions.
+7. DOM/rendered account panel has no Spark switch/bars and surviving controls still work; authentic screenshot in PR.
+8. Hosted CI is complete for the final PR head; no pending/failed jobs masked by shell pipelines or pass-count scripts.
+
+## Source review refinements (before Build)
+- Quota tombstone lives before ingestion/hydration and presence/observation, not only DTO display. quota.ts hydration currently accepts stored customWindows (626); partial updates preserve them (338). Sanitize both and direct-provider DTO paths.
+- Retired Spark model-derived response headers and reset-derived 429 outcomes are ignored before shared quota health/recovery. Preserve true Retry-After account throttle and credential/transport failures.
+- Keep generic WebSocket family normalization in src/server/responses/codex-ws-metadata.ts. It is not Spark-specific merely because fixtures mention codex_bengalfox.
+- Generic custom-window reset observation in src/quota/window-mapping.ts survives; filter retired evidence before it sees the snapshot.
+- Config schema passthrough makes an old setting inert. No destructive config migration or removal of historical observer/usage stores.
+- Ownership correction: B exclusively owns tests/routing/, tests/responses/responses-compaction-routing.test.ts, ws-upstream.test.ts and responses-account-label.test.ts. A owns the remaining Responses tests. B also owns src/codex/subagent-model-fallback.ts and Responses core edits only if tracing requires them; report such expansion. This is explicit rather than overlapping broad directory ownership.
+- Known retirement guard is local catalog/evidence policy (tier E1, runtime executing surface). Manually typed model ids may still pass generic routing; this work removes advertised native membership and model-specific support, not a universal request denylist. No stronger security enforcement is claimed.
+- UI proof: download the exact-head dashboard-preview CI artifact (build-commit and build-gui-tree stamps) and render against synthetic fixture API responses. No local product build/test/install or live service modification.
+

devlog/_plan/260912_codex_spark_retirement/020_review.md

@@ -0,0 +1,7 @@
+# Plan audit
+
+Source reviewer: inherited native agent Beauvoir. D1-D7 aligned; quota tombstones must precede storage/presence/reset observation, Spark 429 needs exclusion from shared model-derived cooldowns, and broad test ownership required disambiguation. Accepted into 010.
+
+Independent A auditor: inherited native agent Hegel. Final result: “PASS — the amended plan is sufficient for the A gate. No required corrections remain.” Its final line was “VERDICT: PASS”. The review specifically confirmed ingestion/hydration tombstones, reset-derived quota versus Retry-After, generic WS/reset preservation, legacy config compatibility, disjoint test scope and CI-artifact screenshot proof.
+
+Both reviews were read-only; no local product checks ran. Registered architect role is unavailable in this host schema; these are ordinary independent source reviews, with shared model-family inheritance requested by the user.

devlog/_plan/260912_codex_spark_retirement/030_delivery.md

@@ -0,0 +1,34 @@
+# Verification and delivery record
+
+Status: Draft PR #4334 prepared for the announced retirement. NO MERGE, auto-merge, release, deployment or live service/config change is authorized.
+
+## Source
+Primary source verified through Aside: https://x.com/thsottiaux/status/2098300998968357218, Tibo, 2026-09-11 06:41:57 UTC. “Next week” is the timing given; no exact cutoff was announced.
+
+## Implemented behavior
+Spark is absent from native membership, observations and restore outputs. Exact retired rows cannot re-enter from a full-shaped bare/cache/account-selector row; future unknown native observations still work. Spark-specific adapter/Lite/tool compatibility branches are removed while generic mechanisms remain.
+
+Dedicated Spark quota collection, routing scope and preference are removed. Old Spark windows are tombstoned before presence/ingestion/hydration/reset observations and Direct/Pool projections. Spark-only quota is unknown (null), not spare shared capacity. Retired-model response headers and reset-derived 429 evidence do not change shared quota state; actual Retry-After/account credential/transport handling and shared/Reserve isolation remain.
+
+The old settings field is inert in persisted passthrough config and cannot reactivate the removed control. UI state, API calls, toggle, CSS and translations are removed. Historical costs, usage, benchmark rows, generic unknown families and other providers including Muse Spark are preserved.
+
+## Independent reviews
+All native agents were dispatched with model/effort overrides omitted, inheriting the main session as explicitly requested.
+- A plan review: Hegel PASS after source-review refinements.
+- Catalog/compatibility post-build review: Kant PASS, then corrected two missed test assumptions after CI failures.
+- Quota/security/UI contract review: Zeno PASS on 8398f2abb7..0a0fd2a225, no concrete blockers.
+
+## CI repair
+First full remote workflow run 34671771774 at 0a0fd2a225 found test fixture failures:
+1. Two-pass retirement regression serialized complete duplicated instructions/catalog/cache rows to captured stdout. The failure wrapper discarded spawn error/signal. Full snapshots now go to the fixture directory with the same complete comparisons, plus preserved subprocess diagnostics. Capture overflow is the supported static diagnosis; the original log did not retain enough subprocess evidence to claim it proven.
+2. Astra without long-window opt-in emits context/max 272000 and compaction 244800. The test mistakenly asserted the raw pin's 872000 ceiling.
+
+No production change was needed for those failures. Re-run on the repaired final head is required; prior-head green or pending jobs are not substitutes.
+
+## UI evidence
+Source dashboard artifact: run 34671771774, artifact 10291125984, commit 0a0fd2a225614fb0c80ad3e125dfa7243879c87b, GUI tree 08717a046c2b2550c8ed08499511e5edc6aa2801.
+The built artifact is served unchanged with synthetic fixture API/bootstrap data on loopback; no local product build and no live proxy are used. Parent visually inspected desktop and mobile captures: no Spark switch or quota rows, surviving main/pool quota and actions visible. Fixture request ledger supplies interaction evidence. Screenshot commits do not change the GUI tree; artifact provenance must match that tree on final delivery.
+
+## Limits and completion gate
+Local product tests/typecheck/build/install: NOT RUN by user instruction. Only static source/diff inspection and rendered remote-built fixture UI ran locally. Exact final-head hosted CI and unmerged Draft PR state are checked by .tmp/spark-retirement/check_remote.py; failures/pending checks return nonzero. The final chat report carries the final SHA/run result because writing it back into this file would create another untested head.
+

docs-site/src/content/docs/fr/guides/codex-app-models.md

@@ -130,7 +130,7 @@ service OpenAI.
 
