fix(responses): tri-state service_tier gate and authoritative-only [1m] picker rows

The service-tier gate stripped the field for UNCLASSIFIED custom
providers too, silently rewriting caller requests against unknown
gateways; only an explicit supportsServiceTier: false strips now
(true supports, false strips, undefined preserves-without-injection).
The Claude picker emitted [1m] rows for sub-1M models under
auto-context (the #854 defect at the picker level — a 372K route
marked [1m] makes Claude Code account 1e6); variants now require an
authoritative >=1M window. Adds the real DeepSeek tool-call
continuation shape (reasoning → call → output) to the replay tests.

Author: lidge-jun

src/claude/model-info.ts

@@ -118,14 +118,17 @@ export function buildAnthropicModelInfos(
   // host the compact window — display stays honest (real window, not "1M"). Guards
   // (audit R1#11): same dedupe set, never double-suffix.
   const push1mVariant = (base: AnthropicModelInfo, contextWindow: number | undefined, mode: AutoContextMode = auto) => {
-    if (!shouldMarkOneMillion(contextWindow, mode)) return;
+    // The [1m] marker makes Claude Code account 1e6 tokens for the row, so it
+    // may only name models whose AUTHORITATIVE effective window is >= 1M —
+    // never the auto-context widening, which would mark a 372K route and have
+    // Claude Code over-fill it (the #854 defect).
+    if (contextWindow === undefined || contextWindow < ONE_MILLION) return;
     if (base.id.includes("[1m]")) return;
     const id = `${base.id}[1m]`;
     if (seen.has(id)) return;
     seen.add(id);
     const window = contextWindow as number;
-    const label = window >= ONE_MILLION ? "1M" : `${Math.round(window / 1_000)}k`;
-    out.push({ ...base, id, display_name: `${base.display_name} · ${label}`, max_input_tokens: Math.min(window, ONE_MILLION) });
+    out.push({ ...base, id, display_name: `${base.display_name} · 1M`, max_input_tokens: ONE_MILLION });
   };
   for (const slug of nativeSlugs) {
     const id = idStyle === "readable" ? claudeCodeNativeAlias(slug) : aliasForRoute("native", slug);

src/server/responses/core.ts

@@ -1147,17 +1147,20 @@ function finalizeOwnedTranslatorBudget(response: Response, budget: TranslatorBud
 
 /**
  * Service-tier capability gate, applied after the final route/wire is settled. A
- * provider that does not document `service_tier` must never receive it: strip the
- * field and clear the logging value even when the caller supplied one (fail
- * closed). An explicit `supportsServiceTier: true` on the provider config is the
- * escape hatch for gateways that genuinely honour tiers.
+ * provider explicitly documented as NOT supporting `service_tier` must never
+ * receive it: strip the field and clear the logging value even when the caller
+ * supplied one (fail closed). Tri-state contract: `true` supports (injection
+ * allowed, caller values preserved), `false` strips, and an UNCLASSIFIED custom
+ * provider (`undefined`) preserves caller-supplied values but never gets an
+ * injection — deleting the caller's field there would silently change their
+ * request against a gateway we know nothing about.
  */
 export function applyServiceTierGate(
   provider: OcxProviderConfig,
   rawBody: unknown,
   options: { serviceTier?: string },
 ): void {
-  if (provider.adapter !== "openai-responses" || provider.supportsServiceTier === true) return;
+  if (provider.adapter !== "openai-responses" || provider.supportsServiceTier !== false) return;
   if (rawBody && typeof rawBody === "object") {
     delete (rawBody as Record<string, unknown>).service_tier;
   }

tests/claude-model-info.test.ts

@@ -96,19 +96,19 @@ describe("anthropic-flavor ModelInfo discovery entries (devlog 130 B4b)", () =>
     expect(infos).toHaveLength(1);
   });
 
-  test("auto-context widens variants to safe sub-1M rows with honest labels (devlog 020)", () => {
+  test("no [1m] rows for sub-1M models, even with auto-context enabled (#854 contract)", () => {
     const auto = { enabled: true, compactWindow: 350_000 };
     const infos = buildAnthropicModelInfos(["gpt-5.4", "gpt-5.6-sol"], [
       { provider: "mock", id: "small-model", contextWindow: 128_000 },
       { provider: "mock", id: "mid-model", contextWindow: 300_000 }, // < compact window: unsafe, no row
     ], auto);
     const variants = infos.filter(i => i.id.endsWith("[1m]"));
-    expect(variants).toHaveLength(2); // gpt-5.4 (1M) + gpt-5.6-sol (372k)
-    const sol = variants.find(v => v.display_name.includes("gpt-5.6-sol"))!;
-    expect(sol.display_name.endsWith("· 372k")).toBe(true); // honest real window, not "1M"
-    expect(sol.max_input_tokens).toBe(372_000);
-    const five4 = variants.find(v => v.display_name.includes("gpt-5.4"))!;
-    expect(five4.display_name.endsWith("· 1M")).toBe(true);
+    // The [1m] marker makes Claude Code account 1e6 tokens: only the
+    // authoritative 1M model may carry it — never the 372K route.
+    expect(variants).toHaveLength(1);
+    expect(variants[0]!.display_name.includes("gpt-5.4")).toBe(true);
+    expect(variants[0]!.display_name.endsWith("· 1M")).toBe(true);
+    expect(variants[0]!.max_input_tokens).toBe(1_000_000);
   });
 
   test("auto-context never widens anthropic passthrough rows (audit 021 #3)", () => {
@@ -131,7 +131,8 @@ describe("anthropic-flavor ModelInfo discovery entries (devlog 130 B4b)", () =>
     ], auto, "readable");
     const ids = infos.map(i => i.id);
     expect(ids).toContain("claude-ocx-native--gpt-5.6-sol");
-    expect(ids).toContain("claude-ocx-native--gpt-5.6-sol[1m]"); // 372k native, auto-marked
+    // 372k native: NO [1m] variant under the authoritative-window contract.
+    expect(ids).not.toContain("claude-ocx-native--gpt-5.6-sol[1m]");
     expect(ids).toContain("claude-ocx-cursor--gpt-5.6-luna");
     expect(ids).toContain("claude-ocx-cursor--gpt-5.6-luna[1m]");
     expect(ids).toContain("claude-opus-4-8"); // anthropic canonical passthrough

tests/deepseek-reasoning-replay.test.ts

@@ -76,6 +76,32 @@ describe("DeepSeek Responses replay keeps reasoning on the wire", () => {
     expect(item.content).toEqual([{ type: "reasoning_text", text: "think step by step" }]);
   });
 
+  test("a real tool-call continuation (reasoning → call → output) keeps all three for DeepSeek", () => {
+    // The documented DeepSeek failure shape: the turn AFTER a tool call must
+    // carry reasoning_content, or the upstream answers HTTP 400.
+    const provider = { ...providerConfigSeed(getProviderRegistryEntry("deepseek")!), apiKey: "sk-test" };
+    enrichProviderFromRegistry("deepseek", provider);
+    const built = createResponsesPassthroughAdapter(provider).buildRequest({
+      modelId: "deepseek-v4-flash",
+      context: { messages: [] },
+      stream: true,
+      options: {},
+      _rawBody: {
+        model: "deepseek-v4-flash",
+        input: [
+          reasoningItem(),
+          { type: "function_call", id: "fc_1", call_id: "call_1", name: "get_weather", arguments: "{\"city\":\"Seoul\"}" },
+          { type: "function_call_output", call_id: "call_1", output: "rain" },
+        ],
+      },
+    } as Parameters<ReturnType<typeof createResponsesPassthroughAdapter>["buildRequest"]>[0], { headers: new Headers() });
+    const body = JSON.parse(String(built.body)) as { input: Record<string, unknown>[] };
+    expect(body.input).toHaveLength(3);
+    expect(body.input[0]!.content).toEqual([{ type: "reasoning_text", text: "think step by step" }]);
+    expect(body.input[1]).toMatchObject({ type: "function_call", call_id: "call_1", name: "get_weather" });
+    expect(body.input[2]).toMatchObject({ type: "function_call_output", call_id: "call_1", output: "rain" });
+  });
+
   test("a canonical OpenAI provider still blanks reasoning content", () => {
     const provider = { ...providerConfigSeed(getProviderRegistryEntry("openai-apikey")!), apiKey: "sk-test" };
     const body = buildBody(provider);

tests/service-tier-capability.test.ts

@@ -58,12 +58,14 @@ describe("applyServiceTierGate fails closed", () => {
     expect(options.serviceTier).toBeUndefined();
   });
 
-  test("an unclassified provider (undefined capability) also fails closed", () => {
+  test("an unclassified provider (undefined capability) preserves the caller value", () => {
     const body = { model: "m", service_tier: "priority" };
     const options: { serviceTier?: string } = { serviceTier: "priority" };
     applyServiceTierGate({ adapter: "openai-responses", baseUrl: "https://example.com/v1" }, body, options);
-    expect("service_tier" in body).toBe(false);
-    expect(options.serviceTier).toBeUndefined();
+    // Tri-state: only an explicit `false` strips; unknown gateways keep the
+    // caller's field (we know nothing about them), and never get an injection.
+    expect(body.service_tier).toBe("priority");
+    expect(options.serviceTier).toBe("priority");
   });
 
   test("a non-Responses adapter is out of scope", () => {
@@ -136,9 +138,11 @@ describe("the gate fires on the live handleResponses path", () => {
     expect(body.service_tier).toBe("flex");
   });
 
-  test("an unclassified custom Responses provider fails closed unless explicitly opted in", async () => {
+  test("an unclassified custom Responses provider keeps caller values; only explicit false strips", async () => {
     const custom = (): OcxProviderConfig => ({ adapter: "openai-responses", baseUrl: "https://gateway.example.com/v1", apiKey: "sk-test" });
-    const stripped = await drive("custom-gw", custom(), "some-model", { service_tier: "priority" });
+    const preserved = await drive("custom-gw", custom(), "some-model", { service_tier: "priority" });
+    expect(preserved.service_tier).toBe("priority");
+    const stripped = await drive("custom-gw", { ...custom(), supportsServiceTier: false }, "some-model", { service_tier: "priority" });
     expect("service_tier" in stripped).toBe(false);
     const optedIn = await drive("custom-gw", { ...custom(), supportsServiceTier: true }, "some-model", { service_tier: "priority" });
     expect(optedIn.service_tier).toBe("priority");