 ## Couverture stable actuelle des modèles
 
-L'ensemble natif de secours comprend `gpt-5.5`, `gpt-5.3-codex-spark` et GPT-5.6
+L'ensemble natif de secours comprend `gpt-5.5` et GPT-5.6
 Sol/Terra/Luna. Pour la famille GPT-5.5, opencodex conserve les entrées dynamiques plus riches du
 catalogue Codex installé et ne synthétise qu'une entrée manquante. L'instantané amont fourni n'est employé
 que pour GPT-5.6, auquel il apporte l'identité et les métadonnées réelles de chaque modèle plutôt qu'une

docs-site/src/content/docs/fr/guides/providers.md

@@ -196,9 +196,9 @@ de récupération strict, déterminé par `Retry-After`, par les en-têtes `rese
 plafond prévu — ou par un bref délai de repli par défaut. Les comptes soumis à un délai `Retry-After` explicite
 ne sont pas sondés avant son expiration. Les délais calculés à partir des informations de réinitialisation
 peuvent bénéficier d'une autorisation de sondage cadencée, afin de détecter la reprise sans submerger le
-fournisseur. Pour les modèles natifs, ces délais préservent également les groupes de quotas indépendants connus :
-`gpt-5.3-codex-spark` n'empêche pas le même compte d'essayer le quota partagé de GPT-5.6 Terra/Luna, tandis
-que les modèles de ce groupe partagé continuent de se protéger mutuellement. Les délais `Retry-After` explicites
+fournisseur. Pour les modèles natifs, ces délais séparent le quota partagé (dont GPT-5.6 Terra/Luna)
+de `gpt-reserve`. Les modèles du groupe partagé continuent de se protéger mutuellement ;
+une requête ordinaire réussie ne lève pas le délai de Reserve. Les délais `Retry-After` explicites
 et les délais par défaut s'appliquent toujours à l'ensemble du compte.
 
 **Affinité de session.** L'affinité entre le fil Codex et le compte est locale au processus — uniquement en mémoire et

docs-site/src/content/docs/fr/reference/cli/lifecycle.md

@@ -40,6 +40,11 @@ Vérifie de manière idempotente qu’un proxy d’arrière-plan est actif, puis
 
 Rétablit le fonctionnement natif de Codex **sans arrêter** le proxy : les lignes de configuration injectées et les entrées routées du catalogue sont supprimées, de sorte qu’une invocation simple de `codex` utilise de nouveau Codex directement. `eject` est un alias de `restore`.
 
+Le catalogue restauré exclut les modèles natifs retirés, dont `gpt-5.3-codex-spark`,
+que leurs identifiants soient nus ou qualifiés par un compte de confiance. Cette règle
+s’applique avec ou sans sauvegarde ; la sauvegarde originale et les anciens choix de modèles
+enregistrés par l’utilisateur sont conservés.
+
 Ajoutez `back` à l’une ou l’autre forme pour rediriger une invocation simple de `codex` vers un proxy déjà actif, sans modifier le cycle de vie du proxy :
 
 ```bash

docs-site/src/content/docs/guides/codex-app-models.md

@@ -188,7 +188,7 @@ including OpenAI service-tier metadata.
 
 ## Current stable model coverage
 
-The native fallback set includes `gpt-5.5`, `gpt-5.3-codex-spark`, and GPT-5.6 Sol/Terra/Luna.
+The native fallback set includes `gpt-5.5` and GPT-5.6 Sol/Terra/Luna.
 For the GPT-5.5 family, opencodex preserves
 the installed Codex catalog's richer live entries and only synthesizes a missing entry. The bundled
 upstream snapshot is used only for GPT-5.6, where it supplies the real per-model identity and

docs-site/src/content/docs/guides/providers.md

@@ -313,9 +313,9 @@ Terminal refresh failures mark the account as needing reauthentication instead o
 `Retry-After`, quota `reset` headers (capped), or a short default backoff. Accounts on an explicit
 `Retry-After` cooldown are not probed early; reset-derived cooldowns may receive a paced probe lease
 so recovery can be detected without flooding the provider. Reset-derived native-model cooldowns
-also preserve known independent quota groups: `gpt-5.3-codex-spark` does not prevent the same account
-from trying the shared GPT-5.6 Terra/Luna quota, while models in that shared group still protect one
-another. Explicit `Retry-After` and default cooldowns always remain account-wide.
+keep shared native quota (including GPT-5.6 Terra/Luna) separate from `gpt-reserve`.
+Models in the shared group still protect one another; an ordinary success cannot clear a Reserve cooldown.
+Explicit `Retry-After` and default cooldowns always remain account-wide.
 
 **Session affinity.** Codex thread→account affinity is process-local (in-memory only; not persisted
 across proxy restarts). On credential failures (`401` / `403`) the account is quarantined for